WordPress plugin vulnerabilities: week 35, 2019

46 vulnerabilities published Aug 26 – Sep 1, 2019 in 38 plugins we track, by day.

10 critical 16 high 20 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Friday, August 30, 2019 · 18

• medium 6.1 Custom 404 Pro

  Reflected cross-site scripting (XSS)

  CVE-2019-15838 · affected older than 3.2.8 · fixed in 3.2.8

• high 8.8 Meta for WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2019-15841 · affected older than 1.9.15 · fixed in 1.9.15

• high 8.8 Meta for WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2019-15840 · affected older than 1.9.14 · fixed in 1.9.14

• high 7.5 Sina Extension for Elementor

  File inclusion

  CVE-2019-15839 · affected older than 2.2.1 · fixed in 2.2.1

• high 8.8 Converter for Media

  Cross-site request forgery (CSRF)

  CVE-2019-15834 · affected older than 1.0.3 · fixed in 1.0.3

• medium 5.4 WebP Express

  Stored cross-site scripting (XSS)

  CVE-2019-15837 · affected older than 0.14.8 · fixed in 0.14.8

• medium 5.4 Icegram Engage

  Cross-site scripting (XSS)

  CVE-2019-15830 · affected older than 1.10.29 · fixed in 1.10.29

• medium 5.4 OneSignal

  Cross-site scripting (XSS)

  CVE-2019-15827 · affected 1.17.5 only · fixed in 1.17.6 *

• medium 4.8 Gallery PhotoBlocks

  Cross-site scripting (XSS)

  CVE-2019-15829 · affected older than 1.1.33 · fixed in 1.1.33

• high 8.8 Visitor Traffic Real Time Statistics

  Cross-site request forgery (CSRF)

  CVE-2019-15832 · affected older than 1.13 · fixed in 1.13

• high 8.8 Visitor Traffic Real Time Statistics

  Cross-site request forgery (CSRF)

  CVE-2019-15831 · affected older than 1.12 · fixed in 1.12

• critical 9.8 WPS Hide Login

  Security issue

  CVE-2019-15826 · affected older than 1.5.3 · fixed in 1.5.3

• high 7.5 Bold Page Builder

  Security issue

  CVE-2019-15821 · affected older than 2.3.2 · fixed in 2.3.2

• medium 6.1 Easy Property Listings

  Cross-site scripting (XSS)

  CVE-2019-15817 · affected older than 3.4 · fixed in 3.4

• high 8.8 Photo Gallery by 10Web

  Cross-site request forgery (CSRF)

  CVE-2015-9380 · affected older than 1.2.42 · fixed in 1.2.42

• critical 9.8 WPS Hide Login

  Security issue

  CVE-2019-15825 · affected older than 1.5.3 · fixed in 1.5.3

• critical 9.8 WPS Hide Login

  Security issue

  CVE-2019-15824 · affected older than 1.5.3 · fixed in 1.5.3

• critical 9.8 WPS Hide Login

  Security issue

  CVE-2019-15823 · affected older than 1.5.3 · fixed in 1.5.3

Thursday, August 29, 2019 · 5

• high 8.8 Social Feed Gallery

  Cross-site request forgery (CSRF)

  CVE-2019-15779 · affected older than 2.4.8 · fixed in 2.4.8

• critical 9.8 Formidable Forms

  PHP object injection

  CVE-2019-15780 · affected older than 4.02.01 · fixed in 4.02.01

• high 8.8 HandL UTM Grabber / Tracker

  Cross-site request forgery (CSRF)

  CVE-2019-15769 · affected older than 2.6.5 · fixed in 2.6.5

• medium 6.1 Hotel Booking

  Open redirect

  CVE-2019-15774 · affected older than 2.5 · fixed in 2.5

• medium 5.4 WP DSGVO Tools (GDPR)

  Cross-site scripting (XSS)

  CVE-2019-15777 · affected older than 2.2.19 · fixed in 2.2.19

Wednesday, August 28, 2019 · 6

• medium 6.1 My Calendar

  Cross-site scripting (XSS)

  CVE-2019-15713 · affected older than 3.1.10 · fixed in 3.1.10

• medium 6.1 UpdraftPlus

  Cross-site scripting (XSS)

  CVE-2017-18593 · affected older than 1.13.5 · fixed in 1.13.5

• medium 6.1 Akismet Anti-spam

  Cross-site scripting (XSS)

  CVE-2015-9357 · affected older than 3.1.5 · fixed in 3.1.5

• medium 6.1 FeedWordPress

  Cross-site scripting (XSS)

  CVE-2015-9358 · affected older than 2015.0514 · fixed in 2015.0514

• medium 6.1 Redirection

  Cross-site scripting (XSS)

  CVE-2012-6717 · affected older than 2.2.12 · fixed in 2.2.12

• medium 6.1 Redirection

  Cross-site scripting (XSS)

  CVE-2011-5329 · affected older than 2.2.9 · fixed in 2.2.9

Tuesday, August 27, 2019 · 17

• critical 9.8 Photo Gallery, Sliders, Proofing and Themes

  SQL injection

  CVE-2019-14314 · affected older than 3.2.10 · fixed in 3.2.10

• medium 6.1 GD Rating System

  Cross-site scripting (XSS)

  CVE-2017-18591 · affected older than 2.1 · fixed in 2.1

• medium 4.3 Easy Updates Manager

  Security issue

  CVE-2019-15650 · affected older than 8.0.5 · fixed in 8.0.5

• high 7.5 CatalogX Product Catalog, Product Enquiry & Qu…

  Arbitrary file upload

  CVE-2017-18592 · affected older than 3.1.0 · fixed in 3.1.0

• high 8.8 WP-Members Membership Plugin

  Cross-site request forgery (CSRF)

  CVE-2019-15660 · affected older than 3.2.8 · fixed in 3.2.8

• medium 6.1 WP-Polls

  Cross-site scripting (XSS)

  CVE-2016-10936 · affected older than 2.73.1 · fixed in 2.73.1

• critical 9.8 WP-Polls

  SQL injection

  CVE-2015-9352 · affected older than 2.72 · fixed in 2.72

• high 7.5 Sell Downloads

  Security issue

  CVE-2015-9348 · affected older than 1.0.8 · fixed in 1.0.8

• critical 9.8 Pie Register

  SQL injection

  CVE-2019-15659 · affected older than 3.1.2 · fixed in 3.1.2

• critical 9.8 BuddyForms

  SQL injection

  CVE-2018-21003 · affected older than 2.2.8 · fixed in 2.2.8

• high 8.8 Groundhogg

  Remote code execution

  CVE-2019-15647 · affected older than 1.3.5 · fixed in 1.3.5

• high 8.8 JS Help Desk

  Cross-site request forgery (CSRF)

  CVE-2018-21002 · affected older than 2.0.6 · fixed in 2.0.6

• medium 6.1 Ultimate FAQ Accordion Plugin

  Cross-site scripting (XSS)

  CVE-2019-15643 · affected older than 1.8.22 · fixed in 1.8.22

• medium 6.1 AnyComment

  Cross-site scripting (XSS)

  CVE-2018-21001 · affected older than 0.0.33 · fixed in 0.0.33

• critical 9.8 Store Exporter

  Privilege escalation

  CVE-2016-10935 · affected older than 1.8.4 · fixed in 1.8.4

• high 8.8 WP Rollback

  Cross-site request forgery (CSRF)

  CVE-2015-9343 · affected older than 1.2.3 · fixed in 1.2.3

• medium 6.1 WP Rollback

  Cross-site scripting (XSS)

  CVE-2015-9342 · affected older than 1.2.3 · fixed in 1.2.3

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan