WordPress plugin vulnerabilities: week 34, 2019
85 vulnerabilities published Aug 19 – Aug 25, 2019 in 46 plugins we track, by day.
21 critical 18 high 46 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Thursday, August 22, 2019 · 49
-
medium 6.1 Import and export users and customers
-
medium 6.1 Import and export users and customers
-
medium 5.4 Advanced Custom Fields (ACF®)
-
medium 6.1 cformsII
-
critical 9.8 Newsletters
-
high 7.5 Iptanus File Upload
-
high 7.5 Iptanus File Upload
-
high 7.5 Iptanus File Upload
-
high 7.5 WebP Express
-
critical 9.1 Insert Pages
-
medium 6.1 cformsII
-
high 7.5 Iptanus File Upload
-
high 8.8 Ad Inserter
-
high 7.5 Ad Inserter
-
critical 9.8 OptionTree
-
critical 9.8 OptionTree
-
critical 9.8 OptionTree
-
medium 6.1 MC4WP
-
critical 9.8 Patreon WordPress
-
critical 9.8 Shortcodes Ultimate
-
medium 6.1 Time Sheets
-
medium 6.1 Time Sheets
-
medium 6.1 Perfect Images
-
critical 10.0 Nelio A/B Testing
-
critical 10.0 Nelio A/B Testing
-
high 7.5 User Profile Builder
-
critical 9.8 Store Toolkit
-
critical 9.8 Store Toolkit
-
medium 5.4 GiveWP
-
critical 9.8 cformsII
-
critical 9.8 Contact Form 7
-
critical 9.8 Photo Gallery by Ays
-
medium 6.1 Media Library Assistant
-
medium 6.1 NewStatPress
-
critical 9.1 Ninja Forms
Security issue
-
high 7.5 Ninja Forms
Security issue
-
medium 6.1 Ninja Forms
Security issue
-
critical 9.8 Appointment Booking Calendar
-
critical 9.8 cformsII
-
medium 6.1 Clean Login
-
medium 6.1 Contact Form by BestWebSoft
-
medium 6.1 Events Manager
-
medium 6.1 Events Manager
-
medium 6.1 Events Manager
-
medium 6.1 Events Manager
-
medium 6.1 Events Manager
-
high 8.8 Photo Gallery by Supsystic
Wednesday, August 21, 2019 · 20
-
medium 6.1 Activity Log
-
medium 6.1 Activity Log
-
medium 6.1 cformsII
-
critical 9.8 Yoast Duplicate Post
-
medium 6.1 Yoast Duplicate Post
-
medium 6.1 Max Mega Menu
-
medium 6.1 cformsII
-
medium 6.1 RSVP and Event Management
-
medium 6.1 User Profile Builder
-
medium 6.1 User Profile Builder
-
medium 6.1 User Profile Builder
-
critical 9.8 WP Frontend Profile
-
medium 6.1 WP Frontend Profile
-
medium 6.1 SlimStat Analytics
-
critical 9.8 Booking Calendar Contact Form
-
medium 6.1 Booking Calendar Contact Form
-
high 8.8 WP Customer Reviews
-
medium 6.1 WP Customer Reviews
-
medium 6.1 The Events Calendar
-
medium 6.1 SEO Redirection Plugin
Tuesday, August 20, 2019 · 16
-
medium 6.1 WP All Import
-
medium 6.1 Chained Quiz
-
medium 6.1 WP Customer Area
-
medium 6.1 Football Pool
-
medium 6.1 OptionTree
-
medium 6.1 OptionTree
-
high 8.8 cformsII
-
high 7.5 Awesome Support
Security issue
-
medium 6.1 Awesome Support
-
high 8.8 Customer Engagement System
-
high 8.8 User Access Manager
-
medium 6.1 WP All Import
-
high 7.5 WP All Import
Security issue
-
critical 9.8 WP All Import
-
medium 6.1 WP All Import
-
medium 6.1 WP Latest Posts
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.