WordPress plugin vulnerabilities: week 3, 2024

34 vulnerabilities published Jan 15 – Jan 21, 2024 in 29 plugins we track, by day.

2 critical 10 high 21 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Friday, January 19, 2024 · 5

• critical 9.8 Montonio for WooCommerce

  Server-side request forgery (SSRF)

  CVE-2022-40700 · affected 6.0.1 and older · fixed in 6.0.2

• high 8.8 Smart Slider 3

  PHP object injection

  CVE-2022-45845 · affected 3.5.1.9 and older · fixed in 3.5.1.11

• medium 6.5 Wp Social Login and Register Social Counter

  Information disclosure

  CVE-2022-47160 · affected 1.9.0 and older · fixed in 2.0

• high 7.2 ProfilePress

  PHP object injection

  CVE-2022-45083 · affected 4.3.2 and older · fixed in 4.4.0

• high 7.5 Payment Gateway of Stripe for WooCommerce

  SQL injection

  CVE-2024-0705 · affected 3.7.9 and older · fixed in 3.8.0 *

Thursday, January 18, 2024 · 3

• medium 5.4 WP Recipe Maker

  Stored cross-site scripting (XSS)

  CVE-2024-0381 · affected 9.1.0 and older · fixed in 9.2.0 *

• medium 6.1 WP Recipe Maker

  Reflected cross-site scripting (XSS)

  CVE-2023-6970 · affected 9.1.0 and older · fixed in 9.2.0 *

• medium 5.4 WP Recipe Maker

  Stored cross-site scripting (XSS)

  CVE-2023-6958 · affected 9.1.0 and older · fixed in 9.2.0 *

Wednesday, January 17, 2024 · 3

• critical 9.8 WP Job Portal

  Missing authorization check

  CVE-2022-41786 · affected 2.0.1 and older · fixed in 2.0.2

• high 8.8 WP Time Slots Booking Form

  Missing authorization check

  CVE-2022-41790 · affected 1.1.76 and older · fixed in 1.1.77

• medium 6.5 Burst Statistics

  SQL injection

  CVE-2024-0405 · affected 1.5.3 and older · fixed in 3.4.3 *

Tuesday, January 16, 2024 · 22

• medium 6.1 Community by PeepSo

  Reflected cross-site scripting (XSS)

  CVE-2024-0187 · affected older than 6.3.1.2 · fixed in 6.3.1.2

• medium 4.3 Community by PeepSo

  Cross-site request forgery (CSRF)

  CVE-2023-7125 · affected older than 6.3.1.2 · fixed in 6.3.1.2

• high 8.8 ArtPlacer Widget

  Cross-site request forgery (CSRF)

  CVE-2023-6373 · affected older than 2.20.7 · fixed in 2.20.7

• medium 6.5 WP Customer Area

  Missing authorization check

  CVE-2023-6824 · affected older than 8.2.1 · fixed in 8.2.1

• medium 4.3 WP Customer Area

  Security issue

  CVE-2023-6741 · affected older than 8.2.1 · fixed in 8.2.1

• medium 5.3 FastDup

  Security issue

  CVE-2023-6592 · affected older than 2.2 · fixed in 2.2

• medium 6.1 LearnPress

  Reflected cross-site scripting (XSS)

  CVE-2023-5558 · affected older than 4.2.5.5 · fixed in 4.2.5.5

• high 7.2 Newsletters

  Command injection

  CVE-2023-4797 · affected older than 4.9.3 · fixed in 4.9.3

• medium 4.8 Ultimate Maps by Supsystic

  Cross-site scripting (XSS)

  CVE-2023-6732 · affected older than 1.2.16 · fixed in 1.2.16

• medium 4.8 Calculated Fields Form

  Stored cross-site scripting (XSS)

  CVE-2023-0389 · affected older than 1.1.151 · fixed in 1.1.151

• medium 5.4 Customer Reviews for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2023-0079 · affected older than 5.17.0 · fixed in 5.17.0

• low 2.7 Directorist

  File inclusion

  CVE-2023-2252 · affected older than 7.5.4 · fixed in 7.5.4

• high 7.2 Form Vibes

  SQL injection

  CVE-2022-3764 · affected older than 1.4.6 · fixed in 1.4.6

• high 7.5 Formidable Forms

  PHP object injection

  CVE-2023-1405 · affected older than 6.2 · fixed in 6.2

• medium 6.1 hiWeb Migration Simple

  Reflected cross-site scripting (XSS)

  CVE-2023-0769 · affected 2.0.0.1 and older · fix not stated

• medium 5.4 Qubely

  Stored cross-site scripting (XSS)

  CVE-2023-0376 · affected older than 1.8.5 · fixed in 1.8.5

• medium 6.1 Print Invoice & Delivery Notes for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2023-0479 · affected older than 4.7.2 · fixed in 4.7.2

• medium 4.3 WooCommerce

  Missing authorization check

  CVE-2022-0775 · affected older than 6.2.1 · fixed in 6.2.1

• medium 6.1 WP Fastest Cache

  Cross-site request forgery (CSRF)

  CVE-2021-24870 · affected older than 0.9.5 · fixed in 0.9.5

• high 8.8 WP Fastest Cache

  SQL injection

  CVE-2021-24869 · affected older than 0.9.5 · fixed in 0.9.5

• medium 6.1 Advanced AJAX Product Filters

  Reflected cross-site scripting (XSS)

  CVE-2021-24432 · affected older than 1.5.4.7 · fixed in 1.5.4.7

• high 7.2 WP Editor

  SQL injection

  CVE-2021-24151 · affected older than 1.2.7 · fixed in 1.2.7

Monday, January 15, 2024 · 1

• medium 4.8 WP Crowdfunding

  Stored cross-site scripting (XSS)

  CVE-2023-6163 · affected older than 2.1.10 · fixed in 2.1.10

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan