WordPress plugin vulnerabilities: week 17, 2024

87 vulnerabilities published Apr 22 – Apr 28, 2024 in 75 plugins we track, by day.

11 critical 14 high 62 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, April 27, 2024 · 3

• medium 5.4 Qi Addons For Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3309 · affected 1.7.0 and older · fixed in 1.7.1 *

• critical 9.9 Timetable and Event Schedule by MotoPress

  SQL injection

  CVE-2024-3342 · affected 2.4.11 and older · fixed in 2.4.12 *

• medium 5.4 Form Maker by 10Web

  Stored cross-site scripting (XSS)

  CVE-2024-2258 · affected 1.15.24 and older · fixed in 1.15.25 *

Friday, April 26, 2024 · 17

• medium 4.3 Popup Builder & Popup Maker for WordPress

  Cross-site request forgery (CSRF)

  CVE-2024-33691 · affected 2.15.3 and older · fixed in 2.16.0

• medium 5.4 Cookie Information

  Cross-site request forgery (CSRF)

  CVE-2024-33682 · affected 2.0.23 and older · fix not stated

• medium 4.3 ClickCease Click Fraud Protection

  Cross-site request forgery (CSRF)

  CVE-2024-33678 · affected 3.2.7 and older · fixed in 3.2.8

• medium 4.3 Connect Contact Form 7 to Mailchimp, Brevo, Ma…

  Cross-site request forgery (CSRF)

  CVE-2024-33677 · affected 0.5.70 and older · fixed in 26.11.01.19 *

• medium 4.7 Live Composer

  Missing authorization check

  CVE-2024-32957 · affected 1.5.38 and older · fixed in 1.5.39

• medium 5.4 MainWP Child Reports

  Cross-site request forgery (CSRF)

  CVE-2024-33680 · affected 2.1.1 and older · fixed in 2.2

• medium 4.3 Data Tables Generator by Supsystic

  Missing authorization check

  CVE-2024-32829 · affected 1.10.31 and older · fixed in 1.10.32

• critical 9.8 PPOM

  Arbitrary file upload

  CVE-2024-3962 · affected 32.0.18 and older · fixed in 32.0.19 *

• medium 5.3 Blog2Social

  Information disclosure

  CVE-2024-3678 · affected 7.4.2 and older · fixed in 7.5.0 *

• medium 4.3 Serious Slider

  Cross-site request forgery (CSRF)

  CVE-2024-33650 · affected 1.2.4 and older · fixed in 1.2.5 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3890 · affected 3.10.6 and older · fixed in 3.10.7 *

• medium 5.3 WP-Members Membership Plugin

  Information disclosure

  CVE-2024-2920 · affected 3.4.9.3 and older · fixed in 3.4.9.4 *

• medium 6.3 Salon Booking System

  Stored cross-site scripting (XSS)

  CVE-2024-2603 · affected 9.6.5 and older · fixed in 9.6.6 *

• medium 4.8 Salon Booking System

  Stored cross-site scripting (XSS)

  CVE-2024-2439 · affected 9.6.5 and older · fixed in 9.6.6 *

• medium 4.3 Salon Booking System

  Cross-site request forgery (CSRF)

  CVE-2024-2429 · affected 9.6.5 and older · fixed in 9.6.6 *

• medium 4.7 Social Sharing Plugin

  Stored cross-site scripting (XSS)

  CVE-2024-2159 · affected older than 3.3.61 · fixed in 3.3.61

• medium 5.9 WP Google Review Slider

  Stored cross-site scripting (XSS)

  CVE-2024-2310 · affected older than 13.6 · fixed in 13.6

Thursday, April 25, 2024 · 12

• medium 5.4 Radio Player

  Server-side request forgery (SSRF)

  CVE-2024-33592 · affected 2.0.73 and older · fixed in 2.0.74

• medium 5.4 Simple Membership

  Stored cross-site scripting (XSS)

  CVE-2024-3730 · affected 4.4.3 and older · fixed in 4.4.5 *

• medium 6.4 Photo Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-4035 · affected 2.7.7.21 and older · fixed in 2.7.7.23 *

• medium 5.4 Tutor LMS

  Stored cross-site scripting (XSS)

  CVE-2024-3994 · affected 2.6.2 and older · fixed in 2.7.0 *

• medium 4.3 MonsterInsights

  Missing authorization check

  CVE-2023-52220 · affected 8.21.0 and older · fixed in 8.22.0

• medium 5.3 Essential Addons for Elementor

  Information disclosure

  CVE-2024-3733 · affected 5.9.15 and older · fixed in 5.9.16 *

• critical 9.0 Anti-Malware Security and Brute-Force Firewall

  Remote code execution

  CVE-2024-22144 · affected 4.21.96 and older · fixed in 4.23.56

• critical 9.1 Advanced Order Export For WooCommerce

  Remote code execution

  CVE-2024-31266 · affected 3.4.4 and older · fixed in 3.4.5

• critical 9.9 Eazy Plugin Manager

  Authentication bypass

  CVE-2023-51482 · affected 4.1.2 and older · fixed in 4.1.3

• critical 9.8 Build App Online

  Privilege escalation

  CVE-2023-51478 · affected 1.0.19 and older · fix not stated

• medium 4.3 Classified Listing

  Missing authorization check

  CVE-2024-3893 · affected older than 3.0.11 · fixed in 3.0.11

• medium 5.4 Sina Extension for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3988 · affected 3.5.2 and older · fixed in 3.5.3 *

Wednesday, April 24, 2024 · 34

• medium 4.1 FV Flowplayer Video Player

  Open redirect

  CVE-2024-32078 · affected 7.5.44.7212 and older · fixed in 7.5.45.7212

• medium 5.3 JetFormBuilder

  Cross-site scripting (XSS)

  CVE-2023-48763 · affected 3.1.4 and older · fixed in 3.1.5

• medium 5.4 Jetpack

  Security issue

  CVE-2023-47774 · affected older than 12.7 · fixed in 12.7

• critical 9.8 Rencontre

  Privilege escalation

  CVE-2023-51425 · affected 3.10.1 and older · fixed in 3.11

• critical 9.8 Elementor Website Builder

  Authentication bypass

  CVE-2023-47504 · affected 3.16.4 and older · fixed in 3.16.5

• high 8.8 Unlimited Elements for Elementor

  Arbitrary file upload

  CVE-2023-31090 · affected 1.5.60 and older · fixed in 1.5.61

• medium 4.3 WPCal.io

  Cross-site request forgery (CSRF)

  CVE-2024-32795 · affected 0.9.5.8 and older · fixed in 0.9.5.9

• medium 4.3 Paid Membership Subscriptions

  Cross-site request forgery (CSRF)

  CVE-2024-32728 · affected 2.11.0 and older · fixed in 2.11.1

• medium 4.3 YITH WooCommerce Compare

  Cross-site request forgery (CSRF)

  CVE-2024-32699 · affected 2.37.0 and older · fixed in 2.38.0

• medium 6.5 RegistrationMagic

  Cross-site scripting (XSS)

  CVE-2023-23989 · affected 5.1.9.2 and older · fixed in 5.1.9.3

• critical 9.1 Newsletters

  Arbitrary file upload

  CVE-2024-32954 · affected 4.9.5 and older · fixed in 4.9.6

• high 8.8 ProfileGrid

  Missing authorization check

  CVE-2024-32808 · affected 5.7.9 and older · fixed in 5.8.0

• medium 5.9 Image Slider

  Stored cross-site scripting (XSS)

  CVE-2024-32707 · affected 1.1.125 and older · fixed in 1.1.127

• medium 6.5 Points Management System For Gamification, Ran…

  Cross-site scripting (XSS)

  CVE-2024-32711 · affected 2.6.3 and older · fixed in 2.6.4

• high 8.8 ProfileGrid

  Missing authorization check

  CVE-2024-32772 · affected 5.7.9 and older · fixed in 5.8.0

• high 7.5 RegistrationMagic

  Security issue

  CVE-2023-23976 · affected 5.1.9.2 and older · fixed in 5.1.9.3

• medium 5.3 Quiz Maker by AYS

  Missing authorization check

  CVE-2023-23985 · affected 6.3.9.4 and older · fixed in 6.3.9.5

• medium 5.4 Jeg Kit for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-32721 · affected 2.6.3 and older · fixed in 2.6.4

• medium 6.5 RTMKit for Elementor

  Cross-site scripting (XSS)

  CVE-2024-32956 · affected 1.4.1 and older · fixed in 1.4.2

• medium 5.4 Premium Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2024-32791 · affected 4.10.25 and older · fixed in 4.10.26

• high 7.5 Newsletters

  Information disclosure

  CVE-2024-32953 · affected 4.9.5 and older · fixed in 4.9.6

• medium 5.4 Export and Import Users and Customers

  PHP object injection

  CVE-2024-32835 · affected 2.5.3 and older · fixed in 2.5.4

• critical 9.1 WP-Lister Lite for eBay

  Arbitrary file upload

  CVE-2024-32836 · affected 3.5.11 and older · fixed in 3.6.0

• medium 4.4 Import and export users and customers

  PHP object injection

  CVE-2024-32817 · affected 1.26.2 and older · fixed in 1.26.3

• medium 5.4 Podlove Podcast Publisher

  Server-side request forgery (SSRF)

  CVE-2024-32812 · affected 4.0.11 and older · fixed in 4.0.12

• high 7.5 Post Grid

  Information disclosure

  CVE-2024-32816 · affected 2.2.78 and older · fixed in 2.2.79

• high 7.5 Email Customizer for WooCommerce

  Information disclosure

  CVE-2024-32781 · affected 2.6.0 and older · fixed in 2.6.1

• medium 6.5 HT Mega Addons for Elementor

  Information disclosure

  CVE-2024-32782 · affected 2.4.7 and older · fixed in 2.4.8

• medium 5.9 VikRentCar Car Rental Management System

  Information disclosure

  CVE-2024-32780 · affected 1.3.2 and older · fixed in 1.3.3

• high 7.5 Frontend Dashboard

  Information disclosure

  CVE-2024-32726 · affected 2.2.2 and older · fixed in 2.2.4

• medium 4.9 FV Flowplayer Video Player

  Server-side request forgery (SSRF)

  CVE-2024-32955 · affected 7.5.43.7212 and older · fixed in 7.5.45.7212

• critical 9.1 ARMember

  Missing authorization check

  CVE-2024-32948 · affected 4.0.28 and older · fixed in 4.0.29

• medium 4.8 Strong Testimonials

  Stored cross-site scripting (XSS)

  CVE-2024-3261 · affected older than 3.1.12 · fixed in 3.1.12

• medium 6.1 Import WP

  Server-side request forgery (SSRF)

  CVE-2023-7253 · affected older than 2.13.1 · fixed in 2.13.1

Tuesday, April 23, 2024 · 13

• medium 5.3 Shared Files

  Missing authorization check

  CVE-2024-32679 · affected 1.7.16 and older · fixed in 1.7.17

• medium 5.4 Comments

  Stored cross-site scripting (XSS)

  CVE-2024-2477 · affected 7.6.15 and older · fixed in 7.6.16 *

• medium 6.4 Schema & Structured Data for WP & AMP

  Stored cross-site scripting (XSS)

  CVE-2024-3491 · affected 1.29 and older · fixed in 1.30 *

• medium 5.4 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2024-3732 · affected 2.3.48 and older · fixed in 2.3.49 *

• medium 5.4 Rank Math SEO

  Stored cross-site scripting (XSS)

  CVE-2024-3665 · affected 1.0.216 and older · fixed in 1.0.217 *

• medium 4.3 Quick Featured Images

  Missing authorization check

  CVE-2024-3664 · affected 13.7.0 and older · fixed in 13.7.1 *

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3889 · affected 1.3.971 and older · fixed in 1.3.972 *

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-2799 · affected 1.3.971 and older · fixed in 1.3.972 *

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-2798 · affected 1.3.971 and older · fixed in 1.3.972 *

• medium 5.4 Forminator Forms

  Cross-site scripting (XSS)

  CVE-2024-31857 · affected older than 1.15.4 · fixed in 1.15.4

• high 7.2 Forminator Forms

  SQL injection

  CVE-2024-31077 · affected older than 1.29.3 · fixed in 1.29.3

• medium 5.3 Forminator Forms

  Arbitrary file upload

  CVE-2024-28890 · affected older than 1.29.0 · fixed in 1.29.0

• high 8.8 rtMedia for WordPress, BuddyPress and bbPress

  SQL injection

  CVE-2024-3293 · affected 4.6.18 and older · fixed in 4.6.19 *

Monday, April 22, 2024 · 8

• medium 5.3 Active Woot Products Tables for WooCommerce. 1…

  Missing authorization check

  CVE-2024-32691 · affected 1.0.6.2 and older · fixed in 1.0.6.3

• medium 6.5 MyRewards

  Missing authorization check

  CVE-2024-32688 · affected 5.3.0 and older · fixed in 5.3.1

• high 8.8 Prime Slider

  Missing authorization check

  CVE-2024-32682 · affected 3.13.2 and older · fixed in 3.13.3

• high 8.8 Prime Slider

  Missing authorization check

  CVE-2024-32681 · affected 3.13.2 and older · fixed in 3.13.3

• high 7.5 WP Ultimate Review

  Missing authorization check

  CVE-2024-32684 · affected 2.2.5 and older · fixed in 2.3.0

• medium 5.4 HappyAddons for Elementor

  Cross-site scripting (XSS)

  CVE-2024-32698 · affected 3.10.4 and older · fixed in 3.10.5

• high 7.1 Real3D Flipbook

  Reflected cross-site scripting (XSS)

  CVE-2024-32694 · affected 3.62 and older · fixed in 3.63

• medium 5.9 RSS Feed Widget

  Stored cross-site scripting (XSS)

  CVE-2024-32690 · affected 2.9.7 and older · fixed in 2.9.8

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan