WordPress Vulnerabilities – November 16 to November 30, 2025
Introduction: Keeping your WordPress site secure is essential. In this post, you’ll find a summary of the latest plugin vulnerabilities discovered over the past two weeks, so you can take action and stay protected.
Community Events
Summary: This plugin is vulnerable to SQL Injection via the dayofyear parameter due to insufficient escaping and lack of prepared statements.
Affected Versions: Up to and including 1.5.4
Source: View details
Schema Scalpel
Summary: Vulnerable to Stored Cross-Site Scripting (XSS) via post titles due to inadequate input sanitization and output escaping in JSON-LD schema markup.
Affected Versions: Up to and including 1.6.1
Source: View details
WordPress Core
Summary: Improper Neutralization of Input During Web Page Generation leading to Stored XSS vulnerability.
Affected Versions: Details pending official patch
Source: View details
Conclusion: Make sure to update any affected plugins and monitor your site regularly. Staying informed is one of the best ways to protect your WordPress installation