WordPress plugin vulnerabilities: week 47, 2023
44 vulnerabilities published Nov 20 – Nov 26, 2023 in 32 plugins we track, by day.
3 critical 10 high 31 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Thursday, November 23, 2023 · 7
-
medium 5.4 eCommerce Product Catalog
-
medium 6.1 Pz-LinkCard
-
medium 5.4 Quiz and Survey Master (QSM)
-
high 7.5 Membership Plugin
-
medium 4.8 Theater for WordPress
-
medium 6.5 Booster for WooCommerce
Wednesday, November 22, 2023 · 30
-
medium 5.4 Email Encoder
-
medium 5.4 Charitable
-
medium 5.4 Accordions
-
medium 4.8 Floating Chat Widget
-
high 8.8 Legal Pages
-
medium 6.1 Bus Ticket Booking with Seat Reservation
-
high 8.8 Community by PeepSo
-
high 8.8 Comments
-
critical 9.8 Drag and Drop Multiple File Upload for Contact…
-
medium 6.7 LifterLMS
-
medium 4.8 MainWP Dashboard
-
medium 5.4 VK Blocks
-
medium 5.4 Garden Gnome Package
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.3 Funnelforms Free
-
medium 4.8 Ultimate Dashboard
-
medium 4.3 WP Customer Reviews
-
high 8.8 AEH Speed Optimization
-
high 8.8 WpStream
-
high 8.8 Leyka
-
high 8.8 FlexTable
-
high 8.8 CM Search And Replace
Monday, November 20, 2023 · 7
-
medium 5.4 WP Hotel Booking
-
critical 9.8 WP Hotel Booking
-
medium 5.4 Embed Privacy
-
critical 9.8 Five Star Restaurant Menu and Food Ordering
-
medium 5.4 Seraphinite Accelerator
-
medium 6.1 Seraphinite Accelerator
-
medium 5.4 WP Hotel Booking
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.