- Plugin Slug:
- wps-team
- Installations
- 3,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
In this report, 88 vulnerabilities have been publicly disclosed. Security patches for 46 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.
Additionally, there are 42 plugin and theme vulnerabilities, and no patch has been available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.
Table of Contents
WordPress Core
WordPress 6.8.1 has been released! This maintenance release includes fixes for 15 bugs throughout Core and the Block Editor, addressing issues affecting multiple areas of WordPress, including the block editor, multisite, and REST API. For a full list, refer to the release candidate announcement.
Plus, WordCamp Europe 2025 lands in Basel, Switzerland, June 5-7! Connect with WordPress enthusiasts, developers, and pros for three days of learning, networking, and collaboration with the global community.
WordPress Plugins — 40 Patched / 42 Unpatched
- Plugin Slug:
- section-widget
- Installations
- 600+
- Vulnerability:
- Path Traversal
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- section-widget
- Installations
- 600+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin Slug:
- crossword-compiler-puzzles
- Installations
- 400+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- personizely
- Installations
- 300+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- totalprocessing-card-payments
- Installations
- 200+
- Vulnerability:
- Arbitrary File Download
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Abundatrade
- Plugin Slug:
- abundatrade-plugin
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Advanced Reorder Image Text Slider
- Plugin Slug:
- advanced-reorder-image-text-slider
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
AHAthat
- Plugin Slug:
- ahathat
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Alink Tap
- Plugin Slug:
- alink-tap
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Buddyboss Platform
- Plugin Slug:
- buddyboss-platform
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Category Widget
- Plugin Slug:
- category-widget
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Custom PC Builder Lite for WooCommerce
- Plugin Slug:
- custom-pc-builder-lite-for-woocommerce
- Vulnerability:
- Settings Change
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Database Toolset
- Plugin Slug:
- database-toolset
- Vulnerability:
- Sensitive Data Exposure
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
EC Authorize.net
- Plugin Slug:
- ec-authorizenet
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
External image replace
- Plugin Slug:
- external-image-replace
- Vulnerability:
- Arbitrary File Upload
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Flynax Bridge
- Plugin Slug:
- flynax-bridge
- Vulnerability:
- Broken Access Control
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
GmapsMania
- Plugin Slug:
- gmapsmania
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
IGIT Related Posts With Thumb Image After Posts
- Plugin Slug:
- igit-related-posts-with-thumb-images-after-posts
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Job Listings
- Plugin Slug:
- job-listings
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- No Fix
- Severity Score:
- Critical
- Plugin:
-
KiwiChat NextClient
- Plugin Slug:
- kiwichat
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
kStats Reloaded
- Plugin Slug:
- kstats-reloaded
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
LayoutBoxx
- Plugin Slug:
- layoutboxx
- Vulnerability:
- Content Injection
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Web3Press
- Plugin Slug:
- likecoin
- Vulnerability:
- Arbitrary File Download
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Custom Login and Registration
- Plugin Slug:
- ms-registration
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Nautic Pages
- Plugin Slug:
- nautic-pages
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
occupancyplan
- Plugin Slug:
- occupancyplan
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
OTP-less one tap Sign in
- Plugin Slug:
- otpless
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- No Fix
- Severity Score:
- Critical
- Plugin:
-
Remote Images Grabber
- Plugin Slug:
- remote-images-grabber
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Separator Shortcode and Widget
- Plugin Slug:
- separator-shortcode-and-widget
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Reales WP STPT
- Plugin Slug:
- short-tax-post
- Vulnerability:
- Broken Access Control
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Reales WP STPT
- Plugin Slug:
- short-tax-post
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Subpage List
- Plugin Slug:
- subpage-view
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Syndicate Out
- Plugin Slug:
- syndicate-out
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Theme Blvd Sliders
- Plugin Slug:
- theme-blvd-sliders
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Total Donations
- Plugin Slug:
- total-donations
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
VerticalResponse Newsletter Widget
- Plugin Slug:
- vertical-response-newsletter-widget
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Visual Builder
- Plugin Slug:
- visual-builder
- Vulnerability:
- Broken Access Control
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Widgets as Shortcodes
- Plugin Slug:
- widgets-as-shortcodes
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Meta Keywords & Description
- Plugin Slug:
- wp-meta-keywords-meta-description
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Xavin’s Review Ratings
- Plugin Slug:
- xavins-review-ratings
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Yame
- Plugin Slug:
- yame-linkinbio
- Vulnerability:
- Sensitive Data Exposure
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- wp-statistics
- Installations
- 600,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 14.13.4
- Severity Score:
- Medium
- Plugin Slug:
- newsletter
- Installations
- 300,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 8.7.1
- Severity Score:
- Medium
- Plugin Slug:
- sureforms
- Installations
- 200,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.4.4
- Severity Score:
- Medium
- Plugin Slug:
- sureforms
- Installations
- 200,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.4.4
- Severity Score:
- Medium
- Plugin Slug:
- admin-site-enhancements
- Installations
- 100,000+
- Vulnerability:
- Bypass Vulnerability
- Patched in Version:
- 7.6.10
- Severity Score:
- Medium
- Plugin Slug:
- depicter
- Installations
- 100,000+
- Vulnerability:
- SQL Injection
- Patched in Version:
- 3.6.2
- Severity Score:
- Critical
- Plugin Slug:
- suretriggers
- Installations
- 100,000+
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- 1.0.83
- Severity Score:
- Critical
- Plugin Slug:
- user-registration
- Installations
- 70,000+
- Vulnerability:
- Insecure Direct Object References (IDOR)
- Patched in Version:
- 4.2.2
- Severity Score:
- Medium
- Plugin Slug:
- wp-google-map-plugin
- Installations
- 70,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 4.7.2
- Severity Score:
- Medium
- Plugin Slug:
- calculated-fields-form
- Installations
- 50,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 5.2.62
- Severity Score:
- Medium
- Plugin Slug:
- seraphinite-accelerator
- Installations
- 50,000+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.27.22
- Severity Score:
- Medium
- Plugin Slug:
- simple-tags
- Installations
- 50,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.30.0
- Severity Score:
- Medium
- Plugin Slug:
- full-customer
- Installations
- 40,000+
- Vulnerability:
- SQL Injection
- Patched in Version:
- 3.1.26
- Severity Score:
- High
- Plugin Slug:
- secupress
- Installations
- 40,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 2.3.10
- Severity Score:
- Medium
- Plugin Slug:
- gutenverse
- Installations
- 30,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.0.0
- Severity Score:
- Medium
- Plugin Slug:
- page-views-count
- Installations
- 20,000+
- Vulnerability:
- Settings Change
- Patched in Version:
- 2.8.5
- Severity Score:
- High
- Plugin Slug:
- wordpress-simple-paypal-shopping-cart
- Installations
- 10,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 5.1.4
- Severity Score:
- Medium
- Plugin Slug:
- wordpress-simple-paypal-shopping-cart
- Installations
- 10,000+
- Vulnerability:
- Insecure Direct Object References (IDOR)
- Patched in Version:
- 5.1.4
- Severity Score:
- Medium
- Plugin Slug:
- mstore-api
- Installations
- 4,000+
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- 4.17.5
- Severity Score:
- Medium
- Plugin Slug:
- wp-recall
- Installations
- 2,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 16.26.12
- Severity Score:
- Medium
- Plugin Slug:
- woo-category-slider-by-pluginever
- Installations
- 1,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 4.3.5
- Severity Score:
- High
- Plugin Slug:
- ultimate-store-kit
- Installations
- 900+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.5.0
- Severity Score:
- Medium
- Plugin Slug:
- am-lottieplayer
- Installations
- 700+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.5.4
- Severity Score:
- Medium
- Plugin Slug:
- surveyjs
- Installations
- 600+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.12.33
- Severity Score:
- Medium
- Plugin Slug:
- projectopia-core
- Installations
- 400+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 5.1.17
- Severity Score:
- High
- Plugin Slug:
- bp-messages-tool
- Installations
- 200+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.5
- Severity Score:
- High
- Plugin Slug:
- formality
- Installations
- 200+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.5.9
- Severity Score:
- Medium
- Plugin Slug:
- cision-block
- Installations
- 100+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 4.4.0
- Severity Score:
- Medium
- Plugin Slug:
- list-children
- Installations
- 100+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.2.0
- Severity Score:
- Medium
- Plugin Slug:
- taxonomy-chain-menu
- Installations
- 100+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.0.9
- Severity Score:
- Medium
- Plugin:
-
Ads Pro Plugin
- Plugin Slug:
- ap-plugin-scripteo
- Vulnerability:
- SQL Injection
- Patched in Version:
- 4.89
- Severity Score:
- Critical
- Plugin:
-
BuddyPress Platform Pro
- Plugin Slug:
- buddyboss-platform-pro
- Vulnerability:
- Broken Authentication
- Patched in Version:
- 2.7.10
- Severity Score:
- Critical
- Plugin:
-
Envolve Plugin
- Plugin Slug:
- envolve-plugin
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.1.0
- Severity Score:
- Medium
- Plugin:
-
Gravity Forms WebHooks
- Plugin Slug:
- gravityformswebhooks
- Vulnerability:
- Server Side Request Forgery (SSRF)
- Patched in Version:
- 1.7.0
- Severity Score:
- Medium
- Plugin:
-
Order Delivery Date for WP e-Commerce
- Plugin Slug:
- order-delivery-date
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- 12.3.1
- Severity Score:
- Critical
- Plugin:
-
Advance Seat Reservation Management for WooCommerce
- Plugin Slug:
- scw-seat-reservation
- Vulnerability:
- SQL Injection
- Patched in Version:
- 3.4
- Severity Score:
- Critical
- Plugin:
-
Multilingual CMS
- Plugin Slug:
- sitepress-multilingual-cms
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 4.7.4
- Severity Score:
- Medium
- Plugin:
-
tagDiv Composer
- Plugin Slug:
- td-composer
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 5.4.1
- Severity Score:
- Medium
- Plugin:
-
tagDiv Opt-In Builder
- Plugin Slug:
- td-subscription
- Vulnerability:
- SQL Injection
- Patched in Version:
- 1.7.1
- Severity Score:
- High
- Plugin:
-
Ultimate Auction Pro
- Plugin Slug:
- ultimate-woocommerce-auction-pro
- Vulnerability:
- SQL Injection
- Patched in Version:
- 1.5.3
- Severity Score:
- Critical
WordPress Themes — 6 Patched / 0 Unpatched
- Theme Slug:
- newsblogger
- Downloads
- 100,624
- Vulnerability:
- Arbitrary File Upload
- Patched in Version:
- 0.2.5.2
- Severity Score:
- High
- Theme Slug:
- newsblogger
- Downloads
- 100,624
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 0.2.5.5
- Severity Score:
- High
- Theme:
-
Homey
- Theme Slug:
- homey
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 2.4.5
- Severity Score:
- Medium
- Theme:
-
Homey
- Theme Slug:
- homey
- Vulnerability:
- Insecure Direct Object References (IDOR)
- Patched in Version:
- 2.4.5
- Severity Score:
- Medium
- Theme:
-
Kleo
- Theme Slug:
- kleo
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 5.4.4
- Severity Score:
- Medium
- Theme:
-
Motors
- Theme Slug:
- motors
- Vulnerability:
- Content Injection
- Patched in Version:
- 5.6.66
- Severity Score:
- High
Solid Security is part of Solid Suite — The best foundation for WordPress websites.
Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!
Leave a Reply