The WordPress Vulnerability Report released on April 2, 2025, by SolidWP revealed a significant surge in security issues affecting plugins and themes. With 542 vulnerabilities identified—spanning 520 plugins and 22 themes—this comprehensive report serves as a serious warning for WordPress site owners and administrators.
A Surge in Security Threats
Out of the total reported vulnerabilities, 275 plugins and themes remain unpatched, leaving thousands of websites exposed to potential attacks. This reinforces the importance of active maintenance, routine updates, and strong security protocols across the WordPress ecosystem.
Hidden Malware Targeting MU-Plugins
A new wave of WordPress malware, uncovered by Sucuri researchers in March 2025, reveals a dangerous evolution in attack methods. Threat actors are now embedding malicious code within the mu-plugins (must-use plugins) directory, which loads plugins automatically and isn’t visible in the standard WordPress dashboard.
Key Findings:
- Redirect Malware was discovered in redirect.php, silently sending users to external, malicious websites.
- Webshells placed in index.php gave attackers remote control and allowed arbitrary PHP execution.
- Spam Injectors in custom-js-loader.php were used to stuff websites with keyword-heavy spam, likely to manipulate SEO.
These infections are hard to detect and remove because the mu-plugins directory is not typically checked by most users or security tools. The presence of files with misleading names, sudden redirections, and increased server load may signal such an infection.
Fake Cloudflare Verification and LummaStealer Trojan
Another Sucuri report from March 2025 highlights an alarming phishing campaign involving a fake Cloudflare verification page. This scheme prompts users to download a malicious file, which installs the LummaStealer Trojan—a credential-harvesting malware known to exfiltrate browser cookies, saved passwords, and session tokens.
Once infected:
- Admin credentials and cookies are stolen.
- Session hijacking becomes possible, even without password access.
- Attackers can bypass MFA if a session is live.
This malware is distributed through compromised websites using social engineering tactics. Users are shown a deceptive Cloudflare “human verification” prompt, encouraging them to download what appears to be a browser patch.
Highlighted Vulnerable Plugins
Here’s a snapshot of some notable plugins listed in the April 2025 report. All of these currently have no fixes available, posing significant risks to any sites that use them.
# | Plugin Name | Active Installations | Vulnerability Type | Patched Version | Severity Level |
1 | Themesflat Addons For Elementor | 40,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
2 | OSM – OpenStreetMap | 10,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
3 | WPCargo Track & Trace | 10,000+ | Insecure Direct Object References (IDOR) | No Fix | Medium |
4 | IMPress for IDX Broker | 7,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
5 | Flag Icons | 5,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
6 | Gallery – Photo Albums Plugin | 2,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
7 | Quick Interest Slider | 2,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
8 | teachPress | 2,000+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
9 | Directory Listings WordPress plugin – uListing | 2,000+ | Privilege Escalation | No Fix | High |
10 | Cryptocurrency Widgets Pack | 1,000+ | Broken Access Control | No Fix | Medium |
11 | Swiss Toolkit For WP | 1,000+ | Broken Access Control | No Fix | Medium |
12 | Price by Quantity & Bulk Quantity Discounts for WooCommerce | 1,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
13 | Simple Owl Carousel | 700+ | Cross Site Scripting (XSS) | No Fix | Medium |
14 | StaticPress | 700+ | Broken Access Control | No Fix | Medium |
15 | Google SEO Pressor for Rich snippets | 600+ | Broken Access Control | No Fix | Medium |
16 | My auctions allegro | 600+ | SQL Injection | No Fix | High |
17 | TGG – WP Optimizer | 600+ | Cross Site Scripting (XSS) | No Fix | Medium |
18 | Uptime Robot Plugin for WordPress | 600+ | SQL Injection | No Fix | High |
19 | ACME Divi Modules | 500+ | Broken Access Control | No Fix | Medium |
20 | CF7 Spreadsheets | 500+ | Settings Change | No Fix | Medium |
21 | EZ SQL Reports Shortcode Widget and DB Backup | 500+ | Cross Site Request Forgery (CSRF) | No Fix | Critical |
22 | Flipdish Ordering System | 500+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
23 | Appointify | 400+ | Arbitrary File Upload | No Fix | Medium |
24 | Advanced WooCommerce Product Sales Reporting – Statistics & Forecast | 400+ | SQL Injection | No Fix | Critical |
25 | SimplyRETS Real Estate IDX | 300+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
26 | Connector to CiviCRM with CiviMcRestFace | 200+ | Broken Access Control | No Fix | Medium |
27 | Ni WooCommerce Product Enquiry | 200+ | Broken Access Control | No Fix | High |
28 | Welcome Popup | 200+ | Cross Site Scripting (XSS) | No Fix | Medium |
29 | Related Posts Widget with Thumbnails | 100+ | Cross Site Request Forgery (CSRF) | No Fix | High |
30 | CBX Poll | 100+ | PHP Object Injection | No Fix | Critical |
31 | CookieHint WP | 100+ | Cross Site Scripting (XSS) | No Fix | Medium |
32 | WordPress Testimonials Slider | 100+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
33 | WordPress Testimonials Slider | 100+ | Broken Access Control | No Fix | Medium |
34 | Shopper – Affiliate Link Management, 25000+ Brand Partnerships & Creative Product Displays | 100+ | SQL Injection | No Fix | Critical |
35 | SP Blog Designer | 100+ | Broken Access Control | No Fix | Medium |
36 | AB Google Map Travel (AB-MAP) | 90+ | Cross Site Request Forgery (CSRF) | No Fix | High |
37 | CoverManager | 80+ | Cross Site Scripting (XSS) | No Fix | Medium |
38 | wordpress related Posts with thumbnails | 80+ | Cross Site Request Forgery (CSRF) | No Fix | High |
39 | Ultimate Push Notifications ( Mobile / Desktop ), Receive Notification From WooCommerce, BuddyPress, WordPress Default Events & Many More | 80+ | SQL Injection | No Fix | High |
40 | PostmarkApp Email Integrator | 70+ | Cross Site Request Forgery (CSRF) | No Fix | High |
41 | Rich Text Editor | 70+ | Cross Site Request Forgery (CSRF) | No Fix | High |
42 | Actionwear products sync | 60+ | SQL Injection | No Fix | High |
43 | Processing Projects | 60+ | Cross Site Scripting (XSS) | No Fix | Medium |
44 | Chat by Chatwee | 50+ | Broken Access Control | No Fix | Medium |
45 | Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme | 50+ | Cross Site Scripting (XSS) | No Fix | Medium |
46 | Salesmate Add-On for Gravity Forms | 40+ | Broken Access Control | No Fix | Medium |
47 | AdSense Privacy Policy | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
48 | Advanced Post Search | N/A | Cross Site Scripting (XSS) | No Fix | High |
49 | Alert Box Block – Display notice/alerts in the front end | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
50 | Amazing service box Addons For WPBakery Page Builder | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
51 | Arrow Maps | N/A | Cross Site Scripting (XSS) | No Fix | High |
52 | ARPrice | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
53 | AvaiBook | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
54 | Ayyash Studio | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
55 | Beautiful Link Preview | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
56 | BMo Expo | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
57 | Browser Address Bar Color | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
58 | Cackle | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
59 | CAS Maestro | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
60 | Contact Form 7 Material Design | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
61 | Clink | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
62 | Menu Duplicator | N/A | Broken Access Control | No Fix | Medium |
63 | cTabs | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
64 | Custom Script Integration | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
65 | Driving Directions | N/A | Cross Site Scripting (XSS) | No Fix | High |
66 | Product Catalog | N/A | SQL Injection | No Fix | Critical |
67 | Multi Days Events and Multi Events in One Day Calendar | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
68 | Duplicate Page and Post | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
69 | Exit Popup Free | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
70 | Secret Meta | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
71 | Fix Rss Feeds | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
72 | Flickr set slideshows | N/A | SQL Injection | No Fix | High |
73 | Frndzk Expandable Bottom Bar | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
74 | GMO Font Agent | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
75 | GP Back To Top | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
76 | IG Shortcodes | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
77 | Image Slider / Slideshow Pearlbells | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
78 | include-file | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
79 | Include URL | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
80 | issuuPress | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
81 | jQuery Dropdown Menu | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
82 | Key4ce osTicket Bridge | N/A | Cross Site Scripting (XSS) | No Fix | High |
83 | LH OGP Meta | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
84 | Login Alert | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
85 | LWS SMS | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
86 | Message ticker | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
87 | Mobile Navigation | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
88 | My Bootstrap Menu | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
89 | NanoSupport | N/A | Broken Access Control | No Fix | Medium |
90 | NextGEN Gallery Voting | N/A | Cross Site Scripting (XSS) | No Fix | High |
91 | Easy 301 Redirects | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
92 | Omnify | N/A | Cross Site Scripting (XSS) | No Fix | High |
93 | OSS Upload | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
94 | Pesapal Gateway for Woocommerce | N/A | Cross Site Scripting (XSS) | No Fix | High |
95 | PostMash | N/A | SQL Injection | No Fix | Critical |
96 | Pro Rank Tracker | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
97 | Related Posts via Categories | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
98 | Rewrite | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
99 | SH Email Alert | N/A | Cross Site Scripting (XSS) | No Fix | High |
100 | Shuffle | N/A | SQL Injection | No Fix | High |
101 | Simple Rating | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
102 | Simple:Press | N/A | Broken Access Control | No Fix | Medium |
103 | So-Called Air Quotes | N/A | Content Injection | No Fix | High |
104 | SoundCloud Ultimate | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
105 | SpeakPipe | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
106 | Super Simple Subscriptions | N/A | SQL Injection | No Fix | High |
107 | Teleport | N/A | Cross Site Scripting (XSS) | No Fix | High |
108 | Text Selection Color | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
109 | Tidekey | N/A | Cross Site Scripting (XSS) | No Fix | High |
110 | Trackserver | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
111 | Typekit plugin for WordPress | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
112 | Ultimate Security Checker | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
113 | Video Embedder | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
114 | wA11y – The Web Accessibility Toolbox | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
115 | Weather Layer | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
116 | WordPress SQL Backup | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
117 | WP Church Donation | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
118 | WP Database Optimizer | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
119 | WP e-Commerce Style Email | N/A | Cross Site Request Forgery (CSRF) | No Fix | Critical |
120 | WP Featured Entries | N/A | SQL Injection | No Fix | High |
121 | Job Colors for WP Job Manager | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
122 | WP Odoo Form Integrator | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
123 | WP Parallax Content Slider | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
124 | WP Profitshare | N/A | SQL Injection | No Fix | High |
125 | WP Social Widget | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
126 | WP Ultimate Search | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
127 | WordPres ???? | N/A | Cross Site Request Forgery (CSRF) | No Fix | High |
128 | XV Random Quotes | N/A | SQL Injection | No Fix | Critical |
129 | Yummly Rich Recipes | N/A | Cross Site Request Forgery (CSRF) | No Fix | Medium |
130 | ElementsKit Elementor Addons and Templates | 1,000,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
131 | Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN | 1,000,000+ | Directory Traversal | No Fix | Medium |
132 | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | 600,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
133 | Happy Addons for Elementor | 400,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
134 | Translate Multilingual sites – TranslatePress | 300,000+ | PHP Object Injection | No Fix | High |
135 | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 200,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
136 | Pods – Custom Content Types and Fields | 100,000+ | SQL Injection | No Fix | High |
137 | The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid | 100,000+ | Local File Inclusion | No Fix | High |
138 | Kubio AI Page Builder | 90,000+ | Local File Inclusion | No Fix | Critical |
139 | PowerPack Elementor Addons (Free Widgets, Extensions and Templates) | 90,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
140 | Product Import Export for WooCommerce – Import Export Product CSV Suite | 90,000+ | Server Side Request Forgery (SSRF) | No Fix | Medium |
141 | Nested Pages | 90,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
142 | Advanced Woo Search | 70,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
143 | Media Library Assistant | 70,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
144 | Drag and Drop Multiple File Upload for Contact Form 7 | 60,000+ | Arbitrary File Deletion | No Fix | High |
145 | User Registration & Membership – Custom Registration Form, Login Form, and User Profile | 60,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
146 | Export and Import Users and Customers | 60,000+ | Arbitrary File Download | No Fix | Low |
147 | Export and Import Users and Customers | 60,000+ | Arbitrary File Deletion | No Fix | Low |
148 | Advanced iFrame | 50,000+ | Broken Access Control | No Fix | Medium |
149 | Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | 50,000+ | Sensitive Data Exposure | No Fix | Medium |
150 | Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website | 50,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
151 | Ultimate Blocks – WordPress Blocks Plugin | 50,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
152 | Greenshift – animation and page builder blocks | 40,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
153 | Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker | 40,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
154 | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX | 40,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
155 | Cost Calculator Builder | 30,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
156 | LeadConnector | 30,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
157 | Ads by WPQuads – Adsense Ads, Banner Ads, Popup Ads | 30,000+ | SQL Injection | No Fix | Critical |
158 | Analytify – Google Analytics Dashboard For WordPress (GA4 analytics made easy) | 30,000+ | Settings Change | No Fix | Medium |
159 | Conversios: Google Analytics GA4, Google Ads, GTM & Multiple Pixel Tracking | 20,000+ | Broken Access Control | No Fix | Medium |
160 | InstaWP Connect – 1-click WP Staging & Migration | 20,000+ | Local File Inclusion | No Fix | High |
161 | Slider by 10Web – Responsive Image Slider | 20,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
162 | SyntaxHighlighter Evolved | 20,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
163 | FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce | 20,000+ | SQL Injection | No Fix | Critical |
164 | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | 20,000+ | Local File Inclusion | No Fix | High |
165 | Import Export Suite for CSV and XML Datafeed | 20,000+ | Arbitrary File Deletion | No Fix | High |
166 | Product Labels For Woocommerce (Sale Badges) | 10,000+ | SQL Injection | No Fix | High |
167 | Webhook Automator & Contact Form Integration to Automate 280+ Platforms – Bit Integrations | 10,000+ | Open Redirection | No Fix | Medium |
168 | Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings | 10,000+ | Broken Access Control | No Fix | Medium |
169 | Social Reviews & Recommendations | 10,000+ | Broken Access Control | No Fix | Medium |
170 | Job Postings | 10,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
171 | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | 10,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
172 | Sensei LMS – Online Courses, Quizzes, & Learning | 10,000+ | Broken Access Control | No Fix | Medium |
173 | WP Tabs – Responsive Tabs and Custom Product Tabs | 10,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
174 | Chat Widget: Customer Support Button with SMS Call Button, Click to Chat Messenger, Live Chat Support Chat Button – Bit Assist | 9,000+ | Path Traversal | No Fix | High |
175 | Essential Real Estate | 9,000+ | Local File Inclusion | No Fix | High |
176 | WP Compress – Instant Performance & Speed Optimization | 9,000+ | Broken Access Control | No Fix | High |
177 | Awesome Support – WordPress HelpDesk & Support Plugin | 8,000+ | Sensitive Data Exposure | No Fix | High |
178 | Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin | 8,000+ | Local File Inclusion | No Fix | High |
179 | WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting | 7,000+ | Broken Access Control | No Fix | Medium |
180 | JS Help Desk – The Ultimate Help Desk & Support Plugin | 7,000+ | SQL Injection | No Fix | Critical |
181 | JS Help Desk – The Ultimate Help Desk & Support Plugin | 7,000+ | Arbitrary File Deletion | No Fix | High |
182 | Shipmondo – A complete shipping solution for WooCommerce | 7,000+ | Sensitive Data Exposure | No Fix | Medium |
183 | Quiz Cat – WordPress Quiz Plugin | 6,000+ | Broken Access Control | No Fix | Low |
184 | Audio Album | 5,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
185 | AliExpress Dropshipping Plugin for WooCommerce – AliNext | 4,000+ | Open Redirection | No Fix | Medium |
186 | Inline Image Upload for BBPress | 4,000+ | Arbitrary File Upload | No Fix | High |
187 | WP Posts Carousel | 4,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
188 | Chartify – WordPress Chart Plugin | 3,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
189 | Newsletters | 3,000+ | SQL Injection | No Fix | High |
190 | Themify Event Post | 3,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
191 | Tickera – WordPress Event Ticketing | 3,000+ | Broken Access Control | No Fix | Medium |
192 | WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg | 2,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
193 | Active Products Tables for WooCommerce. Use constructor to create tables | 2,000+ | Content Injection | No Fix | High |
194 | Sitekit | 2,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
195 | The Pack Elementor addons (Header Footer & WooCommerce Builder, Template Library) | 2,000+ | Local File Inclusion | No Fix | High |
196 | Vitepos – Point of sale (POS) plugin for WooCommerce | 2,000+ | Broken Authentication | No Fix | High |
197 | Currency Switcher for WooCommerce | 1,000+ | Cross Site Request Forgery (CSRF) | No Fix | High |
198 | Dr. Flex | 1,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
199 | Taxi Booking Manager for WooCommerce – WordPress plugin | Ecab | 1,000+ | Broken Access Control | No Fix | Medium |
200 | Event Tickets with Ticket Scanner | 1,000+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
201 | WP Fast Total Search – The Power of Indexed Search | 1,000+ | Broken Access Control | No Fix | Medium |
202 | Just Writing Statistics | 1,000+ | Broken Access Control | No Fix | Medium |
203 | Off-Canvas Sidebars & Menus (Slidebars) | 1,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
204 | SearchIQ – The Search Solution | 1,000+ | Cross Site Scripting (XSS) | No Fix | Medium |
205 | SKU Generator for WooCommerce | 1,000+ | Cross Site Scripting (XSS) | No Fix | High |
206 | WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly | 1,000+ | Local File Inclusion | No Fix | High |
207 | WP Docs | 1,000+ | Broken Access Control | No Fix | Medium |
208 | The Ultimate WordPress Toolkit – WP Extended | 1,000+ | Cross Site Scripting (XSS) | No Fix | High |
209 | 3DPrint Lite | 900+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
210 | Football Pool | 900+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
211 | RPS Include Content | 900+ | Cross Site Scripting (XSS) | No Fix | Medium |
212 | Usermaven | 900+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
213 | Leaky Paywall | 800+ | Cross Site Scripting (XSS) | No Fix | Medium |
214 | Cloudflare Turnstile or reCAPTCHA For any Pages, to Block Spam and Hackers Attack. | 800+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
215 | TWB Woocommerce Reviews | 800+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
216 | WooCommerce Fattureincloud | 800+ | Cross Site Scripting (XSS) | No Fix | High |
217 | WP Compress for MainWP | 800+ | Server Side Request Forgery (SSRF) | No Fix | Medium |
218 | Custom Fields Account Registration For Woocommerce | 700+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
219 | Custom Login Logo | 700+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
220 | PDF for WPForms + Drag and Drop Template Builder | 700+ | Broken Access Control | No Fix | Medium |
221 | Stock Sync for WooCommerce with Google Sheets | WooCommerce Bulk Edit, Stock Management, Inventory Management System & more – FlexStock | 700+ | SQL Injection | No Fix | High |
222 | wpShopGermany IT-RECHT KANZLEI | 700+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
223 | Digital License Manager | 600+ | Cross Site Scripting (XSS) | No Fix | High |
224 | Simple Giveaways – Grow your business, email lists and traffic with contests | 600+ | SQL Injection | No Fix | High |
225 | Cool Author Box – For Widget and Post Content | 600+ | Broken Access Control | No Fix | Medium |
226 | jAlbum Bridge | 600+ | Cross Site Scripting (XSS) | No Fix | Medium |
227 | Listamester | 600+ | Cross Site Scripting (XSS) | No Fix | Medium |
228 | Simplebooklet PDF Viewer and Embedder | 600+ | Cross Site Scripting (XSS) | No Fix | Medium |
229 | Textmetrics | 600+ | Broken Access Control | No Fix | Medium |
230 | Zoho Billing – Embed Payment Form | 600+ | Cross Site Scripting (XSS) | No Fix | Medium |
231 | Christmas Panda | 500+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
232 | Comment Approved Notifier Extended | 500+ | Cross Site Scripting (XSS) | No Fix | Medium |
233 | EZ SQL Reports Shortcode Widget and DB Backup | 500+ | Cross Site Request Forgery (CSRF) | No Fix | High |
234 | Hesabfa Accounting | 500+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
235 | Subscribe to Download Lite – Download after Email Subscription Form WordPress Plugin | 500+ | Local File Inclusion | No Fix | High |
236 | Chatbox Manager | 500+ | Broken Access Control | No Fix | Medium |
237 | WordPress WP-Advanced-Search | 500+ | Cross Site Scripting (XSS) | No Fix | Medium |
238 | WP Subscription Forms – Subscription Form Plugin for WordPress | 500+ | SQL Injection | No Fix | High |
239 | Administrator Z | 400+ | Broken Access Control | No Fix | High |
240 | Support Genix – Helpdesk & Customer Support Ticket System | 400+ | Insecure Direct Object References (IDOR) | No Fix | Medium |
241 | About Author | 300+ | Cross Site Scripting (XSS) | No Fix | High |
242 | Gift Message for WooCommerce | 300+ | Cross Site Request Forgery (CSRF) | No Fix | Medium |
243 | CM Download Manager – Simplify file sharing with powerful download management | 200+ | Arbitrary File Deletion | No Fix | High |
244 | Image Wall | 200+ | Cross Site Scripting (XSS) | No Fix | High |
245 | Cart tracking for WooCommerce | 100+ | SQL Injection | No Fix | High |
246 | DICOM Support | 100+ | Cross Site Scripting (XSS) | No Fix | Medium |
247 | WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | 100+ | Cross Site Scripting (XSS) | No Fix | High |
248 | MDJM Event Management | 90+ | PHP Object Injection | No Fix | High |
249 | Material Dashboard | 80+ | Privilege Escalation | No Fix | Critical |
250 | Hostel | 50+ | Cross Site Scripting (XSS) | No Fix | High |
251 | BizCalendar Web | 30+ | SQL Injection | No Fix | High |
252 | MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet | 30+ | Cross Site Scripting (XSS) | No Fix | Medium |
253 | Bitspecter Suite | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
254 | Bridge Core | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
255 | Fusion Builder | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
256 | JetSearch | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
257 | JetWooBuilder | N/A | Local File Inclusion | No Fix | High |
258 | Smart Maintenance Mode | N/A | Cross Site Scripting (XSS) | No Fix | Medium |
259 | tagDiv Composer | N/A | Cross Site Scripting (XSS) | No Fix | High |
Why This Matters for Your Website
In addition to plugin vulnerabilities, new malware tactics like MU-plugin abuse and fake verification trojans present serious risks to website health and user data.
Consequences Include:
- Security Breaches: Full site takeover or database manipulation.
- SEO Damage: Spam content and redirects can tank your rankings.
- User Trust Loss: Breaches erode confidence in your brand and lead to high bounce rates or blacklisting.
What You Should Do Next
- Update Everything – Apply plugin/theme/core updates regularly.
- Audit Installed Plugins – Remove anything unmaintained or suspicious.
- Scan for Malware – Especially check the mu-plugins folder.
- Install a Firewall & Monitoring Tool – Prevent reinfection and monitor threats.
- Avoid Suspicious Downloads – Never download browser “updates” or plugins from unknown prompts.
- Back Up Frequently – Use automated off-site backups.
Conclusion
The WordPress ecosystem continues to evolve, but so do the threats targeting it. The April 2025 vulnerability report, paired with alarming malware trends like hidden MU-plugin infections and fake verification trojans, makes one thing clear: proactive website security is no longer optional—it’s essential.
Ignoring plugin updates, skipping regular scans, or underestimating phishing tactics can lead to serious consequences—from data theft to blacklisting in search engines. WordPress site owners must prioritize both technical maintenance and strategic security planning to stay ahead of these threats.
Get Expert Help!
Securing your WordPress site is not just about preventing hacks—it’s also about building a trustworthy, high-performing online presence.
If you need help assessing vulnerabilities, optimizing your site for speed and security, or improving your visibility in search engines, the experts at SEO Guru Atlanta are here to help. With deep experience in WordPress development, security, and SEO strategy, their team provides tailored solutions to keep your site fast, safe, and ranking higher in Google.
