WordPress Vulnerability Report — May 14, 2025
Since our last report, 234 vulnerabilities have been publicly disclosed. 92 of the vulnerable plugins remain unpatched.
Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Along with poor user account security, vulnerable plugins & themes are one of the main reasons WordPress websites get hacked, so run those updates.
If this seems overwhelming, talk to us about a Website Care Plan.
WordPress Core
No vulnerabilities disclosed!
WordPress 6.8.1 has been released! This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.
WordPress Themes
Themes With No Fix/Patch Available
All disclosed vulnerability(ies) have been patched.Themes With A Fix/Patch Available
Disclosed vulnerability(ies) have been patched. You should update to the latest version.
- Blocksy
- TheGem
- Wolmart
Looking for peace of mind and less tech stress?
Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.
Signup for one of our website care/management plans and get a tech-savvy team who are committed to your business.
Never worry about your website again.
Let Us Help YouWordPress Plugins
Plugins With No Fix/Patch Available
Disclosed vulnerability(ies) have not yet been patched. You should deactivate the plugin(s).
- Ultimate Member
- Inline Related Posts
- List category posts
- WP Maintenance
- WordPress Infinite Scroll
- Photo Gallery
- User Login History
- Easy PayPal & Stripe Buy Now Button
- Spiraclethemes Site Library
- WPBakery Visual Composer WHMCS Elements
- WP-Recall
- aBlocks
- Web Accessibility with Max Access
- Amazon Product in a Post Plugin
- Awin
- belingoGeo
- BMI Adult & Kid Calculator
- CBX Map for Google Map & OpenStreetMap
- ContentStudio
- Contribuinte Checkout
- DoFollow Case by Case
- Ebook Store
- Email Notification on Login
- RS WP Book Showcase
- Sidebar Manager Light
- Smaily for WP
- Woobox
- WordPress CRM Plugin
- WordPress Webinar Plugin
- WPSpeed
- xili-tidy-tags
- Bulk Featured Image
- Open Close WooCommerce Store
- Really Simple Under Construction Page
- WP jQuery DataTable
- Beacon Lead Magnets and Lead Capture
- Submission DOM tracking for Contact Form 7
- ClickWhale
- Color Your Bar
- CookieCode
- EasyMe Connect
- Simple Giveaways
- LiveAgent
- N360 | Splash Screen
- Show All Comments
- TPUL
- WP Discord Invite
- WP Pipes
- DELUCKS SEO
- Lead Form Data Collection to CRM
- ELEX WordPress HelpDesk & Customer Ticketing System
- FunnelCockpit
- theMarketer
- Ajar in5 Embed
- Pays
- Integrations of Zoho CRM with Elementor form
- Guest posting / Frontend Posting / Front Editor
- Martins Free Monetized Ad Exchange Network
- Calculate Prices based on Distance For WooCommerce
- Credova Financial
- Soccer Live Scores
- PSW Front-end Login & Registration
- WP Podcasts Manager
- Supertext Translation and Proofreading
- Productive Commerce
- StoreKeeper for WooCommerce
- CarDealerPress
- ELEX Product Feed for WooCommerce
- BNS Twitter Follow Button
- 1 Click WordPress Migration
- AHAthat
- Awesome Gallery
- External image replace
- Frontend Login and Registration Blocks
- LayoutBoxx
- LessButtons Social Sharing and Statistics
- Multiple Post Type Order
- PeproDev Ultimate Profile Solutions
- QS Dark Mode
- Reales WP STPT
- WP SmartPay
- Woocommerce Multiple Addresses
- WordPress Review Plugin
- WP shop
- Xavin’s List Subpages
Plugins With A Fix/Patch Available
The vulnerability(ies) have been patched. You should update to the latest version.
- LiteSpeed Cache
- WPForms
- Website Builder by SeedProd
- MailPoet
- Royal Elementor Addons and Templates
- Jeg Elementor Kit
- Newsletter
- Firelight Lightbox
- Advanced File Manager
- Popup and Slider Builder by Depicter
- Login Lockdown & Protection
- Relevanssi
- Download Monitor
- Jupiter X Core
- Contextual Related Posts
- User Registration & Membership
- Bold Page Builder
- Ultimate Blocks
- Content Control
- Ditty – Responsive News Tickers, Sliders, and Lists
- Photo Gallery, Images, Slider in Rbs Image Gallery
- LightPress Lightbox
- Envo Extra
- WP SEO Structured Data Schema
- Ultimate Before After Image Slider & Gallery
- Accept Donations with PayPal & Stripe
- Meks Flexible Shortcodes
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
- PW WooCommerce Bulk Edit
- Responsive Plus
- Top 10 – WordPress Popular posts
- BlockSpare
- Charitable
- GamiPress
- AI Power: Complete AI Pack
- Graphina
- Meow Gallery
- NEX-Forms
- weMail
- Countdown Timer
- Eventin
- YaySMTP and Email Logs
- Contact Form 7
- Cozy Blocks
- WP Compress
- WP Hotel Booking
- Easiest Funnel Builder For WordPress & WooCommerce, Specialized For Digital Creators
- Dynamic Pricing With Discount Rules for WooCommerce
- Email Marketing, Email Automation, Newsletter & Cart Abandonment for WordPress and WooCommerce
- Poll Maker
- ProfileGrid
- Simple File List
- TrackShip for WooCommerce
- WP Job Portal
- Better Search
- Drag and Drop Multiple File Upload for WooCommerce
- EventON
- Hotel Booking
- Simple Blog Stats
- SMS Alert Order Notifications
- WPAdverts
- Ovation Elements
- Hash Form
- Media Hygiene
- Mollie Forms
- Newsletters
- Solace Extra
- Challan – PDF Invoice & Packing Slip for WooCommerce
- Display Eventbrite Events
- Beds24 Online Booking
- CoinPayments.net Payment Gateway for WooCommerce
- WordPress CRM, Email & Marketing Automation for WordPress | Award Winner
- Solid Testimonials
- SendPulse Email Marketing Newsletter
- SKT Skill Bar
- CC BMI Calculator
- Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons
- Easy PayPal Events & Tickets
- Logo Showcase
- Music Player for WooCommerce
- Contact Form Widget
- Progress Bar
- Ultimate WP Mail
- FundEngine
- XT Event Widget for Social Events
- Display Remote Posts Block
- AWEOS WP Lock
- Frontend Dashboard
- Instantio
- Quran multilanguage Text & Audio
- Seznam Webmaster
- WP DPE-GES
- Custom Checkout Fields for WooCommerce
- Cool Author Box
- Listamester
- Time Clock
- Easy Replace Image
- NGG Smart Image Search
- Product Time Countdown for WooCommerce
- TrueBooker
- Simple calendar for Elementor
- WZ Followed Posts
- Subaccounts for WooCommerce
- Wbcom Designs
- B2i Investor Tools
- Cart tracking for WooCommerce
- EUCookieLaw
- WP Gravity Forms Zendesk
- LocateAndFilter
- Product Quantity Dropdown For Woocommerce
- EZ Related Posts Footer Links and Widget
- Integration for WooCommerce and Salesforce
- Cision Block
- PDF for WooCommerce
- Wiki Embed
- GS Variation Swatches for WooCommerce
- WPBookit
- BuddyPress Platform Pro
- Cost Calculator for Elementor
- Envolve Plugin
- IMITHEMES Listing
- Opal Woo Custom Product Variation
- PGS Core
- Relevanssi Premium
How Do I Update WordPress?
Run a full backups of your website using the backup plugin you have installed -or- using the backup feature your web host provides.
Ideally you test major functions – like ecommerce, elearning, membership functionality on a staging server first. If you site is “heavily” customized, you should also test in a staging environgment first.
Perform your updates in the order of WordPress – Theme(s) – Plugin(s). Ideally you are making note of the before and after versions.
After completed, perform a visual inspection of your site and test critical functionality that may have been affected – contact forms, subscription buttons, purchasing etc.