WordPress plugin vulnerabilities: week 9, 2024

103 vulnerabilities published Feb 26 – Mar 3, 2024 in 73 plugins we track, by day.

3 critical 14 high 84 medium 2 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, March 2, 2024 · 6

• medium 5.4 Master Slider

  Stored cross-site scripting (XSS)

  CVE-2024-1449 · affected 3.9.10 and older · fixed in 3.10.0 *

• medium 4.8 Master Slider

  Stored cross-site scripting (XSS)

  CVE-2024-0611 · affected 3.9.9 and older · fixed in 3.9.10 *

• medium 4.3 Master Slider

  Cross-site request forgery (CSRF)

  CVE-2023-6326 · affected 3.9.10 and older · fixed in 3.10.0 *

• medium 6.1 AI Engine

  Stored cross-site scripting (XSS)

  CVE-2024-0378 · affected 2.2.0 and older · fixed in 2.2.1 *

• medium 5.4 Nextend Social Login and Register

  Cross-site request forgery (CSRF)

  CVE-2024-1775 · affected 3.1.12 and older · fixed in 3.1.13 *

• medium 4.3 Complianz GDPR/CCPA Cookie Consent Banner

  Cross-site request forgery (CSRF)

  CVE-2024-1592 · affected 6.5.6 and older · fixed in 7.0.4 *

Friday, March 1, 2024 · 4

• medium 5.3 Finale Lite

  Missing authorization check

  CVE-2024-1120 · affected 2.17.0 and older · fixed in 2.18.0 *

• high 8.8 Image Optimizer, Resizer and CDN

  Missing authorization check

  CVE-2024-27950 · affected 7.2.0 and older · fixed in 7.2.1

• medium 5.4 Image Optimizer, Resizer and CDN

  Server-side request forgery (SSRF)

  CVE-2024-27949 · affected 7.2.0 and older · fixed in 7.2.1

• high 8.8 Responsive Slideshow

  PHP object injection

  CVE-2024-1859 · affected 1.3.8 and older · fixed in 1.4.0 *

Thursday, February 29, 2024 · 72

• critical 9.1 WPvivid

  SQL injection

  CVE-2024-1982 · affected 0.9.68 and older · fixed in 0.9.69 *

• critical 9.1 WPvivid

  SQL injection

  CVE-2024-1981 · affected 0.9.68 only · fixed in 0.9.69 *

• medium 6.1 Ajax Search Lite

  Cross-site request forgery (CSRF)

  CVE-2024-21752 · affected 4.11.4 and older · fixed in 4.11.5

• medium 4.8 Ebook Store

  Stored cross-site scripting (XSS)

  CVE-2024-23501 · affected 5.788 and older · fixed in 6.20 *

• medium 6.1 GD Rating System

  Stored cross-site scripting (XSS)

  CVE-2024-25093 · affected 3.5 and older · fixed in 3.5.1

• medium 6.1 Adsmonetizer

  Reflected cross-site scripting (XSS)

  CVE-2024-1437 · affected 3.1.2 and older · fixed in 3.1.3

• high 7.2 Mollie Payments for WooCommerce

  Arbitrary file upload

  CVE-2023-6090 · affected 7.3.11 and older · fixed in 7.3.12

• medium 6.1 WP Activity Log

  Stored cross-site scripting (XSS)

  CVE-2023-50905 · affected 4.6.1 and older · fixed in 4.6.2

• medium 5.4 Advanced iFrame

  Stored cross-site scripting (XSS)

  CVE-2024-1341 · affected 2024.1 and older · fixed in 2024.5 *

• high 8.8 Anti-Spam, Spam FireWall by CleanTalk

  Cross-site request forgery (CSRF)

  CVE-2023-51696 · affected 6.20 and older · fixed in 6.21

• high 7.5 Tainacan

  Information disclosure

  CVE-2024-1435 · affected 0.20.6 and older · fixed in 0.20.7

• high 8.8 AI Puffer

  Cross-site request forgery (CSRF)

  CVE-2023-51528 · affected 1.8.12 and older · fixed in 1.8.13

• high 8.8 Logo Slider

  Cross-site request forgery (CSRF)

  CVE-2023-51530 · affected 3.5.1 and older · fixed in 3.5.2

• high 8.8 HT Mega Addons for Elementor

  Cross-site request forgery (CSRF)

  CVE-2023-51529 · affected 2.3.3 and older · fixed in 2.3.4

• medium 5.4 Featured Image from URL (FIFU)

  Stored cross-site scripting (XSS)

  CVE-2024-1496 · affected 4.6.2 and older · fixed in 5.2.9 *

• medium 5.4 Schema & Structured Data for WP & AMP

  Stored cross-site scripting (XSS)

  CVE-2024-1586 · affected 1.26 and older · fixed in 1.27 *

• medium 5.4 ProfilePress

  Stored cross-site scripting (XSS)

  CVE-2024-1570 · affected 4.14.4 and older · fixed in 4.15.0 *

• medium 6.1 ProfilePress

  Stored cross-site scripting (XSS)

  CVE-2024-1519 · affected 4.14.4 and older · fixed in 4.15.0 *

• medium 6.4 Social Sharing Plugin

  Stored cross-site scripting (XSS)

  CVE-2024-1448 · affected 3.3.56 and older · fix not stated

• medium 5.3 WPify Woo

  Missing authorization check

  CVE-2024-1492 · affected 4.0.8 and older · fixed in 4.0.9 *

• medium 5.4 EmbedPress

  Stored cross-site scripting (XSS)

  CVE-2024-1425 · affected 3.9.8 and older · fixed in 3.9.9 *

• medium 5.4 PowerPack Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1411 · affected 2.7.15 and older · fixed in 2.7.16 *

• medium 4.3 Paid Membership Subscriptions

  Missing authorization check

  CVE-2024-1390 · affected 2.11.1 and older · fixed in 2.11.2 *

• medium 5.3 Paid Membership Subscriptions

  Missing authorization check

  CVE-2024-1389 · affected 2.11.1 and older · fixed in 2.11.2 *

• medium 5.4 ProfilePress

  Stored cross-site scripting (XSS)

  CVE-2024-1408 · affected 4.14.4 and older · fixed in 4.15.0 *

• medium 5.4 EmbedPress

  Stored cross-site scripting (XSS)

  CVE-2024-1349 · affected 3.9.8 and older · fixed in 3.9.9 *

• medium 5.4 Login Lockdown & Protection

  Missing authorization check

  CVE-2024-1340 · affected 2.08 and older · fixed in 2.09 *

• medium 4.3 SKT Page Builder

  Missing authorization check

  CVE-2024-1337 · affected 4.1 and older · fix not stated

• medium 5.3 Directorist

  Missing authorization check

  CVE-2024-1322 · affected 7.8.4 and older · fixed in 7.8.5 *

• medium 6.5 RSS Aggregator by Feedzy

  Missing authorization check

  CVE-2024-1318 · affected 4.4.2 and older · fixed in 4.4.3 *

• high 8.8 RSS Aggregator by Feedzy

  SQL injection

  CVE-2024-1317 · affected 4.4.2 and older · fixed in 4.4.3 *

• medium 5.3 Sunshine Photo Cart

  Information disclosure

  CVE-2024-1294 · affected 3.0.24 and older · fixed in 3.1 *

• medium 5.4 Email Encoder

  Stored cross-site scripting (XSS)

  CVE-2024-1282 · affected 2.2.0 and older · fixed in 2.2.1 *

• medium 6.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1276 · affected 5.9.8 and older · fixed in 5.9.9 *

• medium 5.4 Ocean Extra

  Stored cross-site scripting (XSS)

  CVE-2024-1277 · affected 2.2.4 and older · fixed in 2.2.5 *

• medium 4.3 Schema & Structured Data for WP & AMP

  Missing authorization check

  CVE-2024-1288 · affected 1.26 and older · fixed in 1.27 *

• medium 5.4 Livemesh Addons by Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1235 · affected 8.3.2 and older · fix not stated

• medium 6.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1236 · affected 5.9.8 and older · fixed in 5.9.9 *

• medium 5.4 Kali Forms

  Missing authorization check

  CVE-2024-1218 · affected 2.3.41 and older · fixed in 2.3.50 *

• medium 6.4 Premium Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1242 · affected older than 4.10.19 · fixed in 4.10.19

• medium 4.3 Kali Forms

  Missing authorization check

  CVE-2024-1217 · affected 2.3.41 and older · fixed in 2.3.50 *

• high 8.8 WP Recipe Maker

  SQL injection

  CVE-2024-1206 · affected 9.1.2 and older · fixed in 9.2.0 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1172 · affected 5.9.8 and older · fixed in 5.9.9 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1171 · affected 5.9.8 and older · fixed in 5.9.9 *

• medium 4.3 NEX-Forms

  Missing authorization check

  CVE-2024-1130 · affected 8.5.6 and older · fixed in 8.5.7 *

• medium 4.3 Tutor LMS

  Missing authorization check

  CVE-2024-1133 · affected 2.6.0 and older · fixed in 2.6.1 *

• medium 4.3 NEX-Forms

  Missing authorization check

  CVE-2024-1129 · affected 8.5.6 and older · fixed in 8.5.7 *

• low 3.5 Tutor LMS

  Cross-site scripting (XSS)

  CVE-2024-1128 · affected 2.6.0 and older · fixed in 2.6.1 *

• medium 5.4 SiteOrigin Widgets Bundle

  Stored cross-site scripting (XSS)

  CVE-2024-1070 · affected 1.58.2 and older · fixed in 1.58.3 *

• medium 6.5 AMP for WP

  Missing authorization check

  CVE-2024-1043 · affected 1.0.93.1 and older · fixed in 1.0.93.2 *

• medium 5.3 Customer Reviews for WooCommerce

  Missing authorization check

  CVE-2024-1044 · affected 5.38.12 and older · fixed in 5.43.1 *

• medium 5.4 SiteOrigin Widgets Bundle

  Stored cross-site scripting (XSS)

  CVE-2024-1058 · affected 1.58.3 and older · fixed in 1.58.4 *

• medium 5.4 Booster for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2024-1054 · affected 7.1.6 and older · fixed in 7.1.7 *

• medium 4.3 NEX-Forms

  Missing authorization check

  CVE-2024-0907 · affected 8.5.6 and older · fixed in 8.5.7 *

• medium 6.1 Cost of Goods

  Reflected cross-site scripting (XSS)

  CVE-2024-0821 · affected 3.2.8 and older · fixed in 3.2.9 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-0838 · affected 3.10.1 and older · fixed in 3.10.2 *

• medium 5.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2024-0792 · affected 7.0.1 and older · fixed in 7.0.2 *

• high 7.3 Oliver POS

  Missing authorization check

  CVE-2024-0702 · affected 2.4.2.0 and older · fixed in 4.5.4 *

• medium 4.8 Password Protected

  Stored cross-site scripting (XSS)

  CVE-2024-0656 · affected 2.6.6 and older · fixed in 2.6.7 *

• medium 5.3 Passster

  Information disclosure

  CVE-2024-0616 · affected 4.2.6.2 and older · fixed in 4.2.6.6 *

• medium 4.8 FooGallery Photo Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-0604 · affected 2.4.7 and older · fixed in 2.4.32 *

• medium 5.3 PPWP

  Information disclosure

  CVE-2024-0620 · affected 1.8.9 and older · fixed in 1.9.0 *

• medium 5.3 Royal Addons for Elementor

  Missing authorization check

  CVE-2024-0516 · affected 1.3.87 and older · fixed in 1.3.88 *

• medium 4.3 Royal Addons for Elementor

  Cross-site request forgery (CSRF)

  CVE-2024-0515 · affected 1.3.87 and older · fixed in 1.3.88 *

• medium 4.3 Royal Addons for Elementor

  Cross-site request forgery (CSRF)

  CVE-2024-0514 · affected 1.3.87 and older · fixed in 1.3.88 *

• medium 5.4 Elementor Website Builder

  Reflected cross-site scripting (XSS)

  CVE-2024-0506 · affected 3.18.3 and older · fixed in 3.19.0-beta1 *

• medium 4.3 Royal Addons for Elementor

  Cross-site request forgery (CSRF)

  CVE-2024-0513 · affected 1.3.87 and older · fixed in 1.3.88 *

• medium 4.3 Royal Addons for Elementor

  Cross-site request forgery (CSRF)

  CVE-2024-0512 · affected 1.3.87 and older · fixed in 1.3.88 *

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-0442 · affected 1.3.87 and older · fixed in 1.3.88 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-0438 · affected 3.10.1 and older · fixed in 3.10.2 *

• medium 4.3 Custom Twitter Feeds

  Cross-site request forgery (CSRF)

  CVE-2024-0379 · affected 2.2.1 and older · fixed in 2.2.2 *

• medium 5.9 InfiniteWP Client

  Information disclosure

  CVE-2023-6565 · affected 1.12.3 and older · fixed in 1.12.3.1 *

Wednesday, February 28, 2024 · 12

• medium 4.3 Customer Reviews for WooCommerce

  Missing authorization check

  CVE-2023-51692 · affected 5.38.1 and older · fixed in 5.38.2

• medium 6.1 Ecwid by Lightspeed Ecommerce Shopping Cart

  Cross-site request forgery (CSRF)

  CVE-2023-51533 · affected 6.12.4 and older · fixed in 6.12.5

• medium 6.5 Duplicator

  Cross-site request forgery (CSRF)

  CVE-2023-51681 · affected 1.5.7 and older · fixed in 1.5.7.1

• high 8.8 MailerLite

  Cross-site request forgery (CSRF)

  CVE-2023-52223 · affected 2.0.8 and older · fixed in 2.0.9

• high 8.8 Easy PayPal & Stripe Buy Now Button

  Cross-site request forgery (CSRF)

  CVE-2023-51683 · affected 1.8.1 and older · fixed in 1.8.2

• high 8.8 SP Project & Document Manager

  SQL injection

  CVE-2024-24868 · affected 4.69 and older · fixed in 4.70

• medium 5.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2024-1808 · affected 7.0.3 and older · fixed in 7.0.4 *

• medium 6.3 Oliver POS

  Cross-site request forgery (CSRF)

  CVE-2024-1954 · affected 2.4.1.8 and older · fixed in 4.5.4 *

• medium 4.3 Envo's Templates & Widgets for Elementor and W…

  Cross-site request forgery (CSRF)

  CVE-2024-0768 · affected 1.4.4 and older · fixed in 1.4.5 *

• medium 4.3 Envo's Templates & Widgets for Elementor and W…

  Cross-site request forgery (CSRF)

  CVE-2024-0767 · affected 1.4.4 and older · fixed in 1.4.5 *

• medium 4.3 Envo's Templates & Widgets for Elementor and W…

  Missing authorization check

  CVE-2024-0766 · affected 1.4.4 and older · fixed in 1.4.5 *

• medium 6.4 Seraphinite Accelerator

  Server-side request forgery (SSRF)

  CVE-2024-1568 · affected 2.20.52 and older · fixed in 2.21 *

Tuesday, February 27, 2024 · 7

• medium 6.1 Shariff Wrapper

  Stored cross-site scripting (XSS)

  CVE-2024-1106 · affected older than 4.6.10 · fixed in 4.6.10

• medium 6.1 Smart Forms

  Cross-site request forgery (CSRF)

  CVE-2023-7203 · affected older than 2.6.87 · fixed in 2.6.87

• medium 5.3 Spiffy Calendar

  Security issue

  CVE-2024-0855 · affected older than 4.9.9 · fixed in 4.9.9

• critical 9.8 NotificationX

  SQL injection

  CVE-2024-1698 · affected 2.8.2 and older · fixed in 2.8.3 *

• medium 5.4 Thanko Thank You Page Customizer for WooCommerce

  Missing authorization check

  CVE-2024-1687 · affected 1.1.2 and older · fix not stated

• medium 4.3 Thanko Thank You Page Customizer for WooCommerce

  Missing authorization check

  CVE-2024-1686 · affected 1.1.2 and older · fix not stated

• medium 5.4 Orbit Fox

  Stored cross-site scripting (XSS)

  CVE-2024-1323 · affected 2.10.31 and older · fixed in 2.10.32 *

Monday, February 26, 2024 · 2

• medium 6.5 Brizy

  Path traversal / file read

  CVE-2024-1165 · affected 2.4.40 and older · fixed in 2.4.41 *

• low 2.7 BackWPup

  Security issue

  CVE-2023-5775 · affected 4.0.2 and older · fixed in 4.0.3 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan