WordPress plugin vulnerabilities: week 26, 2023

36 vulnerabilities published Jun 26 – Jul 2, 2023 in 34 plugins we track, by day.

4 critical 9 high 23 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, July 1, 2023 · 17

• high 8.8 Style Kits for Elementor

  Cross-site request forgery (CSRF)

  CVE-2021-4401 · affected 1.8.0 and older · fixed in 1.8.1 *

• medium 4.3 ElasticPress

  Cross-site request forgery (CSRF)

  CVE-2021-4405 · affected 3.5.3 and older · fixed in 3.5.4 *

• medium 4.3 Event Espresso

  Cross-site request forgery (CSRF)

  CVE-2021-4404 · affected 4.10.11 and older · fix not stated

• medium 4.3 Better Search

  Cross-site request forgery (CSRF)

  CVE-2021-4400 · affected 2.5.2 and older · fixed in 2.5.3 *

• medium 4.3 Dokan

  Cross-site request forgery (CSRF)

  CVE-2020-36748 · affected older than 3.0.9 · fixed in 3.0.9

• high 8.8 Edwiser Bridge

  Cross-site request forgery (CSRF)

  CVE-2021-4399 · affected 2.0.6 and older · fixed in 2.0.7 *

• medium 6.5 Recarto

  Cross-site request forgery (CSRF)

  CVE-2021-4395 · affected 1.0.4 and older · fix not stated

• medium 4.3 Custom Field Template

  Cross-site request forgery (CSRF)

  CVE-2020-36742 · affected older than 2.5.2 · fixed in 2.5.2

• medium 4.3 MultiVendorX

  Cross-site request forgery (CSRF)

  CVE-2020-36741 · affected older than 3.5.8 · fixed in 3.5.8

• medium 4.3 eCommerce Product Catalog

  Cross-site request forgery (CSRF)

  CVE-2021-4393 · affected older than 3.0.18 · fixed in 3.0.18

• medium 4.3 eCommerce Product Catalog

  Cross-site request forgery (CSRF)

  CVE-2021-4392 · affected older than 2.9.44 · fixed in 2.9.44

• medium 4.3 NotificationX

  Cross-site request forgery (CSRF)

  CVE-2020-36744 · affected older than 1.8.3 · fixed in 1.8.3

• high 8.8 Project Manager

  Cross-site request forgery (CSRF)

  CVE-2020-36745 · affected older than 2.4.1 · fixed in 2.4.1

• medium 4.3 Ultimate Gift Cards for WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2021-4391 · affected 2.1.1 and older · fixed in 2.1.2 *

• medium 4.3 WP Travel

  Cross-site request forgery (CSRF)

  CVE-2021-4389 · affected 4.4.6 and older · fixed in 4.4.7 *

• medium 4.3 CartFlows

  Cross-site request forgery (CSRF)

  CVE-2020-36736 · affected older than 1.5.16 · fixed in 1.5.16

• medium 4.3 ERP

  Cross-site request forgery (CSRF)

  CVE-2020-36735 · affected older than 1.6.4 · fixed in 1.6.4

Friday, June 30, 2023 · 2

• high 8.8 SP Project & Document Manager

  Missing authorization check

  CVE-2023-3063 · affected 4.67 and older · fix not stated

• critical 9.8 Bookit

  Authentication bypass

  CVE-2023-2834 · affected 2.3.7 and older · fixed in 2.3.8 *

Thursday, June 29, 2023 · 1

• critical 9.8 Social Login, Social Sharing by miniOrange

  Authentication bypass

  CVE-2023-2982 · affected 7.6.4 and older · fixed in 7.6.5 *

Wednesday, June 28, 2023 · 4

• critical 9.1 Snow Monkey Forms

  Path traversal / file read

  CVE-2023-32623 · affected older than 5.1.2 · fixed in 5.1.2

• medium 4.3 Subscribe2

  Cross-site request forgery (CSRF)

  CVE-2023-3407 · affected 10.40 and older · fixed in 10.41 *

• medium 4.3 Subscribe2

  Missing authorization check

  CVE-2023-1844 · affected 10.40 and older · fixed in 10.41 *

• medium 4.3 Salon Booking System

  Cross-site request forgery (CSRF)

  CVE-2023-3427 · affected 8.4.7 and older · fixed in 8.5 *

Tuesday, June 27, 2023 · 10

• medium 4.8 CodeColorer

  Stored cross-site scripting (XSS)

  CVE-2023-2795 · affected older than 0.10.1 · fixed in 0.10.1

• high 8.8 Formidable Forms

  Remote code execution

  CVE-2023-2877 · affected older than 6.3.1 · fixed in 6.3.1

• high 8.8 Jetpack

  PHP object injection

  CVE-2023-2996 · affected 1.9 up to (not including) 2.0.9, 2.1 up to (not including) 2.1.7, 2.2 up to (not including) 2.2.10, 2.3 up to (not including) 2.3.10, 2.4 up to (not including) 2.4.7, 2.5 up to (not including) 2.5.5, 2.6 up to (not including) 2.6.6, 2.7 up to (not including) 2.7.5, 2.8 up to (not including) 2.8.5, 2.9 up to (not including) 2.9.6, 3.0 up to (not including) 3.0.6, 3.1 up to (not including) 3.1.5, 3.2 up to (not including) 3.2.5, 3.3 up to (not including) 3.3.6, 3.4 up to (not including) 3.4.6, 3.5 up to (not including) 3.5.6, 3.6 up to (not including) 3.6.4, 3.7 up to (not including) 3.7.5, 3.8 up to (not including) 3.8.5, 3.9 up to (not including) 3.9.9, 4.0 up to (not including) 4.0.6, 4.1 up to (not including) 4.1.3, 4.2 up to (not including) 4.2.4, 4.3 up to (not including) 4.3.4, 4.4 up to (not including) 4.4.4, 4.5 up to (not including) 4.5.2, 4.6 up to (not including) 4.6.2, 4.7 up to (not including) 4.7.3, 4.8 up to (not including) 4.8.4, 4.9 up to (not including) 4.9.2, 5.0 up to (not including) 5.0.2, 5.1 up to (not including) 5.1.3, 5.2 up to (not including) 5.2.4, 5.3 up to (not including) 5.3.3, 5.4 up to (not including) 5.4.3, 5.5 up to (not including) 5.5.4, 5.6 up to (not including) 5.6.4, 5.7 up to (not including) 5.7.4, 5.8 up to (not including) 5.8.3, 5.9 up to (not including) 5.9.3, 6.0 up to (not including) 6.0.3, 6.1 up to (not including) 6.1.4, 6.2 up to (not including) 6.2.4, 6.3 up to (not including) 6.3.6, 6.4 up to (not including) 6.4.5, 6.5 up to (not including) 6.5.3, 6.6 up to (not including) 6.6.4, 6.7 up to (not including) 6.7.3, 6.8 up to (not including) 6.8.4, 6.9 up to (not including) 6.9.3, 7.0 up to (not including) 7.0.4, 7.1 up to (not including) 7.1.4, 7.2 up to (not including) 7.2.4, 7.3 up to (not including) 7.3.4, 7.4 up to (not including) 7.4.4, 7.5 up to (not including) 7.5.6, 7.6 up to (not including) 7.6.3, 7.7 up to (not including) 7.7.5, 7.8 up to (not including) 7.8.3, 7.9 up to (not including) 7.9.3, 8.0 up to (not including) 8.0.2, 8.1 up to (not including) 8.1.3, 8.2 up to (not including) 8.2.5, 8.3 up to (not including) 8.3.2, 8.4 up to (not including) 8.4.4, 8.5 up to (not including) 8.5.2, 8.6 up to (not including) 8.6.3, 8.7 up to (not including) 8.7.3, 8.8 up to (not including) 8.8.4, 8.9 up to (not including) 8.9.3, 9.0 up to (not including) 9.0.4, 9.1 up to (not including) 9.1.2, 9.2 up to (not including) 9.2.3, 9.3 up to (not including) 9.3.4, 9.4 up to (not including) 9.4.3, 9.5 up to (not including) 9.5.4, 9.6 up to (not including) 9.6.3, 9.7 up to (not including) 9.7.2, 9.8 up to (not including) 9.8.2, 9.9 up to (not including) 9.9.2, 10.0 up to (not including) 10.0.1, 10.1 up to (not including) 10.1.1, 10.2 up to (not including) 10.2.2, 10.3 up to (not including) 10.3.1, 10.4 up to (not including) 10.4.1, 10.5 up to (not including) 10.5.2, 10.6 up to (not including) 10.6.2, 10.7 up to (not including) 10.7.1, 10.8 up to (not including) 10.8.1, 10.9 up to (not including) 10.9.2, 11.0 up to (not including) 11.0.1, 11.1 up to (not including) 11.1.3, 11.2 up to (not including) 11.2.1, 11.3 up to (not including) 11.3.3, 11.4 up to (not including) 11.4.1, 11.5 up to (not including) 11.5.2, 11.6 up to (not including) 11.6.1, 11.7 up to (not including) 11.7.2, 11.8 up to (not including) 11.8.5, 11.9 up to (not including) 11.9.2, 12.0 up to (not including) 12.0.1, 12.1 up to (not including) 12.1.1 · fixed in 12.1.1

• high 8.1 WP Inventory Manager

  Cross-site request forgery (CSRF)

  CVE-2023-2842 · affected older than 2.1.0.14 · fixed in 2.1.0.14

• medium 4.8 AI Engine

  Stored cross-site scripting (XSS)

  CVE-2023-2580 · affected older than 1.6.83 · fixed in 1.6.83

• medium 6.1 Catalyst Connect Zoho CRM Client Portal

  Reflected cross-site scripting (XSS)

  CVE-2023-0588 · affected older than 2.1.0 · fixed in 2.1.0

• critical 9.8 Custom 404 Pro

  SQL injection

  CVE-2023-2032 · affected older than 3.8.1 · fixed in 3.8.1

• medium 5.4 Editorial Calendar

  Stored cross-site scripting (XSS)

  CVE-2022-4115 · affected older than 3.8.3 · fixed in 3.8.3

• high 7.5 MainWP Child

  Information disclosure

  CVE-2023-3132 · affected 4.4.1.1 and older · fixed in 4.4.1.2 *

• high 7.5 EmbedPress

  Information disclosure

  CVE-2023-3371 · affected 3.7.3 and older · fixed in 3.8.0 *

Monday, June 26, 2023 · 2

• medium 6.1 Booking for Appointments and Events Calendar

  Reflected cross-site scripting (XSS)

  CVE-2023-29427 · affected 1.0.75 and older · fixed in 1.0.76

• medium 6.1 Coupon Affiliates

  Reflected cross-site scripting (XSS)

  CVE-2023-28992 · affected 5.4.3 and older · fixed in 5.4.4

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan