WordPress Vulnerability Report — March 26, 2025
Since our last report, 240 vulnerabilities have been publicly disclosed. 189 of the vulnerable plugins and themes remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
WordPress Themes
Themes With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the themes(s).
- AuraMart
- Hester
- MorningTime Lite
- StoreBiz
- Build
- City Store
- newseqo
- RainbowNews
- Whitish Lite
Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- Altair
- CozyStay
- MinimogWP
- TinySalt
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- teachPress
- GlobalPayments WooCommerce
- EZ SQL Reports Shortcode Widget and DB Backup
- WP Email Delivery
- AdSense Privacy Policy
- Advanced Dewplayer
- AHAthat
- AI Preloader
- Alert Box Block
- AlphaOmega Captcha & Anti-Spam Filter
- ANAC XML Render
- Arrow Maps
- AppExperts
- AppReview
- Are you robot google recaptcha
- ARPrice
- AuMenu
- Auto Load Next Post
- AvaiBook
- Awesome Logos
- banner-manager
- Beautiful Link Preview
- Block Logic
- Blue Captcha
- BMo Expo
- Browser Address Bar Color
- Cackle
- CallPhone’r
- CAS Maestro
- Cazamba
- Contact Form 7 Material Design
- UTM tags tracking for Contact Form 7
- cits-support-svg-webp-media-upload
- Clink
- Code Clone
- CG Button
- Cookies Pro
- CopyLink
- Menu Duplicator
- CryoKey
- CSV to Responsive Tables
- cTabs
- custom-field-list-widget
- Custom Product Stickers for Woocommerce
- Custom Script Integration
- Custom Smilies
- Management-screen-droptiles
- WP Database Audit
- Driving Directions
- DesignThemes Core Features
- Display Post Meta
- Docpro
- Easy Custom Admin Bar
- Easy Page Transition
- En Masse
- External image replace
- Secret Meta
- Fancybox Plus
- File Away
- Fiverr.com Official Search Box
- Fix Rss Feeds
- Flickr set slideshows
- Flipdish Ordering System
- FOMO Pay Chinese Payment Solution
- Frndzk Expandable Bottom Bar
- custom-post-edit
- Frontend Post Submission
- GDPR Tools
- Generate Post Thumbnails
- GetShop e-commerce
- Gravity 2 PDF
- GMO Font Agent
- Google Plus
- Gotcha
- GP Back To Top
- Hacklog Remote Image Autosave
- IG Shortcodes
- Image Captcha
- Image Slider / Slideshow Pearlbells
- Improve My City
- include-file
- Include URL
- Info Boxes Shortcode and Widget
- Infugrator
- Instant Appointment
- issuuPress
- JiangQie Official Website Mini Program
- jQuery Dropdown Menu
- Key4ce osTicket Bridge
- LH OGP Meta
- Lightview Plus
- LinkedIn Lite
- LIVE TV
- Login Redirect
- Map Contact
- Message ticker
- Mobile Navigation
- Multi Video Box
- Music Press Pro
- My Bootstrap Menu
- My Default Post Content
- Narnoo Operator
- NextGEN Gallery Voting
- NS Simple Intro Loader
- Easy 301 Redirects
- Off Page SEO
- Omnify
- OSS Upload
- Pixobe Cartography
- Pretty file links
- Product Puller
- Pro Rank Tracker
- Random Quotes
- RDP inGroups+
- RDP Linkedin Login
- Related Posts via Categories
- Replace Default Words
- Rewrite
- Rizzi Guestbook
- RWS Enquiry And Lead Follow-up
- s2Member Pro
- Schedule
- Shuffle
- Simple Optimizer
- Simple Post Series
- Simple Rating
- Site Editor Google Map
- Sleekplan
- SoundCloud Ultimate
- sourceplay-navermap
- SpatialMatch IDX
- SpeakPipe
- STEdb Forms
- Stencies
- Super Simple Subscriptions
- SUPER RESPONSIVE SLIDER
- Super Static Cache
- Teleport
- Translator
- Trust Payments Gateway for WooCommerce
- Typekit plugin for WordPress
- Top Bar
- ULTIMATE VIDEO GALLERY
- Upload Quota per User
- Visual Text Editor
- wA11y – The Web Accessibility Toolbox
- Já-Já Pagamentos for WooCommerce
- WooCommerce Multivendor Marketplace – REST API
- Weather Layer
- Bitcoin / AltCoin Payment Gateway for WooCommerce
- WordPress Admin Bar Improved
- Secure Invites
- WordPress SQL Backup
- Theme Demo Bar
- Ads24 Lite
- WP Azure offload
- WP Colorful Tag Cloud
- WP Contact Form III
- WP e-Commerce Style Email
- WP Featured Entries
- FoodBakery
- WP Google Calendar Manager
- WP Multistore Locator
- WP Odoo Form Integrator
- WP Parallax Content Slider
- WP Profitshare
- WP Ride Booking
- WP Social Widget
- WP Event Ticketing
- Your Lightbox
- Yummly Rich Recipes
- Zalo Live Chat
- ZD Scribd iPaper
- ZenphotoPress
- ZhinaTwitterWidget
- Zielke Design Project Gallery
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- Slider, Gallery, and Carousel by MetaSlider
- Fluent Forms
- GDPR Cookie Compliance
- WP Ghost (Hide My WP Ghost)
- Photo Gallery by 10We
- Custom Twitter Feeds
- GiveWP
- Pods
- HT Mega
- Nested Pages
- Site Reviews
- Export and Import Users and Customers
- Easy Digital Downloads
- Form Maker by 10Web
- Order Export & Order Import for WooCommerce
- Age Gate
- Logo Slider
- FunnelKit Automations
- Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings
- LifterLMS
- Event Manager, Events Calendar, Tickets, Registrations
- NP Quote Request for WooCommerce
- WP Compress
- Poll Maker
- ProfileGrid
- Newsletters
- WordPress form builder plugin for contact forms, surveys and quizzes
- Digital License Manager
- Web Directory Free
- MemberSpace
- Formality
- Your Friendly Drag and Drop Page Builder — Make Builder
- DICOM Support
- Your Simple SVG Support
- Bitspecter Suite
- BoomBox Theme Extensions
- Service Finder Booking
- FoodBakery
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.