WordPress plugin vulnerabilities: week 33, 2019
66 vulnerabilities published Aug 12 – Aug 18, 2019 in 31 plugins we track, by day.
13 critical 13 high 40 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Friday, August 16, 2019 · 5
-
medium 6.1 Easy Digital Downloads
-
high 8.8 Church Admin
-
high 8.8 Nelio A/B Testing
-
critical 9.8 Easy Digital Downloads
-
critical 9.8 WP Business Intelligence Lite
Thursday, August 15, 2019 · 4
-
medium 6.1 CP Contact Form with PayPal
-
medium 6.1 Custom 404 Pro
-
high 8.8 Newsletters
-
medium 5.3 FV Flowplayer Video Player
Wednesday, August 14, 2019 · 20
-
critical 9.8 All-In-One Security (AIOS)
-
high 8.8 WP Ultimate CSV Importer
-
critical 9.8 All-In-One Security (AIOS)
-
critical 9.8 All-In-One Security (AIOS)
-
high 8.8 Simple Membership
-
critical 9.8 WP Editor
Security issue
-
high 8.8 WP Editor
-
high 8.8 WP Maps
-
high 8.8 WP Maps
-
high 8.8 WP Maps
-
critical 9.8 Ninja Forms
-
critical 9.8 NewStatPress
-
medium 6.1 NewStatPress
-
critical 9.8 NewStatPress
-
medium 6.1 NewStatPress
-
medium 6.1 NewStatPress
-
critical 9.8 Photo Gallery, Sliders, Proofing and Themes
-
critical 9.8 WP Fastest Cache
-
critical 9.8 WP Statistics
Tuesday, August 13, 2019 · 19
-
medium 6.1 All-In-One Security (AIOS)
-
medium 6.1 All-In-One Security (AIOS)
-
medium 6.1 JetBackup
-
medium 6.1 Contact Form by BestWebSoft
-
medium 6.1 Contact Form to DB by BestWebSoft
-
high 8.8 Contact Form Email
-
medium 6.1 Contact Form Email
-
medium 6.1 All-In-One Security (AIOS)
-
medium 6.1 Contact Form by BestWebSoft
-
medium 6.1 Events Manager
-
medium 6.1 Events Manager
-
medium 6.1 MC4WP
-
medium 6.1 All-In-One Security (AIOS)
-
medium 6.1 All-In-One Security (AIOS)
-
medium 6.1 Contact Form by BestWebSoft
-
medium 6.1 Contact Form by BestWebSoft
-
medium 6.1 Download Monitor
-
critical 9.8 Events Manager
-
medium 6.1 Events Manager
Monday, August 12, 2019 · 18
-
medium 5.4 Ultimate Member
-
medium 5.4 Ultimate Member
-
medium 5.4 Ultimate Member
-
medium 6.1 Ultimate Member
-
medium 6.1 Booster for WooCommerce
-
medium 6.1 Simple Membership
-
medium 6.1 Ultimate Member
-
medium 6.1 Ultimate Member
-
medium 5.4 PPOM
-
medium 6.1 WP Database Backup
-
medium 6.1 PDF Invoices & Packing Slips for WooCommerce
-
high 8.8 WP Database Backup
-
medium 6.1 WP Database Backup
-
high 8.8 WP Database Backup
-
medium 6.1 WP Database Backup
-
medium 6.1 WP Maps
-
medium 6.1 WP Maps
-
medium 6.1 WP Ultimate CSV Importer
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.