These included the Furby Connect, i-Que Intelligent Robot, Toy-Fi Teddy and CloudPets.
As with anything technological, once hackers connect to the toys they are able to send messages, which can then be heard as the child plays with the toy.
The group's resident hackers found they could send text and audio messages through the toys, either through their companion apps or by connecting via laptop, without a password or other form of authentication.
That's something that's especially concerning when kids' toys are involved, and Which? has asked retailers to stop selling the ones that have "proven" problems where security is concerned.
Alex Neill, managing director of home products at Which?, said: "You wouldn't let a young child play with a smartphone unsupervised and our investigation shows parents need to apply the same level of caution if considering giving a child a connect toy".
Security experts warned that some toys which used Bluetooth wireless technology had few or no security measures.
Another safety advice is to always talk to your children, keep communication open when it comes to being safe online. But Which? found the toy could be hacked via its unsecured Bluetooth connection. "If that can't be guaranteed, then the products should not be sold".
Trump asks Chinese president to help UCLA trio
White House press secretary Sarah Huckabee Sanders confirmed in an email to the newspaper that Trump raised the issue with Xi. The Post reports that charges against the players have been reduced, and that the case is closing in on a resolution.
With the Furby Connect, anyone within a 30 to 100 foot (10 to 30 metre) Bluetooth range can connect to the toy when it's switched on.
Which? also tested Wowee Chip, Mattel Hello Barbie, and Fisher Price's Smart Toy Bear but couldn't find evidence that these toys had any security issues.
Vivid Imaginations, which distributes the robot on behalf of manufacturer Genesis, downplayed fears over its security, adding that its toys fully comply with the Toy Safety Directive and European standards.
It said: 'While it may be technically possible for a third party (someone other than the intended user) to connect to the toys, it requires certain sequence of events to happen in order to pair a Bluetooth device to the toy, all of which make it hard for the third party to remotely connect to the toy'.
The I-Que Intelligent Robot (left) has previously featured on Hamleys top toys Christmas list.
It said: 'While the researchers at Which? identified ways to manipulate the Furby Connect toy, we believe that doing so would require close proximity to the toy. Hasbro, which makes Furbys, claimed that the testing was done in a very specific set of conditions, and that someone would have to reverse engineer the product and create new firmware to gain access.
Spiral Toys, which makes the Toy-Fi Teddy and CloudPets devices, has not yet commented on the report.