> Wordfence Intelligence Weekly WordPress Vulnerability Report (October 27, 2025 to November 2, 2025)

[SOURCE] Wordfence [AUTHOR: Chloe Chamberland] [DATE: 06/11/2025 16:18] [LANGUAGE: EN]
 Calling all Vulnerability Researchers and Bug Bounty Hunters! 
  Operation: Maximum Impact Challenge! Now through November 10, 2025, earn 2X bounty rewards for all in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!
 The LFInder Challenge: Refine your LFI hunting skills with an expanded scope. Now through November 24, 2025, all LFI vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier, AND earn a 30% bonus on all Local File Inclusion vulnerability submissions not already increased by another promotion.

Last week, there were 76 vulnerabilities disclosed in 62 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 47 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 29,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

WAF-RULE-871 – Data redacted while we work with the vendor on a patch.
Alone – Charity Multipurpose Non-profit WordPress Theme &lt;= 7.8.3 – Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation (Extended Coverage)
WAF-RULE-873 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched &amp; Patched Vulnerabilities Last Week

		Patch Status
		Number of Vulnerabilities
	
		Patched
		71
	
		Unpatched
		5
	
Total Vulnerabilities by CVSS Severity Last Week

		Severity Rating
		Number of Vulnerabilities
	
				Medium Severity
				48
			
				High Severity
				23
			
				Critical Severity
				5
			
Total Vulnerabilities by CWE Type Last Week

		Vulnerability Type by CWE
		Number of Vulnerabilities
	
		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
		21
	
		Missing Authorization
		17
	
		Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
		7
	
		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
		4
	
		Exposure of Sensitive Information to an Unauthorized Actor
		3
	
		Unrestricted Upload of File with Dangerous Type
		3
	
		Authorization Bypass Through User-Controlled Key
		2
	
		Cross-Site Request Forgery (CSRF)
		2
	
		Improper Authorization
		2
	
		Improper Control of Generation of Code ('Code Injection')
		2
	
		Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
		2
	
		Improper Privilege Management
		2
	
		Absolute Path Traversal
		1
	
		Authentication Bypass Using an Alternate Path or Channel
		1
	
		Client-Side Enforcement of Server-Side Security
		1
	
		Deserialization of Untrusted Data
		1
	
		External Control of File Name or Path
		1
	
		Improper Output Neutralization for Logs
		1
	
		Incorrect Authorization
		1
	
		Protection Mechanism Failure
		1
	
		Server-Side Request Forgery (SSRF)
		1
	
Researchers That Contributed to WordPress Security Last Week

		Researcher Name
		Number of Vulnerabilities
	
					João Pedro S Alcântara (Kinorth)
				
		11
	
					Jonas Benjamin Friedli
				
		7
	
					Athiwat Tiprasaharn (Jitlada)
				
		5
	
					stealthcopter
				
		3
	
					Legion Hunter
				
		3
	
					Dmitrii Ignatyev
				
		3
	
					Thái An
				
		2
	
					Nguyen Xuan Chien
				
		2
	
					Ala Arfaoui
				
		2
	
					Peter Thaleikis
				
		2
	
					Tonn
				
		2
	
					Rafshanzani Suhada
				
		1
	
					Avraham Shemesh
				
		1
	
					Kai Aizen
				
		1
	
					Talal Nasraddeen
				
		1
	
					Jamiryoo
				
		1
	
					István Márton
				
		1
	
					SavPhill (Savphill)
				
		1
	
					mikemyers
				
		1
	
					Adrian Lukita
				
		1
	
					Naoya Takahashi (nakko)
				
		1
	
					WPBrigade Support
				
		1
	
					netranger
				
		1
	
					Alyudin Nafiie
				
		1
	
					zaim
				
		1
	
					Ryan Novotny
				
		1
	
					theviper17
				
		1
	
					D01EXPLOIT OFFICIAL
				
		1
	
					ifoundbug
				
		1
	
					ch4r0n
				
		1
	
					Nicholas Giemsa
				
		1
	
					kr0d
				
		1
	
					Khaled Alenazi (Nxploited)
				
		1
	
					Kyokito
				
		1
	
					Foxyyy
				
		1
	
					Bob Matyas
				
		1
	
					YC_Infosec
				
		1
	
					Md. Moniruzzaman Prodhan (NomanProdhan)
				
		1
	
					zakaria
				
		1
	
					HunSec
				
		1
	
					Bao - BlueRock
				
		1
	
					Nguyen Ngoc Quang Bach (maysbachs)
				
		1
	
					Karuppiah Sabari Kumar
				
		1
	
					Phat RiO - BlueRock
				
		1
	
					Muhammad Yudha - DJ
				
		1
	
					LionTree
				
		1
	
					shark3y
				
		1
	
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

		Software Name
		Software Slug
	
		Advanced Ads – Ad Manager &amp; AdSense
		
			advanced-ads
		
		Analytify Pro
		
			wp-analytify-pro
		
		Anti-Malware Security and Brute-Force Firewall
		
			gotmls
		
		AppPresser – Mobile App Framework
		
			apppresser
		
		Auto Featured Image (Auto Post Thumbnail)
		
			auto-post-thumbnail
		
		Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment
		
			booking-and-rental-manager-for-woocommerce
		
		Call Now Button – The #1 Click to Call Button for WordPress
		
			call-now-button
		
		Community Events
		
			community-events
		
		Consulting Elementor Widgets
		
			consulting-elementor-widgets
		
		CSS &amp; JavaScript Toolbox
		
			css-javascript-toolbox
		
		Doccure Core
		
			doccure
		
		Document Library Lite
		
			document-library-lite
		
		Easy Testimonial Slider and Form
		
			easy-testimonial-rotator
		
		Employee Spotlight – Team Member Showcase &amp; Meet the Team Plugin
		
			employee-spotlight
		
		ERI File Library
		
			eri-file-library
		
		Facebook for WooCommerce
		
			facebook-for-woocommerce
		
		Flying Images: Optimize and Lazy Load Images for Faster Page Speed
		
			nazy-load
		
		Folderly
		
			folderly
		
		FuseWP – WordPress User Sync to Email List &amp; Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)
		
			fusewp
		
		Groundhogg — CRM, Newsletters, and Marketing Automation
		
			groundhogg
		
		HUSKY – Products Filter Professional for WooCommerce
		
			woocommerce-products-filter
		
		IDonate – Blood Donation, Request And Donor Management System
		
			idonate
		
		Import WP – Export and Import CSV and XML files to WordPress
		
			jc-importer
		
		Inactive Logout
		
			inactive-logout
		
		Insert PHP Code Snippet
		
			insert-php-code-snippet
		
		Jannah - Extensions
		
			jannah-extensions
		
		K Elements
		
			k-elements
		
		King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor
		
			king-addons
		
		List category posts
		
			list-category-posts
		
		LiteSpeed Cache
		
			litespeed-cache
		
		NS Maintenance Mode for WP
		
			ns-maintenance-mode-for-wp
		
		OOPSpam Anti-Spam: Spam Protection for WordPress Forms &amp; Comments (No CAPTCHA)
		
			oopspam-anti-spam
		
		Polylang
		
			polylang
		
		Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel
		
			depicter
		
		Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
		
			ays-popup-box
		
		Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP &amp; Mobile App
		
			post-smtp
		
		Privacy Policy Generator, Terms &amp; Conditions Generator WordPress Plugin : WP Legal Pages
		
			wplegalpages
		
		Qi Blocks
		
			qi-blocks
		
		Qzzr Shortcode Plugin
		
			qzzr-shortcode
		
		Range Slider Addon for Gravity Forms
		
			range-slider-addon-for-gravity-forms
		
		RESTful Content Syndication
		
			restful-syndication
		
		Schema &amp; Structured Data for WP &amp; AMP
		
			schema-and-structured-data-for-wp
		
		Schema Scalpel
		
			schema-scalpel
		
		Service Finder Bookings
		
			sf-booking
		
		Simple Payment
		
			simple-payment
		
		Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue
		
			site-checkup
		
		SiteSEO – SEO Simplified
		
			siteseo
		
		Smart Coupons For WooCommerce Coupons
		
			wt-smart-coupons-for-woocommerce
		
		Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent
		
			tablesome
		
		The Events Calendar
		
			the-events-calendar
		
		Thumbnail Slider With Lightbox
		
			wp-responsive-slider-with-lightbox
		
		Translate WordPress and go Multilingual – Weglot
		
			weglot
		
		Web Accessibility by accessiBe
		
			accessibe
		
		WooCommerce
		
			woocommerce
		
		WooCommerce Designer Pro
		
			wc-designer-pro
		
		WordPress User Extra Fields
		
			wp-user-extra-fields
		
		WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
		
			delicious-recipes
		
		WP Discourse
		
			wp-discourse
		
		WPC Name Your Price for WooCommerce
		
			wpc-name-your-price
		
		WPCOM Member
		
			wpcom-member
		
		wpForo Forum
		
			wpforo
		
		Zombify
		
			zombify
		
WordPress Themes with Reported Vulnerabilities Last Week

		Software Name
		Software Slug
	
		Consulting
		
			consulting
		
		KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme
		
			kallyas
		
		kleo
		
			kleo
		
		Masterstudy - Education WordPress Theme
		
			masterstudy
		
		Noo JobMonster
		
			noo-jobmonster
		
		Sahifa
		
			sahifa
		
		SmartMag - Newspaper Magazine &amp; News WordPress
		
			smart-mag
		
		WpResidence
		
			wpresidence
		
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

				Doccure Core &lt; 1.5.4 - Unauthenticated Privilege Escalation
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-8900
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Doccure Core					
					
																				Researcher
							
								Alyudin Nafiie							
											
				More Details &gt;
			
				Jobmonster - Job Board WordPress Theme &lt;= 4.8.1 - Authentication Bypass
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-5397
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Noo JobMonster					
					
																				Researcher
							
								Thái An							
											
				More Details &gt;
			
				King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-8489
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor					
					
																				Researcher
							
								Peter Thaleikis							
											
				More Details &gt;
			
				Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP &amp; Mobile App &lt;= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-11833
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP &amp; Mobile App					
					
																				Researcher
							
								netranger							
											
				More Details &gt;
			
				Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent &lt;= 1.1.32 - Unauthenticated Arbitrary File Upload
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-11499
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent					
					
																				Researcher
							
								Talal Nasraddeen							
											
				More Details &gt;
			
				Delicious Recipes &lt;= 1.9.0 - Authenticated (Contributor+) Arbitrary File Upload
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-11755
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)					
					
																				Researchers
							
								stealthcoptertheviper17							
											
				More Details &gt;
			
				Kallyas &lt;= 4.24.0 - Authenticated (Contributor+) Remote Code Execution
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-6990
					
						Patch Status
						Unpatched
					
						Published
						Oct 31, 2025
					
						Affected Software
						KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme					
					
																				Researcher
							
								stealthcopter							
											
				More Details &gt;
			
				RESTful Content Syndication 1.1.0 - 1.5.0 - Authenticated (Contributor+) Arbitrary File Upload
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-12171
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						RESTful Content Syndication					
					
																				Researcher
							
								kr0d							
											
				More Details &gt;
			
				Service Finder Bookings &lt; 6.1 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-6574
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Service Finder Bookings					
					
																				Researcher
							
								Thái An							
											
				More Details &gt;
			
				Service Finder Bookings &lt;= 6.0 - Authenticated (Subscriber+) Privilege Escalation via change_candidate_password
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-5949
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Service Finder Bookings					
					
																				Researcher
							
								Foxyyy							
											
				More Details &gt;
			
				WordPress User Extra Fields &lt;= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-7846
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						WordPress User Extra Fields					
					
																				Researcher
							
								Tonn							
											
				More Details &gt;
			
				WPCOM Member &lt;= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-11920
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						WPCOM Member					
					
																				Researcher
							
								Naoya Takahashi (nakko)							
											
				More Details &gt;
			
				WooCommerce Designer Pro &lt;= 1.9.28 - Unauthenticated Arbitrary File Read
								8.6
							
							CVSS Rating
							High (8.6)
						
						CVE-ID
						CVE-2025-10897
					
						Patch Status
						Unpatched
					
						Published
						Oct 30, 2025
					
						Affected Software
						WooCommerce Designer Pro					
					
																				Researcher
							
								István Márton							
											
				More Details &gt;
			
				Simple Payment &lt;= 2.4.6 - Unauthenticated Local File Inclusion
								8.1
							
							CVSS Rating
							High (8.1)
						
						CVE-ID
						CVE-2025-62075
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						Simple Payment					
					
																				Researcher
							
								Nguyen Xuan Chien							
											
				More Details &gt;
			
				Auto Featured Image (Auto Post Thumbnail) &lt;= 4.1.7 - Authenticated (Author+) Server-Side Request Forgery
								7.7
							
							CVSS Rating
							High (7.7)
						
						CVE-ID
						CVE-2025-10145
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Auto Featured Image (Auto Post Thumbnail)					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Consulting &lt; 6.7.5 - Authenticated (Contributor+) Local File Inclusion
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-64359
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Consulting					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				Consulting Elementor Widgets &lt;= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-64360
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Consulting Elementor Widgets					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				HUSKY – Products Filter Professional for WooCommerce &lt;= 1.3.7.1 - Unauthenticated SQL Injection via `phrase` Parameter
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-11735
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						HUSKY – Products Filter Professional for WooCommerce					
					
																				Researcher
							
								LionTree							
											
				More Details &gt;
			
				Kleo &lt; 5.5.0 - Authenticated (Contributor+) Local File Inclusion
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-64363
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						kleo					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				Masterstudy &lt; 4.8.126 - Authenticated (Contributor+) Local File Inclusion
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-64364
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Masterstudy - Education WordPress Theme					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				Polylang &lt;= 3.7.3 - Authenticated (Contributor+) PHP Object Injection
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-64353
					
						Patch Status
						Patched
					
						Published
						Oct 28, 2025
					
						Affected Software
						Polylang					
					
																				Researcher
							
								Phat RiO - BlueRock							
											
				More Details &gt;
			
				SmartMag &lt;= 10.3.0 - Authenticated (Contributor+) Local File Inclusion
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-64216
					
						Patch Status
						Patched
					
						Published
						Nov 1, 2025
					
						Affected Software
						SmartMag - Newspaper Magazine &amp; News WordPress					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				WPC Name Your Price for WooCommerce &lt;= 2.1.9 - Unauthenticated Price Alteration
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-12115
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						WPC Name Your Price for WooCommerce					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Advanced Ads &lt;= 2.0.12 - Unauthenticated Limited Code Execution
								7.3
							
							CVSS Rating
							High (7.3)
						
						CVE-ID
						CVE-2025-10487
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Advanced Ads – Ad Manager &amp; AdSense					
					
																				Researcher
							
								mikemyers							
											
				More Details &gt;
			
				Booking and Rental Manager &lt;= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-49904
					
						Patch Status
						Patched
					
						Published
						Nov 1, 2025
					
						Affected Software
						Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment					
					
																				Researcher
							
								Ryan Novotny							
											
				More Details &gt;
			
				Community Events &lt;= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-11995
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Community Events					
					
																				Researcher
							
								ifoundbug							
											
				More Details &gt;
			
				Range Slider Addon for Gravity Forms &lt;= 1.1.6 - Unauthenticated Stored Cross-Site Scripting
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-49905
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Range Slider Addon for Gravity Forms					
					
																				Researcher
							
								HunSec							
											
				More Details &gt;
			
				Simple Payment &lt;= 2.4.6 - Unauthenticated Stored Cross-Site Scripting
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-62076
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						Simple Payment					
					
																				Researcher
							
								Nguyen Xuan Chien							
											
				More Details &gt;
			
				Zombify &lt;= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read
								6.8
							
							CVSS Rating
							Medium (6.8)
						
						CVE-ID
						CVE-2025-8385
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Zombify					
					
																				Researcher
							
								Tonn							
											
				More Details &gt;
			
				Anti-Malware Security and Brute-Force Firewall &lt;= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-11705
					
						Patch Status
						Patched
					
						Published
						Oct 28, 2025
					
						Affected Software
						Anti-Malware Security and Brute-Force Firewall					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue &lt;= 1.47 - Unauthenticated Log File Poisoning
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-11627
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				wpForo Forum &lt;= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-11740
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						wpForo Forum					
					
																				Researcher
							
								YC_Infosec							
											
				More Details &gt;
			
				Consulting Elementor Widgets &lt;= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-64361
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Consulting Elementor Widgets					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				Employee Spotlight – Team Member Showcase &amp; Meet the Team Plugin &lt;= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12090
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Employee Spotlight – Team Member Showcase &amp; Meet the Team Plugin					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Groundhogg &lt;= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-64367
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Groundhogg — CRM, Newsletters, and Marketing Automation					
					
																				Researcher
							
								zaim							
											
				More Details &gt;
			
				Inactive Logout &lt;= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-11922
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Inactive Logout					
					
																				Researcher
							
								shark3y							
											
				More Details &gt;
			
				Jannah - Extensions &lt;= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-64208
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Jannah - Extensions					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				K Elements &lt; 5.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-64362
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						K Elements					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				Kallyas &lt;= 4.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-6988
					
						Patch Status
						Unpatched
					
						Published
						Oct 31, 2025
					
						Affected Software
						KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme					
					
																				Researcher
							
								stealthcopter							
											
				More Details &gt;
			
				Qzzr Shortcode Plugin &lt;= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-11806
					
						Patch Status
						Unpatched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Qzzr Shortcode Plugin					
					
																				Researcher
							
								zakaria							
											
				More Details &gt;
			
				Sahifa &lt; 5.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-64202
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Sahifa					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				Schema &amp; Structured Data for WP &amp; AMP &lt;= 1.51 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-11502
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Schema &amp; Structured Data for WP &amp; AMP					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				Schema Scalpel &lt;= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-12118
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Schema Scalpel					
					
																				Researcher
							
								Peter Thaleikis							
											
				More Details &gt;
			
				SmartMag &lt;= 10.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-64204
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						SmartMag - Newspaper Magazine &amp; News WordPress					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				LiteSpeed Cache &lt;= 7.5.0.1 - Reflected Cross-Site Scripting
								6.1
							
							CVSS Rating
							Medium (6.1)
						
						CVE-ID
						CVE-2025-12450
					
						Patch Status
						Patched
					
						Published
						Oct 28, 2025
					
						Affected Software
						LiteSpeed Cache					
					
																				Researcher
							
								Nicholas Giemsa							
											
				More Details &gt;
			
				Analytify Pro &lt;= 7.0.3 - Unauthenticated Information Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-12521
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Analytify Pro					
					
																				Researcher
							
								WPBrigade Support							
											
				More Details &gt;
			
				AppPresser – Mobile App Framework &lt;= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-11881
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						AppPresser – Mobile App Framework					
					
																				Researcher
							
								D01EXPLOIT OFFICIAL							
											
				More Details &gt;
			
				Document Library Lite &lt;= 1.1.6 - Missing Authorization to Sensitive Information Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-11174
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Document Library Lite					
					
																				Researchers
							
								Avraham ShemeshKai Aizen							
											
				More Details &gt;
			
				ERI File Library &lt;= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-12041
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						ERI File Library					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Facebook for WooCommerce &lt;= 3.5.7 - Missing Authorization to Unauthenticated Notification Dismissal
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-64296
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						Facebook for WooCommerce					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				IDonate &lt; 2.1.13 - Missing Authorization
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-11154
					
						Patch Status
						Patched
					
						Published
						Oct 28, 2025
					
						Affected Software
						IDonate – Blood Donation, Request And Donor Management System					
					
																				Researcher
							
								Khaled Alenazi (Nxploited)							
											
				More Details &gt;
			
				OOPSpam Anti-Spam: Spam Protection for WordPress Forms &amp; Comments (No CAPTCHA) &lt;= 1.2.53 - Unauthenticated IP Header Spoofing
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-12094
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						OOPSpam Anti-Spam: Spam Protection for WordPress Forms &amp; Comments (No CAPTCHA)					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Privacy Policy Generator, Terms &amp; Conditions Generator WordPress Plugin : WP Legal Pages &lt;= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-11816
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Privacy Policy Generator, Terms &amp; Conditions Generator WordPress Plugin : WP Legal Pages					
					
																				Researcher
							
								Rafshanzani Suhada							
											
				More Details &gt;
			
				Translate WordPress and go Multilingual – Weglot &lt;= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-10008
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						Translate WordPress and go Multilingual – Weglot					
					
																				Researcher
							
								Nguyen Ngoc Quang Bach (maysbachs)							
											
				More Details &gt;
			
				WpResidence &lt;= 5.3.2 - Missing Authorization
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-64199
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						WpResidence					
					
																				Researcher
							
								João Pedro S Alcântara (Kinorth)							
											
				More Details &gt;
			
				Easy Testimonial Slider and Form &lt;= 1.0.2 - Authenticated (Admin+) SQL injection
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2015-10147
					
						Patch Status
						Patched
					
						Published
						Oct 28, 2025
					
						Affected Software
						Easy Testimonial Slider and Form					
					
																				Researcher
							
								Ala Arfaoui							
											
				More Details &gt;
			
				Import WP – Export and Import CSV and XML files to WordPress &lt;= 2.14.16 - Authenticated (Admin+) Arbitrary File Read
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2025-12137
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Import WP – Export and Import CSV and XML files to WordPress					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Thumbnail Slider With Lightbox &lt;= 1.0.4 - Authenticated (Admin+) SQL Injection
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2015-10146
					
						Patch Status
						Patched
					
						Published
						Oct 28, 2025
					
						Affected Software
						Thumbnail Slider With Lightbox					
					
																				Researcher
							
								Ala Arfaoui							
											
				More Details &gt;
			
				CSS &amp; JavaScript Toolbox &lt;= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-11928
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						CSS &amp; JavaScript Toolbox					
					
																				Researcher
							
								Kyokito							
											
				More Details &gt;
			
				Flying Images: Optimize and Lazy Load Images for Faster Page Speed &lt;= 2.4.14 - Authenticated (Admin+) Stored Cross-Site Scripting
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-11927
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Flying Images: Optimize and Lazy Load Images for Faster Page Speed					
					
																				Researcher
							
								Karuppiah Sabari Kumar							
											
				More Details &gt;
			
				NS Maintenance Mode for WP &lt;= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-10636
					
						Patch Status
						Unpatched
					
						Published
						Oct 30, 2025
					
						Affected Software
						NS Maintenance Mode for WP					
					
																				Researcher
							
								Bob Matyas							
											
				More Details &gt;
			
				WooCommerce &lt;= 10.0.2 - Authenticated (Shop manager+) Stored Cross-Site Scripting
								4.4
							
							CVSS Rating
							Medium (4.4)
						
						CVE-ID
						CVE-2025-49042
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						WooCommerce					
					
																				Researcher
							
								SavPhill (Savphill)							
											
				More Details &gt;
			
				Call Now Button &lt;= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-11587
					
						Patch Status
						Patched
					
						Published
						Oct 28, 2025
					
						Affected Software
						Call Now Button – The #1 Click to Call Button for WordPress					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				Call Now Button &lt;= 1.5.4 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-11632
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						Call Now Button – The #1 Click to Call Button for WordPress					
					
																				Researcher
							
								Jamiryoo							
											
				More Details &gt;
			
				Depicter &lt;= 4.0.4 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-8383
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				Folderly &lt;= 0.3 - Incorrect Authorization to Authenticated (Author+) Term Deletion
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12038
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Folderly					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				FuseWP – WordPress User Sync to Email List &amp; Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) &lt;= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-11975
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						FuseWP – WordPress User Sync to Email List &amp; Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Insert PHP Code Snippet &lt;= 1.4.3 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-64356
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Insert PHP Code Snippet					
					
																				Researcher
							
								Bao - BlueRock							
											
				More Details &gt;
			
				List category posts &lt;= 0.92.0 - Authenticated (Contributor+) Information Exposure
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-11377
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						List category posts					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Popup box &lt;= 5.5.4 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-57931
					
						Patch Status
						Patched
					
						Published
						Oct 29, 2025
					
						Affected Software
						Popup Box – Create Countdown, Coupon, Video, Contact Form Popups					
					
																				Researcher
							
								ch4r0n							
											
				More Details &gt;
			
				Qi Blocks &lt;= 1.4.3 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12180
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						Qi Blocks					
					
																				Researcher
							
								Adrian Lukita							
											
				More Details &gt;
			
				SiteSEO – SEO Simplified &lt;= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12367
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						SiteSEO – SEO Simplified					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Smart Coupons for WooCommerce &lt;= 2.2.3 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-64358
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						Smart Coupons For WooCommerce Coupons					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				The Events Calendar &lt;= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-12175
					
						Patch Status
						Patched
					
						Published
						Oct 30, 2025
					
						Affected Software
						The Events Calendar					
					
																				Researcher
							
								Md. Moniruzzaman Prodhan (NomanProdhan)							
											
				More Details &gt;
			
				Web Accessibility By accessiBe &lt;= 2.10 - Missing Authorization
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-49920
					
						Patch Status
						Patched
					
						Published
						Oct 27, 2025
					
						Affected Software
						Web Accessibility by accessiBe					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				WP Discourse &lt;= 2.5.9 - Authenticated (Author+) Information Exposure
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-11983
					
						Patch Status
						Patched
					
						Published
						Oct 31, 2025
					
						Affected Software
						WP Discourse					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 27, 2025 to November 2, 2025) appeared first on Wordfence.
[messages.read_original_source] →