WordPress plugin vulnerabilities: week 45, 2023
55 vulnerabilities published Nov 6 – Nov 12, 2023 in 52 plugins we track, by day.
13 critical 27 high 15 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, November 12, 2023 · 6
-
high 8.8 WP Maps
-
high 8.8 Affiliate Super Assistent
-
high 8.8 MotoPress Hotel Booking
-
high 8.8 WP Ultimate Review
-
high 8.8 Slideshow Gallery LITE
-
high 8.8 WP Shortcode by MyThemeShop
Friday, November 10, 2023 · 2
-
high 8.8 Newsletters
Thursday, November 9, 2023 · 9
-
high 8.8 Participants Database
-
high 8.8 Community by PeepSo
-
high 8.8 Forget About Shortcode Buttons
-
high 8.8 ShortPixel Adaptive Images
-
high 8.8 Groundhogg
-
high 8.8 WebberZone Top 10
-
high 8.8 WPC Smart Wishlist for WooCommerce
-
high 8.8 WP Inventory Manager
Wednesday, November 8, 2023 · 2
-
medium 5.4 Apollo13 Framework Extensions
-
medium 6.1 WP Simple HTML Sitemap
Tuesday, November 7, 2023 · 16
-
medium 5.4 UpdraftPlus
-
high 8.8 Directorist
CSV injection
-
critical 9.8 ReviewX
CSV injection
-
critical 9.8 Comments Import & Export
CSV injection
-
critical 9.8 Email Subscribers & Newsletters by Icegram Exp…
CSV injection
-
critical 9.8 Noptin
CSV injection
-
critical 9.8 Site Reviews
CSV injection
-
high 7.2 WPLP Cookie Consent
CSV injection
-
critical 9.8 GiveWP
CSV injection
-
high 8.8 UsersWP
CSV injection
-
high 8.8 Simple History
CSV injection
-
medium 5.4 SendPress Newsletters
-
medium 5.4 Simple Like Page
-
medium 5.4 WP MapIt
Monday, November 6, 2023 · 20
-
medium 4.8 URL Shortify
-
high 8.1 Awesome Support
-
medium 6.1 Awesome Support
-
medium 4.3 Awesome Support
-
medium 6.5 Front End PM
Security issue
-
high 7.5 Templately
-
medium 4.8 Responsive Pricing Table
-
high 8.8 Feather Login Page
-
high 8.8 Kadence WooCommerce Email Designer
-
medium 6.1 Comments
-
high 7.2 GD Security Headers
-
medium 5.4 Pre-Orders for WooCommerce
-
medium 6.1 Store Exporter
-
critical 9.8 MStore API
-
critical 9.8 Accessibility Suite by Ability, Inc
-
critical 9.8 ilGhera Support System for WooCommerce
-
critical 9.8 Booking calendar, Appointment Booking System
-
critical 9.8 Accessibility Suite by Ability, Inc
-
critical 9.8 The School Management
-
critical 9.8 SlimStat Analytics
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.