WordPress Vulnerabilities – November 1 to November 14, 2025
Keeping your WordPress site secure is essential. In this post, you’ll find a summary of the latest plugin vulnerabilities discovered over the past two weeks, so you can take action and stay protected.
AI Engine
Summary: The AI Engine plugin is vulnerable to PHP Object Injection via PHAR Deserialization. This issue arises from the deserialization of untrusted input in the rest_simpleTranscribeAudio and rest_simpleVisionQuery functions, which could allow attackers to execute arbitrary code.
Affected Versions: Up to and including 3.1.8
Source: View details
Post SMTP
Summary: A critical Account Takeover vulnerability was discovered in the Post SMTP plugin, which affects over 400,000 active installations. The flaw allows attackers to exploit email log disclosures to gain unauthorized access to admin accounts.
Affected Versions: Specific versions not listed; vulnerability disclosed on October 11, 2025
Source: View details
Multiple Plugins (101 total)
Summary: A total of 110 vulnerabilities were disclosed across 101 different WordPress plugins. These include issues ranging from Cross-Site Scripting (XSS) to SQL Injection and privilege escalation vulnerabilities. It’s crucial to review the full list to ensure your site is not affected.
Affected Versions: Varies by plugin
Source: View details
Make sure to update any affected plugins and monitor your site regularly. Staying informed is one of the best ways to protect your WordPress installation.