WordPress plugin vulnerabilities: week 8, 2023

15 vulnerabilities published Feb 20 – Feb 26, 2023 in 12 plugins we track, by day.

2 critical 2 high 11 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Friday, February 24, 2023 · 3

• medium 4.3 WP Meta SEO

  Cross-site request forgery (CSRF)

  CVE-2023-1029 · affected 4.5.3 and older · fix not stated

• medium 5.4 All in One SEO

  Stored cross-site scripting (XSS)

  CVE-2023-0586 · affected 4.2.9 and older · fixed in 4.9.5 *

• medium 4.8 All in One SEO

  Stored cross-site scripting (XSS)

  CVE-2023-0585 · affected 4.2.9 and older · fixed in 4.9.5 *

Thursday, February 23, 2023 · 3

• critical 9.8 BuddyForms

  PHP object injection

  CVE-2023-26326 · affected older than 2.7.8 · fixed in 2.7.8

• high 8.8 WPBot

  Cross-site request forgery (CSRF)

  CVE-2023-24415 · affected 4.2.8 and older · fixed in 4.2.9

• high 8.8 Organization chart

  Cross-site request forgery (CSRF)

  CVE-2023-24384 · affected 1.4.4 and older · fixed in 1.4.5

Tuesday, February 21, 2023 · 9

• medium 6.1 Japanized for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2023-0942 · affected 2.5.4 and older · fixed in 2.5.5 *

• medium 5.4 GS Portfolio for Envato

  Stored cross-site scripting (XSS)

  CVE-2023-0559 · affected older than 1.4.0 · fixed in 1.4.0

• medium 5.4 Easy Digital Downloads

  Stored cross-site scripting (XSS)

  CVE-2023-0380 · affected older than 3.1.0.5 · fixed in 3.1.0.5

• medium 4.8 Watu Quiz

  Stored cross-site scripting (XSS)

  CVE-2023-0429 · affected older than 3.3.8.2 · fixed in 3.3.8.2

• medium 6.1 Watu Quiz

  Reflected cross-site scripting (XSS)

  CVE-2023-0428 · affected older than 3.3.8.2 · fixed in 3.3.8.2

• critical 9.8 ShopLentor

  PHP object injection

  CVE-2023-0232 · affected older than 2.5.4 · fixed in 2.5.4

• medium 5.4 Youzify

  Stored cross-site scripting (XSS)

  CVE-2023-0059 · affected older than 1.2.2 · fixed in 1.2.2

• medium 4.3 Intuitive Custom Post Order

  Cross-site request forgery (CSRF)

  CVE-2022-4386 · affected older than 3.1.4 · fixed in 3.1.4

• medium 4.3 Intuitive Custom Post Order

  Missing authorization check

  CVE-2022-4385 · affected older than 3.1.4 · fixed in 3.1.4

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan