Wordfence Intelligence Weekly WordPress Vulnerability Report (September 8, 2025 to September 14, 2025)

🗓️ 18 Sep 2025 14:42:05Reported by Chloe ChamberlandType

wordfence

wordfence🔗 www.wordfence.com👁 120 Views

Wordfence Intelligence weekly report (Sept 8–14, 2025) on WordPress plugin and theme vulnerabilities.

Reporter	Title	Published	Views	Family All 1052
Vulnrichment	CVE-2025-8570 BeyondCart Connector <= 2.1.0 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine_current_user Filter	11 Sep 202507:24	–	vulnrichment
Vulnrichment	CVE-2025-8575 LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'	12 Sep 202505:24	–	vulnrichment
Vulnrichment	CVE-2025-8686 WP Easy FAQs <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via WP_EASY_FAQ Shortcode	11 Sep 202507:24	–	vulnrichment
Vulnrichment	CVE-2025-8689 Elements Plus! <= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets	11 Sep 202507:24	–	vulnrichment
Vulnrichment	CVE-2025-8691 WP Scriptcase <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter	11 Sep 202507:25	–	vulnrichment
Vulnrichment	CVE-2025-8692 Coupon API <= 6.2.12 - Authenticated (Administrator+) SQL Injection via 'log_duration'	11 Sep 202507:24	–	vulnrichment
Vulnrichment	CVE-2025-8721 Workable API <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via workable_jobs Shortcode	11 Sep 202507:24	–	vulnrichment
Vulnrichment	CVE-2025-8778 NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function	10 Sep 202506:38	–	vulnrichment
Vulnrichment	CVE-2025-9018 Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion	11 Sep 202511:15	–	vulnrichment
Vulnrichment	CVE-2025-9058 Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	9 Sep 202505:25	–	vulnrichment

18 Sep 2025 14:42Current

8.8High risk

Vulners AI Score8.8

CVSS 3.19.8

EPSS0.00746

SSVC

Wordfence Intelligence WordPress plugins WordPress themes vulnerability report vulnerability database vulnerability researchers