WordPress plugin vulnerabilities: week 23, 2023

110 vulnerabilities published Jun 5 – Jun 11, 2023 in 58 plugins we track, by day.

15 critical 16 high 79 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Friday, June 9, 2023 · 62

• medium 4.3 WP Activity Log

  Cross-site request forgery (CSRF)

  CVE-2023-2286 · affected 4.5.0 and older · fixed in 4.5.2 *

• medium 4.3 WP Activity Log

  Cross-site request forgery (CSRF)

  CVE-2023-2285 · affected 4.5.0 and older · fixed in 4.5.2 *

• medium 4.3 WP Activity Log

  Missing authorization check

  CVE-2023-2284 · affected 4.5.0 and older · fixed in 4.5.2 *

• medium 4.3 WP Activity Log

  Missing authorization check

  CVE-2023-2261 · affected 4.5.0 and older · fixed in 4.5.2 *

• medium 5.3 Brizy

  Information disclosure

  CVE-2023-2897 · affected 2.4.18 and older · fixed in 2.4.19 *

• medium 4.3 WP EasyCart

  Cross-site request forgery (CSRF)

  CVE-2023-2896 · affected 5.4.8 and older · fixed in 5.4.9 *

• medium 4.3 WP EasyCart

  Cross-site request forgery (CSRF)

  CVE-2023-2895 · affected 5.4.8 and older · fixed in 5.4.9 *

• medium 4.3 WP EasyCart

  Cross-site request forgery (CSRF)

  CVE-2023-2894 · affected 5.4.8 and older · fixed in 5.4.9 *

• medium 4.3 WP EasyCart

  Cross-site request forgery (CSRF)

  CVE-2023-2893 · affected 5.4.8 and older · fixed in 5.4.9 *

• medium 4.3 WP EasyCart

  Cross-site request forgery (CSRF)

  CVE-2023-2892 · affected 5.4.8 and older · fixed in 5.4.9 *

• medium 4.3 WP EasyCart

  Cross-site request forgery (CSRF)

  CVE-2023-2891 · affected 5.4.8 and older · fixed in 5.4.9 *

• medium 5.5 Iptanus File Upload

  Stored cross-site scripting (XSS)

  CVE-2023-2767 · affected 4.19.1 and older · fixed in 4.19.2 *

• medium 4.9 Iptanus File Upload

  Path traversal / file read

  CVE-2023-2688 · affected 4.19.1 and older · fixed in 4.19.2 *

• high 7.2 MPG

  SQL injection

  CVE-2023-2607 · affected 3.3.17 and older · fixed in 3.3.18 *

• medium 5.4 WPCS

  Stored cross-site scripting (XSS)

  CVE-2023-2558 · affected 1.1.9 and older · fixed in 1.3.2 *

• medium 4.3 WPCS

  Missing authorization check

  CVE-2023-2557 · affected 1.1.9 and older · fixed in 1.3.2 *

• medium 4.8 PixelYourSite

  Stored cross-site scripting (XSS)

  CVE-2023-2584 · affected 9.3.6 and older · fixed in 9.3.7 *

• medium 4.3 WPCS

  Missing authorization check

  CVE-2023-2556 · affected 1.1.9 and older · fixed in 1.3.2 *

• medium 4.3 WPCS

  Missing authorization check

  CVE-2023-2555 · affected 1.1.9 and older · fixed in 1.3.2 *

• medium 5.4 Easy Google Maps by Supsystic

  Cross-site request forgery (CSRF)

  CVE-2023-2526 · affected 1.11.7 and older · fixed in 1.11.8 *

• medium 4.4 FiboSearch

  Stored cross-site scripting (XSS)

  CVE-2023-2450 · affected 1.23.0 only · fixed in 1.24.0 *

• medium 4.3 Online Booking & Scheduling Calendar by vcita

  Missing authorization check

  CVE-2023-2414 · affected 4.4.6 and older · fixed in 4.5 *

• medium 5.4 Download Manager

  Stored cross-site scripting (XSS)

  CVE-2023-2305 · affected 3.2.70 and older · fixed in 3.2.71 *

• medium 5.3 WP Directory Kit

  Missing authorization check

  CVE-2023-2280 · affected 1.2.2 and older · fixed in 1.2.3 *

• medium 5.4 WCFM

  Missing authorization check

  CVE-2023-2275 · affected 1.5.3 and older · fixed in 1.6.0 *

• high 8.8 wpForo Forum

  PHP object injection

  CVE-2023-2249 · affected 2.1.7 and older · fixed in 2.1.8 *

• medium 5.3 CMP

  Missing authorization check

  CVE-2023-2159 · affected 4.1.7 and older · fixed in 4.1.8 *

• medium 4.3 Gutenberg Essential Blocks

  Cross-site request forgery (CSRF)

  CVE-2023-2087 · affected 4.0.6 and older · fixed in 4.0.7 *

• medium 4.3 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2023-2086 · affected 4.0.6 and older · fixed in 4.0.7 *

• medium 4.3 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2023-2085 · affected 4.0.6 and older · fixed in 4.0.7 *

• medium 4.3 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2023-2084 · affected 4.0.6 and older · fixed in 4.0.7 *

• medium 4.3 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2023-2083 · affected 4.0.6 and older · fixed in 4.0.7 *

• medium 5.4 Locatoraid Store Locator

  Stored cross-site scripting (XSS)

  CVE-2023-2031 · affected 3.9.14 and older · fixed in 3.9.19 *

• medium 4.3 Getwid

  Missing authorization check

  CVE-2023-1910 · affected 1.8.3 and older · fixed in 1.8.7 *

• medium 5.4 PowerPress Podcasting plugin by Blubrry

  Stored cross-site scripting (XSS)

  CVE-2023-1917 · affected 10.0 and older · fixed in 10.0.1 *

• medium 6.5 Directorist

  Missing authorization check

  CVE-2023-1889 · affected 7.5.4 and older · fixed in 7.5.5 *

• high 8.8 Directorist

  Security issue

  CVE-2023-1888 · affected 7.5.4 and older · fixed in 7.5.5 *

• critical 9.6 Getwid

  Server-side request forgery (SSRF)

  CVE-2023-1895 · affected 1.8.3 and older · fixed in 1.8.7 *

• medium 5.3 MetForm

  Missing authorization check

  CVE-2023-1843 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 6.5 FluentCRM

  Security issue

  CVE-2023-1430 · affected 2.8.0.1 and older · fixed in 2.8.01 *

• medium 6.5 Ultra Addons for Contact Form 7

  SQL injection

  CVE-2023-1615 · affected 3.1.23 only · fixed in 3.1.24 *

• medium 5.4 Weaver Show Posts

  Stored cross-site scripting (XSS)

  CVE-2023-1404 · affected 1.6 and older · fixed in 1.7 *

• medium 4.3 WP Fastest Cache

  Missing authorization check

  CVE-2023-1375 · affected 1.1.2 and older · fixed in 1.1.3 *

• high 7.2 Intuitive Custom Post Order

  SQL injection

  CVE-2023-1016 · affected 3.1.4 and older · fixed in 3.1.4.1 *

• medium 4.3 OoohBoi Steroids for Elementor

  Missing authorization check

  CVE-2023-1169 · affected 2.1.4 and older · fixed in 2.1.5 *

• medium 4.3 Shield Security

  Cross-site scripting (XSS)

  CVE-2023-0993 · affected older than 17.0.18 · fixed in 17.0.18

• medium 4.3 Under Construction

  Cross-site request forgery (CSRF)

  CVE-2023-0832 · affected 3.96 and older · fixed in 3.97 *

• medium 4.3 Under Construction

  Cross-site request forgery (CSRF)

  CVE-2023-0831 · affected 3.96 and older · fixed in 3.97 *

• medium 6.1 Shield Security

  Stored cross-site scripting (XSS)

  CVE-2023-0992 · affected older than 17.0.18 · fixed in 17.0.18

• high 7.8 MetForm

  CSV injection

  CVE-2023-0721 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 5.4 MetForm

  Cross-site scripting (XSS)

  CVE-2023-0710 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 4.3 Wicked Folders

  Cross-site request forgery (CSRF)

  CVE-2023-0729 · affected 2.18.16 and older · fixed in 2.18.17 *

• medium 5.4 MetForm

  Cross-site scripting (XSS)

  CVE-2023-0709 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 5.4 MetForm

  Cross-site scripting (XSS)

  CVE-2023-0708 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 5.4 MetForm

  Cross-site scripting (XSS)

  CVE-2023-0695 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 4.3 MetForm

  Information disclosure

  CVE-2023-0694 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 4.3 MetForm

  Information disclosure

  CVE-2023-0693 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 4.3 MetForm

  Information disclosure

  CVE-2023-0692 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 4.3 MetForm

  Information disclosure

  CVE-2023-0691 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 6.5 MetForm

  Information disclosure

  CVE-2023-0688 · affected 3.3.1 and older · fixed in 3.3.2 *

• high 8.1 Quiz and Survey Master (QSM)

  Cross-site request forgery (CSRF)

  CVE-2023-0292 · affected 8.0.8 and older · fixed in 8.0.9 *

• critical 9.1 Quiz and Survey Master (QSM)

  Missing authorization check

  CVE-2023-0291 · affected 8.0.8 and older · fixed in 8.0.9 *

Thursday, June 8, 2023 · 1

• critical 9.8 Abandoned Cart Lite for WooCommerce

  Authentication bypass

  CVE-2023-2986 · affected 5.15.1 and older · fixed in 5.15.2 *

Wednesday, June 7, 2023 · 45

• medium 4.3 B2BKing

  Missing authorization check

  CVE-2023-3126 · affected 4.6.00 and older · fixed in 4.6.80 *

• medium 6.5 B2BKing

  Missing authorization check

  CVE-2023-3125 · affected 4.6.00 and older · fixed in 4.6.80 *

• medium 4.3 Better Search

  Cross-site request forgery (CSRF)

  CVE-2021-4373 · affected older than 2.5.3 · fixed in 2.5.3

• critical 9.8 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4381 · affected older than 1.7 · fixed in 1.7

• medium 4.3 Welcart e-Commerce

  Missing authorization check

  CVE-2021-4375 · affected older than 2.2.8 · fixed in 2.2.8

• medium 4.3 CURCY

  Missing authorization check

  CVE-2021-4376 · affected 2.1.17 and older · fix not stated

• medium 5.4 Flo Forms

  Stored cross-site scripting (XSS)

  CVE-2021-4367 · affected 1.0.35 and older · fix not stated

• medium 5.3 Frontend File Manager Plugin

  Content injection

  CVE-2021-4369 · affected older than 18.3 · fixed in 18.3

• high 8.8 Frontend File Manager Plugin

  Remote code execution

  CVE-2021-4368 · affected older than 18.3 · fixed in 18.3

• medium 6.1 Frontend File Manager Plugin

  Stored cross-site scripting (XSS)

  CVE-2021-4365 · affected older than 18.3 · fixed in 18.3

• medium 5.3 Frontend File Manager Plugin

  Missing authorization check

  CVE-2021-4359 · affected older than 18.3 · fixed in 18.3

• critical 9.8 Frontend File Manager Plugin

  Missing authorization check

  CVE-2021-4356 · affected older than 18.3 · fixed in 18.3

• medium 6.1 WP DSGVO Tools (GDPR)

  Stored cross-site scripting (XSS)

  CVE-2021-4358 · affected older than 3.1.24 · fixed in 3.1.24

• critical 9.8 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4370 · affected older than 1.7 · fixed in 1.7

• medium 5.3 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4357 · affected older than 1.7 · fixed in 1.7

• medium 5.3 Frontend File Manager Plugin

  Missing authorization check

  CVE-2021-4351 · affected older than 18.3 · fixed in 18.3

• medium 5.3 Frontend File Manager Plugin

  Content injection

  CVE-2021-4350 · affected older than 18.3 · fixed in 18.3

• medium 5.4 Frontend File Manager Plugin

  Privilege escalation

  CVE-2021-4344 · affected older than 18.3 · fixed in 18.3

• critical 9.8 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4341 · affected older than 1.7 · fixed in 1.7

• high 7.5 Directory Listings WordPress plugin

  SQL injection

  CVE-2021-4340 · affected older than 1.7 · fixed in 1.7

• high 7.5 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4346 · affected older than 1.7 · fixed in 1.7

• medium 5.3 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4345 · affected older than 1.7 · fixed in 1.7

• critical 9.8 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4343 · affected older than 1.7 · fixed in 1.7

• medium 5.3 Directory Listings WordPress plugin

  Missing authorization check

  CVE-2021-4339 · affected older than 1.7 · fixed in 1.7

• medium 5.3 Welcart e-Commerce

  Missing authorization check

  CVE-2021-4355 · affected older than 2.2.8 · fixed in 2.2.8

• medium 6.5 Advanced Shipment Tracking for WooCommerce

  Missing authorization check

  CVE-2021-4347 · affected 3.2.6 and older · fixed in 3.5.1 *

• critical 9.3 CMP

  Missing authorization check

  CVE-2020-36730 · affected 3.8.1 and older · fixed in 3.8.2 *

• high 8.8 Kali Forms

  Cross-site request forgery (CSRF)

  CVE-2020-36717 · affected older than 2.1.2 · fixed in 2.1.2

• high 7.1 Kali Forms

  Missing authorization check

  CVE-2020-36720 · affected older than 2.1.2 · fixed in 2.1.2

• critical 9.8 GDPR CCPA Compliance & Cookie Consent Banner

  PHP object injection

  CVE-2020-36718 · affected 2.3 and older · fixed in 2.6.1 *

• high 8.1 TI WooCommerce Wishlist

  Missing authorization check

  CVE-2020-36725 · affected 1.21.11 and older · fixed in 1.21.12 *

• critical 9.8 Ultimate Reviews

  PHP object injection

  CVE-2020-36726 · affected older than 2.1.33 · fixed in 2.1.33

• medium 4.8 Visual Composer Website Builder

  Cross-site scripting (XSS)

  CVE-2020-36722 · affected 26.0 and older · fixed in 45.0-beta.1 *

• critical 9.8 Wordable

  Authentication bypass

  CVE-2020-36724 · affected older than 3.1.2 · fixed in 3.1.2

• medium 5.4 Elementor Website Builder

  Stored cross-site scripting (XSS)

  CVE-2020-36703 · affected 2.9.7 and older · fixed in 3.0.0 *

• medium 5.3 Kali Forms

  Missing authorization check

  CVE-2020-36712 · affected older than 2.1.2 · fixed in 2.1.2

• critical 9.8 MStore API

  Authentication bypass

  CVE-2020-36713 · affected older than 2.1.6 · fixed in 2.1.6

• high 7.3 WP Activity Log

  Missing authorization check

  CVE-2020-36716 · affected older than 4.0.2 · fixed in 4.0.2

• high 7.5 WPS Hide Login

  Missing authorization check

  CVE-2020-36710 · affected 1.5.4.2 and older · fixed in 1.5.5 *

• medium 4.3 CartFlows

  Missing authorization check

  CVE-2019-25151 · affected 1.3.0 and older · fixed in 1.3.1 *

• critical 9.8 Easy WP SMTP

  Missing authorization check

  CVE-2019-25141 · affected older than 1.3.9.1 · fixed in 1.3.9.1

• high 8.8 Email Templates Customizer and Designer for Wo…

  Cross-site request forgery (CSRF)

  CVE-2019-25150 · affected 1.3 and older · fixed in 1.3.1 *

• medium 4.3 GDPR Cookie Compliance

  Missing authorization check

  CVE-2019-25143 · affected 4.0.2 and older · fixed in 4.0.3 *

• medium 6.1 PrettyLinks

  Stored cross-site scripting (XSS)

  CVE-2019-25147 · affected older than 2.1.10 · fixed in 2.1.10

• critical 9.8 User Submitted Posts

  Arbitrary file upload

  CVE-2019-25138 · affected older than 20190426 · fixed in 20190426

Tuesday, June 6, 2023 · 1

• high 8.8 ReviewX

  Privilege escalation

  CVE-2023-2833 · affected 1.6.13 and older · fixed in 1.6.14 *

Monday, June 5, 2023 · 1

• medium 4.8 Hostel

  Stored cross-site scripting (XSS)

  CVE-2023-0545 · affected older than 1.1.5.2 · fixed in 1.1.5.2

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan