WordPress plugin vulnerabilities: week 13, 2024
227 vulnerabilities published Mar 25 – Mar 31, 2024 in 172 plugins we track, by day.
20 critical 60 high 146 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, March 31, 2024 · 3
-
medium 5.4 MP3 Audio Player
-
medium 4.3 LWS Optimize
-
high 8.5 Easy Form Builder by WhiteStudio
Saturday, March 30, 2024 · 8
-
high 8.8 Essential Addons for Elementor
-
medium 5.4 PowerPack Addons for Elementor
-
medium 6.4 Favorites
-
high 8.8 ElementsKit Elementor Addons
-
critical 10.0 File Manager for Google Drive
-
medium 5.4 ElementsKit Elementor Addons
-
medium 6.4 List category posts
-
medium 5.4 Unlimited Elements for Elementor
Friday, March 29, 2024 · 67
-
medium 6.5 Solid Testimonials
-
medium 5.4 Bold Page Builder
-
high 7.1 Post Grid
-
medium 5.9 Themify Event Post
-
medium 6.5 Chatbot for WordPress by Collect.chat ⚡️
-
high 7.1 Nexter Blocks
-
medium 6.5 MultiVendorX
-
medium 5.9 WP-CRM System
-
medium 6.5 bSlider
-
high 7.1 Mang Board
-
medium 4.3 All-In-One Security (AIOS)
-
medium 5.3 BEAR
-
high 8.8 HUSKY
-
medium 4.3 GamiPress
-
medium 4.3 Tumult Hype Animations
-
medium 5.4 Brave
-
high 8.8 WSMS (formerly WP SMS)
-
medium 6.5 Geo Controller
-
medium 5.9 Landing Page Builder
-
high 7.1 Booking Activities
-
medium 5.4 CRM Perks Forms
-
medium 6.5 ProfileGrid
-
medium 4.3 Export and Import Users and Customers
-
critical 9.8 Klarna for WooCommerce
-
low 2.7 Molongui Authorship
-
critical 9.8 WP Hotel Booking
-
medium 6.5 Church Admin
-
high 7.2 WP Travel Engine
-
critical 9.8 WP Travel Engine
-
high 7.2 Download Monitor
-
critical 9.8 Salon Booking System
-
high 8.8 CRM Perks Forms
-
critical 10.0 CRM Perks Forms
-
high 8.8 CubeWP Framework
-
high 8.8 Element Pack Addons for Elementor
-
medium 4.3 Church Admin
-
high 7.2 Falang multilanguage for WordPress
-
high 8.8 ProfileGrid
-
critical 9.8 ProfileGrid
-
high 8.8 Zotpress
-
medium 4.8 FluentCRM
-
high 8.8 Media Library Folders
-
high 7.6 MP3 Audio Player
-
medium 6.1 Contest Gallery
-
medium 5.4 Hash Elements
-
medium 6.1 Spiffy Calendar
-
medium 5.4 Beaver Builder Page Builder
-
medium 5.4 Better Addons for Elementor
-
medium 6.1 Mailster WordPress Newsletter Plugin
-
high 8.8 WPCS
-
high 8.8 FOX
-
high 8.8 MDTF
-
high 7.2 HUSKY
-
critical 9.8 MasterStudy LMS WordPress Plugin
-
critical 9.8 MasterStudy LMS WordPress Plugin
-
medium 6.4 Xpro Addons
-
medium 5.4 Better Addons for Elementor
-
medium 4.3 Ninja Forms
-
medium 5.4 Ninja Forms
-
medium 4.9 ERP
-
high 7.2 ERP
-
medium 6.1 ERP
-
medium 6.5 ERP
-
medium 4.3 Easy Appointments
-
medium 5.4 Easy Appointments
-
medium 5.4 Media Library Assistant
-
medium 5.4 Otter Blocks
Thursday, March 28, 2024 · 34
-
medium 4.3 Events Manager
-
critical 9.1 Tumult Hype Animations
-
high 7.1 Cornerstone
-
high 7.1 Favicon Rotator
-
medium 5.3 Community by PeepSo
-
medium 6.1 Seriously Simple Podcasting
-
medium 5.3 Seraphinite Accelerator
-
medium 5.5 CMP
-
critical 9.8 Sunshine Photo Cart
-
high 7.2 AI Engine
-
medium 6.1 BEAR
-
medium 6.8 AI Engine
-
medium 4.3 Colibri Page Builder
-
medium 6.5 Kadence Blocks
-
medium 5.4 Max Mega Menu
-
medium 6.5 Spectra Legacy
-
high 8.8 Church Admin
-
high 8.5 Contact Form to Any API
-
high 8.8 ProfileGrid
-
high 8.5 Tooltips for WordPress
-
critical 9.9 Contest Gallery
-
high 7.2 GiveWP
-
critical 9.8 ARMember
-
critical 9.0 BetterDocs
-
critical 9.0 Geo Controller
-
critical 9.8 WholesaleX
-
high 8.8 ARMember
-
medium 5.1 Pz-LinkCard
-
medium 6.1 Pz-LinkCard
-
high 7.1 Pz-LinkCard
-
medium 5.4 Events Manager
-
medium 4.3 Events Manager
Wednesday, March 27, 2024 · 81
-
high 8.8 Contest Gallery
-
medium 6.5 Molongui Authorship
-
medium 6.5 Off-Canvas Sidebars & Menus (Slidebars)
-
medium 6.1 Booster for WooCommerce
-
medium 6.1 MDTF
-
medium 6.1 Calculated Fields Form
-
high 7.1 Co-marquage service-public.fr
-
medium 5.4 Cincopa video and media plug-in
-
high 8.8 WooCommerce Stripe Payment Gateway
-
medium 6.1 Uncanny Toolkit for LearnDash
-
medium 5.4 DearFlip
-
medium 5.4 Radio Player
-
medium 5.4 ReviewX
-
medium 5.4 Fancy Comments WordPress
-
medium 6.5 FlatPM
-
medium 6.5 Football Pool
-
medium 6.5 Fullscreen Galleria
-
medium 6.5 WP Fast Total Search
-
medium 5.4 Mailmunch Forms for Mailchimp
-
medium 6.1 GEO Plugin by Squirrly SEO
-
medium 6.1 Unlimited Elements for Elementor
-
medium 4.8 EventPrime
-
medium 6.1 Forminator Forms
-
medium 6.5 Frontend Dashboard
-
medium 6.5 OneClick Chat to Order
-
medium 6.5 Podlove Web Player
-
medium 6.5 MyBookTable Bookstore by Stormhill Media
-
high 7.1 PrettyLinks
-
medium 6.1 WP Directory Kit
-
medium 5.4 Prime Slider
-
medium 5.4 Element Pack Addons for Elementor
-
medium 6.5 Popup Builder
-
medium 6.5 WPBakery Page Builder Addons by Livemesh
-
medium 5.4 HT Mega Addons for Elementor
-
medium 5.9 Locatoraid Store Locator
-
medium 5.4 Bold Page Builder
-
medium 6.5 affiliate-toolkit
-
medium 5.9 CartFlows
-
medium 5.4 Exclusive Addons for Elementor
-
medium 5.4 Sina Extension for Elementor
-
medium 6.5 Piotnet Addons For Elementor
-
medium 5.9 WPFront Notification Bar
-
medium 6.1 WP Go Maps
-
medium 5.4 MDTF
-
medium 5.9 WCFM
-
medium 4.4 Simple Ajax Chat
-
medium 5.4 WC Builder
-
medium 5.4 WishSuite
-
high 7.1 Premium Packages
-
medium 4.8 Photo Gallery by Supsystic
-
medium 6.1 Property Hive
-
medium 5.9 Slider Hero with Video Background, Animation
-
high 7.1 Photo Gallery by Ays
-
medium 5.4 Survey Maker by AYS
-
medium 6.1 BuddyForms
-
medium 5.4 Church Admin
-
medium 6.1 Sunshine Photo Cart
-
medium 5.4 Church Admin
-
medium 6.5 GS Pinterest Portfolio
-
medium 6.1 Podlove Podcast Publisher
-
medium 6.5 Stratum Widgets for Elementor
-
medium 5.4 Tutor LMS Elementor Addons
-
medium 5.4 Master Addons for Elementor
-
medium 6.5 Co-marquage service-public.fr
-
medium 6.5 Travelers' Map
-
medium 5.9 Breeze Cache
-
medium 5.4 MDTF
-
medium 5.4 WSMS (formerly WP SMS)
-
high 8.7 Echo Knowledge Base
-
high 7.1 WP Editor
-
high 7.1 Simply Schedule Appointments
-
high 7.1 FV Flowplayer Video Player
-
high 7.1 cformsII
-
medium 5.4 Master Addons for Elementor
-
medium 6.4 The Plus Addons for Elementor
-
high 8.8 The Plus Addons for Elementor
Tuesday, March 26, 2024 · 28
-
high 8.8 Elementor Website Builder
-
high 8.0 Widgets for Google Reviews
-
critical 9.8 Jupiter X Core
-
critical 9.3 Quiz and Survey Master (QSM)
-
high 7.2 Theme Editor
-
medium 5.3 Community by PeepSo
-
high 8.8 User Registration & Membership
-
medium 4.3 RegistrationMagic
-
high 7.5 GSheetConnector
-
medium 5.4 Photo Gallery by 10Web
-
medium 6.1 Photo Gallery by 10Web
-
medium 5.4 Photo Gallery by 10Web
-
medium 5.4 Photo Gallery by 10Web
-
medium 5.4 Photo Gallery by 10Web
-
high 8.8 MPG
-
medium 6.5 Radio Player
-
high 8.8 WholesaleX
-
medium 6.5 WholesaleX
-
medium 5.4 Exclusive Addons for Elementor
-
medium 6.5 Property Hive
-
medium 4.3 Conversion Tracking for WooCommerce
-
medium 6.5 User Submitted Posts
-
medium 5.3 WP Dummy Content Generator
-
high 7.6 Booking Calendar
-
medium 6.5 EnvíaloSimple
-
medium 5.4 Post and Page Builder by BoldGrid
-
medium 5.4 VK All in One Expansion Unit
Monday, March 25, 2024 · 6
-
high 8.1 WP Crontrol
-
high 8.8 CodePeople Post Map for Google Maps
-
critical 9.8 Points and Rewards for WooCommerce
-
medium 5.4 ShareThis Dashboard for Google Analytics
-
medium 6.3 GEO Plugin by Squirrly SEO
-
critical 9.8 Advance Product Search- Voice & Ajax Search fo…
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.