WordPress plugin vulnerabilities: week 22, 2024

36 vulnerabilities published May 27 – Jun 2, 2024 in 29 plugins we track, by day.

2 critical 7 high 27 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, June 2, 2024 · 1

• medium 4.3 Shield Security

  Cross-site request forgery (CSRF)

  CVE-2024-4344 · affected 19.1.10 and older · fixed in 19.1.19 *

Saturday, June 1, 2024 · 11

• medium 6.5 wpForo Forum

  SQL injection

  CVE-2024-3200 · affected 2.3.3 and older · fixed in 2.3.4 *

• high 7.1 User Registration & Membership

  Missing authorization check

  CVE-2024-4958 · affected 3.2.0.1 and older · fixed in 3.2.1 *

• medium 6.4 Popup Builder

  Stored cross-site scripting (XSS)

  CVE-2024-2506 · affected 4.2.7 and older · fixed in 4.3.0 *

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4342 · affected 1.3.975 and older · fixed in 1.3.976 *

• medium 6.4 Supreme Modules Lite

  Stored cross-site scripting (XSS)

  CVE-2024-5501 · affected 2.5.51 and older · fixed in 2.5.52 *

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4087 · affected 1.3.975 and older · fixed in 1.3.976 *

• medium 5.4 Master Slider

  Stored cross-site scripting (XSS)

  CVE-2023-6382 · affected 3.9.9 and older · fixed in 3.9.10 *

• medium 5.4 Content Blocks (Custom Post Widget)

  Stored cross-site scripting (XSS)

  CVE-2024-3565 · affected 3.3.0 and older · fixed in 3.3.1 *

• high 8.8 Content Blocks (Custom Post Widget)

  File inclusion

  CVE-2024-3564 · affected 3.3.0 and older · fixed in 3.3.1 *

• medium 5.4 Ajax Load More

  Stored cross-site scripting (XSS)

  CVE-2024-4711 · affected 7.1.1 and older · fixed in 7.1.2 *

• medium 6.4 Page Builder Gutenberg Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-2933 · affected 3.1.9 and older · fixed in 3.1.10 *

Friday, May 31, 2024 · 9

• medium 6.4 Auto Featured Image (Auto Post Thumbnail)

  Server-side request forgery (SSRF)

  CVE-2023-7073 · affected 4.1.7 and older · fixed in 4.2.0 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5347 · affected 3.10.9 and older · fixed in 3.11.0 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5041 · affected 3.10.9 and older · fixed in 3.11.0 *

• medium 5.4 Download Manager

  Stored cross-site scripting (XSS)

  CVE-2024-4160 · affected 3.2.90 and older · fixed in 3.2.91 *

• medium 5.4 WPCafe

  Stored cross-site scripting (XSS)

  CVE-2024-5427 · affected 2.2.24 and older · fixed in 2.2.25 *

• medium 5.4 Premium Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4379 · affected older than 4.10.32 · fixed in 4.10.32

• medium 5.4 Premium Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4376 · affected older than 4.10.32 · fixed in 4.10.32

• medium 4.3 Premium Addons for Elementor

  Missing authorization check

  CVE-2024-4205 · affected older than 4.10.32 · fixed in 4.10.32

• high 7.2 Atarim

  Stored cross-site scripting (XSS)

  CVE-2024-2793 · affected 3.30 and older · fixed in 3.31 *

Thursday, May 30, 2024 · 9

• medium 6.4 Simple Like Page

  Stored cross-site scripting (XSS)

  CVE-2024-3583 · affected 1.5.2 and older · fixed in 1.5.3 *

• high 8.8 Post Grid Blocks & Templates for News, Magazin…

  Missing authorization check

  CVE-2024-5326 · affected 4.1.2 and older · fix not stated

• medium 6.4 Gum Addon for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-4668 · affected 1.3.4 and older · fixed in 1.3.5 *

• medium 5.4 PowerPack Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5327 · affected 2.7.19 and older · fixed in 2.7.20 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5073 · affected 5.9.21 and older · fixed in 5.9.22 *

• high 7.2 Post SMTP

  SQL injection

  CVE-2024-5207 · affected 2.9.3 and older · fixed in 2.9.4 *

• medium 5.4 Download Monitor

  Missing authorization check

  CVE-2024-3269 · affected 4.9.13 and older · fixed in 4.9.14 *

• medium 6.4 Post Grid Blocks & Templates for News, Magazin…

  Stored cross-site scripting (XSS)

  CVE-2024-5223 · affected 4.1.1 and older · fix not stated

• medium 4.6 Unlimited Elements for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-3190 · affected 1.5.107 and older · fixed in 1.5.132 *

Wednesday, May 29, 2024 · 6

• medium 6.4 HUSKY

  Stored cross-site scripting (XSS)

  CVE-2024-5039 · affected 1.3.5.3 and older · fixed in 1.3.8.1 *

• critical 9.1 Site Reviews

  Security issue

  CVE-2024-3050 · affected older than 7.0.0 · fixed in 7.0.0

• high 8.8 Unlimited Elements for Elementor

  Remote code execution

  CVE-2023-6743 · affected 1.5.89 and older · fixed in 1.5.92 *

• medium 5.3 Travelly

  Cross-site request forgery (CSRF)

  CVE-2024-0434 · affected 1.7.1 and older · fixed in 2.0.6 *

• critical 9.8 OTP Login With Phone Number, OTP Verification

  Authentication bypass

  CVE-2024-5150 · affected 1.7.26 and older · fixed in 1.7.27 *

• high 8.8 Swiss Toolkit For WP

  Authentication bypass

  CVE-2024-5204 · affected 1.0.7 and older · fix not stated

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan