WordPress plugin vulnerabilities: week 33, 2023

25 vulnerabilities published Aug 14 – Aug 20, 2023 in 25 plugins we track, by day.

1 critical 1 high 23 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Friday, August 18, 2023 · 7

• medium 6.1 Spiffy Calendar

  Reflected cross-site scripting (XSS)

  CVE-2023-32122 · affected 4.9.3 and older · fixed in 4.9.4

• medium 6.1 FV Flowplayer Video Player

  Reflected cross-site scripting (XSS)

  CVE-2023-30499 · affected 7.5.32.7212 and older · fixed in 7.5.35.7212

• medium 6.1 Photo Gallery by Ays

  Reflected cross-site scripting (XSS)

  CVE-2023-32107 · affected 5.1.3 and older · fixed in 5.1.4

• medium 6.1 WOLF

  Cross-site request forgery (CSRF)

  CVE-2023-31218 · affected 1.0.6 and older · fixed in 1.0.7

• medium 6.1 WP Docs

  Reflected cross-site scripting (XSS)

  CVE-2023-32106 · affected 1.9.9 and older · fixed in 2.0.0

• medium 6.1 WPPizza

  Reflected cross-site scripting (XSS)

  CVE-2023-32105 · affected 3.17.1 and older · fixed in 3.17.2

• medium 4.8 CM Search And Replace

  Stored cross-site scripting (XSS)

  CVE-2023-31228 · affected 1.3.0 and older · fixed in 1.3.1

Thursday, August 17, 2023 · 3

• medium 6.1 Extensions for Leaflet Map

  Reflected cross-site scripting (XSS)

  CVE-2023-31074 · affected 3.4.1 and older · fixed in 3.4.2

• medium 6.1 Modal Dialog

  Reflected cross-site scripting (XSS)

  CVE-2023-31071 · affected 3.5.14 and older · fixed in 3.5.15

• medium 6.1 Recipe Cards For Your Food Blog from Zip Recipes

  Reflected cross-site scripting (XSS)

  CVE-2023-31076 · affected 8.0.6 and older · fixed in 8.0.7

Wednesday, August 16, 2023 · 6

• high 8.8 Booking Manager

  Server-side request forgery (SSRF)

  CVE-2023-1977 · affected older than 2.0.29 · fixed in 2.0.29

• medium 5.4 REST API TO MiniProgram

  Cross-site request forgery (CSRF)

  CVE-2023-0551 · affected 4.6.1 and older · fix not stated

• medium 6.1 WP Inventory Manager

  Reflected cross-site scripting (XSS)

  CVE-2023-2123 · affected older than 2.1.0.13 · fixed in 2.1.0.13

• medium 6.1 Query Wrangler

  Reflected cross-site scripting (XSS)

  CVE-2023-30779 · affected 1.5.51 and older · fixed in 1.5.52

• medium 6.1 Church Admin

  Reflected cross-site scripting (XSS)

  CVE-2023-30782 · affected 3.7.5 and older · fixed in 3.7.6

• medium 6.1 YML for Yandex Market

  Reflected cross-site scripting (XSS)

  CVE-2023-30473 · affected 3.10.7 and older · fixed in 3.10.8

Tuesday, August 15, 2023 · 4

• medium 6.1 Vimeotheque

  Reflected cross-site scripting (XSS)

  CVE-2023-30498 · affected 2.2.1 and older · fixed in 2.2.2

• medium 5.4 PowerPress Podcasting plugin by Blubrry

  Stored cross-site scripting (XSS)

  CVE-2023-30778 · affected 10.0.1 and older · fixed in 10.0.2

• medium 5.3 InfiniteWP Client

  Information disclosure

  CVE-2023-2916 · affected 1.11.1 and older · fixed in 1.12.1 *

• medium 5.4 User Submitted Posts

  Stored cross-site scripting (XSS)

  CVE-2023-4308 · affected 20230809 and older · fixed in 20230811 *

Monday, August 14, 2023 · 5

• critical 9.8 User Activity Log

  SQL injection

  CVE-2023-3435 · affected older than 1.6.5 · fixed in 1.6.5

• medium 6.1 Elementor Website Builder

  Security issue

  CVE-2022-4953 · affected older than 3.5.5 · fixed in 3.5.5

• medium 4.8 Optima Express IDX

  Stored cross-site scripting (XSS)

  CVE-2023-30749 · affected 7.3.0 and older · fixed in 7.3.1

• medium 6.1 Watu Quiz

  Reflected cross-site scripting (XSS)

  CVE-2023-30483 · affected 3.3.9.2 and older · fixed in 3.3.9.3

• medium 6.1 Coupon Affiliates

  Reflected cross-site scripting (XSS)

  CVE-2023-30475 · affected 5.4.5 and older · fixed in 5.4.6

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan