WordPress plugin vulnerabilities: week 20, 2024

200 vulnerabilities published May 13 – May 19, 2024 in 149 plugins we track, by day.

20 critical 55 high 125 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, May 18, 2024 · 9

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5088 · affected 3.10.8 and older · fixed in 3.10.9 *

• medium 6.4 Piotnet Addons For Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4432 · affected 2.4.26 and older · fixed in 2.4.27 *

• medium 6.4 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2024-4709 · affected 5.1.16 and older · fixed in 5.1.17 *

• medium 5.4 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2024-2772 · affected 5.1.13 and older · fixed in 5.1.14 *

• high 7.5 Fluent Forms

  Missing authorization check

  CVE-2024-2782 · affected 5.1.16 and older · fixed in 5.1.17 *

• critical 9.8 Fluent Forms

  Privilege escalation

  CVE-2024-2771 · affected 5.1.16 and older · fixed in 5.1.17 *

• medium 5.4 Gutenberg Essential Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-4891 · affected 4.5.12 and older · fixed in 4.5.13 *

• medium 5.4 GiveWP

  Stored cross-site scripting (XSS)

  CVE-2024-3714 · affected 3.10.0 and older · fixed in 3.11.0 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4865 · affected 3.10.8 and older · fixed in 3.10.9 *

Friday, May 17, 2024 · 70

• medium 5.3 Flo Forms

  Missing authorization check

  CVE-2024-35174 · affected 1.0.42 and older · fix not stated

• medium 4.3 Integration for HubSpot and Contact Form 7, WP…

  Cross-site request forgery (CSRF)

  CVE-2024-34756 · affected 1.3.1 and older · fixed in 1.3.2

• medium 4.3 Clearfy Cache

  Cross-site request forgery (CSRF)

  CVE-2024-34806 · affected 2.2.1 and older · fixed in 2.2.3 *

• high 8.8 Booking Ultra Pro Appointments Booking Calenda…

  Privilege escalation

  CVE-2024-32960 · affected 1.1.12 and older · fixed in 1.1.13 *

• medium 4.3 Integration for Salesforce and Contact Form 7,…

  Cross-site request forgery (CSRF)

  CVE-2024-34755 · affected 1.3.9 and older · fixed in 1.4.0

• high 8.8 Image Optimizer, Resizer and CDN

  Privilege escalation

  CVE-2024-32959 · affected 7.2.2 and older · fixed in 7.2.3

• high 7.5 BuddyForms

  Path traversal / file read

  CVE-2024-32830 · affected 2.8.8 and older · fixed in 2.8.9

• medium 5.3 Giveaways and Contests by RafflePress

  Authentication bypass

  CVE-2024-32827 · affected 1.12.7 and older · fixed in 1.12.11

• medium 5.3 Better Messages

  Missing authorization check

  CVE-2024-32802 · affected 2.4.32 and older · fixed in 2.4.33

• high 8.8 ProfileGrid

  Security issue

  CVE-2024-32774 · affected 5.8.2 and older · fixed in 5.8.3

• critical 9.8 Royal Addons for Elementor

  Authentication bypass

  CVE-2024-32786 · affected 1.3.93 and older · fixed in 1.3.95

• medium 5.3 Appointment Hour Booking

  Security issue

  CVE-2024-32720 · affected 1.4.56 and older · fixed in 1.4.57

• medium 6.5 MDTF

  Missing authorization check

  CVE-2024-34434 · affected 1.3.3.2 and older · fixed in 1.3.3.3

• critical 9.8 Barcode Scanner (+Mobile App)

  Privilege escalation

  CVE-2024-33567 · affected 1.5.3 and older · fixed in 1.5.4

• medium 5.3 WP Ultimate Review

  Security issue

  CVE-2024-32685 · affected 2.2.5 and older · fixed in 2.3.0

• high 8.1 Mailster WordPress Newsletter Plugin

  File inclusion

  CVE-2024-32523 · affected 4.0.6 and older · fixed in 4.0.7

• high 8.8 HUSKY

  Remote code execution

  CVE-2024-32680 · affected 1.3.5.2 and older · fixed in 1.3.5.3

• medium 5.3 weForms

  Security issue

  CVE-2024-32512 · affected 1.6.20 and older · fixed in 1.6.21

• medium 5.3 Zero Spam for WordPress

  Security issue

  CVE-2024-32521 · affected 5.5.6 and older · fixed in 5.5.7

• high 8.8 OTP Login With Phone Number, OTP Verification

  Privilege escalation

  CVE-2024-32507 · affected 1.7.16 and older · fixed in 1.7.17

• high 7.5 Download Manager

  Information disclosure

  CVE-2024-32131 · affected 3.2.82 and older · fixed in 3.2.83

• medium 5.3 User Profile Builder

  Security issue

  CVE-2024-31341 · affected 3.11.2 and older · fixed in 3.11.3

• medium 5.3 Captcha by BestWebSoft

  Security issue

  CVE-2024-31295 · affected 5.2.0 and older · fixed in 5.2.1

• medium 6.3 Church Admin

  Missing authorization check

  CVE-2024-31281 · affected 4.1.6 and older · fixed in 4.1.7

• high 7.5 s2Member

  Privilege escalation

  CVE-2024-31237 · affected 240315 and older · fixed in 240325 *

• critical 9.8 WholesaleX

  Privilege escalation

  CVE-2024-30542 · affected 1.3.2 and older · fixed in 1.3.3

• high 7.5 WP Express Checkout (Fast Payments via PayPal…

  Security issue

  CVE-2024-30527 · affected 2.3.7 and older · fixed in 2.3.8

• medium 5.3 Newsletter

  Authentication bypass

  CVE-2024-30522 · affected 8.2.0 and older · fixed in 8.2.1

• high 8.3 Premmerce Permalink Manager for WooCommerce

  File inclusion

  CVE-2024-27971 · affected 2.3.10 and older · fixed in 2.3.11

• high 8.1 Elementor Website Builder

  Path traversal / file read

  CVE-2024-24934 · affected 3.19.0 and older · fixed in 3.19.1

• critical 9.8 Masteriyo LMS

  Privilege escalation

  CVE-2024-24882 · affected 1.7.2 and older · fixed in 1.7.3

• high 7.5 Total Upkeep

  Path traversal / file read

  CVE-2024-24869 · affected 1.15.8 and older · fixed in 1.15.9

• medium 6.5 Bookit

  Security issue

  CVE-2024-24715 · affected 2.4.0 and older · fixed in 2.4.2

• medium 6.1 Formidable Forms

  Cross-site scripting (XSS)

  CVE-2024-23522 · affected 6.7 and older · fixed in 6.7.1

• high 8.8 InstaWP Connect

  Privilege escalation

  CVE-2024-22145 · affected 0.1.0.8 and older · fixed in 0.1.0.9

• high 7.5 WP Ultimate Review

  Authentication bypass

  CVE-2024-21746 · affected 2.3.6 and older · fixed in 2.3.7

• high 7.2 WebToffee WooCommerce PDF Invoices, Packing Sl…

  Privilege escalation

  CVE-2023-51546 · affected 4.2.1 and older · fixed in 4.3.0

• critical 9.8 WP Frontend Profile

  Privilege escalation

  CVE-2023-51483 · affected 1.3.1 and older · fixed in 1.3.2

• high 8.8 Build App Online

  Privilege escalation

  CVE-2023-51479 · affected 1.0.19 and older · fix not stated

• critical 9.8 Local Delivery Drivers for WooCommerce

  Privilege escalation

  CVE-2023-51481 · affected 1.9.0 and older · fixed in 1.9.1

• critical 9.8 WebinarIgnition

  Privilege escalation

  CVE-2023-51424 · affected 3.05.0 and older · fixed in 3.05.1

• high 8.8 ARMember

  Privilege escalation

  CVE-2023-51356 · affected 4.0.10 and older · fixed in 4.0.11

• high 7.2 Salon Booking System

  Privilege escalation

  CVE-2023-48319 · affected 8.6 and older · fixed in 8.7

• critical 9.8 wpForo Forum

  Privilege escalation

  CVE-2023-47868 · affected 2.2.3 and older · fixed in 2.2.4

• high 8.0 Social Login, Social Sharing by miniOrange

  Privilege escalation

  CVE-2023-47683 · affected 7.6.6 and older · fixed in 7.6.7

• high 8.8 Qi Addons For Elementor

  File inclusion

  CVE-2023-47679 · affected 1.6.3 and older · fixed in 1.6.4

• high 7.2 User Frontend

  Privilege escalation

  CVE-2023-47682 · affected 3.6.5 and older · fixed in 3.6.6

• high 8.2 ICS Calendar

  Path traversal / file read

  CVE-2023-46784 · affected 10.12.0.3 and older · fixed in 10.12.0.4

• medium 6.5 Customer Engagement System

  Path traversal / file read

  CVE-2023-46197 · affected 1.10.19 and older · fixed in 1.10.20

• critical 9.8 Simple Membership

  Privilege escalation

  CVE-2023-41957 · affected 4.3.4 and older · fixed in 4.3.5

• high 8.8 Simple Membership

  Authentication bypass

  CVE-2023-41956 · affected 4.3.4 and older · fixed in 4.3.5

• high 8.8 Essential Addons for Elementor

  Privilege escalation

  CVE-2023-41955 · affected 5.8.8 and older · fixed in 5.8.9

• high 8.8 GiveWP

  Privilege escalation

  CVE-2023-41665 · affected 2.33.0 and older · fixed in 2.33.1

• high 8.6 ProfilePress

  Privilege escalation

  CVE-2023-41954 · affected 4.13.1 and older · fixed in 4.13.2

• high 8.6 Premium Portfolio Features for Phlox theme

  File inclusion

  CVE-2023-38399 · affected 2.3.1 and older · fixed in 2.3.2

• high 8.8 WPvivid

  Privilege escalation

  CVE-2023-41243 · affected 0.9.90 and older · fixed in 0.9.91

• critical 9.8 Shortcodes and extra features for Phlox theme

  File inclusion

  CVE-2023-37888 · affected 2.14.0 and older · fixed in 2.15.0

• critical 9.8 HT Mega Addons for Elementor

  Privilege escalation

  CVE-2023-37999 · affected 2.2.0 and older · fixed in 2.2.1

• high 7.2 JetFormBuilder

  Privilege escalation

  CVE-2023-37866 · affected 3.0.8 and older · fixed in 3.0.9

• high 8.8 Booking Package

  Privilege escalation

  CVE-2023-37389 · affected 1.5.98 and older · fixed in 1.5.99

• medium 5.3 EventPrime

  Missing authorization check

  CVE-2023-33321 · affected 2.8.6 and older · fixed in 3.0.0

• high 7.7 Online Scheduling and Appointment Booking System

  Path traversal / file read

  CVE-2023-26526 · affected 21.7.1 and older · fixed in 21.8

• critical 9.1 JS Help Desk

  Arbitrary file upload

  CVE-2023-25444 · affected 2.7.7 and older · fixed in 2.7.8

• critical 9.8 WatchTowerHQ

  Privilege escalation

  CVE-2023-25701 · affected 3.6.16 and older · fixed in 3.6.17

• high 7.1 Shortcodes Ultimate

  Path traversal / file read

  CVE-2023-25050 · affected 5.12.6 and older · fixed in 5.12.7

• high 7.6 Redirection for Contact Form 7

  Privilege escalation

  CVE-2023-23990 · affected 2.7.0 and older · fixed in 2.8.0

• high 7.5 My Tickets

  Missing authorization check

  CVE-2023-23988 · affected 1.9.11 and older · fixed in 1.9.12

• high 8.8 Rank Math SEO

  Path traversal / file read

  CVE-2023-23888 · affected 1.0.107.2 and older · fixed in 1.0.107.3

• medium 6.5 Easy Notify Lite

  Stored cross-site scripting (XSS)

  CVE-2024-34567 · affected 1.1.29 and older · fixed in 1.1.30

• high 7.1 Landing Page Builder

  Reflected cross-site scripting (XSS)

  CVE-2024-34752 · affected 1.5.1.8 and older · fixed in 1.5.1.9

Thursday, May 16, 2024 · 20

• medium 5.4 Master Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3134 · affected 2.0.6.0 and older · fixed in 2.0.6.1 *

• medium 4.3 ReviewX

  Missing authorization check

  CVE-2024-3609 · affected 1.6.27 and older · fixed in 1.6.28 *

• medium 5.4 Ultimate Addons for Elementor

  Content injection

  CVE-2024-2619 · affected 1.6.26 and older · fixed in 1.6.27 *

• medium 6.5 Magazine Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-34760 · affected 1.3.6 and older · fixed in 1.3.7

• medium 4.4 Order Export & Order Import for WooCommerce

  PHP object injection

  CVE-2024-34751 · affected 2.4.9 and older · fixed in 2.5.0

• medium 5.4 Master Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4580 · affected 2.0.6.0 and older · fixed in 2.0.6.1 *

• medium 5.4 Ultimate Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4634 · affected 1.6.28 and older · fixed in 1.6.29 *

• medium 5.4 Envo Extra

  Stored cross-site scripting (XSS)

  CVE-2024-4385 · affected 1.8.16 and older · fixed in 1.8.17 *

• medium 5.4 Post and Page Builder by BoldGrid

  Stored cross-site scripting (XSS)

  CVE-2024-4400 · affected 1.26.4 and older · fixed in 1.26.5 *

• medium 6.4 Rank Math SEO

  Stored cross-site scripting (XSS)

  CVE-2024-4617 · affected 1.0.218 and older · fixed in 1.0.219 *

• medium 5.4 Simply Schedule Appointments

  Stored cross-site scripting (XSS)

  CVE-2024-4288 · affected 1.6.7.14 and older · fixed in 1.6.7.18 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4391 · affected 3.10.7 and older · fixed in 3.10.8 *

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3887 · affected 1.3.974 and older · fixed in 1.3.975 *

• critical 9.8 Tutor LMS

  Missing authorization check

  CVE-2024-4223 · affected 2.7.0 and older · fixed in 2.7.1 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4478 · affected 3.10.7 and older · fixed in 3.10.8 *

• medium 6.4 Menu Icons by Themeisle

  Stored cross-site scripting (XSS)

  CVE-2024-4635 · affected 0.13.13 and older · fixed in 0.13.14 *

• medium 6.5 Tutor LMS

  SQL injection

  CVE-2024-4318 · affected 2.7.0 and older · fixed in 2.7.1 *

• medium 6.5 Tutor LMS

  Missing authorization check

  CVE-2024-4279 · affected 2.7.0 and older · fixed in 2.7.1 *

• high 8.8 Visualizer

  Privilege escalation

  CVE-2024-3750 · affected 3.10.15 and older · fixed in 3.11.0 *

• medium 6.4 Yoast SEO

  Stored cross-site scripting (XSS)

  CVE-2024-4984 · affected 22.6 and older · fixed in 22.7 *

Wednesday, May 15, 2024 · 15

• high 8.8 All-in-One Video Gallery

  File inclusion

  CVE-2024-4670 · affected 3.6.5 and older · fixed in 3.7.0 *

• high 8.8 Email Subscribers & Newsletters by Icegram Exp…

  SQL injection

  CVE-2024-4010 · affected 5.7.19 and older · fixed in 5.7.20 *

• medium 6.4 Optimole

  Stored cross-site scripting (XSS)

  CVE-2024-4636 · affected 3.12.10 and older · fixed in 3.13.0 *

• medium 6.5 SP Project & Document Manager

  Security issue

  CVE-2024-3749 · affected 4.71 and older · fix not stated

• medium 6.5 SP Project & Document Manager

  Security issue

  CVE-2024-3748 · affected 4.71 and older · fix not stated

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-4208 · affected 3.2.37 and older · fixed in 3.2.38 *

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-3189 · affected 3.2.37 and older · fixed in 3.2.38 *

• high 8.8 Alt Text AI

  SQL injection

  CVE-2024-4847 · affected 1.4.9 and older · fixed in 1.5.0 *

• medium 4.4 Import and export users and customers

  Stored cross-site scripting (XSS)

  CVE-2024-4734 · affected 1.26.6.1 and older · fixed in 1.26.7 *

• medium 5.4 Exclusive Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4618 · affected 2.6.9.6 and older · fixed in 2.6.9.7 *

• medium 4.4 Import and export users and customers

  Stored cross-site scripting (XSS)

  CVE-2024-4656 · affected 1.26.6.1 and older · fixed in 1.26.7 *

• medium 5.4 Sina Extension for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4373 · affected 3.5.3 and older · fixed in 3.5.4 *

• medium 6.4 Gallery by Visual Portfolio

  Stored cross-site scripting (XSS)

  CVE-2024-4363 · affected 3.3.2 and older · fixed in 3.3.3 *

• medium 5.4 WPZOOM Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4370 · affected 1.1.36 and older · fixed in 1.1.37 *

• medium 4.3 Password Protected

  Information disclosure

  CVE-2024-0437 · affected 2.6.6 and older · fixed in 2.6.7 *

Tuesday, May 14, 2024 · 86

• high 8.8 Leyka

  Privilege escalation

  CVE-2023-33327 · affected 3.30.2 and older · fixed in 3.30.3

• medium 6.1 WP RSS Aggregator

  Cross-site scripting (XSS)

  CVE-2024-4860 · affected older than 4.23.9 · fixed in 4.23.9

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4624 · affected 5.9.20 and older · fixed in 5.9.21 *

• medium 5.4 Jetpack

  Stored cross-site scripting (XSS)

  CVE-2024-4392 · affected 13.3.1 and older · fixed in 13.3.2 *

• medium 4.3 WP Compress

  Cross-site scripting (XSS)

  CVE-2024-4445 · affected 6.20.01 and older · fixed in 6.30.26 *

• medium 6.4 Xpro Addons

  Stored cross-site scripting (XSS)

  CVE-2024-4440 · affected 1.4.3 and older · fix not stated

• medium 5.4 Sina Extension for Elementor

  DOM-based cross-site scripting (XSS)

  CVE-2024-4333 · affected 3.5.3 and older · fixed in 3.5.4 *

• medium 6.1 WP Compress

  Open redirect

  CVE-2023-6812 · affected 6.20.01 and older · fixed in 6.30.26 *

• high 7.1 Propovoice

  Stored cross-site scripting (XSS)

  CVE-2024-4747 · affected 1.7.6.2 and older · fix not stated

• medium 4.3 ShortPixel Adaptive Images

  Cross-site request forgery (CSRF)

  CVE-2024-4689 · affected 3.8.3 and older · fixed in 3.8.4

• medium 6.4 Starter Templates

  Stored cross-site scripting (XSS)

  CVE-2024-4630 · affected 4.2.1 and older · fixed in 4.2.2 *

• medium 5.4 Ultimate Store Kit

  PHP object injection

  CVE-2024-4606 · affected 2.0.3 and older · fixed in 2.0.4

• medium 6.4 Graphina

  Stored cross-site scripting (XSS)

  CVE-2024-4574 · affected 1.8.9 and older · fixed in 1.8.10 *

• critical 9.8 Kognetiks Chatbot

  Arbitrary file upload

  CVE-2024-4560 · affected 1.9.9 and older · fixed in 2.0.0 *

• medium 5.4 Blocksy Companion

  Stored cross-site scripting (XSS)

  CVE-2024-4487 · affected 2.0.45 and older · fixed in 2.0.46 *

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-4481 · affected 3.2.36 and older · fixed in 3.2.37 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4449 · affected 5.9.19 and older · fixed in 5.9.20 *

• medium 6.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4448 · affected 5.9.19 and older · fixed in 5.9.20 *

• medium 6.5 LearnPress

  Missing authorization check

  CVE-2024-4444 · affected 4.2.6.5 and older · fixed in 4.2.6.6 *

• critical 9.8 LearnPress

  SQL injection

  CVE-2024-4434 · affected 4.2.6.5 and older · fixed in 4.2.6.6 *

• medium 5.4 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2024-4430 · affected 2.8.1.2 and older · fixed in 2.8.1.3 *

• medium 4.4 Falang multilanguage for WordPress

  Stored cross-site scripting (XSS)

  CVE-2024-4417 · affected 1.3.49 and older · fixed in 1.3.50 *

• critical 9.8 MotoPress Hotel Booking

  PHP object injection

  CVE-2024-4413 · affected 4.11.1 and older · fixed in 4.11.2 *

• medium 6.4 HTML5 Audio Player

  Stored cross-site scripting (XSS)

  CVE-2024-4398 · affected 2.2.19 and older · fixed in 2.2.24 *

• high 8.8 LearnPress

  Arbitrary file upload

  CVE-2024-4397 · affected 4.2.6.5 and older · fixed in 4.2.6.6 *

• medium 6.4 Meow Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-4386 · affected 5.1.3 and older · fixed in 5.1.4 *

• medium 5.4 Simple Membership

  Stored cross-site scripting (XSS)

  CVE-2024-4383 · affected 4.4.5 and older · fixed in 4.4.6 *

• medium 5.4 Prime Slider

  Stored cross-site scripting (XSS)

  CVE-2024-4339 · affected 3.14.3 and older · fixed in 3.14.5 *

• medium 5.4 Rank Math SEO

  Stored cross-site scripting (XSS)

  CVE-2024-4335 · affected 1.0.217 and older · fixed in 1.0.218 *

• medium 6.4 Thim Kit for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4329 · affected 1.1.9 and older · fixed in 1.1.9.1 *

• medium 5.4 EmbedPress

  Stored cross-site scripting (XSS)

  CVE-2024-4316 · affected 3.9.16 and older · fixed in 3.9.17 *

• medium 4.3 Hostel

  Cross-site request forgery (CSRF)

  CVE-2024-4314 · affected 1.1.5.3 and older · fixed in 1.1.5.5 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4275 · affected 5.9.19 and older · fixed in 5.9.20 *

• medium 5.4 LearnPress

  Stored cross-site scripting (XSS)

  CVE-2024-4277 · affected 4.2.6.5 and older · fixed in 4.2.6.6 *

• medium 5.3 White Label CMS

  Missing authorization check

  CVE-2024-4280 · affected 2.7.3 and older · fixed in 2.7.4 *

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-4209 · affected 3.2.36 and older · fixed in 3.2.37 *

• medium 5.3 WP EasyCart

  Information disclosure

  CVE-2024-4213 · affected 5.6.4 and older · fixed in 5.6.5 *

• medium 6.1 Yoast SEO

  Reflected cross-site scripting (XSS)

  CVE-2024-4041 · affected 22.5 and older · fixed in 22.6 *

• medium 5.4 HT Mega Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3990 · affected 2.5.0 and older · fixed in 2.5.1 *

• medium 5.4 BuddyPress

  Stored cross-site scripting (XSS)

  CVE-2024-3974 · affected 12.4.0 and older · fixed in 12.4.1 *

• medium 5.4 HT Mega Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3989 · affected 2.5.0 and older · fixed in 2.5.1 *

• medium 5.4 Pods

  Stored cross-site scripting (XSS)

  CVE-2024-3956 · affected 3.2.1 and older · fixed in 3.2.8.3 *

• medium 6.4 Advanced Ads

  Stored cross-site scripting (XSS)

  CVE-2024-3952 · affected 1.52.1 and older · fixed in 1.52.2 *

• high 8.8 Ditty

  PHP object injection

  CVE-2024-3954 · affected 3.1.38 and older · fixed in 3.1.39 *

• medium 5.4 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2024-3923 · affected 2.8.1.1 and older · fixed in 2.8.1.2 *

• medium 5.4 Enter Addons

  Stored cross-site scripting (XSS)

  CVE-2024-3831 · affected 2.1.5 and older · fixed in 2.2.2 *

• medium 5.4 Enter Addons

  Stored cross-site scripting (XSS)

  CVE-2024-3680 · affected 2.1.5 and older · fixed in 2.2.2 *

• medium 6.1 Unlimited Elements for Elementor

  Reflected cross-site scripting (XSS)

  CVE-2024-3547 · affected 1.5.102 and older · fixed in 1.5.132 *

• high 8.8 Unlimited Elements for Elementor

  SQL injection

  CVE-2024-3055 · affected 1.5.102 and older · fixed in 1.5.132 *

• medium 4.4 ShortPixel Adaptive Images

  Server-side request forgery (SSRF)

  CVE-2024-35172 · affected 3.8.3 and older · fixed in 3.8.4

• medium 5.3 Academy LMS

  Information disclosure

  CVE-2024-35171 · affected 1.9.25 and older · fixed in 1.9.26

• medium 5.9 All Bootstrap Blocks

  Cross-site scripting (XSS)

  CVE-2024-35169 · affected 1.3.15 and older · fixed in 1.3.16

• medium 5.4 Envo's Templates & Widgets for Elementor and W…

  Stored cross-site scripting (XSS)

  CVE-2024-35167 · affected 1.4.8 and older · fixed in 1.4.9

• high 7.5 FileBird

  Information disclosure

  CVE-2024-35166 · affected 5.6.3 and older · fixed in 5.6.4

• medium 5.3 Gutenify

  Information disclosure

  CVE-2024-35165 · affected 1.4.0 and older · fixed in 1.4.1

• medium 4.3 Church Admin

  Cross-site request forgery (CSRF)

  CVE-2024-34828 · affected 4.1.32 and older · fixed in 4.2.0

• medium 4.3 TranslatePress

  Cross-site request forgery (CSRF)

  CVE-2024-34827 · affected 2.7.5 and older · fixed in 2.7.6

• medium 5.4 WPCal.io

  Cross-site request forgery (CSRF)

  CVE-2024-34816 · affected 0.9.5.8 and older · fixed in 0.9.5.9

• medium 5.3 ShopBuilder

  Information disclosure

  CVE-2024-34812 · affected 2.1.8 and older · fixed in 2.1.9

• medium 4.8 WSMS (formerly WP SMS)

  Stored cross-site scripting (XSS)

  CVE-2024-34811 · affected 6.5.1 and older · fixed in 6.5.2

• medium 4.3 Barcode Scanner (+Mobile App)

  Cross-site request forgery (CSRF)

  CVE-2024-34557 · affected 1.5.4 and older · fixed in 1.5.5

• medium 5.3 Barcode Scanner (+Mobile App)

  Information disclosure

  CVE-2024-34556 · affected 1.5.4 and older · fixed in 1.5.5

• medium 5.3 WP Job Manager

  Information disclosure

  CVE-2024-34549 · affected 2.2.2 and older · fixed in 2.3.0

• medium 5.4 SKT Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-34445 · affected 1.8 and older · fixed in 1.9

• high 7.2 AI Engine

  Arbitrary file upload

  CVE-2024-34440 · affected 2.2.63 and older · fixed in 2.2.70

• medium 4.8 Form Maker by 10Web

  Stored cross-site scripting (XSS)

  CVE-2024-34437 · affected 1.15.24 and older · fixed in 1.15.25

• medium 5.4 SKT Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-34436 · affected 1.8 and older · fixed in 1.9

• medium 5.4 Better Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-34432 · affected 1.4.4 and older · fixed in 1.4.5

• high 7.2 One Click Demo Import

  PHP object injection

  CVE-2024-34433 · affected 3.2.0 and older · fixed in 3.2.1

• medium 6.5 Thim Kit for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-34415 · affected 1.1.8 and older · fixed in 1.1.9

• medium 4.3 Podlove Podcast Publisher

  Missing authorization check

  CVE-2024-32712 · affected 4.0.14 and older · fixed in 4.0.15

• critical 10.0 Kognetiks Chatbot

  Arbitrary file upload

  CVE-2024-32700 · affected 2.0.0 and older · fixed in 2.0.1

• high 7.5 Easy Digital Downloads

  Information disclosure

  CVE-2024-32100 · affected 3.2.11 and older · fixed in 3.2.12

• critical 10.0 WP Photo Album Plus

  Arbitrary file upload

  CVE-2024-31377 · affected 8.7.01.001 and older · fixed in 8.7.01.002

• high 8.8 Easy Digital Downloads

  Cross-site request forgery (CSRF)

  CVE-2024-31113 · affected 3.2.11 and older · fixed in 3.2.12

• medium 5.4 Magical Addons For Elementor ( Theme Builder,…

  Stored cross-site scripting (XSS)

  CVE-2024-2923 · affected 1.1.37 and older · fixed in 1.1.40 *

• medium 5.4 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-2785 · affected 5.4.2 and older · fixed in 5.5.0 *

• medium 5.9 VikBooking Hotel Booking Engine & PMS

  Missing authorization check

  CVE-2024-2749 · affected older than 1.6.8 · fixed in 1.6.8

• high 7.2 Unlimited Elements for Elementor

  Command injection

  CVE-2024-2662 · affected 1.5.102 and older · fixed in 1.5.132 *

• high 8.1 VikBooking Hotel Booking Engine & PMS

  Missing authorization check

  CVE-2024-2441 · affected older than 1.6.8 · fixed in 1.6.8

• high 7.2 Advanced Ads

  PHP object injection

  CVE-2024-2290 · affected 1.52.1 and older · fixed in 1.52.2 *

• medium 4.3 SP Project & Document Manager

  Missing authorization check

  CVE-2024-1693 · affected 4.70 and older · fix not stated

• medium 4.3 Starter Templates

  Server-side request forgery (SSRF)

  CVE-2024-1467 · affected 4.1.6 and older · fixed in 4.1.7 *

• medium 5.4 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-0445 · affected 5.4.2 and older · fixed in 5.5.0 *

• medium 5.3 ShopLentor

  Missing authorization check

  CVE-2023-6327 · affected 2.8.7 and older · fixed in 2.8.8 *

• medium 4.8 Save as PDF Plugin by PDFCrowd

  Stored cross-site scripting (XSS)

  CVE-2023-5971 · affected older than 3.2.0 · fixed in 3.2.0

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan