WP Security CVE APR 2025: 34 Public Plugin Risks

By Csaba, Miklós WP Security WP SERVICES 21 April 2025

WP SECURITY CVE APR 2025

WP Security CVE APR 2025

Be informed about the latest reported WP Security Plugin Vulnerabilities. WP Security CVE APR 2025 is a -17% DECREASE, compared to last month. Consider for your online safety, a WP/Woo Security AUDIT, – OR – switching with a TOP10LIST alternative WP Security Plugin – OR – Hire us for your recurrent needs of managed WordPress Security and managed WooCommerce Security.

What is CVE?

TLDR: the details on how to hack a specific software is made public, forcing the vendor to provide a solution (patch or upgrade), that closes that specific WP Security CVE APR 2025 vulnerability.

CVE is short for Common Vulnerabilities and Exposures. The Common Vulnerabilities and Exposures (CVE) system provides a reference method for publicly known information-security vulnerabilities and exposures. Read more on wikipedia.org: Common Vulnerabilities and Exposures, Common Vulnerability Scoring System, Common Weakness Enumeration.

Patch today the publicly reported cases of WP Security CVE APR 2025 BEFORE IT’S TOO LATE! You will also protect your customers, your reputation and your online business!

BUY NOW

If you are serious about your business, then you need to pay attention to the WordPress security best practices. The following cases made headlines PUBLICLY just last month in the WP Security CVE APR 2025 category:

Admin and Site Enhancements (ASE)	Limit Login Attempt Bypass (BAC) from IP Spoofing
Administrator Z	Missing Authorization (BAC) to Options Update (BAC)
Advanced iFrame	Cross-Site Scripting (XSS)
Advanced iFrame	Unauthenticated Settings Update (BAC)
Age Gate	Unauthenticated Local PHP File Inclusion from 'lang'
Allow PHP Execute	PHP Code Injection
Clearout Email Validator	Cross-Site Scripting (XSS)
Contact Form & SMTP Plugin	Cross-Site Scripting (XSS)
Hacklog Remote Image Autosave	Cross-Site Request Forgery (CSRF)
Hide My WP Ghost	Local File Inclusion (LFi) to Remote Code Execution (RCE)
Image Captcha	Cross-Site Request Forgery (CSRF) to Private Settings Change (BAC)
IP Based Login	Cross-Site Scripting (XSS)
IP Based Login	Log Deletion (BAC) from Cross-Site Request Forgery (CSRF)
IP Locator	Cross-Site Scripting (XSS)
Login Alert	Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS)
Login Logger	Cross-Site Request Forgery (CSRF)
LoginPress	Cross-Site Request Forgery (CSRF) and Options Update (BAC)
Login Redirect	Cross-Site Scripting (XSS)
Members page only for logged in users	Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS)
No Disposable Email	Cross-Site Request Forgery (CSRF) to Cross-Site Scripting (XSS)
Post SMTP	SQL Injection (SQLi) from columns Parameter
RDP inGroups+	Cross-Site Scripting (XSS)
RDP Linkedin Login	Cross-Site Scripting (XSS)
ReportAttacks	SQL Injection (SQLi)
Secure Copy Content Protection and Content Locking	Missing Authorization (BAC) to Unauthenticated User Email Retrieval from ays_sccp_reports_user_search Function
SH Email Alert	Cross-Site Scripting (XSS)
SMTP by BestWebSoft	File Upload (BAC)
Tabbed Login Widget	Cross-Site Scripting (XSS)
User Registration	Cross-Site Scripting (XSS)
User Registration	Unauthenticated Privilege Escalation (BAC)
WP Activity Log	PHP Object Injection (RCE)
WP Database Audit	Cross-Site Scripting (XSS)
WP Login Control	Cross-Site Scripting (XSS)
WP Login Control	Cross-Site Scripting (XSS)

WordPress Security CVE (plugin vulnerabilities) reported in 2023:	396
ALL WordPress CVE (core+plugin+theme vulnerabilities) reported in 2023:	5853

WordPress Security CVE (plugin vulnerabilities) reported in 2024:	351
ALL WordPress CVE (core+plugin+theme vulnerabilities) reported so far in 2024:	7614

WordPress Security CVE (plugin vulnerabilities) reported in 2025:	160
ALL WordPress CVE (core+plugin+theme vulnerabilities) reported so far in 2025:	3834

Get Healthy, Stay Healthy! A healthier online business starts today and it begins with you. Hire security experts to solve all your vulnerabilities created from WP Security CVE APR 2025.

START NOW

Security isn’t something that you can just do once. It's something that's constantly evolving and you need to regularly update your site’s Security standards and conduct routine website safety checks if you want to stay protected.

There isn’t a way to 100% protect your website from hackers and other malicious attempts. But, if you want to give your site the highest level of protection possible, then it’s a good idea to update immediately these WP Security CVE APR 2025. You rely on a Security guard that currently is sleeping!

SOLVE TODAY any reported WP Security CVE APR 2025 vulnerability! Do you suspect any security circumvention in your WordPress?

SHOP NOW

Not sure that our recurrent security offer is worthy of long-term consideration? Contact us: WP Security CVE APR 2025 audit! Decide after you compare RISK + IMPACT versus COST.

10 Apr: WP Theme CVE APR 2025: 57(!) Premium Hack risk

We’re passionate about helping you grow and make your impact Continue being informed Email (*double opt-in) Vulnerability reports (monthly) owlpower services (monthly) INSPIRATION (weekly) FEATURED (weekly) managed online business for you (tailored for niche needs) NEWS (weekly) Monthly vulnerability reports about WordPress and WooCommerce, plugins, themes. Weekly inspiration, news and…

WP Security CVE APR 2025: 34 public plugin risks