Leyka
Leyka has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; 10 are fixed and 3 remain unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 2 high. 2023 was the busiest year with 7 disclosures.
The most common weakness is Cross-Site Scripting, behind 6 of the records (46%). Other recurring categories include Missing Authorization, Authorization Bypass Through User-Controlled Key.
10 of the records (77%) have a vendor fix, while 3 remain unpatched. The oldest unresolved one dates back to 2025.
11 independent researchers contributed these findings, most of them (2) reported by Peter Thaleikis. Leyka is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-52805Leyka <= 3.31.9 - Unauthenticated Local File Inclusion
Read the full analysisVulnerability Records
Leyka
Author
VaultDweller
Supported payment methods include Visa and MasterCard bank cards payments via Cloudpayments, Yandex.Kassa, PayPal, Chronopay, QIWI Kassa, ROBOKASSA and RBK Money systems, mobile and SMS payments via MIXPLAT, also WebMoney. You can also use a traditional bank payment orders. This plugin developed and supported by Teplitsa of social technologies. The plugin’s task is to ease and improve integrations of donations collecting function on websites of NGOs and any social oriented projects. Plugin is very easy to install, and it requires only a minimum of settings. You can start to collect donations right after plugin setup. Many important settings are setted automatically. The plugin is designed for any website that wants to collect money online – NGOs, informal unions, individuals. Official website: leyka.org Warning: you will need to sign a contract with some payment systems, like Yandex.Money or RBK, to collect donations through them. Core features Wide range of payment systems and options Suitable for private persons and NGOs Automatic e-mails to supporters User accounts that help donors to manage recurring donations Payment history and statistics on the website Integration with Google Analytics out of the box Campaign templates and visualization of the progress bars Template color customization Widgets and shortcodes for WP Legally correct templates for personal data usage agreement and oferta text Multiple language support Partially complies with accessibility standards WCAG 2.0 The plugin manual is avaliable at official website. Intallation and usage are illustrated with screencasts course. PHP at least 7.2.5 is required for plugin to work correctly. Help the project We will be very grateful if you will help us to make Leyka better. You can add a bugreport or a feature request on GitHub. Send us your pull request to share a code impovement. You can make a new plugin translation for your language or send us a fixes for an existing translation, if needed. If you have a questions for the plugin work in any aspect, please address our support service on GitHub.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C