These included the Furby Connect, i-Que Intelligent Robot, Toy-Fi Teddy and CloudPets.
As with anything technological, once hackers connect to the toys they are able to send messages, which can then be heard as the child plays with the toy.
The group's resident hackers found they could send text and audio messages through the toys, either through their companion apps or by connecting via laptop, without a password or other form of authentication.
That's something that's especially concerning when kids' toys are involved, and Which? has asked retailers to stop selling the ones that have "proven" problems where security is concerned.
Alex Neill, managing director of home products at Which?, said: "You wouldn't let a young child play with a smartphone unsupervised and our investigation shows parents need to apply the same level of caution if considering giving a child a connect toy".
Security experts warned that some toys which used Bluetooth wireless technology had few or no security measures.
Another safety advice is to always talk to your children, keep communication open when it comes to being safe online. But Which? found the toy could be hacked via its unsecured Bluetooth connection. "If that can't be guaranteed, then the products should not be sold".
Diabetes a very real danger for women
Today is World Diabetes Day , and experts estimate there are up to 549,000 people living with diabetes who don't know it yet. Nearly half of women who die in low-income countries due to high blood glucose die prematurely, before the age of 70 years.
With the Furby Connect, anyone within a 30 to 100 foot (10 to 30 metre) Bluetooth range can connect to the toy when it's switched on.
Which? also tested Wowee Chip, Mattel Hello Barbie, and Fisher Price's Smart Toy Bear but couldn't find evidence that these toys had any security issues.
Vivid Imaginations, which distributes the robot on behalf of manufacturer Genesis, downplayed fears over its security, adding that its toys fully comply with the Toy Safety Directive and European standards.
It said: 'While it may be technically possible for a third party (someone other than the intended user) to connect to the toys, it requires certain sequence of events to happen in order to pair a Bluetooth device to the toy, all of which make it hard for the third party to remotely connect to the toy'.
The I-Que Intelligent Robot (left) has previously featured on Hamleys top toys Christmas list.
It said: 'While the researchers at Which? identified ways to manipulate the Furby Connect toy, we believe that doing so would require close proximity to the toy. Hasbro, which makes Furbys, claimed that the testing was done in a very specific set of conditions, and that someone would have to reverse engineer the product and create new firmware to gain access.
Spiral Toys, which makes the Toy-Fi Teddy and CloudPets devices, has not yet commented on the report.