Wordfence Intelligence Weekly WordPress Vulnerability Report (October 6, 2025 to October 12, 2025)

🗓️ 16 Oct 2025 16:22:31Reported by Chloe ChamberlandType

Wordfence Intelligence reports 55 vulnerabilities in plugins and themes; large bounties and expanded local file inclusion scope.

Reporter	Title	Published	Views	Family All 1056
Vulnrichment	CVE-2025-60041 WordPress Emails Catch All plugin <= 3.5.3 - Broken Authentication vulnerability	22 Oct 202514:32	–	vulnrichment
Vulnrichment	CVE-2025-60246 WordPress Simple Finance Calculator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability	22 Oct 202514:32	–	vulnrichment
Vulnrichment	CVE-2025-6038 Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation	9 Oct 202503:23	–	vulnrichment
Vulnrichment	CVE-2025-62029 WordPress Grevo theme <= 2.4 - Local File Inclusion vulnerability	22 Oct 202514:32	–	vulnrichment
Vulnrichment	CVE-2025-62031 WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability	6 Nov 202515:55	–	vulnrichment
Vulnrichment	CVE-2025-62033 WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability	6 Nov 202515:55	–	vulnrichment
Vulnrichment	CVE-2025-62034 WordPress Togo theme < 1.0.4 - Privilege Escalation vulnerability	6 Nov 202515:55	–	vulnrichment
Vulnrichment	CVE-2025-62035 WordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability	6 Nov 202515:55	–	vulnrichment
Vulnrichment	CVE-2025-62036 WordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerability	6 Nov 202515:55	–	vulnrichment
Vulnrichment	CVE-2025-62037 WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability	6 Nov 202515:55	–	vulnrichment

16 Oct 2025 16:22Current

8.4High risk

Vulners AI Score8.4

CVSS 3.19.8

EPSS0.01273

SSVC