Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 17, 2025 to November 23, 2025)

🗓️ 26 Nov 2025 15:02:43Reported by Chloe ChamberlandType 
wordfence
 wordfence🔗 www.wordfence.com👁 24 Views

Weekly Wordfence Report: 140 vulnerabilities in WordPress plugins and theme; 58 researchers.

Related
ReporterTitlePublishedViews
Family
Packet Storm		📄 WordPress WP Directory Kit 1.4.3 Unauthenticated Blind SQL Injection
21 Jul 202600:00
–packetstorm
Packet Storm		📄 WordPress Enable SVG, WebP and ICO Upload 1.1.2 Shell Upload
21 Jul 202600:00
–packetstorm
Patchstack		WordPress WP Directory Kit plugin <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function vulnerability
21 Nov 202521:24
–patchstack
Patchstack		WordPress CSV to SortTable plugin <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
17 Nov 202522:51
–patchstack
Patchstack		WordPress Enable SVG, WebP, and ICO Upload plugin <= 1.1.2 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass vulnerability
18 Nov 202504:46
–patchstack
Patchstack		WordPress WP Duplicate Page plugin <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure vulnerability
18 Nov 202504:48
–patchstack
Patchstack		WordPress Return Refund and Exchange For WooCommerce plugin <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read vulnerability
21 Nov 202522:19
–patchstack
Patchstack		WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty vulnerability
31 Dec 202500:00
–patchstack
Patchstack		WordPress Padlet Shortcode plugin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
21 Nov 202522:47
–patchstack
Patchstack		WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability
21 Nov 202523:12
–patchstack
Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
26 Nov 2025 15:02Current
8.4High risk
Vulners AI Score8.4
CVSS 3.17.5 - 9.8
EPSS0.02203
SSVC
vulnerability reportwordpress pluginswordpress themevulnerability databasefree toolswebhook integrationcommand line scannervulnerability researchers
24