WordPress Vulnerability Report —June 25, 2025
Since our last report, 177 vulnerabilities have been publicly disclosed. 161 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
No vulnerabilities disclosed!
WordPress 6.8.1 has been released! This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.
WordPress Themes
Themes With No Fix/Patch Available
- Fitness Park
- Hello FSE Blog
- Spark Multipurpose
- Zita
- Zenny
- HYDRO
- LMS
- MagOne
- MBStore
- Nuss
- Sala
- Seven Stars
- Sofass
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- OceanWP
- Amely
- Puca
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- Zapier for WordPress
- Auto Upload Images
- PowerPress Podcasting plugin by Blubrry
- Giveaways and Contests
- WP Visitor Statistics
- WP Customer Area
- Job Postings
- User Roles and Capabilities
- WP User Profile Avatar
- Cookie-Script.com
- Download Attachments
- Media Hygiene
- Automatically Hierarchic Categories in Menu
- App Builder
- ContentStudio
- Notifier
- WP Inventory Manager
- WPThumb
- Football Pool
- ATP Call Now
- Better Random Redirect
- CodePen Embed Block
- RDFa Breadcrumb
- Real Estate Manager
- Simple Sticky Footer
- Spoki
- Tealium
- WP Social AutoConnect
- Polls CP
- Code Engine
- FormLift for Infusionsoft Web Forms
- Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes
- Trusty Whistleblowing Solution
- UpStream: a Project Management Plugin for WordPress
- Gutenberg Blocks – ACF Blocks Suite
- Anant Addons for Elementor
- Hand Talk
- PDPA Consent for Thailand
- WP Register Profile With Shortcode
- WP Voting Contest Lite
- Contact Form 7 AWeber Extension
- IP Based Login
- Buying Buddy IDX CRM – Real Estate MLS Plugin
- Content No Cache
- WooCommerce Manager
- TM Replace Howdy
- WooCommerce Fortnox Integration
- WP Roadmap
- Abandoned Contact Form 7
- Lewe ChordPress – ChordPro Text Formatter
- CSV Importer Improved
- eDS Responsive Menu
- Esselink.nu Settings
- WP Front User Submit
- Fyrebox Quizzes
- Knowledge Base
- Creative Contact Form
- WP-DownloadCounter
- Mailing Group Listserv
- Bluff Post
- CRM ERP Business Solution
- Enhanced Blocks
- Import YouTube videos as WP Posts
- Inventory Presser
- National Weather Service Alerts
- Logo Manager For Samandehi
- Scroll UP
- TinyNav
- Video List Manager
- Change Cart button Colors WooCommerce
- WP User Stylesheet Switcher
- xili-dictionary
- Zara 4 Image Compression
- Infility Global
- MDJM Event Management
- Photo Express for Google
- XML Travel Portal Widget
- SpecFit-Virtual Try On Woocommerce
- DirectIQ Email Marketing
- Live Sports Streamthunder
- Oganro Travel Portal Search Widget for HotelBeds APITUDE API
- PixelBeds Channel Manager and Hotel Booking Engine
- Backwp
- Bulk YouTube Post Creator
- ClipLink
- CSV Me
- Evangelische Termine
- FastBook
- Flexo Counter
- Image Shadow
- BRW
- Pixabay Images
- Simple Link Directory
- School Management
- Smart Notification
- Virtual Moderator
- Woocommerce Line Notify
- JobSearch
- WP Optimize By xTraffic
- WP-Recall
- WPCRM
- Recipes manager – WPH
- WPKit For Elementor
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- Elementor Website Builder
- ElementsKit Elementor Addons and Templates
- Click to Chat
- Slider, Gallery, and Carousel by MetaSlider
- YITH WooCommerce Wishlist
- Firelight Lightbox
- Ivory Search – WordPress Search Plugin
- AI Engine
- Download Manager
- Filester
- GiveWP
- HUSKY
- Master Slider
- Drag and Drop Multiple File Upload for Contact Form 7
- Post and Page Builder by BoldGrid
- Appointment Booking Calendar
- Ultra Addons for Contact Form 7
- WP-Members Membership Plugin
- Blog2Social: Social Media Auto Post & Scheduler
- Login & Register Customizer
- Pixel Manager for WooCommerce
- WordPress Infinite Scroll
- FunnelKit Automations
- Classified Listing
- tarteaucitron.io
- Eventin
- eCommerce Product Catalog Plugin for WordPress
- Poll, Survey & Quiz Maker Plugin by Opinion Stage
- WP Dummy Content Generator
- ProfileGrid
- Wise Chat
- Modern Footnotes
- WP Zoho
- Sitekit
- YITH PayPal Express Checkout for WooCommerce
- JobWP
- Slidebars
- Related Products Manager for WooCommerce
- WPComplete
- Gutenverse News
- Kata Plus – Addons for Elementor
- Conference Scheduler
- Euro FxRef Currency Converter
- WP Front User Submit
- Simple Logo Carousel
- StreamWeasels Kick Integration
- Target Video Easy Publish
- ANON
- Aiomatic
- Drag and Drop Multiple File Upload (Pro) – WooCommerce
- Elementor Pro
- WPBakery Page Builder
- Echo RSS Feed Post Generator Plugin for WordPress
- Rankie
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.