WordPress plugin vulnerabilities: week 4, 2024

21 vulnerabilities published Jan 22 – Jan 28, 2024 in 21 plugins we track, by day.

3 critical 4 high 14 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, January 27, 2024 · 8

• medium 4.8 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2024-0618 · affected 5.1.5 and older · fixed in 5.1.7 *

• medium 4.9 Backuply

  Path traversal / file read

  CVE-2024-0697 · affected 1.2.3 and older · fixed in 1.2.6 *

• medium 5.4 Exclusive Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-0824 · affected 2.6.8 and older · fixed in 2.6.9 *

• medium 6.3 Form Maker by 10Web

  Cross-site request forgery (CSRF)

  CVE-2024-0667 · affected 1.15.21 and older · fixed in 1.15.22 *

• medium 4.8 Simple Shopping Cart

  Stored cross-site scripting (XSS)

  CVE-2023-6497 · affected 4.7.1 and older · fixed in 4.7.2 *

• high 7.5 Image Source Control Lite

  Information disclosure

  CVE-2023-52187 · affected 2.17.0 and older · fixed in 2.17.1

• medium 6.5 InstaWP Connect

  Information disclosure

  CVE-2024-23506 · affected 0.1.0.9 and older · fixed in 0.1.0.10

• high 7.2 PDF Invoices & Packing Slips for WooCommerce

  SQL injection

  CVE-2024-22147 · affected 3.7.5 and older · fixed in 3.7.6

Thursday, January 25, 2024 · 2

• medium 4.8 WPFront Notification Bar

  Stored cross-site scripting (XSS)

  CVE-2024-0625 · affected 3.3.2 and older · fixed in 3.4 *

• medium 5.3 Simple Discount Rules for Woocommerce

  Missing authorization check

  CVE-2024-0617 · affected 4.12 and older · fix not stated

Wednesday, January 24, 2024 · 9

• medium 6.1 WP Go Maps

  Reflected cross-site scripting (XSS)

  CVE-2023-6697 · affected 9.0.28 and older · fixed in 9.0.29 *

• critical 9.8 WPBot

  PHP object injection

  CVE-2024-22309 · affected 5.1.0 and older · fixed in 5.1.1

• medium 6.1 Simple Membership

  Open redirect

  CVE-2024-22308 · affected 4.4.1 and older · fixed in 4.4.2

• critical 9.8 Asgaros Forum

  PHP object injection

  CVE-2024-22284 · affected 2.7.2 and older · fixed in 2.8.0

• medium 6.5 Connect Contact Form 7 to Mailchimp, Brevo, Ma…

  Server-side request forgery (SSRF)

  CVE-2024-22134 · affected 0.5.70 and older · fixed in 26.11.01.19 *

• high 7.2 Order Export & Order Import for WooCommerce

  Arbitrary file upload

  CVE-2024-22135 · affected 2.4.3 and older · fixed in 2.4.4

• high 7.2 Product Import Export for WooCommerce

  Arbitrary file upload

  CVE-2024-22152 · affected 2.3.7 and older · fixed in 2.3.8

• critical 9.8 Barcode Scanner (+Mobile App)

  Arbitrary file upload

  CVE-2023-52221 · affected 1.5.1 and older · fixed in 1.5.2

• medium 6.1 WP Customer Area

  Reflected cross-site scripting (XSS)

  CVE-2024-0665 · affected 8.2.2 and older · fixed in 8.2.3 *

Tuesday, January 23, 2024 · 1

• medium 6.1 AMP for WP

  Reflected cross-site scripting (XSS)

  CVE-2024-0587 · affected 1.0.92.1 and older · fixed in 1.0.93 *

Monday, January 22, 2024 · 1

• medium 4.8 WP Review Slider

  Stored cross-site scripting (XSS)

  CVE-2023-6456 · affected older than 13.0 · fixed in 13.0

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan