WordPress plugin vulnerabilities: week 6, 2023

34 vulnerabilities published Feb 6 – Feb 12, 2023 in 16 plugins we track, by day.

34 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Wednesday, February 8, 2023 · 12

medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0726 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0725 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0724 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0722 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0720 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0717 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0716 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0715 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0711 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0685 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0684 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0718 · affected 2.18.16 and older · fixed in 2.18.17 *

Tuesday, February 7, 2023 · 8

medium 5.4 MapGeo

Stored cross-site scripting (XSS)

CVE-2023-0731 · affected 1.5.9 and older · fixed in 1.5.11 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0730 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0727 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0723 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0719 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0712 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Cross-site request forgery (CSRF)

CVE-2023-0728 · affected 2.18.16 and older · fixed in 2.18.17 *
medium 4.3 Wicked Folders

Missing authorization check

CVE-2023-0713 · affected 2.18.16 and older · fixed in 2.18.17 *

Monday, February 6, 2023 · 14

medium 5.4 Contextual Related Posts

Stored cross-site scripting (XSS)

CVE-2023-0252 · affected older than 3.3.1 · fixed in 3.3.1
medium 6.1 Tutor LMS

Reflected cross-site scripting (XSS)

CVE-2023-0236 · affected older than 2.0.10 · fixed in 2.0.10
medium 5.4 Happyforms

Stored cross-site scripting (XSS)

CVE-2023-0096 · affected older than 1.22.0 · fixed in 1.22.0
medium 5.4 HTML5 Audio Player

Stored cross-site scripting (XSS)

CVE-2023-0170 · affected older than 2.1.12 · fixed in 2.1.12
medium 5.4 Giveaways and Contests by RafflePress

Stored cross-site scripting (XSS)

CVE-2023-0176 · affected older than 1.11.3 · fixed in 1.11.3
medium 5.4 Clean Login

Stored cross-site scripting (XSS)

CVE-2022-4838 · affected older than 1.13.7 · fixed in 1.13.7
medium 5.4 Materialis Companion

Stored cross-site scripting (XSS)

CVE-2022-4762 · affected older than 1.3.40 · fixed in 1.3.40
medium 5.4 Page View Count

Stored cross-site scripting (XSS)

CVE-2023-0095 · affected older than 2.6.1 · fixed in 2.6.1
medium 5.4 Strong Testimonials

Stored cross-site scripting (XSS)

CVE-2022-4717 · affected older than 3.0.3 · fixed in 3.0.3
medium 5.4 WP-ShowHide

Stored cross-site scripting (XSS)

CVE-2022-4825 · affected older than 1.05 · fixed in 1.05
medium 5.4 Logo Slider

Stored cross-site scripting (XSS)

CVE-2022-4664 · affected older than 3.6.0 · fixed in 3.6.0
medium 5.4 Restaurant Menu

Stored cross-site scripting (XSS)

CVE-2022-4657 · affected older than 2.3.6 · fixed in 2.3.6
medium 6.1 PDF Generator for WordPress

Reflected cross-site scripting (XSS)

CVE-2022-4321 · affected older than 1.1.2 · fixed in 1.1.2
medium 6.5 Stream

Information disclosure

CVE-2022-4384 · affected older than 3.9.2 · fixed in 3.9.2

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan