WordPress Vulnerability Report — May 21, 2025
Since our last report, 359 vulnerabilities have been publicly disclosed. 165 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
No vulnerabilities disclosed!
WordPress 6.8.1 has been released! This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.
WordPress Themes
Themes With No Fix/Patch Available
- Acerola
- AnyWhere Elementor Pro
- Bimber
- Bloggie
- CouponXL
- Dash
- HotStar
- Jarvis
- The Business
- Plant
- Rozario
- Seven Stars
- Spare
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- Motors
- TheGem
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- TI WooCommerce Wishlist
- Form Maker by 10Web
- WP Tabs
- WooCommerce POS
- Salon Booking System
- Eventer
- ShayanWeb Admin Fonthanger
- Estatik Mortgage Calculator
- RS WP Book Showcase
- Simplelightbox
- WP Notes Widget
- UltraAddons
- ValidateCertify Free
- MapSVG
- BERTHA AI
- Broadstreet
- Dynamic Pricing & Discounts Lite for WooCommerce
- Push notification for Mobile and Web app
- Wishlist
- Import Export For WooCommerce
- STAGGS – Product Configurator Toolkit
- Embed and Integrate Etsy Shop
- SEO Flow by LupsOnline
- X Addons for Elementor
- Aptivada for WP
- Dot html,php,xml etc pages
- Facturante – Facturación Electrónica
- Printcart Web to Print Product Designer
- WC Affiliate
- WP2LEADS
- 6Storage Rentals
- Interview
- BNS Twitter Follow Button
- Real WP Shop Lite Ajax eCommerce Shopping Cart
- 360 Product Rotation
- WP Ultimate Tours Builder
- Advance Post Prefix
- Advanced Page Visit Counter
- AffiliateImporterEb
- AlT Monitoring
- Ads Pro Plugin
- Audio Comments
- Radio Player Shoutcast & Icecast WordPress Plugin
- BabelZ
- Backup Database
- Badgearoo
- Element Pack Pro
- BTEV
- Bon Toolkit
- WPCHURCH
- CountDown Pro WP Plugin
- Clasify Classified Listing
- Clicksold IDX
- ClipArt
- Competition Form
- Countdown Timer
- CSS3 Accordions for WordPress
- CSS3 Tooltips for WordPress
- CSS3 Compare Pricing Tables for WordPress
- Custom Author Base
- Custom Field Manager
- DL Verification
- DL Yandex Metrika
- Dokan Pro
- S3Player
- EG-Series
- Event Calendar
- EventON
- FAT Services Booking
- File Manager Advanced Shortcode
- Front End Users
- Full Screen (Page) Background Image Slideshow
- Geocache Stat Bar Widget
- WPGYM
- JavaScript Logic
- JSP Store Locator
- jwp-a11y
- Chameleon HTML5 Audio Player With/Without Playlist
- Responsive HTML5 Audio Player PRO With Playlist
- Sticky HTML5 Music Player
- Sticky Radio Player
- Apollo
- SHOUT
- illi Link Party!
- Connexion Logs
- Magic Responsive Slider and Carousel
- MapFig Studio
- MapSVG
- Multimedia Responsive Carousel with Image Video Audio Support
- Nasa Core
- Ninja Tables Pro
- Ntz Antispam
- TNC FlipBook
- PeoplePond
- Pixel WordPress Form BuilderPlugin & Autoresponder
- Planning Center Online Giving
- profilepro
- Panorama
- PVN Auth Popup
- Simple Link Directory Pro
- QuickCal
- Rootspersona
- Sailthru Triggermail
- Salon Booking Pro
- Simple Nav Archives
- Smooth Gallery Replacement
- Spiritual Gifts Survey
- Spotlight
- The Plus Addons for Elementor Pro
- TwitterPosts
- UberSlider
- Video Player & FullScreen Video Background
- User Profile Meta Manager
- Weluka Lite
- WHMpress
- Widgets Reset
- WolfNet IDX
- CURCY
- WOOEXIM
- WordPress Auto Spinner
- WP Content Security Plugin
- WP DeskLite
- WP JobHunt
- Pinterest Automatic Pin
- WP-PManagerWPBot Pro WordPress Chatbot
- WordPress Events Calendar Registration & Tickets
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- Jetpack
- All in One SEO
- Ninja Forms
- The Events Calendar
- Photo Gallery, Sliders, Proofing and Themes
- Jetpack Boost
- Page Builder: Pagelayer
- PrettyLinks
- Firelight Lightbox
- Photo Gallery by 10Web
- Download Manager
- Everest Forms
- My Sticky Bar
- Relevanssi
- Responsive Lightbox & Gallery
- Simple Lightbox
- Tracking Code Manager
- Social Media Share Buttons & Social Sharing Icons
- Hustle
- Jupiter X Core
- LearnPress
- Nested Pages
- Ajax Search Lite
- ImageMagick Engine
- Exclusive Addons for Elementor
- Qi Blocks
- WP-Members Membership Plugin
- Popup Box
- WP Booking Calendar
- User Profile Builder
- Ultimate Blocks
- Uncanny Automator
- Visual Composer Website Builder
- LatePoint
- MapPress Maps for WordPress
- Photo Gallery, Images, Slider in Rbs Image Gallery
- Hubbub Lite
- LightPress Lightbox
- Advanced Cron Manager
- Cost Calculator Builder
- FunnelKit
- Logo Slider
- Social Slider Feed
- Uncanny Toolkit for LearnDash
- WP Google Review Slider
- Maspik
- Happyforms
- Kali Forms
- Smart Post Show
- PWA for WP
- Quiz Maker
- Simple Job Board
- AWeber
- bunny.net
- Cost of Goods
- RegistrationMagic
- UPC, ISBN & GTIN Inventory
- The GDPR Framework
- Prisna GWT
- Responsive Contact Form Builder & Lead Generation Plugin
- Legal Pages
- LifterLMS
- MB Custom Post Types & Custom Taxonomies
- Mobile Contact Bar
- Sensei LMS
- Simple Basic Contact Form
- Team
- UiPress lite
- Japanized for WooCommerce
- AutomatorWP
- VikBooking Hotel Booking Engine & PMS
- CM Tooltip Glossary
- If-So Dynamic Content Personalization
- Travelpayouts
- WPFunnels
- WPBot
- WP ERP
- HD Quiz
- ProfileGrid
- Wise Chat
- WP Job Portal
- Back Button Widget
- Easy Property Listings
- EventON
- EventPrime
- Arconix Shortcodes
- MultiVendorX
- ElementInvader Addons for Elementor
- Podlove Podcast Publisher
- Responsive Gallery Grid
- SMS Alert Order Notifications – WooCommerce
- Melapress File Monitor
- WPAdverts
- Import Social Events
- Salon Booking System
- Stylish Price List
- Ultimate Noindex Nofollow Tool II
- Auto Affiliate Links
- Free Shipping Bar
- ApplyOnline
- Majestic Support
- User Activity Tracking and Log
- Wishlist for WooCommerce: Multi Wishlists Per Customer
- Additional Custom Emails & Recipients for WooCommerce
- Active Products Tables for WooCommerce
- SKT Blocks – Gutenberg based Page Builder
- Coupons & Add to Cart by URL Links for WooCommerce
- Change Add to Cart Button Text for WooCommerce
- Auto Prune Posts
- Falang multilanguage for WordPress
- WordPress Mega Menu Block
- GDPR CCPA Compliance & Cookie Consent Banner
- Product Code for WooCommerce
- Product Notes Tab & Private Admin Notes for WooCommerce
- Tainacan
- Year Make Model Search for WooCommerce
- Taskbuilder
- Polls CP
- Frontend Dashboard
- Cloudflare Turnstile or reCAPTCHA
- Secure Downloads
- Broadcast Live Video
- Drag and Drop File Upload for Elementor Forms
- Sitewide Discount for WooCommerce: Apply Discount to All Products
- Sharespine Woocommerce Connector
- Xpro Addons For Beaver Builder – Lite
- Affiliates Manager Google reCAPTCHA Integration
- GamiPress – Reset User
- Plugin Oficial
- Getnet para WooCommerce
- WP Mapa Politico España
- Backup
- Url Rewrite Analyzer
- Bot for Telegram on WooCommerce
- Posts per Cat
- Projectopia – WordPress Project Management
- RSVPMaker
- Subaccounts for WooCommerce
- Wholesale Market
- AWcode Toolkit
- B2i Investor Tools
- Push Notification for Post and BuddyPress
- WP Image Mask
- CTT Expresso para WooCommerce
- eaSYNC Booking
- Activity Log
- Payment Gateway for Telcell
- Experto CTA Widget
- TicketBAI Facturas para WooCommerce
- Z-Downloads
- Tours
- EKC Tournament Manager
- KBucket
- Offload Videos
- Simple Video Directory
- File Manager Advanced Shortcode PRO
- ARForms Form Builder
- Buddyboss Platform
- EventON
- Jetpack Debug Tools
- Ninja Forms Webhooks
- Opal Woo Custom Product Variation
- PeepSo Core: File Uploads
- Relevanssi Premium
- Echo RSS Feed Post Generator Plugin for WordPress
- tarteaucitron.js for WordPress
- Rankie
- WP Content Copy Protection & No Right Click (premium)
- GDPR Cookie Consent
- WPBot Pro WordPress Chat
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.