TikTok Trends 2025: The Most Important Trends To Watch via @sejournal, @theshelleywalsh

TikTok trends move so quickly that it’s not easy to keep pace, as memes can appear and disappear within days.

For anyone working in social media or content marketing, keeping up to date is important to leverage relevant trends and inspire new content.

From observation, TikTok is becoming the starting point for many trends and memes that then influence other channels.

So, even if you are not on the video platform, you should still be monitoring what is happening on TikTok to stay informed of general trends and memes that can filter down through other channels and forms of content.

We’ll be looking at the macro trends we’ve seen swaying TikTok over the start of 2025, as well as some specific examples you can start to use.

As always, if you’re going to get involved with a trend or meme, your approach needs to feel authentic to both the format and your brand.

10 TikTok Trends For 2025

Here are some of the most popular recent trends, from the relatable to the absurd. While many work best for solo creators or social media managers, others will translate to brands for creative social media ideas.

1. Roasting Colleagues

Who doesn’t love an opportunity to roast a colleague or a co-creator?

The premise of the #SuspectChallenge is simple: The “suspect” attempts to escape on foot while the cameraperson runs alongside, verbally identifying them in the style of a police broadcast.

But instead of stating an objective characteristic (like “the suspect is a brunette woman”), the cameraperson calls out the “suspect” for something embarrassing.

@aldiuk

We can confirm no clubcards were owned by suspects in the making of this video 🫣 🛒 #SuspectChallenge #Suspect #Viral #AldiUK

♬ original sound – Aldi UK

In the second take, the tables turn as the cameraperson becomes the “suspect.” The two go back and forth, roasting each other over the course of several takes. It’s a great way to poke fun at a colleague or co-creator while helping followers get to know the people behind your brand a bit better, as Aldi does above.

@liverpoolfcw

“Yeah I do, liar” 🤣 @liv @Mia enderby #suspectchallenge #suspect #LFC #LiverpoolFC #Liverpool

♬ original sound – Liverpool FC Women

It works particularly well for brands with numerous personalities, such as sports teams. And the trend can be even more engaging when the roast turns into an exchange of compliments, as in the Liverpool FC Women video above.

2. Revealing A New POV

One of the easiest trends to film, the “Oops, I Flipped the Camera” meme uses just two clips.

The first is a generic shot with a text overlay detailing a hot take. Bonus points if the background video has any connection at all to the hot take, but that isn’t necessary.

After a few seconds, the camera “accidentally” flips, exposing the person who’s sharing their POV. Inevitably, it’s someone with a clear agenda – so they act flustered.

To heighten the drama, a sad violin song plays in the background. However, there’s nothing sad about the content. Instead, it’s all about getting a laugh.

Here, Sony Pictures UK shares a rave review for the star of Kraven the Hunter – delivered by none other than the star himself, Aaron Taylor-Johnson.

@sonypictures.uk

oops. #KravenTheHunter #AaronTaylorJohnson #London #trend #cameraflip #oops #movie #filmtok

♬ original sound – Capital

The POV doesn’t have to come from a person. Here, Mercedes-Benz encourages everyone to purchase a Mercedes-AMG in order to live a happy life. When the camera flips, it’s clear that the POV came from a vehicle.

@mercedesbenz

we swear, this is totally unbiased… #MercedesBenz #MercedesAMG

♬ Sad violin – Katsuyuki Takahashi

3. Yapping

Have a lot to say? You aren’t alone. #Yapping trended on TikTok throughout 2024, turning the term from a somewhat derogatory word to a celebration of long-winded (and sometimes one-sided) conversations.

The “Here’s My Thing” trend riffs on this concept and borrows from the Best of Both Worlds podcast, which focused an entire episode on debating the merits of pasta. After saying, “Because here’s my thing, I’m so sorry,” one of the podcast hosts launches into a lengthy opinion about the right pasta shape to use with vodka sauce.

Brands like President’s Choice hop on the trend by lip-synching along to the audio and showcasing several pasta shapes in the brand’s product line.

@preschoice

Hear us out, please! 🍝

♬ original sound – BestofBothWorldsPod

But here’s the thing about this trend. The content doesn’t have to touch on pasta at all. The audio works for almost any topic, as long as it focuses on a love for yapping.

For example, edtech brand Formee Express uses the trend to poke fun at two best friends being unable to study because they can’t stop talking.

@formee_express

my mind thinks of the most random things #student #uni #universitymeme #studentmemes #studytok #study #unimeme #collegehumor #unilifestyle #university #unilife

♬ original sound – BestofBothWorldsPod

And Dancing with the Stars Tour uses the audio to make fun of themselves for creating content on the topics of their choice rather than answering followers’ persistent questions about tour dates and special guests.

@dwtstourofficial

Don’t get us started on ravioli @Rylee Arnold #dwts #dwtstour

♬ original sound – BestofBothWorldsPod

4. Being Cool, Calm, And Collected

If you aren’t a yapper, you might be a chill guy instead.

The “Chill Guy” meme features an animated anthropomorphic dog calmly standing in a confident pose. Think the “This Is Fine” meme but without the flames or the sense of impending doom.

Posts have a photo or video relevant to the brand with a text overlay qualifying the “chill guy” behavior. For example, Etihad jumps on the trend with “Just a chill guy announcing 10 new destinations on a random Monday.”

@etihad

Which one will you be flying to? #airplane #aviation

♬ Hinoki Wood – Gia Margaret

It’s a fun way to make an announcement, share exciting news, or say something relatable while downplaying it as “chill guy” behavior. Consider taking it to the next level by editing the character to add branded elements, as the New Orleans Pelicans do below.

@pelicansnba

Chill guy ready for City Edition ⚜️ #pelicans #nba #basketball #chillguy #nop #nola

♬ just.be. – 1

5. Feeling (Not So) Sad

Feeling a little down? If only a specific product, service, or experience could turn your mood around.

The “I Wasn’t Sad, I Just Needed …” trend explores the many different ways TikTokers make themselves happy—from small purchases to major indulgences.

Here, travel creator Travel With Kennice uses the trend to promote a trip to Tromsø, Norway. The video is packed with beautiful shots of the destination, designed to inspire followers to travel.

@travelwithkennice

I just needed to book a flight to Tromsø 🇳🇴 #tromsø #norway #travel #traveltiktok #city #cityscape #sunset #traveldiaries #bucketlist #fyp #f #foru #viral_video

♬ intro x chorus the night we met – ourfeelings🪐

Brands can use the trend with a first- or second-person point of view. Either way, it’s ideal for reminding followers how happy your brand makes them – like Chipotle does with its “burrito a day” video below.

@chipotle

a burrito a day ✍️

♬ original sound – Chipotle

Brands can make videos shoppable, making it even easier for followers to buy what the content promotes. With TikTok Shop, you can sell products directly and use the platform as an ecommerce channel.

6. Comparing Type A Vs. Type B Friends

When you want to cause a commotion in the comments section, try a branded take on the “Type A vs Type B Friend” trend.

It contrasts Type A people (known for their organization and proactivity) with Type B people (known for their easygoing nature and ability to go with the flow).

When done well, it inspires viewers to strongly identify with one type or the other. And potentially tag the friend who fits the other stereotype.

Here, Hilton depicts the Type A friend as the person who makes her bed, keeps an organized suitcase, and carefully packs her day bag. In contrast, the video shows the Type B friend as someone who is so casual about travel that she forgot her toothbrush and had to request one from the hotel.

@hilton

Are you a Type A or Type B friend? Tag your counterpart in the comments! #HiltonForTheStay

♬ original sound – hilton

And here, RootineCo compares hanging out with a Type A friend while she goes through a lengthy pre-sleep routine as a Type B person who’s hesitant to plan ahead.

@rootine_co

But we love them even more because of it 🩷 #typea #typeb #friendship #hangingout #rootine #fyp

♬ original sound – RootineCo

7. Rallying Unhinged Fans

While TikTok is a short-form video platform, it’s allowed progressively longer videos over the years. Brands can now upload videos up to 10 minutes long. And in some regions, 15- and 30-minute video uploads are available.

But in some cases, short and sweet content still performs best. “Right vs. Left Pocket” is a great example of a 15-second trend that’s designed to be completely unserious yet still attract raving fans.

It’s based on a simple concept: the average person’s jeans typically have one (right) pocket for essentials like a wallet or phone, while the other (left) pocket is filled with complete chaos.

Taco Bell’s take on the trend shows a neatly organized right pocket and a left pocket filled with hundreds of packets of hot sauce.

@tacobell

just a few

♬ DON`T STOP – Slowed++ – GLXXMSTRIDER

Oreo’s spin on the trend takes it to an absurd level, showing the pockets filled with dozens of packages of Oreos.

@oreo

Just in case we get hungry 🤭 #rightvsleft #pockets #fyp #oreo

♬ Falling Angel – HCTM

8. Foreshadowing Something Ominous

On average, TikTok users spend 58 minutes and 24 seconds on the app every day. That means brands have the potential to rack up a lot of views, as long as they can successfully capture viewers’ attention.

To keep viewers interested, experiment with different styles of storytelling. Like the #SubtleForeshadowing trend, which uses a unique editing style to intersperse flashes of the conclusion at various points in the video.

Here, Scrub Daddy hints that the protagonist—who uses an off-brand sponge—will have an encounter with an unusually large sponge. Sure enough, the protagonist gets attacked by a Scrub Daddy at the end.

@scrubdaddy

Just a reminder… #scrubdaddy #smile #cleantok #cleaningtiktok #clean

♬ original sound – Scrub Daddy

Bakers Delight takes the concept a step further by foreshadowing the conclusion—a baker hunched over on the floor – without giving away the reason. The viewer has to watch until the end to learn that the baker’s carefully proofed dough has fallen to the floor, leaving it unusable.

@bakersdelight

Dough! 🫠👨‍🍳 #breadtok #bakersdelight #bakersoftiktok #baking #bakingvideo #foryou #forshadowing #fail #cctv #trend #bakerylife #bts #dough #epicfail

♬ Comforting – Noah

9. Taking Viewers Behind The Scenes

Let’s face it: whether you work in the office or from home, a lot of day-to-day work isn’t exactly exciting. At least, it might not be exciting to you, the person doing the work.

For followers and customers, it’s a different story. When you take viewers behind the scenes, you give them a glimpse of a world they don’t typically get to experience.

While behind-the-scenes content is hardly new on TikTok, styles and formats have evolved. Instead of unfiltered footage, some of the most popular behind-the-scenes videos are heavily edited content that shows business owners completing tasks like packing up orders.

@lovewisd

Let’s packaging All Purple Order 🎉Dear Natalie bought purple tumbler set and purple journal kit. Thank you soso much💜hoping you will like them💜#asmr #orderpacking #orderpackingasmr #order #packingorders #packagingorders #packwithme #packaging #packanorderwithme #packingasmr #ordernow #packageopening #canada #usa #europe #uk #tumbler #stanley #stanleycup #stanleytumbler #cup #journalkit #stationery #journal #notebook #planneraddict #plannercommunity #plannertok #schoolsupplies #stationeryaddict #stationeryshop #stationeryhaul #tumblerset #accessories #stanleydecorations #purple #newyork #america #asmr #foryou #fyp

♬ original sound – LOVEWISD

Many “pack an order with me” videos are highly aesthetic and include ASMR elements that make them especially pleasant to watch. As a result, they do an excellent job of selling the brand experience – which can have the added effect of driving sales and cultivating loyalty.

@xxl.scrunchie

OUR BIGGEST SINGLE ORDER EVER. 😱 Pack a 1645 item order with me for Gia, @Silky Gem Crystal Candy ✨🥹📦 Thank you SO much! Wait til you see the struggle when we figure out how to ship it all 🥲 #asmrpackaging #packageanorderwithme #smallbusinesspackaging #packagingasmr #packingordersasmr

♬ original sound – XXL SCRUNCHIE & CO 🇨🇦

This format can also serve as social proof, which can turn casual viewers into paying customers. Above, XXL Scrunchie invites followers to pack more than 1,000 items, the company’s largest order yet.

10. Asking Employees For Their Opinions

Not all behind-the-scenes content has to focus on your products or services. Some of the most engaging videos put a spotlight on employees, introducing the people behind the brand.

Instead of simply filming employees as they go about their day, ask several staff members for their opinion on a trending topic.

Here, the Chicago Bulls asks the team’s players to weigh in on the top three items on their Thanksgiving plate.

@chicagobulls

What are 3 things you need on your Thanksgiving plate?! 👀🍽️ #thanksgiving #foodtiktok #basketball #travel #nba

♬ original sound – Chicago Bulls

And here, Sephora asks in-house beauty advisors for their recommendations. Each employee shares a top pick while offering a mini pitch for the product.

@sephora

Their faves 🤝🏽 your new faves.

♬ original sound – sephora

For social media managers who spend a lot of time as the face of the brand on TikTok, this approach is great for getting other employees or players in front of the camera. Pay close attention to the comments to see which personalities are most popular with followers. Then, ask them to star in more videos.

How Trends Evolve On TikTok

Trends aren’t a new thing in the world, especially in fashion. People have wanted to be on trend for years, with magazines, movies, and TV shows all setting the trends and reflecting the organic ones that formed.

TikTok and social media have accelerated the trending process, breaking down the 20-year trend cycles we used to see into rapid trend sprints that can overlap.

Trends are now incubated by the collective attention of social media users who determine what gets engagement and what doesn’t.

This becomes amplified by the sheer number of people engaging with content. Because of the huge audience interacting on TikTok daily, people can validate their experiences almost instantly.

And, if someone has coined a term for it, it can spread like wildfire. Think “girl dinner,” “microcheating,” “polywork,” and more.

Once it becomes part of the collective consciousness of TikTok with its own hashtag, people can Duet or Stitch videos and create their own content using templates to evolve a trend further.

How To Find Trending Ideas In The Tiktok Creative Center

TikTok launched its Creative Center this year, giving creators another tool to help find inspiration for posts.

You can browse what’s trending in your country, broken down into hashtags, songs, creators, and videos.

Each category can give you insights into what type of content is trending, whether that’s lip-syncing audio, popular creators, or specific video formats.

There’s also the Creative Assistant, which provides a suite of AI-assisted tools to help streamline the creative process.

You can ask the Creative Assistant for insights on what’s trending right now, along with related videos, so you can see what other creators are making for that niche.

It also writes ad scripts, but these won’t be tailored to your business’s tone of voice or unique selling points.

They can act as a starting point if you’re very stuck, but without a detailed prompt, they might not produce content you can easily use.

How TikTok Trends Can Be A Source Of Inspiration For Content Ideas

When looking for ideas to fill your content calendar with, TikTok gives you a good indicator of what Gen Z is currently resonating with.

By getting an idea of the platform’s popular trends, you can find a way to leverage them for your own brand in an authentic way.

You need to make sure that the trend’s video style is a good fit for your brand. If it feels forced, your content could draw negative attention due to the inauthentic sentiment behind it.

What’s important is that in order to integrate your content organically into a trend, you need to be agile and reactive.

Leaving it too late to get involved with a trend might make your audience feel that you’re too corporate and leave them cringing at your content instead.

More resources: 


Featured Image: Gorodenkoff/Shutterstock

Mullenweg Criticizes WP Engine For Something He Also Does via @sejournal, @martinibuster

Matt Mullenweg cited a Reddit thread on X to promote the idea that WP Engine makes it difficult to cancel accounts. Turns out that his own hosting company does the exact same thing.

“Money Grab” Post By Redditor

Someone posted that they cancelled a WP Engine account on Friday December 6th. They subsequently learned that WP Engine has a 30 day advance notice cancellation policy so they called customer service and was assured they wouldn’t be charged, despite not giving 30 days advance notice.

They wrote:

“On Dec 6th, I cancelled my WPEngine service that I’ve had since 2015. …That’s when I discovered that WPEngine requires 30 days notice to cancel. An obvious money-grab. A user should be able to cancel a single-site hosting environment instantly with one click of a button. In fact, this will be the law soon, created because of unscrupulous cancellation tactics like this.

WPEngine support informed me that my site would be cancelled on Jan 3rd. …Surprise, surprise… it’s Jan 5th. My account hasn’t been cancelled, and I was charged $300 today for another year of service.”

Hours after starting the Reddit post to complain about WP Engine they updated it to say that WP Engine had refunded their money.

They posted:

“UPDATE: WP Engine support got back to me, cancelled the account today, and initiated a refund that’ll take up to 10 business days.”

Mullenweg Dumps On WP Engine

Mullenweg posted on X to compare WP Engine to an unscrupulous gym, accompanying his post with a screenshot of the Reddit post:

“One way @wpengine juices its profits at the expense of its customers is by making it hard to export or cancel your plan, like one of those bad gyms.”

He followed that up with another post touting that WordPress.com has a flexible cancellation policy:

“The WordPress philosophy is to make it easy for people to leave, so they’re more likely to stay. Give freedom and choice.”

But the reality is that WordPress.com’s cancellation policy also requires 30 day advanced notice:

“You must cancel at least one month before the scheduled end date of any annual subscription…”

What’s Going On?

WP Engine’s contract is clear that they require 30 days notice to cancel a service. But it’s not like once you pay you’re committed to a whole year of hosting. The contract enables customers to cancel their yearly hosting plan at any time (with 30 days notice) and the difference for any remaining months will be refunded.

The Redditor cancelled their account with less than 30 days notice (on a Friday), got charged 24 days later and then refunded on a Sunday, before the weekend was over.

Response On Reddit

While many Redditors were supportive of the person who started the discussion, others pointed out the obvious that it’s a weekend and they failed to give adequate notice.

A Redditor named ThePresidentOfStraya posted:

“Not affiliated with WPEngine. Downvoted. This is a boring billing issue, you’re not being oppressed. Annoying sure. But just call them Monday mate.”

Another Redditor downplayed the events:

“Meh, crap happens. It’s not at all abnormal to have a 30 day opt-out prior to renewal.”

Another Redditor put the original posters situation into perspective, commenting:

“Money grab? You know the rules…

Inform yourself. You should have cancelled sooner. Now be polite and ask them for a solution instead of ranting about it online.”

Read the original Reddit post:

UPDATE: WPEngine didn’t follow through on cancelling my account on Jan 3rd and I was charged for another year of service

Featured Image by Shutterstock/Nicoleta Ionescu

Ecommerce SMBs Need Faceless Videos

So-called “faceless videos” use voiceovers, animations, and images to tell a story, educate, or entertain. In the ecommerce context, these relatively easy-to-make videos promote items and build trust.

Video is an excellent way to showcase products and convert shoppers. Enterprise retailers often place videos on ecommerce pages, social media, and ads.

The only drawback is production. Compared to a blog post or a text-based search ad, videos are expensive to produce and require a much higher skill level. Thus some small and mid-sized ecommerce businesses avoid videos altogether.

AI-enabled Faceless Video

Online merchants produced “faceless” videos before the term became a buzzword. Tools such as Animoto have facilitated such videos for 15 years, as in the recent example below.

These tools make creating a video much easier, but the video-production bar was still above some merchant’s reach. Fortunately, generative artificial intelligence has made faceless video production achievable for nearly every ecommerce business.

Consider a faceless video workflow.

  • Idea generation. Generative AI models — ChatGPT, Gemini, Claude, and Grok — can help create faceless video ideas.
  • Scripting and storyboarding. AI tools such as Jasper and Copy.ai feature script writing, although many other AI models can compose video scripts.
  • Gathering visuals. For this step, an ecommerce business might use product images in combination with AI-generated pictures or video from tools such as Midjourney, Grok, or Pika.
  • Recording the voiceover. This might be an actual recording or AI-generated audio from ElevenLabs, Murf.ai, and others.
  • Video editing. Use AI, humans, or a combination.

Generative AI can help throughout the process. Multiple AI-powered platforms perform almost all these steps based on a prompt or two.

Why Faceless Videos?

AI makes creating faceless ecommerce videos nearly as easy as asking ChatGPT to rewrite some Google Ads copy. But why should online merchants use such videos at all?

The answer is more sales — in five ways.

Video advertising. Most common digital advertising platforms, from Meta’s Facebook and Instagram to Snapchat and Google Ads, support video formats. These platforms report that video in ads boosts performance. A 2023 Meta analysis showed a 35% improvement in clicks for vertical Reels ads containing video with audio.

Showcase products. Videos showing and describing a product and its features can appear directly on its detailed web page. This common practice boosts conversations. With an automated workflow employing Zapier (or similar) and generative AI tools described above, a merchant could generate a faceless product video for every item in a store.

Customer service. The same AI-enabled workflow for products could also generate customer service videos addressing, say, return policies or frequently asked questions.

Content marketing. Several AI tools can convert a blog post or product description into a faceless video, which merchants can embed on the item’s page or distribute via YouTube.

Social media marketing. Finally, videos drive modern social media marketing, and faceless versions — in full or excerpted into vertical shorts — can work on just about every platform, from YouTube to Meta.

Faceless or Humans?

Faceless videos are not perfect.

Some users report that faceless versions do not build trust as well as a human speaker. A person saying, “Hi, I am Bob Smith, and I want to tell you why I love this product,” carries more emotional clout than a voiceover.

Plus, some social media platforms — TikTok, in particular — favor videos with humans such as influencers talking directly into the camera.

Nonetheless, faceless videos can help ecommerce shops improve advertising performance, showcase products, provide customer information, and produce engaging content.

And thanks to ever-improving AI, this type of video is relatively easy to produce.

WordPress Popular Posts Plugin Vulnerability Affects 100k+ Sites via @sejournal, @martinibuster

An advisory has been issued about a high-severity WordPress vulnerability that makes it possible for attackers to inject arbitrary shortcodes into sites using the WordPress Popular Posts plugin. Attackers do not need a user account to launch an attack.

WordPress Popular Posts is installed in over 100,000 websites enables websites to display the most popular posts within any given time period and has been translated into sixteen different languages to extend its use around the world. It comes with caching features to improve performance and an admin console that allows website administrators to view popularity statistics.

WordPress Shortcode Vulnerability

Shortcodes is a feature that allows users to insert functionalities within a web page by inserting a predefined snippet within brackets that automatically inserts a script that performs a function, like adding a contact form with a shortcode that looks like this: [add_contact_form].

WordPress is gradually evolving away from the use of shortcodes in favor of blocks with specific functionalities. The official WordPress developer site encourages plugin and theme developers to discontinue using shortcodes in favor of dedicated blocks, with the main reason being that it’s a smoother workflow for a user to select and insert a block rather than configure a shortcode within a plugin then manually inserting the shortcode into a webpage.

WordPress advises:

“We would recommend people eventually upgrade their shortcodes to be blocks.”

The vulnerability discovered in the WordPress Popular Posts plugin is due to the implementation of the shortcode functionality, specifically a part called do_shortcode(), which is a WordPress function for processing and executing shortcodes that requires input sanitization and other standard WordPress plugin and theme security practices.

According to an advisory published by Wordfence:

“The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.”

That part about “validating a value” generally means checking to ensure that what the user inputs (the “value”), such as the content of a shortcode, is validated to confirm that it’s safe and conforms to expected inputs before being passed along for use by the website.

Official Plugin Changelog

A changelog is the documentation of what’s being updated, which for users of the plugin provides them an opportunity to understand what is being updated and to make decisions about whether to update their installation or not, thus transparency is important.

The WordPress Popular Posts plugin is responsibly transparent in their documentation of the update.

The plugin changelog advises:

“Fixes a security issue that allows unintended arbitrary shortcode execution (props to mikemyers and the Wordfence team!)”

Recommended Actions

All versions of the WordPress Popular Posts plugin up to and including version 7.1.0 are vulnerable. Wordfence recommends updating to the latest version of the plugin, 7.2.0.

Read the official Wordfence advisory:

WordPress Popular Posts <= 7.1.0 – Unauthenticated Arbitrary Shortcode Execution

Featured Image by Shutterstock/GrandeDuc

WordPress Backup Plugin Vulnerability Affects 3+ Million Sites via @sejournal, @martinibuster

A high severity vulnerability in a popular WordPress backup plugin allows unauthenticated attackers to exploit the flaw. The vulnerability is rated 8.8 on a scale of 0.0 to 10.

UpdraftPlus: WP Backup & Migration Plugin

The vulnerability affects the popular Updraft Plus WordPress plugin, installed in over 3 million websites. Updraft Plus comes in a free and paid version that allows users to upload backups to a user’s cloud storage or to email the files. The plugin allows users to manually backup the website or schedule it for automatic backups. It offers a tremendous amount of flexibility of what can be backed up and can make a huge difference for recovering from a catastrophic server issue and is also useful for migrating to a different server altogether.

Wordfence explains the vulnerability:

“The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.24.11 via deserialization of untrusted input in the ‘recursive_unserialized_replace’ function. This makes it possible for unauthenticated attackers to inject a PHP Object.

No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must perform a search and replace action to trigger the exploit.”

The Updraft Plus changelog seems to minimize the vulnerability, it doesn’t even call the update a security patch, it’s labeled as a “tweak.”

From the official Updraft Plus WordPress plugin changelog:

“TWEAK: Complete the review and removal of calls to the unserialize() PHP function allowing class instantiation begun in 1.24.7. (The final removal involved a theoretical security defect, if your development site allowed an attacker to post content to it which you migrated to another site, and which contained customised code that could perform destructive actions which the attacker knew about, prior to you then cloning the site. The result of this removal is that some search-replaces, highly unlikely to be encountered in practice, will be skipped).”

Updraft Plus Vulnerability Patched

Users are recommended to consider updating their installations of Updraft Plus to the latest version, 1.24.12. All versions prior to the latest version are vulnerable.

Read the Wordfence advisory:

UpdraftPlus: WP Backup & Migration Plugin <= 1.24.11 – Unauthenticated PHP Object Injection

Featured Image by Shutterstock/Tithi Luadthong

Google Shows How To Confirm Indexing Issues Due To JavaScript via @sejournal, @martinibuster

SearchNorwich recently published an excellent video featuring Google’s Martin Splitt discussing how to debug crawling and indexing issues related to JavaScript, saying that most of the times it’s not JavaScript that’s causing indexing issues, the actual cause is something else. Even if you don’t know how to code with JavaScript, the tips that Martin shares will enable anyone to get a good start on debugging crawl issues that are originating on a website.

JavaScript Is Rarely The Cause Of SEO Issues

Martin’s SearchNorwich video was published a month ago. Just a few days ago John Mueller advises that too much JavaScript can have a negative impact on SEO, which aligns with Martin’s assertion that JavaScript is rarely the reason for SEO issues, that it’s either the misuse of JavaScript or something else entirely.

He explains that of the issues that virtually all suspected JavaScript issues that get emailed to him end up being something else. He pins the blame on a flawed approach to debugging SEO issues. What he describes is confirmation bias, which is suspecting that something is the cause and then looking for clues to justify that opinion. The definition of confirmation bias is the tendency to interpret existing evidence or to look for evidence that confirms existing beliefs, while ignoring evidence that contradicts those beliefs.

Martin explained:

“…it seems to me, as someone on the Google side of things, that SEOs look for clues that allow them to blame things they’re seeing on JavaScript. Then they show up, or someone from their team shows up, in my inbox or on my social media and says, “We found a bug. It’s JavaScript. You say JavaScript works in Google Search, but we have a strong hint that it doesn’t, and you know it’s because of JavaScript.”

He goes on to say that out of hundreds of times a year that he’s approached with a diagnosis that JavaScript is to blame for an SEO problem he has only seen one actual instance where an actual bug related to JavaScript was to blame. Just one.

He also says:

“People often claim, “You say it works if you use client-side rendering, but clearly, it is not working. It must be a JavaScript problem and maybe even a bug in Google.” Surprisingly, many of the people who end up in my inbox suspect it’s a Google bug. I find that interesting, especially when a small, niche website claims to be affected by a bug that doesn’t affect any other websites. Most of the time, it’s not us—it’s you.”

Splitt explains that when JavaScript is involved in a crawling or rendering issue, it’s most often not because JavaScript is to blame but rather it’s being used incorrectly

Finding Source Of Rendering Issues

Martin suggests debugging rendering issues by checking how Google “sees” the web page. Rendering, in the context of Googlebot crawling, is the process of downloading all the resources from a web page like fonts, JavaScript, CSS and HTML and then creating fully functional web page that’s similar to what a human user would experience in a web browser.

Debugging how Google renders a page may show that the page renders fine, that certain parts don’t render or that the page cannot be indexed at all.

He recommends using the following tools for debugging possible JavaScript issues:

1. Google Search Console URL Inspection Tool

2. Google Rich Results Test

3. Chrome Dev Tools

Easy JavaScript Debugging

Both of the first two tools let you submit a URL that gets immediately crawled by Google and they’ll show you the rendered page, what the page looks like for Google for indexing purposes.

Martin explains the usefulness of the JavaScript console messages in Chrome Dev Tools:

“There’s also more info that gives you very helpful details about what happened in the JavaScript console messages and what happened in the network. If your content is there and it’s what you expect it to be, then it’s very likely not going to be JavaScript that is causing the problem. If people were doing just that, checking these basics, 90% of the people showing up in my inbox would not show up in my inbox. That’s what I do.”

He also explained that just because the JavaScript console flags an error that doesn’t mean that the problem is with the JavaScript itself. He uses the example of an error in how JavaScript failed to execute that was caused by an API that’s blocked by Robots.txt, preventing the page from rendering.

Why Do So Many SEOs Blame JavaScript?

Martin implies that not knowing how to debug JavaScript is the cause of the reputation it’s received as a cause of crawling and indexing issues. I get it, I learned the basics of coding JavaScript by hand 25 years ago and I disliked it then and now, it’s never been my thing.

But Martin’s right that knowing a few tricks for debugging JavaScript will save a lot of wasted time chasing down the wrong problem.

Watch Martin Splitt’s presentation here:

Maybe It Isn’t JavaScript – Martin Splitt at SearchNorwich 18

Featured Image by Shutterstock/Artem Samokhvalov

Small language models: 10 Breakthrough Technologies 2025

WHO

Allen Institute for Artificial Intelligence, Anthropic, Google, Meta, Microsoft, OpenAI

WHEN

Now

Make no mistake: Size matters in the AI world. When OpenAI launched GPT-3 back in 2020, it was the largest language model ever built. The firm showed that supersizing this type of model was enough to send performance through the roof. That kicked off a technology boom that has been sustained by bigger models ever since. As Noam Brown, a research scientist at OpenAI, told an audience at TEDAI San Francisco in October, “The incredible progress in AI over the past five years can be summarized in one word: scale.”

But as the marginal gains for new high-end models trail off, researchers are figuring out how to do more with less. For certain tasks, smaller models that are trained on more focused data sets can now perform just as well as larger ones—if not better. That’s a boon for businesses eager to deploy AI in a handful of specific ways. You don’t need the entire internet in your model if you’re making the same kind of request again and again. 

Most big tech firms now boast fun-size versions of their flagship models for this purpose: OpenAI offers both GPT-4o and GPT-4o mini; Google DeepMind has Gemini Ultra and Gemini Nano; and Anthropic’s Claude 3 comes in three flavors: outsize Opus, midsize Sonnet, and tiny Haiku. Microsoft is pioneering a range of small language models called Phi.

A growing number of smaller companies offer small models as well. The AI startup Writer claims that its latest language model matches the performance of the largest top-tier models on many key metrics despite in some cases having just a 20th as many parameters (the values that get calculated during training and determine how a model behaves). 

Explore the full 2025 list of 10 Breakthrough Technologies.

Smaller models are more efficient, making them quicker to train and run. That’s good news for anyone wanting a more affordable on-ramp. And it could be good for the climate, too: Because smaller models work with a fraction of the computer oomph required by their giant cousins, they burn less energy. 

These small models also travel well: They can run right in our pockets, without needing to send requests to the cloud. Small is the next big thing.

Vera C. Rubin Observatory: 10 Breakthrough Technologies 2025

WHO

US Department of Energy’s SLAC National Accelerator Laboratory, US National Science Foundation

WHEN

6 months

The next time you glance up at the night sky, consider: The particles inside everything you can see make up only about 5% of what’s out there in the universe. Dark energy and dark matter constitute the rest, astronomers believe—but what exactly is this mysterious stuff? 

A massive new telescope erected in Chile will explore this question and other cosmic unknowns. It’s named for Vera Rubin, an American astronomer who in the 1970s and 1980s observed stars moving faster than expected in the outer reaches of dozens of spiral galaxies. Her calculations made a strong case for the existence of dark matter—mass we can’t directly observe but that appears to shape everything from the paths of stars to the structure of the universe itself. 

Explore the full 2025 list of 10 Breakthrough Technologies.

Soon, her namesake observatory will carry on that work in much higher definition. The facility, run by the SLAC National Accelerator Laboratory and the US National Science Foundation, will house the largest digital camera ever made for astronomy. And its first mission will be to complete what’s called the Legacy Survey of Space and Time. Astronomers will focus its giant lens on the sky over the Southern Hemisphere and snap photo after photo, passing over the same patches of sky repeatedly for a decade. 

By the end of the survey, this 3.2-gigapixel camera will have catalogued 20 billion galaxies and collected up to 60 petabytes of data—roughly three times the amount currently stored by the US Library of Congress. Compiling all these images together, with help from specialized algorithms and a supercomputer, will give astronomers a time-lapse view of the sky. Seeing how so many galaxies are dispersed and shaped will enable them to study dark matter’s gravitational effect. They also plan to create the most detailed three-dimensional map of our Milky Way galaxy ever made. 

If all goes well, the telescope will snap its first science-quality images—a special moment known as first light—in mid-2025. The public could see the first photo released from Rubin soon after. 

Long-acting HIV prevention meds: 10 Breakthrough Technologies 2025

WHO

Gilead Sciences, GSK, ViiV Healthcare

WHEN

1 to 3 years

In June 2024, results from a trial of a new medicine to prevent HIV were announced—and they were jaw-dropping. Lenacapavir, a treatment injected once every six months, protected over 5,000 girls and women in Uganda and South Africa from getting HIV. And it was 100% effective.

The drug, which is produced by Gilead, has other advantages. We’ve had effective pre-exposure prophylactic (PrEP) drugs for HIV since 2012, but these must be taken either daily or in advance of each time a person is exposed to the virus. That’s a big ask for healthy people. And because these medicines also treat infections, there’s stigma attached to taking them. For some, the drugs are expensive or hard to access. In the lenacapavir trial, researchers found that injections of the new drug were more effective than a daily PrEP pill, probably because participants didn’t manage to take the pills every day.

 In 2021, the US Food and Drug Administration approved another long-acting injectable drug that protects against HIV. That drug, cabotegravir, is manufactured by ViiV Healthcare (which is largely owned by GSK) and needs to be injected every two months. But despite huge demand, rollout has been slow.   

Explore the full 2025 list of 10 Breakthrough Technologies.

Scientists and activists hope that the story will be different for lenacapavir. So far, the FDA has approved the drug only for people who already have HIV that’s resistant to other treatments. But Gilead has signed licensing agreements with manufacturers to produce generic versions for HIV prevention in 120 low-income countries. 

In October, Gilead announced more trial results for lenacapavir, finding it 96% effective at preventing HIV infection in just over 3,200 cisgender gay, bisexual, and other men, as well as transgender men, transgender women, and nonbinary people who have sex with people assigned male at birth. 

The United Nations has set a goal of ending AIDS by 2030. It’s ambitious, to say the least: We still see over 1 million new HIV infections globally every year. But we now have the medicines to get us there. What we need is access. 

Generative AI search: 10 Breakthrough Technologies 2025

WHO

Apple, Google, Meta, Microsoft, OpenAI, Perplexity

WHEN

Now

Google’s introduction of AI Overviews, powered by its Gemini language model, will alter how billions of people search the internet. And generative search may be the first step toward an AI agent that handles any question you have or task you need done.

Rather than returning a list of links, AI Overviews offer concise answers to your queries. This makes it easier to get quick insights without scrolling and clicking through to multiple sources. After a rocky start with high-profile nonsense results following its US release in May 2024, Google limited its use of answers that draw on user-­generated content or satire and humor sites.   

Explore the full 2025 list of 10 Breakthrough Technologies.

The rise of generative search isn’t limited to Google. Microsoft and OpenAI both rolled out versions in 2024 as well. Meanwhile, in more places, on our computers and other gadgets, AI-assisted searches are now analyzing images, audio, and video to return custom answers to our queries. 

But Google’s global search dominance makes it the most important player, and the company has already rolled out AI Overviews to more than a billion people worldwide. The result is searches that feel more like conversations. Google and OpenAI both report that people interact differently with generative search—they ask longer questions and pose more follow-ups.    

This new application of AI has serious implications for online advertising and (gulp) media. Because these search products often summarize information from online news stories and articles in their responses, concerns abound that generative search results will leave little reason for people to click through to the original sources, depriving those websites of potential ad revenue. A number of publishers and artists have sued over the use of their content to train AI models; now, generative search will be another battleground between media and Big Tech.