WordPress plugin vulnerabilities: week 14, 2024

48 vulnerabilities published Apr 1 – Apr 7, 2024 in 44 plugins we track, by day.

3 critical 12 high 33 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, April 7, 2024 · 12

• medium 5.4 MailMunch

  Stored cross-site scripting (XSS)

  CVE-2024-31349 · affected 3.1.6 and older · fixed in 3.1.7

• medium 5.4 Gutenberg Essential Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-31306 · affected 4.5.3 and older · fixed in 4.5.4

• high 7.2 WP Import Export Lite

  PHP object injection

  CVE-2024-31308 · affected 3.9.26 and older · fixed in 3.9.27

• high 7.1 ProfileGrid

  Missing authorization check

  CVE-2024-31291 · affected 5.7.6 and older · fixed in 5.7.7

• critical 9.9 WP Photo Album Plus

  Arbitrary file upload

  CVE-2024-31286 · affected older than 8.6.03.005 · fixed in 8.6.03.005

• high 8.8 Church Admin

  Arbitrary file upload

  CVE-2024-31280 · affected 4.1.5 and older · fixed in 4.1.6

• high 7.2 Edwiser Bridge

  SQL injection

  CVE-2024-31260 · affected 3.0.2 and older · fixed in 3.0.4

• medium 6.5 Form to Chat App ⚡️

  Stored cross-site scripting (XSS)

  CVE-2024-31258 · affected 1.1.6 and older · fixed in 1.1.7

• high 7.6 LearnPress

  SQL injection

  CVE-2024-31241 · affected 4.0.3 and older · fixed in 4.0.4

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-31236 · affected 1.3.93 and older · fixed in 1.3.95

• medium 4.3 WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2024-22155 · affected 8.5.2 and older · fixed in 8.6.0

• medium 5.4 RSS Aggregator by Feedzy

  Stored cross-site scripting (XSS)

  CVE-2023-6877 · affected 4.3.3 and older · fixed in 4.3.4 *

Saturday, April 6, 2024 · 10

• medium 4.8 Photo Gallery by 10Web

  Stored cross-site scripting (XSS)

  CVE-2024-2296 · affected 1.8.21 and older · fixed in 1.8.22 *

• medium 5.4 Element Pack Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1428 · affected 5.5.3 and older · fixed in 5.5.6 *

• medium 5.4 Element Pack Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-0837 · affected 5.3.2 and older · fixed in 5.4.0 *

• medium 5.4 Powerkit

  Stored cross-site scripting (XSS)

  CVE-2024-2458 · affected 2.9.1 and older · fixed in 2.9.2 *

• medium 5.4 AI-Powered Carousel, Slider, Video & Photo Gal…

  Stored cross-site scripting (XSS)

  CVE-2024-2949 · affected 2.6.3 and older · fixed in 2.6.4 *

• medium 5.4 FooGallery Photo Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-2471 · affected 2.4.14 and older · fixed in 2.4.32 *

• medium 4.4 Email Subscribers & Newsletters by Icegram Exp…

  Stored cross-site scripting (XSS)

  CVE-2024-2656 · affected 5.7.15 and older · fixed in 5.7.16 *

• medium 5.3 WebToffee WooCommerce PDF Invoices, Packing Sl…

  Missing authorization check

  CVE-2024-3216 · affected 4.4.2 and older · fixed in 4.4.3 *

• high 7.1 WP-Stateless

  Missing authorization check

  CVE-2024-1385 · affected 3.4.0 and older · fixed in 3.4.1 *

• medium 5.4 EmbedPress

  Stored cross-site scripting (XSS)

  CVE-2024-3245 · affected 3.9.14 and older · fixed in 3.9.15 *

Friday, April 5, 2024 · 2

• high 8.8 LearnPress

  Cross-site request forgery (CSRF)

  CVE-2024-2115 · affected 4.0.0 and older · fixed in 4.0.1 *

• high 8.8 WP Directory Kit

  SQL injection

  CVE-2024-3217 · affected 1.3.0 and older · fixed in 1.3.1 *

Thursday, April 4, 2024 · 5

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-2919 · affected 3.2.31 and older · fixed in 3.2.32 *

• high 8.8 Modal Popup Box

  PHP object injection

  CVE-2024-2008 · affected 1.5.2 and older · fixed in 1.5.3 *

• medium 6.4 PublishPress Taxonomies

  Stored cross-site scripting (XSS)

  CVE-2024-2830 · affected 3.12.0 and older · fixed in 3.13.0 *

• medium 6.4 ShopLentor

  Stored cross-site scripting (XSS)

  CVE-2024-2868 · affected 2.8.3 and older · fixed in 2.8.4 *

• medium 5.4 ElementsKit Elementor Addons

  Stored cross-site scripting (XSS)

  CVE-2024-2803 · affected 3.0.7 and older · fixed in 3.1.0 *

Wednesday, April 3, 2024 · 8

• critical 9.8 Canto

  Remote code execution

  CVE-2024-25096 · affected 3.0.7 and older · fixed in 3.0.8 *

• critical 9.8 Broadcast Live Video

  Command injection

  CVE-2023-25699 · affected 5.5.15 and older · fixed in 5.5.16

• high 7.2 MPG

  Arbitrary file upload

  CVE-2024-27951 · affected 3.4.0 and older · fixed in 3.4.1

• high 8.8 InstaWP Connect

  Remote code execution

  CVE-2024-25918 · affected 0.1.0.8 and older · fixed in 0.1.0.9

• medium 5.3 Survey Maker by AYS

  Security issue

  CVE-2023-35764 · affected older than 3.6.4 · fixed in 3.6.4

• medium 6.1 Survey Maker by AYS

  Stored cross-site scripting (XSS)

  CVE-2023-34423 · affected older than 3.6.4 · fixed in 3.6.4

• medium 5.4 Jeg Kit for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3162 · affected 2.6.3 and older · fixed in 2.6.4 *

• medium 5.4 Jeg Kit for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-1327 · affected 2.6.3 and older · fixed in 2.6.4 *

Tuesday, April 2, 2024 · 9

• medium 4.9 Builderall for WordPress

  Server-side request forgery (SSRF)

  CVE-2024-30532 · affected 2.0.1 and older · fixed in 2.0.2

• medium 6.5 Kadence Blocks

  Server-side request forgery (SSRF)

  CVE-2024-24888 · affected 3.2.25 and older · fixed in 3.2.26

• medium 4.9 Nelio Content

  Server-side request forgery (SSRF)

  CVE-2024-30531 · affected 3.2.0 and older · fixed in 3.2.1

• medium 5.4 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2024-2925 · affected 2.8.0.5 and older · fixed in 2.8.0.7 *

• medium 5.4 Colibri Page Builder

  Stored cross-site scripting (XSS)

  CVE-2024-2839 · affected 1.0.263 and older · fixed in 1.0.305 *

• medium 5.4 MetForm

  Stored cross-site scripting (XSS)

  CVE-2024-2791 · affected 3.8.5 and older · fixed in 3.8.6 *

• medium 5.4 My Calendar

  Cross-site scripting (XSS)

  CVE-2024-1274 · affected older than 3.4.24 · fixed in 3.4.24

• medium 4.3 SecuPress with Simple SSL

  Cross-site request forgery (CSRF)

  CVE-2024-1504 · affected 2.2.5.1 and older · fixed in 2.7 *

• medium 5.4 Page Builder Gutenberg Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-2369 · affected older than 3.1.7 · fixed in 3.1.7

Monday, April 1, 2024 · 2

• high 8.8 Shortcodes and extra features for Phlox theme

  Missing authorization check

  CVE-2024-31099 · affected 2.15.7 and older · fixed in 2.15.8

• medium 5.3 Hubbub Lite

  Security issue

  CVE-2024-1526 · affected older than 1.33.1 · fixed in 1.33.1

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan