> Wordfence Intelligence Weekly WordPress Vulnerability Report (October 6, 2025 to October 12, 2025)

[SOURCE] Wordfence [AUTHOR: Chloe Chamberland] [DATE: 16/10/2025 16:22] [LANGUAGE: EN]
 Calling all Vulnerability Researchers and Bug Bounty Hunters! 
  Operation: Maximum Impact Challenge! Now through November 10, 2025, earn 2X bounty rewards for all in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 per vulnerability. Submit bold. Earn big!
 The LFInder Challenge: Refine your LFI hunting skills with an expanded scope. Now through November 24, 2025, all LFI vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of researcher tier, AND earn a 30% bonus on all Local File Inclusion vulnerability submissions not already increased by another promotion.

Last week, there were 55 vulnerabilities disclosed in 48 WordPress Plugins and 3 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to implement layered security, aligning with our overarching mission to secure WordPress with defense in depth strategies. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report. As the world’s leading quality vulnerability database provider for WordPress, site owners can rest assured knowing Wordfence has their back.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 29,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

WAF-RULE-865 – Data redacted while we work with the vendor on a patch.

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched &amp; Patched Vulnerabilities Last Week

		Patch Status
		Number of Vulnerabilities
	
		Patched
		42
	
		Unpatched
		13
	
Total Vulnerabilities by CVSS Severity Last Week

		Severity Rating
		Number of Vulnerabilities
	
				Low Severity
				1
			
				Medium Severity
				39
			
				High Severity
				7
			
				Critical Severity
				8
			
Total Vulnerabilities by CWE Type Last Week

		Vulnerability Type by CWE
		Number of Vulnerabilities
	
		Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
		12
	
		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
		9
	
		Cross-Site Request Forgery (CSRF)
		7
	
		Exposure of Sensitive Information to an Unauthorized Actor
		4
	
		Missing Authorization
		4
	
		Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
		3
	
		Authorization Bypass Through User-Controlled Key
		2
	
		Authentication Bypass Using an Alternate Path or Channel
		1
	
		External Control of File Name or Path
		1
	
		Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
		1
	
		Improper Neutralization of Formula Elements in a CSV File
		1
	
		Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
		1
	
		Improper Privilege Management
		1
	
		Incorrect Authorization
		1
	
		Insertion of Sensitive Information into Log File
		1
	
		Missing Authentication for Critical Function
		1
	
		Protection Mechanism Failure
		1
	
		Relative Path Traversal
		1
	
		Server-Side Request Forgery (SSRF)
		1
	
		Unrestricted Upload of File with Dangerous Type
		1
	
		URL Redirection to Untrusted Site ('Open Redirect')
		1
	
Researchers That Contributed to WordPress Security Last Week

		Researcher Name
		Number of Vulnerabilities
	
					Muhammad Yudha - DJ
				
		5
	
					wesley (wcraft)
				
		4
	
					ifoundbug
				
		3
	
					Moose Love
				
		3
	
					Dmitrii Ignatyev
				
		3
	
					Sandeep Kambhampati
				
		2
	
					Foxyyy
				
		2
	
					meghnine islem
				
		2
	
					zaim
				
		2
	
					stealthcopter
				
		2
	
					Athiwat Tiprasaharn (Jitlada)
				
		2
	
					Rafshanzani Suhada
				
		2
	
					Legion Hunter
				
		2
	
					Jonas Benjamin Friedli
				
		2
	
					Tonn
				
		1
	
					R1sky
				
		1
	
					Valatty
				
		1
	
					Peter Thaleikis
				
		1
	
					gensho ni
				
		1
	
					netranger
				
		1
	
					tmrswrr
				
		1
	
					NumeX
				
		1
	
					Duc Manh
				
		1
	
					Aurélien BOURDOIS (Elymaro)
				
		1
	
					Alyudin Nafiie
				
		1
	
					Avraham Shemesh
				
		1
	
					Kai Aizen
				
		1
	
					khanhhnahk1
				
		1
	
					jamaal
				
		1
	
					Kishan Vyas
				
		1
	
					dutafi
				
		1
	
					Gilang - DJ
				
		1
	
					Nabil Irawan
				
		1
	
					Zbigniew Piotrak
				
		1
	
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

		Software Name
		Software Slug
	
		All In One Login — WP Admin Login Page Security and Customization with Google reCAPTCHA, Social Login, Limit Login Attempt, 2FA, and more.
		
			change-wp-admin-login
		
		APPExperts – Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps
		
			appexperts
		
		Blocksy Companion
		
			blocksy-companion
		
		Chartify – WordPress Chart Plugin
		
			chart-builder
		
		CM Registration – Tailored tool for seamless login and invitation-based registrations
		
			cm-invitation-codes
		
		Code Quality Control Tool
		
			code-quality-control-tool
		
		Colibri Page Builder
		
			colibri-page-builder
		
		Community Events
		
			community-events
		
		Contest Gallery – Upload, Vote &amp; Sell with PayPal and Stripe
		
			contest-gallery
		
		Cookie Notice &amp; Consent
		
			cookie-notice-consent
		
		Course Redirects for Learndash Plugin
		
			course-redirects-for-learndash
		
		Custom 404 Pro
		
			custom-404-pro
		
		Draft List
		
			simple-draft-list
		
		Easy Plugin Stats
		
			easy-plugin-stats
		
		Enable Media Replace
		
			enable-media-replace
		
		Error Log Viewer by BestWebSoft
		
			error-log-viewer
		
		Everest Backup – WordPress Cloud Backup, Migration, Restore &amp; Cloning Plugin
		
			everest-backup
		
		Featured Image from URL (FIFU)
		
			featured-image-from-url
		
		GSheetConnector For Gravity Forms
		
			gsheetconnector-gravity-forms
		
		Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme
		
			lisfinity-core
		
		Motors – Car Dealership &amp; Classified Listings Plugin
		
			motors-car-dealership-classified-listings
		
		My auctions allegro
		
			my-auctions-allegro-free-edition
		
		NEX-Forms – Ultimate Forms Plugin for WordPress
		
			nex-forms-express-wp-form-builder
		
		Ovatheme Events Manager
		
			ova-events-manager
		
		Page Blocks
		
			page-blocks
		
		Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers
		
			popup-builder-block
		
		Progress Planner
		
			progress-planner
		
		RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
		
			custom-registration-form-builder-with-submission-manager
		
		Search &amp; Filter
		
			search-filter
		
		Slider Revolution
		
			revslider
		
		Stock History &amp; Reports Manager for WooCommerce
		
			stock-snapshot-for-woocommerce
		
		Trinity Audio – Text to Speech AI audio player to convert content into audio
		
			trinity-audio
		
		Ultimate Addons for WPBakery
		
			Ultimate_VC_Addons
		
		Web Accessibility by accessiBe
		
			accessibe
		
		Welcart e-Commerce
		
			usc-e-shop
		
		WidgetPack Comment System
		
			widgetpack-comment-system
		
		WooCommerce Designer Pro
		
			wc-designer-pro
		
		WordPress Live Webcam Widget &amp; Shortcode
		
			wp-webcam-widget-shortcode
		
		WP Easy Toggles
		
			wp-easy-toggles
		
		WP Freeio
		
			wp-freeio
		
		WP Gmail SMTP
		
			wp-gmail-smtp
		
		WP Go Maps (formerly WP Google Maps)
		
			wp-google-maps
		
		WP JobHunt
		
			wp-jobhunt
		
		WP Links Page
		
			wp-links-page
		
		WP Reset
		
			wp-reset
		
		WP Scraper
		
			wp-scraper
		
		WP Travel Engine – Tour Booking Plugin – Tour Operator Software
		
			wp-travel-engine
		
		WPC Smart Wishlist for WooCommerce
		
			woo-smart-wishlist
		
WordPress Themes with Reported Vulnerabilities Last Week

		Software Name
		Software Slug
	
		Betheme
		
			betheme
		
		Newsup
		
			newsup
		
		Search &amp; Go - Directory WordPress Theme
		
			search-and-go
		
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

				Community Events &lt;= 1.5.1 - Unauthenticated SQL Injection
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-10587
					
						Patch Status
						Patched
					
						Published
						Oct 7, 2025
					
						Affected Software
						Community Events					
					
																				Researcher
							
								ifoundbug							
											
				More Details &gt;
			
				Community Events &lt;= 1.5.1 - Unauthenticated SQL Injection
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-10586
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						Community Events					
					
																				Researcher
							
								ifoundbug							
											
				More Details &gt;
			
				Ovatheme Events Manager &lt;= 1.8.5 - Unauthenticated Arbitrary File Upload
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-6553
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Ovatheme Events Manager					
					
																				Researcher
							
								Foxyyy							
											
				More Details &gt;
			
				Search &amp; Go - Directory WordPress Theme &lt;= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-11522
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						Search &amp; Go - Directory WordPress Theme					
					
																				Researcher
							
								khanhhnahk1							
											
				More Details &gt;
			
				WooCommerce Designer Pro &lt;= 1.9.26 - Unauthenticated Arbitrary File Deletion
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-6439
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WooCommerce Designer Pro					
					
																				Researcher
							
								Tonn							
											
				More Details &gt;
			
				WP Freeio &lt;= 1.2.21 - Unauthenticated Privilege Escalation
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-11533
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WP Freeio					
					
																				Researcher
							
								Foxyyy							
											
				More Details &gt;
			
				WP Travel Engine – Tour Booking Plugin – Tour Operator Software &lt;= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-7526
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						WP Travel Engine – Tour Booking Plugin – Tour Operator Software					
					
																				Researcher
							
								wesley (wcraft)							
											
				More Details &gt;
			
				WP Travel Engine – Tour Booking Plugin – Tour Operator Software &lt;= 6.6.7 - Unauthenticated Local File Inclusion
								9.8
							
							CVSS Rating
							Critical (9.8)
						
						CVE-ID
						CVE-2025-7634
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						WP Travel Engine – Tour Booking Plugin – Tour Operator Software					
					
																				Researcher
							
								wesley (wcraft)							
											
				More Details &gt;
			
				GSheetConnector For Gravity Forms &lt;= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-8593
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						GSheetConnector For Gravity Forms					
					
																				Researcher
							
								wesley (wcraft)							
											
				More Details &gt;
			
				Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme &lt;= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						CVE-2025-6038
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme					
					
																				Researcher
							
								Alyudin Nafiie							
											
				More Details &gt;
			
				Progress Planner &lt;= 1.8.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
								8.8
							
							CVSS Rating
							High (8.8)
						
						CVE-ID
						Unknown
					
						Patch Status
						Patched
					
						Published
						Oct 6, 2025
					
						Affected Software
						Progress Planner					
					
																				Researcher
							
								NumeX							
											
				More Details &gt;
			
				Motors – Car Dealership &amp; Classified Listings Plugin &lt;= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
								8.1
							
							CVSS Rating
							High (8.1)
						
						CVE-ID
						CVE-2025-10494
					
						Patch Status
						Patched
					
						Published
						Oct 7, 2025
					
						Affected Software
						Motors – Car Dealership &amp; Classified Listings Plugin					
					
																				Researcher
							
								Kishan Vyas							
											
				More Details &gt;
			
				Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers &lt;= 2.1.3 - Unauthenticated SQL Injection via 'id'
								7.5
							
							CVSS Rating
							High (7.5)
						
						CVE-ID
						CVE-2025-10862
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers					
					
																				Researcher
							
								Rafshanzani Suhada							
											
				More Details &gt;
			
				Cookie Notice &amp; Consent &lt;= 1.6.5 - Unauthenticated Stored Cross-Site Scripting
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-10496
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						Cookie Notice &amp; Consent					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login &lt;= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
								7.2
							
							CVSS Rating
							High (7.2)
						
						CVE-ID
						CVE-2025-11204
					
						Patch Status
						Patched
					
						Published
						Oct 7, 2025
					
						Affected Software
						RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login					
					
																				Researcher
							
								ifoundbug							
											
				More Details &gt;
			
				WP Scraper &lt;= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery
								6.8
							
							CVSS Rating
							Medium (6.8)
						
						CVE-ID
						CVE-2025-9975
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WP Scraper					
					
																				Researcher
							
								Valatty							
											
				More Details &gt;
			
				Slider Revolution &lt;= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-10249
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						Slider Revolution					
					
																				Researcher
							
								stealthcopter							
											
				More Details &gt;
			
				Welcart e-Commerce &lt;= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-10649
					
						Patch Status
						Patched
					
						Published
						Oct 7, 2025
					
						Affected Software
						Welcart e-Commerce					
					
																				Researcher
							
								Peter Thaleikis							
											
				More Details &gt;
			
				WP Links Page &lt;= 4.9.6 - Authenticated (Subscriber+) SQL Injection
								6.5
							
							CVSS Rating
							Medium (6.5)
						
						CVE-ID
						CVE-2025-10175
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WP Links Page					
					
																				Researcher
							
								Moose Love							
											
				More Details &gt;
			
				Betheme &lt;= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-9371
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						Betheme					
					
																				Researcher
							
								Zbigniew Piotrak							
											
				More Details &gt;
			
				Blocksy Companion &lt;= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						Unknown
					
						Patch Status
						Patched
					
						Published
						Oct 6, 2025
					
						Affected Software
						Blocksy Companion					
					
																				Researcher
							
								Rafshanzani Suhada							
											
				More Details &gt;
			
				Colibri Page Builder &lt;= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-9560
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Colibri Page Builder					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				Draft List &lt;= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-11197
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Draft List					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Easy Plugin Stats &lt;= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-7652
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Easy Plugin Stats					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				Enable Media Replace &lt;= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-9496
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Enable Media Replace					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				Featured Image from URL (FIFU) &lt;= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-7400
					
						Patch Status
						Patched
					
						Published
						Oct 6, 2025
					
						Affected Software
						Featured Image from URL (FIFU)					
					
																				Researcher
							
								Muhammad Yudha - DJ							
											
				More Details &gt;
			
				Stock History &amp; Reports Manager for WooCommerce &lt;= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-10167
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Stock History &amp; Reports Manager for WooCommerce					
					
																				Researcher
							
								zaim							
											
				More Details &gt;
			
				Ultimate Addons for WPBakery Page Builder &lt; 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-11814
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Ultimate Addons for WPBakery					
					
																				Researcher
							
								stealthcopter							
											
				More Details &gt;
			
				WordPress Live Webcam Widget &amp; Shortcode &lt;= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-10129
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WordPress Live Webcam Widget &amp; Shortcode					
					
																				Researcher
							
								Gilang - DJ							
											
				More Details &gt;
			
				WP Easy Toggles &lt;= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-10190
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WP Easy Toggles					
					
																				Researcher
							
								zaim							
											
				More Details &gt;
			
				WP JobHunt &lt;= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’
								6.4
							
							CVSS Rating
							Medium (6.4)
						
						CVE-ID
						CVE-2025-7781
					
						Patch Status
						Patched
					
						Published
						Oct 9, 2025
					
						Affected Software
						WP JobHunt					
					
																				Researcher
							
								meghnine islem							
											
				More Details &gt;
			
				Everest Backup &lt;= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure
								5.9
							
							CVSS Rating
							Medium (5.9)
						
						CVE-ID
						CVE-2025-11380
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Everest Backup – WordPress Cloud Backup, Migration, Restore &amp; Cloning Plugin					
					
																				Researcher
							
								netranger							
											
				More Details &gt;
			
				WP Go Maps (formerly WP Google Maps) &lt;= 9.0.46 - Cross-Site Request Forgery to Plugin Settings Update
								5.4
							
							CVSS Rating
							Medium (5.4)
						
						CVE-ID
						CVE-2025-11166
					
						Patch Status
						Patched
					
						Published
						Oct 8, 2025
					
						Affected Software
						WP Go Maps (formerly WP Google Maps)					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				WP JobHunt &lt;= 7.6 Authenticated (Custom+) Authorization Bypass
								5.4
							
							CVSS Rating
							Medium (5.4)
						
						CVE-ID
						CVE-2025-7374
					
						Patch Status
						Patched
					
						Published
						Oct 9, 2025
					
						Affected Software
						WP JobHunt					
					
																				Researcher
							
								meghnine islem							
											
				More Details &gt;
			
				AppExperts &lt;= 1.4.5 - Unauthenticated Sensitive Information Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-53218
					
						Patch Status
						Unpatched
					
						Published
						Oct 9, 2025
					
						Affected Software
						APPExperts – Mobile App Builder for WordPress | WooCommerce to iOS and Android Apps					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				Chartify – WordPress Chart Plugin &lt;= 3.5.9 - Missing Authentication for Administrative Function
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-11171
					
						Patch Status
						Patched
					
						Published
						Oct 7, 2025
					
						Affected Software
						Chartify – WordPress Chart Plugin					
					
																				Researchers
							
								Avraham ShemeshKai Aizen							
											
				More Details &gt;
			
				Code Quality Control Tool &lt;= 0.1 - Unauthenticated Information Exposure via Log Files
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-8484
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Code Quality Control Tool					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Trinity Audio &lt;= 5.21.0 - Unauthenticated Information Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-9196
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Trinity Audio – Text to Speech AI audio player to convert content into audio					
					
																				Researcher
							
								Moose Love							
											
				More Details &gt;
			
				WordPress All In One Login Plugin &lt;= 2.0.8 - IP Sooofing to Protection Mechanism Bypass
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-58595
					
						Patch Status
						Patched
					
						Published
						Oct 9, 2025
					
						Affected Software
						All In One Login — WP Admin Login Page Security and Customization with Google reCAPTCHA, Social Login, Limit Login Attempt, 2FA, and more.					
					
																				Researcher
							
								R1sky							
											
				More Details &gt;
			
				WP Gmail SMTP &lt;= 1.0.7 - Sensitive Information Exposure
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-53232
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WP Gmail SMTP					
					
																				Researcher
							
								Legion Hunter							
											
				More Details &gt;
			
				WP Reset &lt;= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-10645
					
						Patch Status
						Patched
					
						Published
						Oct 6, 2025
					
						Affected Software
						WP Reset					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				WPC Smart Wishlist for WooCommerce &lt;= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
								5.3
							
							CVSS Rating
							Medium (5.3)
						
						CVE-ID
						CVE-2025-11518
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WPC Smart Wishlist for WooCommerce					
					
																				Researcher
							
								Athiwat Tiprasaharn (Jitlada)							
											
				More Details &gt;
			
				Custom 404 Pro &lt;= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameter
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2025-9947
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Custom 404 Pro					
					
																				Researcher
							
								jamaal							
											
				More Details &gt;
			
				Error Log Viewer by BestWebSoft &lt;= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2025-9950
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Error Log Viewer by BestWebSoft					
					
																				Researcher
							
								Duc Manh							
											
				More Details &gt;
			
				My Auctions Allegro Plugin &lt;= 3.6.31 - Authenticated (Admin+) SQL Injection
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2025-10048
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						My auctions allegro					
					
																				Researcher
							
								tmrswrr							
											
				More Details &gt;
			
				NEX-Forms – Ultimate Forms Plugin for WordPress &lt;= 9.1.6 - Authenticated (Admin+) SQL Injection
								4.9
							
							CVSS Rating
							Medium (4.9)
						
						CVE-ID
						CVE-2025-10185
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						NEX-Forms – Ultimate Forms Plugin for WordPress					
					
																				Researcher
							
								dutafi							
											
				More Details &gt;
			
				CM Registration – Tailored tool for seamless login and invitation-based registrations &lt;= 2.5.6 - Open Redirect
								4.7
							
							CVSS Rating
							Medium (4.7)
						
						CVE-ID
						CVE-2025-11167
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						CM Registration – Tailored tool for seamless login and invitation-based registrations					
					
																				Researcher
							
								Jonas Benjamin Friedli							
											
				More Details &gt;
			
				Contest Gallery – Upload, Vote &amp; Sell with PayPal and Stripe &lt;= 27.0.3 - Unauthenticated CSV Injection
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-11254
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Contest Gallery – Upload, Vote &amp; Sell with PayPal and Stripe					
					
																				Researcher
							
								Aurélien BOURDOIS (Elymaro)							
											
				More Details &gt;
			
				Course Redirects for Learndash Plugin &lt;= 0.4 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-10376
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Course Redirects for Learndash Plugin					
					
																				Researcher
							
								Nabil Irawan							
											
				More Details &gt;
			
				Newsup &lt;= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-8682
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Newsup					
					
																				Researcher
							
								Dmitrii Ignatyev							
											
				More Details &gt;
			
				Page Blocks &lt;= 1.1.0 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-9626
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Page Blocks					
					
																				Researcher
							
								Sandeep Kambhampati							
											
				More Details &gt;
			
				Search &amp; Filter &lt;= 1.2.17 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-48099
					
						Patch Status
						Patched
					
						Published
						Oct 7, 2025
					
						Affected Software
						Search &amp; Filter					
					
																				Researcher
							
								gensho ni							
											
				More Details &gt;
			
				Web Accessibility By accessiBe &lt;= 2.10 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-10375
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						Web Accessibility by accessiBe					
					
																				Researcher
							
								Moose Love							
											
				More Details &gt;
			
				WidgetPack Comment System &lt;= 1.6.1 - Cross-Site Request Forgery
								4.3
							
							CVSS Rating
							Medium (4.3)
						
						CVE-ID
						CVE-2025-9621
					
						Patch Status
						Unpatched
					
						Published
						Oct 10, 2025
					
						Affected Software
						WidgetPack Comment System					
					
																				Researcher
							
								Sandeep Kambhampati							
											
				More Details &gt;
			
				GSheetConnector For Gravity Forms &lt;= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation
								2.4
							
							CVSS Rating
							Low (2.4)
						
						CVE-ID
						CVE-2025-8606
					
						Patch Status
						Patched
					
						Published
						Oct 10, 2025
					
						Affected Software
						GSheetConnector For Gravity Forms					
					
																				Researcher
							
								wesley (wcraft)							
											
				More Details &gt;
			
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
The post Wordfence Intelligence Weekly WordPress Vulnerability Report (October 6, 2025 to October 12, 2025) appeared first on Wordfence.
[messages.read_original_source] →