Plugin security history

Leyka Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 12 vulnerability records associated with Leyka, published between 2023 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

12Total records

1Critical

2High

9Medium

0Low

0Informational

10Patched records

2Currently marked unpatched

2023-03-03First disclosure

2025-07-01Latest disclosure

12 of 12CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	7	7 records
2024	2	2 records
2025	3	3 records

Severity Breakdown

Severity	Records	Share
Critical	1	8.3%
High	2	16.7%
Medium	9	75%

Vulnerability-Type Breakdown

Cross-Site Scripting

6 records50%

First: 2023. Latest: 2025.

Missing Authorization

3 records25%

First: 2023. Latest: 2024.

CSRF

1 record8.3%

First: 2023. Latest: 2023.

Information Disclosure

1 record8.3%

First: 2023. Latest: 2023.

Other

1 record8.3%

First: 2025. Latest: 2025.

Patch Status

Patched: 10
Currently marked unpatched: 2
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.31.9
3.31.7
3.31.2
3.30.7.1
3.30.2
3.30.3
3.30

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.31.9`	Leyka <= 3.31.9 - Unauthenticated Local File Inclusion	July 1, 2025	Not supplied	High
`*-3.31.9`	Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	June 27, 2025	Not supplied	Medium
`*-3.31.8`	Leyka <= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	February 14, 2025	3.31.9	Medium
`*-3.31.6`	Leyka <= 3.31.6 - Missing Authorization	October 14, 2024	3.31.7	Medium
`*-3.31.1`	Leyka <= 3.31.1 - Missing Authorization	June 6, 2024	3.31.2	Medium
`*-3.30.7`	Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure	September 12, 2023	3.30.7.1	Medium
`[*, 3.30.3)`	Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	August 23, 2023	3.30.3	Medium
`*-3.30.2`	Leyka <= 3.30.2 - Reflected Cross-Site Scripting	August 7, 2023	3.30.3	Medium
`*-3.30.1`	Leyka <= 3.30.1 - Reflected Cross-Site Scripting	May 22, 2023	3.30.2	Medium
`*-3.30.2`	Leyka <= 3.30.2 - Privilege Escalation via Admin Password Reset	May 22, 2023	3.30.3	Critical
`*-3.29.2`	Leyka <= 3.29.2 - Cross-Site Request Forgery	March 3, 2023	3.30	Medium
`*-3.29.2`	Leyka <= 3.29.2 - Unauthenticated Stored Cross-Site Scripting	March 3, 2023	3.30	High

Selected source records

Latest Records

HighCVE-2025-52805

Leyka <= 3.31.9 - Unauthenticated Local File Inclusion

Published: July 1, 2025

Affected versions: *-3.31.9
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-53275

Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 27, 2025

Affected versions: *-3.31.9
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-26766

Leyka <= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 14, 2025

Affected versions: *-3.31.8
Patched versions: 3.31.9

Original Wordfence record

MediumCVE-2024-49252

Leyka <= 3.31.6 - Missing Authorization

Published: October 14, 2024

Affected versions: *-3.31.6
Patched versions: 3.31.7

Original Wordfence record

MediumCVE-2024-35683

Leyka <= 3.31.1 - Missing Authorization

Published: June 6, 2024

Affected versions: *-3.31.1
Patched versions: 3.31.2

Original Wordfence record

MediumCVE-2023-4917

Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure

Published: September 12, 2023

Affected versions: *-3.30.7
Patched versions: 3.30.7.1

Original Wordfence record

MediumCVE-2023-2995

Leyka <= 3.30.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: August 23, 2023

Affected versions: [*, 3.30.3)
Patched versions: 3.30.3

Original Wordfence record

MediumCVE-2023-39314

Leyka <= 3.30.2 - Reflected Cross-Site Scripting

Published: August 7, 2023

Affected versions: *-3.30.2
Patched versions: 3.30.3

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-33327

Leyka <= 3.30.2 - Privilege Escalation via Admin Password Reset

Published: May 22, 2023

Affected versions: *-3.30.2
Patched versions: 3.30.3

Original Wordfence record

HighCVE-2025-52805

Leyka <= 3.31.9 - Unauthenticated Local File Inclusion

Published: July 1, 2025

Affected versions: *-3.31.9
Patched versions: Not supplied

Original Wordfence record

HighCVE-2023-27450

Leyka <= 3.29.2 - Unauthenticated Stored Cross-Site Scripting

Published: March 3, 2023

Affected versions: *-3.29.2
Patched versions: 3.30

Original Wordfence record

MediumCVE-2025-26766

Leyka <= 3.31.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: February 14, 2025

Affected versions: *-3.31.8
Patched versions: 3.31.9

Original Wordfence record

MediumCVE-2025-53275

Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 27, 2025

Affected versions: *-3.31.9
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2023-33325

Leyka <= 3.30.1 - Reflected Cross-Site Scripting

Published: May 22, 2023

Affected versions: *-3.30.1
Patched versions: 3.30.2

Original Wordfence record

MediumCVE-2023-39314

Leyka <= 3.30.2 - Reflected Cross-Site Scripting

Published: August 7, 2023

Affected versions: *-3.30.2
Patched versions: 3.30.3

Original Wordfence record

MediumCVE-2023-27442

Leyka <= 3.29.2 - Cross-Site Request Forgery

Published: March 3, 2023

Affected versions: *-3.29.2
Patched versions: 3.30

Original Wordfence record

Currently Marked Unpatched Records

HighCVE-2025-52805

Leyka <= 3.31.9 - Unauthenticated Local File Inclusion

Published: July 1, 2025

Affected versions: *-3.31.9
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-53275

Leyka <= 3.31.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: June 27, 2025

Affected versions: *-3.31.9
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory