WordPress plugin vulnerabilities: week 8, 2022

27 vulnerabilities published Feb 21 – Feb 27, 2022 in 18 plugins we track, by day.

1 critical 8 high 17 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Thursday, February 24, 2022 · 9

• medium 6.1 Header Footer Code Manager

  Reflected cross-site scripting (XSS)

  CVE-2022-0710 · affected 1.1.16 to 1.1.16 · fixed in 1.1.17 *

• medium 6.1 WP Statistics

  Cross-site scripting (XSS)

  CVE-2022-25307 · affected 13.1.5 to 13.1.5 · fixed in 13.1.6 *

• medium 6.1 WP Statistics

  Cross-site scripting (XSS)

  CVE-2022-25306 · affected 13.1.5 to 13.1.5 · fixed in 13.1.6 *

• medium 6.1 WP Statistics

  Cross-site scripting (XSS)

  CVE-2022-25305 · affected 13.1.5 to 13.1.5 · fixed in 13.1.6 *

• high 7.5 WP Statistics

  SQL injection

  CVE-2022-25149 · affected 13.1.5 to 13.1.5 · fixed in 13.1.6 *

• critical 9.8 WP Statistics

  SQL injection

  CVE-2022-25148 · affected 13.1.5 to 13.1.5 · fixed in 13.1.6 *

• medium 6.1 Essential Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2022-0683 · affected 5.0.8 to 5.0.8 · fixed in 5.0.9 *

• medium 6.1 User Profile Builder

  Cross-site scripting (XSS)

  CVE-2022-0653 · affected 3.6.1 to 3.6.1 · fixed in 3.6.2 *

• high 7.5 WP Statistics

  SQL injection

  CVE-2022-0651 · affected 13.1.5 to 13.1.5 · fixed in 13.1.6 *

Monday, February 21, 2022 · 18

• medium 4.3 Spiffy Calendar

  Cross-site request forgery (CSRF)

  CVE-2022-25599 · affected 4.9.0 and older · fixed in 4.9.2 *

• high 7.5 Comments

  Information disclosure

  CVE-2022-23984 · affected 7.3.11 and older · fixed in 7.3.12 *

• medium 6.1 Survey Maker by AYS

  Stored cross-site scripting (XSS)

  CVE-2021-26256 · affected 2.0.6 and older · fix not stated

• medium 6.1 Ad Inserter

  Reflected cross-site scripting (XSS)

  CVE-2022-0288 · affected older than 2.7.10 · fixed in 2.7.10

• low 3.1 AnyComment

  Security issue

  CVE-2022-0279 · affected older than 0.2.18 · fixed in 0.2.18

• high 8.8 AnyComment

  Cross-site request forgery (CSRF)

  CVE-2022-0134 · affected older than 0.2.18 · fixed in 0.2.18

• medium 5.4 Image Photo Gallery Final Tiles Grid

  Cross-site scripting (XSS)

  CVE-2022-0186 · affected older than 3.5.3 · fixed in 3.5.3

• medium 6.1 GiveWP

  Reflected cross-site scripting (XSS)

  CVE-2022-0252 · affected older than 2.17.3 · fixed in 2.17.3

• high 7.2 Popup Builder

  SQL injection

  CVE-2022-0228 · affected older than 4.0.7 · fixed in 4.0.7

• high 7.2 Database Backup for WordPress

  SQL injection

  CVE-2022-0255 · affected older than 2.5.1 · fixed in 2.5.1

• medium 4.8 Shield Security

  Cross-site scripting (XSS)

  CVE-2022-0211 · affected older than 13.0.6 · fixed in 13.0.6

• medium 5.4 Five Star Business Profile and Schema

  Cross-site request forgery (CSRF)

  CVE-2021-25060 · affected older than 2.1.7 · fixed in 2.1.7

• high 8.8 Download Manager

  Reflected cross-site scripting (XSS)

  CVE-2021-25069 · affected older than 3.2.34 · fixed in 3.2.34

• medium 6.1 FeedWordPress

  Reflected cross-site scripting (XSS)

  CVE-2021-25055 · affected older than 2022.0123 · fixed in 2022.0123

• medium 6.1 GiveWP

  Reflected cross-site scripting (XSS)

  CVE-2021-25100 · affected older than 2.17.3 · fixed in 2.17.3

• medium 6.1 GiveWP

  Reflected cross-site scripting (XSS)

  CVE-2021-25099 · affected older than 2.17.3 · fixed in 2.17.3

• medium 4.8 Anti-Malware Security and Brute-Force Firewall

  Reflected cross-site scripting (XSS)

  CVE-2021-25101 · affected older than 4.20.94 · fixed in 4.20.94

• high 8.8 Popup Builder

  Remote code execution

  CVE-2021-25082 · affected older than 4.0.7 · fixed in 4.0.7

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan