Theme security history

Soledad Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 18 vulnerability records associated with Soledad, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

18Total records

1Critical

7High

10Medium

0Low

0Informational

16Patched records

2Currently marked unpatched

2022-09-13First disclosure

2026-01-10Latest disclosure

18 of 18CVE coverage

Use this history

Check and watch Soledad.

A history record does not establish whether the version installed on your website is affected. Enter the exact version in the checker, or add this software to a private Critical/High alert watchlist.

Check my installed version Watch Soledad

Year-by-Year Timeline

Year	Records	Relative volume
2022	3	3 records
2023	3	3 records
2024	4	4 records
2025	7	7 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
Critical	1	5.6%
High	7	38.9%
Medium	10	55.6%

Vulnerability-Type Breakdown

Cross-Site Scripting

6 records33.3%

First: 2022. Latest: 2026.

Other

6 records33.3%

First: 2023. Latest: 2025.

Missing Authorization

4 records22.2%

First: 2022. Latest: 2025.

SQL Injection

1 record5.6%

First: 2023. Latest: 2023.

CSRF

1 record5.6%

First: 2024. Latest: 2024.

Patch Status

Patched: 16
Currently marked unpatched: 2
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

8.6.9.1
8.6.9
8.6.8
8.6.0
8.4.6
8.4.2
8.2.6
8.2.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-8.7.2`	Soledad <= 8.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 10, 2026	Not supplied	Medium
`*-8.7.0`	Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion	October 28, 2025	Not supplied	High
`*-8.6.9`	Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update	October 23, 2025	8.6.9.1	High
`*-8.6.8`	Soledad <= 8.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 22, 2025	8.6.9	Medium
`*-8.6.8`	Soledad <= 8.6.8 - Authenticated (Contributor+) Local File Inclusion	September 22, 2025	8.6.9	High
`*-8.6.7`	Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'	August 15, 2025	8.6.8	Medium
`*-8.6.7`	Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution	August 15, 2025	8.6.8	High
`*-8.6.7`	Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'	August 15, 2025	8.6.8	High
`*-8.5.9`	Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion	December 5, 2024	8.6.0	High
`*-8.4.5`	Soledad <= 8.4.5 - Cross-Site Request Forgery	April 9, 2024	8.4.6	Medium
`*-8.4.5`	Soledad <= 8.4.5 - Missing Authorization	April 9, 2024	8.4.6	Medium
`*-8.4.5`	Soledad <= 8.4.5 - Missing Authorization	April 9, 2024	8.4.6	Medium
`*-8.4.1`	Soledad <= 8.4.1 - Reflected Cross-Site Scripting	December 5, 2023	8.4.2	Medium
`*-8.4.1`	Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection	December 5, 2023	8.4.2	High
`*-8.4.1`	Soledad <= 8.4.1 - Unauthenticated PHP Object Injection	December 5, 2023	8.4.2	Critical
`*-8.2.5`	Soledad <= 8.2.5 - Missing Authorization	November 1, 2022	8.2.6	Medium
`*-8.2.5`	Soledad <= 8.2.5 - Authenticated (Subscriber+) Cross-Site Scripting	October 30, 2022	8.2.6	Medium
`*-8.2.4`	Soledad <= 8.2.4 - Reflected Cross-Site Scripting	September 13, 2022	8.2.5	Medium

Selected source records

Latest Records

MediumCVE-2026-27069

Soledad <= 8.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 10, 2026

Affected versions: *-8.7.2
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-68066

Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion

Published: October 28, 2025

Affected versions: *-8.7.0
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-64188

Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

Published: October 23, 2025

Affected versions: *-8.6.9
Patched versions: 8.6.9.1

Original Wordfence record

HighCVE-2025-59588

Soledad <= 8.6.8 - Authenticated (Contributor+) Local File Inclusion

Published: September 22, 2025

Affected versions: *-8.6.8
Patched versions: 8.6.9

Original Wordfence record

MediumCVE-2025-59589

Soledad <= 8.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 22, 2025

Affected versions: *-8.6.8
Patched versions: 8.6.9

Original Wordfence record

HighCVE-2025-8142

Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'

Published: August 15, 2025

Affected versions: *-8.6.7
Patched versions: 8.6.8

Original Wordfence record

HighCVE-2025-8105

Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution

Published: August 15, 2025

Affected versions: *-8.6.7
Patched versions: 8.6.8

Original Wordfence record

MediumCVE-2025-8143

Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'

Published: August 15, 2025

Affected versions: *-8.6.7
Patched versions: 8.6.8

Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-49826

Soledad <= 8.4.1 - Unauthenticated PHP Object Injection

Published: December 5, 2023

Affected versions: *-8.4.1
Patched versions: 8.4.2

Original Wordfence record

HighCVE-2023-49825

Soledad <= 8.4.1 - Authenticated (Contributor+) SQL Injection

Published: December 5, 2023

Affected versions: *-8.4.1
Patched versions: 8.4.2

Original Wordfence record

HighCVE-2025-8142

Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'

Published: August 15, 2025

Affected versions: *-8.6.7
Patched versions: 8.6.8

Original Wordfence record

HighCVE-2025-64188

Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

Published: October 23, 2025

Affected versions: *-8.6.9
Patched versions: 8.6.9.1

Original Wordfence record

HighCVE-2024-11289

Soledad <= 8.5.9 - Unauthenticated Limited Local File Inclusion

Published: December 5, 2024

Affected versions: *-8.5.9
Patched versions: 8.6.0

Original Wordfence record

HighCVE-2025-59588

Soledad <= 8.6.8 - Authenticated (Contributor+) Local File Inclusion

Published: September 22, 2025

Affected versions: *-8.6.8
Patched versions: 8.6.9

Original Wordfence record

HighCVE-2025-68066

Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion

Published: October 28, 2025

Affected versions: *-8.7.0
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-8105

Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution

Published: August 15, 2025

Affected versions: *-8.6.7
Patched versions: 8.6.8

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2026-27069

Soledad <= 8.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 10, 2026

Affected versions: *-8.7.2
Patched versions: Not supplied

Original Wordfence record

HighCVE-2025-68066

Soledad <= 8.7.0 - Authenticated (Contributor+) Local File Inclusion

Published: October 28, 2025

Affected versions: *-8.7.0
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory