Weekly WordPress Vulnerability Report - Week 40

Summary of the Wordfence Intelligence Weekly WordPress Vulnerability Report (September 29 to October 5, 2025):

93 vulnerabilities reported: 83 in plugins, 2 in WordPress themes.
27 vulnerabilities were patched; 66 remain unpatched.
Severity breakdown: 1 low, 73 medium, 11 high, 8 critical.
Main vulnerability types:
- Cross-site scripting (XSS): 42 cases
- Cross-Site Request Forgery (CSRF): 17
- SQL Injection: 6
- Authorization failure: 5
- Others (including unsafe file upload, authentication bypass, sensitive data exposure)
Critical highlights:
- Plugins such as Appy Pie Connect for WooCommerce, Copypress Rest API, RestroPress, and others with CVSS 9.8 (critical). Many still lack patches.
Special initiatives:
- Vulnerability bounty program running until November 24.
- Expanded scope for LFI (Local File Inclusion) research.
Tools: Wordfence CLI, API, and integrations for free monitoring.
38 security researchers contributed; top contributors are identified in the report.
Detailed list of affected plugins and themes is available, including popular examples like AffiliateWP, GiveWP, OAuth Single Sign-On, WPRecovery, LatePoint, and more.

The report stresses the importance of timely updates and active vulnerability monitoring to help keep WordPress sites secure.wordfence

View full report for WordPress security:

https://www.wordfence.com/blog/2025/10/wordfence-intelligence-weekly-wordpress-vulnerability-report-september-29-2025-to-october-5-2025/

Frequent Questions

Do I need WordPress maintenance services?

If you run a small or medium-sized business, the answer is yes. It saves you time, reduces operational costs, and keeps your site running smoothly without draining internal resources. For larger companies, outsourcing WordPress maintenance helps streamline teams and boost shareholder value through greater efficiency.
What is the cost of WordPress website maintenance?

Our WP Maxify service offers straightforward, transparent pricing: 49 € per site/month, or 490 € per site/year (save 2 months). For businesses needing enhanced protection, we also offer a High-Security option at 749 € per site/year (no monthly option available).
Do you offer refunds?

We do not offer refunds. Once a plan is purchased, services are provided for the full period. You may cancel your subscription at any time before the next billing cycle to avoid further charges. That said, we’re confident you’ll be fully satisfied with the value and reliability of our service.
Do you offer phone or livechat support?

Not at the moment. We only offer support via email and there is no limit on how many support questions you can ask.
Do you have a white-label program for agencies?

Yes we do! We offer white-label packs for 10, 50 and 100 sites at a special price. We configure a support @youragency.com email addresses to our help desk software so we can manage any questions and requests in you agency name. All reports sent to your clients will have your agency name and logo. We keep payment completely separate so as to maintain the white-label aspect of our support.

Have more questions? See all FAQ.

Weekly WordPress Vulnerability Report – Week 40

View full report for WordPress security:

We leave no questions answered

Frequent Questions

Do I need WordPress maintenance services?

What is the cost of WordPress website maintenance?

Do you offer refunds?

Do you offer phone or livechat support?

Do you have a white-label program for agencies?