> Wordfence Intelligence Weekly WordPress Vulnerability Report (November 24, 2025 to November 30, 2025)

[SOURCE] Wordfence [AUTHOR: Chloe Chamberland] [DATE: 04/12/2025 15:54] [LANGUAGE: EN]
Last week, there were 74 vulnerabilities disclosed in 67 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 41 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 31,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

WAF-RULE-877 – Data redacted while we work with the vendor on a patch.
Frontend Admin by DynamiApps &lt;= 3.28.20 – Unauthenticated Arbitrary Options Update
WP Directory Kit &lt;= 1.4.4 – Authentication Bypass to Privilege Escalation via Account Takeover

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched &amp; Patched Vulnerabilities Last Week

		Patch Status
		Number of Vulnerabilities
	
		Patched
		47
	
		Unpatched
		27
	
Total Vulnerabilities by CVSS Severity Last Week

		Severity Rating
		Number of Vulnerabilities
	
				Medium Severity
				59
			
				High Severity
				6
			
				Critical Severity
				9
			
Total Vulnerabilities by CWE Type Last Week

		Vulnerability Type by CWE
		Number of Vulnerabilities
	
		Missing Authorization
		21
	
		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
		19
	
		Authorization Bypass Through User-Controlled Key
		6
	
		Cross-Site Request Forgery (CSRF)
		5
	
		Improper Privilege Management
		5
	
		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
		4
	
		Unrestricted Upload of File with Dangerous Type
		4
	
		Deserialization of Untrusted Data
		2
	
		Exposure of Sensitive Information to an Unauthorized Actor
		2
	
		Authentication Bypass Using an Alternate Path or Channel
		1
	
		Client-Side Enforcement of Server-Side Security
		1
	
		External Control of File Name or Path
		1
	
		Improper Control of Generation of Code ('Code Injection')
		1
	
		Incorrect Authorization
		1
	
		Server-Side Request Forgery (SSRF)
		1
	
Researchers That Contributed to WordPress Security Last Week

		Researcher Name
		Number of Vulnerabilities
	
					Legion Hunter
				
		7
	
					Nabil Irawan
				
		4
	
					Athiwat Tiprasaharn (Jitlada)
				
		4
	
					blue0x1
				
		3
	
					シルAsuna
				
		3
	
					dayea song
				
		3
	
					Ivan Cese
				
		3
	
					Dmitrii Ignatyev
				
		3
	
					Powpy
				
		3
	
					Ryan Kozak
				
		3
	
					zakaria
				
		2
	
					Muhammad Yudha - DJ
				
		2
	
					Md. Moniruzzaman Prodhan (NomanProdhan)
				
		2
	
					daroo
				
		2
	
					Denver Jackson
				
		2
	
					Jonas Benjamin Friedli
				
		2
	
					István Márton
				
		2
	
					Peter Thaleikis
				
		2
	
					Alex Thomas
				
		2
	
					benzdeus
				
		2
	
					NumeX
				
		1
	
					ch4r0n
				
		1
	
					Jamshed Yergashvoyev (CVE Guy)
				
		1
	
					Deadbee
				
		1
	
					Phat RiO - BlueRock
				
		1
	
					Tarcísio Luchesi(Poystick)
				
		1
	
					ZAST.AI
				
		1
	
					type5afe
				
		1
	
					t.t.brothers
				
		1
	
					0xd4rk5id3
				
		1
	
					0xVenus
				
		1
	
					Lucas Montes (Nirox)
				
		1
	
					Peerapat Samatathanyakorn
				
		1
	
					Tonn
				
		1
	
					Foxyyy
				
		1
	
					zaim
				
		1
	
					Muhammad Nur Ibnu Hubab (Ibnu)
				
		1
	
					Alyudin Nafiie
				
		1
	
					ISMAILSHADOW
				
		1
	
					Sopon Tangpathum (SoNaJaa)
				
		1
	
					venom5iix
				
		1
	
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

		Software Name
		Software Slug
	
		Ace Post Type Builder
		
			ace-post-type-builder
		
		Admin and Customer Messages After Order for WooCommerce: OrderConvo
		
			admin-and-client-message-after-order-for-woocommerce
		
		AI ChatBot with ChatGPT and Content Generator by AYS
		
			ays-chatgpt-assistant
		
		AI Engine for WordPress: ChatGPT, GPT Content Generator
		
			liquid-chatgpt
		
		AI Feeds
		
			ai-feeds
		
		Analytics Germanized for Google Analytics (GDPR / DSGVO)
		
			ga-germanized
		
		atec Duplicate Page &amp; Post
		
			atec-duplicate-page-post
		
		Autochat Automatic Conversation
		
			auyautochat-for-wp
		
		Blog2Social: Social Media Auto Post &amp; Scheduler
		
			blog2social
		
		Bold Page Builder
		
			bold-page-builder
		
		Bookme – Free Online Appointment Booking and Scheduling Plugin
		
			bookme-free-appointment-booking-system
		
		Chamber Dashboard Business Directory
		
			chamber-dashboard-business-directory
		
		CIBELES AI
		
			cibeles-ai
		
		Conditionnal Maintenance Mode for WordPress
		
			maintenance-mode-based-on-user-roles
		
		Customer Reviews Collector for WooCommerce
		
			customer-reviews-collector-for-woocommerce
		
		EduKart Pro
		
			edukart-pro
		
		Featured Post Creative
		
			featured-post-creative
		
		FindAll Listing
		
			findall-listing
		
		FindAll Membership
		
			findall-membership
		
		FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS &amp; Online Courses
		
			fluent-community
		
		Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager
		
			folders
		
		Frontend File Manager Plugin
		
			nmedia-user-file-uploader
		
		Google Drive upload and download link
		
			google-drive-upload-and-download-link
		
		Gutenverse Form – Contact Form Builder, Booking, Reservation, Subscribe for Block Editor
		
			gutenverse-form
		
		Gutenverse – Ultimate WordPress FSE Blocks Addons &amp; Ecosystem
		
			gutenverse
		
		Hide Category by User Role for WooCommerce
		
			hide-category-by-user-role-for-woocommerce
		
		Inline frame – Iframe
		
			inline-frame-iframe
		
		JetFormBuilder — Dynamic Blocks Form Builder
		
			jetformbuilder
		
		Job Board by BestWebSoft
		
			job-board
		
		Just Highlight
		
			just-highlight
		
		KiviCare – Clinic &amp; Patient Management System (EHR)
		
			kivicare-clinic-management-system
		
		Locker Content
		
			locker-content
		
		Nextend Social Login and Register
		
			nextend-facebook-connect
		
		Peer Publish
		
			peer-publish
		
		Perfect Brands for WooCommerce
		
			perfect-woocommerce-brands
		
		Poll, Survey &amp; Quiz Maker Plugin by Opinion Stage
		
			social-polls-by-opinionstage
		
		PowerPress Podcasting plugin by Blubrry
		
			powerpress
		
		ProjectList
		
			projectlist
		
		Property Hive
		
			propertyhive
		
		QODE Wishlist for WooCommerce
		
			qode-wishlist-for-woocommerce
		
		Quick View for WooCommerce
		
			woo-quickview
		
		Refund Request for WooCommerce
		
			refund-request-for-woocommerce
		
		Reuters Direct
		
			reuters-direct
		
		Search Exclude
		
			search-exclude
		
		Shouty
		
			shouty
		
		Show Variations as Single Products Woocommerce
		
			woo-show-single-variations-shop-category
		
		Simple Folio
		
			simple-folio
		
		SKT PayPal for WooCommerce
		
			skt-paypal-for-woocommerce
		
		Sneeit Framework
		
			sneeit-framework
		
		Social Images Widget
		
			social-images-widget
		
		SortTable Post
		
			sorttable-post
		
		Soundslides
		
			soundslides
		
		StaffList
		
			stafflist
		
		StreamTube Core
		
			streamtube-core
		
		Subscriptions &amp; Memberships for PayPal
		
			subscriptions-memberships-for-paypal
		
		Telegram Bot &amp; Channel
		
			telegram-bot
		
		Tiare Membership
		
			tiare-membership
		
		Unlimited Elements For Elementor
		
			unlimited-elements-for-elementor
		
		Unlimited Elements for Elementor (Premium)
		
			unlimited-elements-for-elementor-premium
		
		UsersWP – Front-end login form, User Registration, User Profile &amp; Members Directory plugin for WP
		
			userswp
		
		Wishlist for WooCommerce
		
			th-wishlist
		
		WP Directory Kit
		
			wpdirectorykit
		
		WP Fastest Cache
		
			wp-fastest-cache
		
		WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress
		
			wp-webhooks
		
		wp-twitpic
		
			wp-twitpic
		
		YouTube Subscribe
		
			easy-youtube-subscribe
		
		Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile
		
			zweb-social-mobile
		
WordPress Themes with Reported Vulnerabilities Last Week

		Software Name
		Software Slug
	
		Houzez
		
			houzez
		
		Tiger
		
			tiger
		
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

				AI Feeds &lt;= 1.0.11 - Unauthenticated Arbitrary File Upload
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13597
					
						Patch Status
						Patched
					
						Published
						Nov 25, 2025
					
						Affected Software
						AI Feeds					
					
																				Researcher
							
								Ryan Kozak							
											
				More Details &gt;
			
				CIBELES AI &lt;= 1.10.8 - Unauthenticated Arbitrary File Upload
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13595
					
						Patch Status
						Patched
					
						Published
						Nov 25, 2025
					
						Affected Software
						CIBELES AI					
					
																				Researcher
							
								Ryan Kozak							
											
				More Details &gt;
			
				EduKart Pro &lt;= 1.0.3 - Unauthenticated Privilege Escalation
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13559
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						EduKart Pro					
					
																				Researcher
							
								Alyudin Nafiie							
											
				More Details &gt;
			
				FindAll Listing &lt;= 1.0.5 - Unauthenticated Privilege Escalation
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13538
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						FindAll Listing					
					
																				Researcher
							
								シルAsuna							
											
				More Details &gt;
			
				FindAll Membership &lt;= 1.0.4 - Authentication Bypass via Social Login
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13539
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						FindAll Membership					
					
																				Researcher
							
								István Márton							
											
				More Details &gt;
			
				Sneeit Framework &lt;= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-6389
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Sneeit Framework					
					
																				Researcher
							
								Tonn							
											
				More Details &gt;
			
				StreamTube Core &lt;= 4.78 - Unauthenticated Arbitrary User Password Change
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13615
					
						Patch Status
						Patched
					
						Published
						Nov 29, 2025
					
						Affected Software
						StreamTube Core					
					
																				Researcher
							
								Foxyyy							
											
				More Details &gt;
			
				Tiare Membership &lt;= 1.2 - Unauthenticated Privilege Escalation
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13540
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Tiare Membership					
					
																				Researcher
							
								シルAsuna							
											
				More Details &gt;
			
				Tiger &lt;= 101.2.1 - Unauthenticated Privilege Escalation
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-13675
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Tiger					
					
																				Researcher
							
								シルAsuna							
											
				More Details &gt;
			
				Blubrry PowerPress &lt;= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-13536
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						PowerPress Podcasting plugin by Blubrry					
					
																				Researcher
							
								ISMAILSHADOW							
											
				More Details &gt;
			
				Tiger &lt;= 101.2.1 - Authenticated (Subscriber+) Privilege Escalation
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-13680
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Tiger					
					
																				Researcher
							
								István Márton							
											
				More Details &gt;
			
				SKT PayPal for WooCommerce &lt;= 1.4 - Unauthenticated Payment Bypass
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-7820
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						SKT PayPal for WooCommerce					
					
																				Researcher
							
								ch4r0n							
											
				More Details &gt;
			
				ProjectList &lt;= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-13376
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						ProjectList					
					
																				Researcher
							
								Ivan Cese							
											
				More Details &gt;
			
				Telegram Bot &amp; Channel &lt;= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-13068
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Telegram Bot &amp; Channel					
					
																				Researcher
							
								venom5iix							
											
				More Details &gt;
			
				Unlimited Elements For Elementor and  Unlimited Elements For Elementor (Premium) &lt;= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-13692
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Unlimited Elements For ElementorUnlimited Elements for Elementor (Premium)					
					
																				Researchers
							
								0xd4rk5id30xVenus							
											
				More Details &gt;
			
				Webhooks &lt;= 3.3.8 - Authenticated (Administrator+) PHP Object Injection
								6.6
							
							CVSS Rating
							Medium (6.6)
						
						CVE-ID
						CVE-2025-66073
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						WP Webhooks – Automate repetitive tasks by creating powerful automation workflows directly within WordPress					
					
																				Researcher
							
								Phat RiO - BlueRock							
											
				More Details &gt;
			
				AI ChatBot with ChatGPT and Content Generator by AYS &lt;= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-13378
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						AI ChatBot with ChatGPT and Content Generator by AYS					
					
																				Researcher
							
								blue0x1							
											
				More Details &gt;
			
				AI Engine for WordPress: ChatGPT, GPT Content Generator &lt;= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-13380
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						AI Engine for WordPress: ChatGPT, GPT Content Generator					
					
																				Researcher
							
								Ryan Kozak							
											
				More Details &gt;
			
				KiviCare &lt;= 3.6.13 - Authenticated (Patient+) SQL Injection
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-66095
					
						Patch Status
						Patched
					
						Published
						Nov 27, 2025
					
						Affected Software
						KiviCare – Clinic &amp; Patient Management System (EHR)					
					
																				Researcher
							
								benzdeus							
											
				More Details &gt;
			
				Perfect Brands for WooCommerce &lt;= 3.6.2 - Authenticated (Contributor+) SQL Injection
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-10144
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Perfect Brands for WooCommerce					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Wishlist for WooCommerce &lt;= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-12040
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Wishlist for WooCommerce					
					
																				Researcher
							
								Powpy							
											
				More Details &gt;
			
				Analytics Germanized for Google Analytics &lt;= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-64292
					
						Patch Status
						Patched
					
						Published
						Nov 28, 2025
					
						Affected Software
						Analytics Germanized for Google Analytics (GDPR / DSGVO)					
					
																				Researcher
							
								zaim							
											
				More Details &gt;
			
				Bold Page Builder &lt;= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-66057
					
						Patch Status
						Patched
					
						Published
						Nov 27, 2025
					
						Affected Software
						Bold Page Builder					
					
																				Researcher
							
								Tarcísio Luchesi(Poystick)							
											
				More Details &gt;
			
				Google Drive upload and download link &lt;= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12666
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Google Drive upload and download link					
					
																				Researcher
							
								zakaria							
											
				More Details &gt;
			
				Inline frame – Iframe &lt;= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12645
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Inline frame – Iframe					
					
																				Researcher
							
								Peter Thaleikis							
											
				More Details &gt;
			
				Shouty &lt;= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shouty Shortcode Attributes
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12712
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Shouty					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				Simple Folio &lt;= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12151
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Simple Folio					
					
																				Researcher
							
								Nabil Irawan							
											
				More Details &gt;
			
				SortTable Post &lt;= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12649
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						SortTable Post					
					
																				Researcher
							
								Peter Thaleikis							
											
				More Details &gt;
			
				Soundslides &lt;= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundslides Shortcode
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12713
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Soundslides					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				wp-twitpic &lt;= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12670
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						wp-twitpic					
					
																				Researcher
							
								zakaria							
											
				More Details &gt;
			
				Houzez &lt;= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search
								6.3
							
							CVSS Rating
							Medium (6.3)
						
						CVE-ID
						CVE-2025-9191
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Houzez					
					
																				Researcher
							
								Alex Thomas							
											
				More Details &gt;
			
				Customer Reviews Collector for WooCommerce &lt;= 4.6.1 - Reflected Cross-Site Scripting
								6.1
							
							CVSS Rating
							Medium (6.1)
						
						CVE-ID
						CVE-2025-12123
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Customer Reviews Collector for WooCommerce					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Houzez &lt;= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
								6.1
							
							CVSS Rating
							Medium (6.1)
						
						CVE-ID
						CVE-2025-9163
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Houzez					
					
																				Researcher
							
								Alex Thomas							
											
				More Details &gt;
			
				Job Board by BestWebSoft &lt;= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage
								6.1
							
							CVSS Rating
							Medium (6.1)
						
						CVE-ID
						CVE-2025-13383
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Job Board by BestWebSoft					
					
																				Researcher
							
								Jamshed Yergashvoyev (CVE Guy)							
											
				More Details &gt;
			
				WP Directory Kit &lt;= 1.4.5 - Reflected Cross-Site Scripting via 'order_by' Parameter
								6.1
							
							CVSS Rating
							Medium (6.1)
						
						CVE-ID
						CVE-2025-13525
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						WP Directory Kit					
					
																				Researcher
							
								blue0x1							
											
				More Details &gt;
			
				Blog2Social &lt;= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing
								5.4
							
							CVSS Rating
							Medium (5.4)
						
						CVE-ID
						CVE-2025-13558
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Blog2Social: Social Media Auto Post &amp; Scheduler					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				Ace Post Type Builder &lt;= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13405
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Ace Post Type Builder					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				Admin and Customer Messages After Order for WooCommerce: OrderConvo &lt;= 14 - Missing Authorization to Unauthenticated Information Disclosure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13389
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Admin and Customer Messages After Order for WooCommerce: OrderConvo					
					
																				Researcher
							
								Md. Moniruzzaman Prodhan (NomanProdhan)							
											
				More Details &gt;
			
				AI ChatBot with ChatGPT and Content Generator by AYS &lt;= 2.7.0 - Missing Authorization to Unauthenticated Media File Uploads
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13381
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						AI ChatBot with ChatGPT and Content Generator by AYS					
					
																				Researcher
							
								blue0x1							
											
				More Details &gt;
			
				atec Duplicate Page &amp; Post &lt;= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13404
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						atec Duplicate Page &amp; Post					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Autochat Automatic Conversation &lt;= 1.1.9 - Missing Authorization to Unauthenticated Settings Update
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-12043
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Autochat Automatic Conversation					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				Chamber Dashboard Business Directory &lt;= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13414
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Chamber Dashboard Business Directory					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				Hide Category by User Role for WooCommerce &lt;= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13441
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Hide Category by User Role for WooCommerce					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				JetFormBuilder &lt;= 3.5.3 - Missing Authorization
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-64384
					
						Patch Status
						Patched
					
						Published
						Nov 29, 2025
					
						Affected Software
						JetFormBuilder — Dynamic Blocks Form Builder					
					
																				Researcher
							
								benzdeus							
											
				More Details &gt;
			
				Locker Content &lt;= 1.0.0 - Unauthenticated Information Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-12525
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Locker Content					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				QODE Wishlist for WooCommerce &lt;= 1.2.7 - Unauthenticated Insecure Direct Object Reference to Wishlist Update
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13157
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						QODE Wishlist for WooCommerce					
					
																				Researchers
							
								Athiwat Tiprasaharn (Jitlada)PowpyPeerapat Samatathanyakorn							
											
				More Details &gt;
			
				Quick View for WooCommerce &lt;= 2.2.17 - Unauthenticated Private Product Disclosure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-12584
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Quick View for WooCommerce					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Reuters Direct &lt;= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-12579
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Reuters Direct					
					
																				Researcher
							
								Nabil Irawan							
											
				More Details &gt;
			
				Show Variations as Single Products Woocommerce &lt;= 2.0 - Missing Authorization
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-66114
					
						Patch Status
						Patched
					
						Published
						Nov 28, 2025
					
						Affected Software
						Show Variations as Single Products Woocommerce					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				Social Images Widget &lt;= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-13386
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Social Images Widget					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				Subscriptions &amp; Memberships for PayPal &lt;= 1.1.7 - Missing Authorization
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-66107
					
						Patch Status
						Patched
					
						Published
						Nov 28, 2025
					
						Affected Software
						Subscriptions &amp; Memberships for PayPal					
					
																				Researcher
							
								NumeX							
											
				More Details &gt;
			
				UsersWP &lt;= 1.2.47 - Missing Authorization
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-66072
					
						Patch Status
						Patched
					
						Published
						Nov 25, 2025
					
						Affected Software
						UsersWP – Front-end login form, User Registration, User Profile &amp; Members Directory plugin for WP					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				Bookme &lt;= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2025-13385
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Bookme – Free Online Appointment Booking and Scheduling Plugin					
					
																				Researcher
							
								Sopon Tangpathum (SoNaJaa)							
											
				More Details &gt;
			
				ProjectList &lt;= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2025-13370
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						ProjectList					
					
																				Researcher
							
								Ivan Cese							
											
				More Details &gt;
			
				Just Highlight &lt;= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-13311
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Just Highlight					
					
																				Researcher
							
								Muhammad Nur Ibnu Hubab (Ibnu)							
											
				More Details &gt;
			
				StaffList &lt;= 3.2.6 - Authenticated (Admin+) Stored Cross-Site Scripting
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-12185
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						StaffList					
					
																				Researcher
							
								Ivan Cese							
											
				More Details &gt;
			
				YouTube Subscribe &lt;= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-12025
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						YouTube Subscribe					
					
																				Researcher
							
								ZAST.AI							
											
				More Details &gt;
			
				ZWeb - Social Mobile &lt;= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-12032
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile					
					
																				Researcher
							
								dayea song							
											
				More Details &gt;
			
				Admin and Customer Messages After Order for WooCommerce: OrderConvo &lt;= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-13452
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Admin and Customer Messages After Order for WooCommerce: OrderConvo					
					
																				Researcher
							
								Md. Moniruzzaman Prodhan (NomanProdhan)							
											
				More Details &gt;
			
				Conditional Maintenance Mode for WordPress &lt;= 1.0.0 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12586
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Conditionnal Maintenance Mode for WordPress					
					
																				Researcher
							
								dayea song							
											
				More Details &gt;
			
				Featured Post Creative &lt;= 1.5.5 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-66106
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Featured Post Creative					
					
																				Researcher
							
								Nabil Irawan							
											
				More Details &gt;
			
				FluentCommunity &lt;= 2.0.0 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-66084
					
						Patch Status
						Patched
					
						Published
						Nov 28, 2025
					
						Affected Software
						FluentCommunity – Ultra-Fast High-Performance Social Network, Community, LMS &amp; Online Courses					
					
																				Researcher
							
								daroo							
											
				More Details &gt;
			
				Folders &lt;= 3.1.5 - Incorrect Authorization to Authenticated (Contributor+) Folder Content Manipulation
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12971
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				Frontend File Manager Plugin &lt;= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-13382
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Frontend File Manager Plugin					
					
																				Researcher
							
								t.t.brothers							
											
				More Details &gt;
			
				Gutenverse &lt;= 3.2.1 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-66065
					
						Patch Status
						Patched
					
						Published
						Nov 28, 2025
					
						Affected Software
						Gutenverse – Ultimate WordPress FSE Blocks Addons &amp; Ecosystem					
					
																				Researcher
							
								Denver Jackson							
											
				More Details &gt;
			
				Gutenverse Form &lt;= 2.2.0 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-66079
					
						Patch Status
						Patched
					
						Published
						Nov 28, 2025
					
						Affected Software
						Gutenverse Form – Contact Form Builder, Booking, Reservation, Subscribe for Block Editor					
					
																				Researcher
							
								Denver Jackson							
											
				More Details &gt;
			
				Nextend Social Login and Register &lt;= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-13737
					
						Patch Status
						Patched
					
						Published
						Nov 27, 2025
					
						Affected Software
						Nextend Social Login and Register					
					
																				Researcher
							
								type5afe							
											
				More Details &gt;
			
				Peer Publish &lt;= 1.0 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12587
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Peer Publish					
					
																				Researcher
							
								dayea song							
											
				More Details &gt;
			
				Poll, Survey &amp; Quiz Maker Plugin by Opinion Stage &lt;= 19.12.0 - Cross-Site Request Forgery to Account Disconnection
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-13143
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Poll, Survey &amp; Quiz Maker Plugin by Opinion Stage					
					
																				Researcher
							
								Deadbee							
											
				More Details &gt;
			
				PropertyHive &lt;= 2.1.12 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-66087
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Property Hive					
					
																				Researcher
							
								daroo							
											
				More Details &gt;
			
				Refund Request for WooCommerce &lt;= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12634
					
						Patch Status
						Unpatched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Refund Request for WooCommerce					
					
																				Researcher
							
								Powpy							
											
				More Details &gt;
			
				Reuters Direct &lt;= 3.0.0 - Cross-Site Request Forgery to Settings Reset
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12578
					
						Patch Status
						Unpatched
					
						Published
						Nov 26, 2025
					
						Affected Software
						Reuters Direct					
					
																				Researcher
							
								Nabil Irawan							
											
				More Details &gt;
			
				Search Exclude &lt;= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-10646
					
						Patch Status
						Patched
					
						Published
						Nov 24, 2025
					
						Affected Software
						Search Exclude					
					
																				Researcher
							
								Lucas Montes (Nirox)							
											
				More Details &gt;
			
				WP Fastest Cache &lt;= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) DB Cleanup Actions
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-10476
					
						Patch Status
						Patched
					
						Published
						Nov 26, 2025
					
						Affected Software
						WP Fastest Cache					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 24, 2025 to November 30, 2025) appeared first on Wordfence.
[messages.read_original_source] →