WordPress plugin vulnerabilities: week 1, 2024

44 vulnerabilities published Jan 1 – Jan 7, 2024 in 39 plugins we track, by day.

4 critical 14 high 26 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, January 6, 2024 · 2

• medium 5.4 RSS Aggregator by Feedzy

  Stored cross-site scripting (XSS)

  CVE-2023-6801 · affected 4.3.2 and older · fixed in 4.3.3 *

• medium 5.4 RSS Aggregator by Feedzy

  Missing authorization check

  CVE-2023-6798 · affected 4.3.2 and older · fixed in 4.3.3 *

Friday, January 5, 2024 · 21

• medium 5.3 Affiliates Manager

  Information disclosure

  CVE-2023-52148 · affected 2.9.30 and older · fixed in 2.9.31

• medium 5.3 Uncanny Automator

  Information disclosure

  CVE-2023-52151 · affected 5.1.0.2 and older · fixed in 5.1.0.3

• medium 5.3 404 Solution

  Information disclosure

  CVE-2023-52146 · affected 2.33.0 and older · fixed in 2.33.1

• critical 9.8 JS Help Desk

  Arbitrary file upload

  CVE-2022-46839 · affected 2.7.1 and older · fixed in 2.7.2

• high 8.8 NEX-Forms

  Cross-site request forgery (CSRF)

  CVE-2023-52120 · affected 8.5.2 and older · fixed in 8.5.5

• high 8.8 NitroPack

  Cross-site request forgery (CSRF)

  CVE-2023-52121 · affected 1.10.2 and older · fixed in 1.10.3

• medium 6.5 DOOFINDER Search and Discovery for WP & WooCom…

  Cross-site request forgery (CSRF)

  CVE-2023-51678 · affected 2.0.33 and older · fixed in 2.1.1

• high 8.8 Icegram Engage

  Cross-site request forgery (CSRF)

  CVE-2023-52119 · affected 3.1.18 and older · fixed in 3.1.19

• critical 9.8 Stylish Price List

  Cross-site request forgery (CSRF)

  CVE-2023-51673 · affected 7.0.17 and older · fixed in 7.0.18

• high 8.8 Apollo13 Framework Extensions

  Cross-site request forgery (CSRF)

  CVE-2023-51539 · affected 1.9.1 and older · fixed in 1.9.2

• high 8.8 Awesome Support

  Cross-site request forgery (CSRF)

  CVE-2023-51538 · affected 6.1.5 and older · fixed in 6.1.6

• high 8.8 Anti-Spam, Spam FireWall by CleanTalk

  Cross-site request forgery (CSRF)

  CVE-2023-51535 · affected 6.20 and older · fixed in 6.21

• high 8.8 Affiliates Manager

  Cross-site request forgery (CSRF)

  CVE-2023-52130 · affected 2.9.31 and older · fixed in 2.9.32

• high 8.8 Custom Twitter Feeds

  Cross-site request forgery (CSRF)

  CVE-2023-52136 · affected 2.1.2 and older · fixed in 2.2

• high 8.8 teachPress

  Cross-site request forgery (CSRF)

  CVE-2023-52129 · affected 9.0.4 and older · fixed in 9.0.5

• high 8.8 WPC Product Bundles for WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2023-52127 · affected 7.3.1 and older · fixed in 7.3.2

• high 8.8 Strong Testimonials

  Cross-site request forgery (CSRF)

  CVE-2023-52123 · affected 3.1.10 and older · fixed in 3.1.11

• medium 5.4 WP Affiliate Disclosure

  Stored cross-site scripting (XSS)

  CVE-2023-52178 · affected 1.2.7 and older · fixed in 1.2.8

• high 8.8 WP Job Portal

  Cross-site request forgery (CSRF)

  CVE-2023-52184 · affected 2.0.6 and older · fixed in 2.0.7

• critical 9.8 WooCommerce Stripe Payment Gateway

  Missing authorization check

  CVE-2023-51502 · affected 7.6.1 and older · fixed in 7.6.2

• medium 4.3 Depicter

  Cross-site request forgery (CSRF)

  CVE-2023-6493 · affected 2.0.6 and older · fixed in 2.0.7 *

Thursday, January 4, 2024 · 4

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2023-7044 · affected 5.9.2 and older · fixed in 5.9.3 *

• medium 4.8 Complianz GDPR/CCPA Cookie Consent Banner

  Stored cross-site scripting (XSS)

  CVE-2023-6498 · affected 6.5.5 and older · fixed in 6.5.6 *

• medium 5.4 Page Builder

  Stored cross-site scripting (XSS)

  CVE-2023-6738 · affected 1.7.8 and older · fixed in 1.7.9 *

• medium 6.5 WP-Members Membership Plugin

  Information disclosure

  CVE-2023-6733 · affected 3.4.8 and older · fixed in 3.4.9 *

Wednesday, January 3, 2024 · 11

• medium 5.4 FooGallery Photo Gallery

  Stored cross-site scripting (XSS)

  CVE-2023-6747 · affected older than 2.4.6 · fixed in 2.4.6

• medium 6.1 Post SMTP

  Reflected cross-site scripting (XSS)

  CVE-2023-6621 · affected older than 2.8.7 · fixed in 2.8.7

• medium 4.3 PowerPack Addons for Elementor

  Cross-site request forgery (CSRF)

  CVE-2023-6984 · affected 2.7.13 and older · fixed in 2.7.14 *

• medium 6.5 WebToffee WooCommerce PDF Invoices, Packing Sl…

  Missing authorization check

  CVE-2023-7068 · affected 4.3.0 and older · fixed in 4.3.1 *

• medium 5.4 EmbedPress

  Stored cross-site scripting (XSS)

  CVE-2023-6986 · affected older than 3.9.5 · fixed in 3.9.5

• medium 5.4 OMGF

  Stored cross-site scripting (XSS)

  CVE-2023-6600 · affected 5.7.9 and older · fixed in 5.7.10 *

• medium 5.4 MapPress

  Stored cross-site scripting (XSS)

  CVE-2023-6524 · affected 2.88.13 and older · fixed in 2.88.14 *

• medium 4.9 WSMS (formerly WP SMS)

  Reflected cross-site scripting (XSS)

  CVE-2023-6981 · affected 6.5 and older · fixed in 6.5.1 *

• medium 4.3 WSMS (formerly WP SMS)

  Cross-site request forgery (CSRF)

  CVE-2023-6980 · affected 6.5 and older · fixed in 6.5.1 *

• medium 5.4 Post SMTP

  Stored cross-site scripting (XSS)

  CVE-2023-7027 · affected 2.8.7 and older · fixed in 2.8.8 *

• medium 6.1 Post SMTP

  Reflected cross-site scripting (XSS)

  CVE-2023-6629 · affected 2.8.6 and older · fixed in 2.8.7 *

Monday, January 1, 2024 · 6

• high 7.5 Download Manager

  Security issue

  CVE-2023-6421 · affected older than 3.2.83 · fixed in 3.2.83

• medium 5.4 HTML5 Video Player

  Stored cross-site scripting (XSS)

  CVE-2023-6485 · affected older than 2.5.19 · fixed in 2.5.19

• high 7.5 PayHere Payment Gateway

  Information disclosure

  CVE-2023-6064 · affected older than 2.2.12 · fixed in 2.2.12

• medium 6.1 Popup Builder

  Stored cross-site scripting (XSS)

  CVE-2023-6000 · affected older than 4.2.3 · fixed in 4.2.3

• medium 4.8 WP TripAdvisor Review Slider

  Stored cross-site scripting (XSS)

  CVE-2023-6037 · affected older than 11.9 · fixed in 11.9

• critical 9.8 affiliate-toolkit

  Server-side request forgery (SSRF)

  CVE-2023-5877 · affected older than 3.4.3 · fixed in 3.4.3

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan