Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 17, 2025 to November 23, 2025)

🗓️ 26 Nov 2025 15:02:43Reported by Chloe ChamberlandType 
wordfence
 wordfence🔗 www.wordfence.com👁 54 Views

Weekly Wordfence Report: 140 vulnerabilities in WordPress plugins and theme; 58 researchers.

Related
ReporterTitlePublishedViews
Family
patchstack
Patchstack		WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty vulnerability
31 Dec 202500:00
–patchstack
patchstack
Patchstack		WordPress Padlet Shortcode plugin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
21 Nov 202522:47
–patchstack
patchstack
Patchstack		WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability
21 Nov 202523:12
–patchstack
patchstack
Patchstack		WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability
18 Nov 202511:09
–patchstack
patchstack
Patchstack		WordPress ArtiBot Free Chat Bot for WebSites plugin <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage vulnerability
17 Nov 202523:02
–patchstack
patchstack
Patchstack		WordPress Live sales notification for WooCommerce plugin <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure vulnerability
18 Nov 202504:44
–patchstack
patchstack
Patchstack		WordPress User Profile Builder plugin <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
18 Nov 202523:01
–patchstack
patchstack
Patchstack		WordPress EchBay Admin Security plugin <= 1.3.0 - Reflected Cross-Site Scripting vulnerability
24 Nov 202509:19
–patchstack
patchstack
Patchstack		WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability
21 Nov 202509:15
–patchstack
patchstack
Patchstack		WordPress SiteSEO – SEO Simplified plugin <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure vulnerability
18 Nov 202523:45
–patchstack
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
26 Nov 2025 15:02Current
8.4High risk
Vulners AI Score8.4
CVSS 3.17.5 - 9.8
EPSS0.02203
SSVC
vulnerability reportwordpress pluginswordpress themevulnerability databasefree toolswebhook integrationcommand line scannervulnerability researchers
54