WordPress Vulnerability Report — May 28, 2025
Since our last report, 180 vulnerabilities have been publicly disclosed. 92 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
No vulnerabilities disclosed!
WordPress 6.8.1 has been released! This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.
WordPress Themes
Themes With No Fix/Patch Available
- Acerola
- Avantage
- Backpack Traveler
- Bloggie
- Butcher
- Capie
- Car Dealer
- CouponXL
- Crafts & Arts
- Dash
- Entrada
- Enzio
- Finance Consultant
- Fish House
- Grand Tour | Travel Agency WordPress
- Healsoul
- HotStar
- Insurance
- Jarvis
- Kiamo
- La Boom
- Medicare
- The Business
- Ogami
- Oxpitan
- Pet World
- Photography
- Umberto
- Vizeon – Business Consulting
- Winnex
- Yozi
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- Ashley
- Builty
- ITSulu
- Kaffen
- Kids Planet
- Kinsley
- Larson
- Luique
- Madara
- Motors
- Ober
- Ruizarch
- Samantha
- Wilmër
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- Form Maker by 10Web
- WP Event Manager
- miniOrange Social Login and Register
- Essential Real Estate
- Simplelightbox
- User Meta – User Profile Builder and User management plugin
- StyleAI
- Spreadsheet Price Changer for WooCommerce and WP E-commerce
- Dynamic Pricing & Discounts Lite for WooCommerce
- CryptoCloud – Crypto Payment Gateway
- MetalpriceAPI
- Embed and Integrate Etsy Shop
- miniOrange Discord Integration
- Splitit
- Binary MLM Plan
- 4stats
- WhatsCart
- Animated Buttons
- Ads Pro Plugin
- Blog Designer PRO for WordPress
- WPCHURCH
- DPEPress
- DZS Video Gallery
- ZoomSounds
- Formulario de contacto SalesUp!
- Goodlayers Hostel
- Hospital Management System
- JobHunt Job Alerts
- JP Students Result Management System Premium
- KBx Pro Ultimate
- MapSVG
- Nasa Core
- Posts Extended
- Pixel WordPress Form BuilderPlugin & Autoresponder
- Raisely Donation Form
- Rootspersona
- School Management
- Bus Ticket Booking with Seat Reservation for WooCommerce
- Simple Business Directory Pro
- Smart Forms
- eMagicOne Store Manager
- User Profile Meta Manager
- Affiliate Sales in Google Analytics and other tools
- WP Post Modules for Elementor
- WP YouTube Video Optimizer
- Glossary by WPPedia
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- WooCommerce
- All in One SEO
- Ninja Form
- TablePress
- The Events Calendar
- Photo Gallery, Sliders, Proofing and Themes
- Page Builder: Pagelaye
- PrettyLinks
- Essential Blocks
- Solid Mail
- Exclusive Addons for Elementor
- Qi Blocks
- Blog2Social: Social Media Auto Post & Scheduler
- Slim SEO
- Ultimate Blocks
- Visual Composer Website Builder
- Cost Calculator Builder
- bunny.net
- Cost of Goods: Product Cost & Profit Calculator for WooCommerce
- EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory
- Legal Pages
- Japanized for WooCommerce
- AutomatorWP
- WP Job Portal
- Back Button Widget
- Leadinfo
- ElementInvader Addons for Elementor
- WPAdverts – Classifieds Plugin
- MultiVendorX
- Import Social Events
- MStore API
- Free Shipping Bar
- Hot Random Image
- Majestic Support
- Wishlist for WooCommerce
- Additional Custom Emails & Recipients for WooCommerce
- Active Products Tables for WooCommerce. Use constructor to create tables
- SKT Blocks
- Coupons & Add to Cart by URL Links for WooCommerce
- Change Add to Cart Button Text for WooCommerce
- Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
- Falang multilanguage for WordPress
- WordPress Mega Menu Block
- GDPR CCPA Compliance & Cookie Consent Banner
- Product Code for WooCommerce
- Product Notes Tab & Private Admin Notes for WooCommerce
- WP Smart Import
- Year Make Model Search for WooCommerce
- ReDi Restaurant Reservation – Instant Availability & Confirmation
- Cloudflare Turnstile or reCAPTCHA For any Pages, to Block Spam and Hackers Attack
- Broadcast Live Video
- Sitewide Discount for WooCommerce: Apply Discount to All Products
- Xpro Addons For Beaver Builder
- Affiliates Manager Google reCAPTCHA Integration
- Visual Header
- WP Mapa Politico España
- Url Rewrite Analyzer
- Bot for Telegram on WooCommerce
- Projectopia – WordPress Project Management
- RSVPMaker
- AWcode Toolkit
- WP Image Mask
- Infocob CRM Forms
- Pix 4x sem juros – Pagaleve
- Property – Real Estate Directory Listing
- Advanced Database Cleaner PRO
- Digits
- Order Delivery Date for WP e-Commerce
- Tourmaster
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.