WordPress plugin vulnerabilities: week 23, 2024
202 vulnerabilities published Jun 3 – Jun 9, 2024 in 162 plugins we track, by day.
15 critical 47 high 136 medium 4 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, June 9, 2024 · 46
-
high 8.8 MultiVendorX
-
critical 9.8 EmbedPress
-
critical 9.8 EventPrime
-
critical 9.8 Email Subscribers & Newsletters by Icegram Exp…
-
high 8.8 InstaWP Connect
-
high 8.8 WP Accessibility Helper (WAH)
-
high 8.8 AWP Classifieds
-
medium 4.3 Tracking Code Manager
-
high 8.8 Academy LMS
-
medium 5.3 RTMForm
-
medium 4.3 TotalPoll for Polls and Contests
-
medium 5.3 Social Share Icons & Social Share Buttons
-
high 8.8 MDTF
-
medium 5.3 File Manager for Google Drive
-
medium 6.5 Social Snap
-
critical 9.8 Easy Property Listings
-
medium 5.3 Hummingbird Performance
-
medium 5.3 WP Travel Engine
-
high 8.1 Contest Gallery
-
high 8.8 Debug Log Manager
-
high 7.5 Barcode Scanner (+Mobile App)
-
critical 9.8 Master Addons for Elementor
-
high 8.8 Nexter Blocks
-
medium 5.3 EmbedPress
-
critical 9.8 JS Help Desk
-
high 7.5 WP Time Slots Booking Form
-
high 8.8 Responsive Lightbox & Gallery
-
high 8.8 All-in-One Video Gallery
-
high 8.8 Events Manager
-
critical 9.8 Tainacan
-
high 8.8 Finale Lite
-
critical 9.1 weForms
-
high 8.8 Gutenberg Essential Blocks
-
high 8.8 Page Builder
-
high 8.8 WPZOOM Connect
-
medium 5.4 Awesome Support
-
high 8.8 NextMove Lite
-
critical 9.1 CatalogX Product Catalog, Product Enquiry & Qu…
-
high 8.8 Unlimited Elements for Elementor
-
high 8.8 WP Sort Order
-
critical 9.8 Awesome Support
-
high 8.8 WPC Badge Management for WooCommerce
Saturday, June 8, 2024 · 35
-
medium 5.4 Icegram Engage
-
medium 5.3 Import and export users and customers
-
medium 5.4 Advanced Woo Labels
-
high 8.8 Contact Form to DB by BestWebSoft
-
high 8.8 KiviCare
-
medium 5.4 BlockArt Blocks
-
medium 6.1 Heateor Social Login WordPress
-
medium 5.4 Master Addons for Elementor
-
medium 5.4 Property Hive
-
medium 5.4 Sina Extension for Elementor
-
medium 4.8 YITH WooCommerce Tab Manager
-
medium 6.1 WP Docs
-
medium 5.4 WP Docs
-
medium 6.1 WPMobile.App
-
medium 6.1 12 Step Meeting List
-
medium 6.1 Link Library
-
medium 5.4 Master Addons for Elementor
-
medium 4.3 ElasticPress
-
medium 6.1 GiveWP
-
medium 5.4 Comments
-
medium 5.4 RestroPress
-
medium 6.1 Newsletters
-
medium 5.3 Podlove Web Player
-
medium 5.4 The Plus Addons for Elementor
-
medium 5.4 Heateor Social Login WordPress
-
medium 4.8 Woody Code Snippets
-
medium 5.4 Kognetiks Chatbot
-
medium 5.4 The Post Grid
-
high 8.8 Visualizer
-
medium 6.1 WP Time Slots Booking Form
-
medium 6.5 GSheetConnector
-
medium 5.4 Salon Booking System
-
medium 5.4 SKT Addons for Elementor
-
medium 4.3 WP Reset
Friday, June 7, 2024 · 22
-
medium 6.1 Master Addons for Elementor
-
medium 5.3 Master Addons for Elementor
-
medium 4.3 Tutor LMS
-
medium 5.4 Envo Extra
-
high 8.8 Photo Gallery by 10Web
-
medium 5.4 Photo Gallery by 10Web
-
high 8.8 WS Form LITE
CSV injection
-
medium 5.4 Royal Addons for Elementor
-
medium 5.4 Royal Addons for Elementor
-
medium 5.4 Colibri Page Builder
-
medium 5.4 Post Grid
-
medium 6.4 TablePress
-
medium 5.4 Logo Slider
-
medium 6.5 Quiz and Survey Master (QSM)
-
medium 4.3 Strong Testimonials
-
medium 5.4 Prime Slider
-
high 7.2 Tutor LMS
-
medium 5.4 LightPress Lightbox
-
high 7.5 Qi Addons For Elementor
-
medium 6.5 Music Store
-
medium 5.4 Post Grid
-
medium 5.4 GDPR CCPA Compliance & Cookie Consent Banner
Thursday, June 6, 2024 · 16
-
medium 5.4 Essential Addons for Elementor
-
medium 5.4 Colibri Page Builder
-
high 8.8 Unlimited Elements for Elementor
-
medium 5.4 MultiVendorX
-
medium 5.4 Qi Blocks
-
medium 5.4 Materialis Companion
-
medium 5.4 Qi Addons For Elementor
-
medium 5.4 Themesflat Addons For Elementor
-
medium 5.4 Themesflat Addons For Elementor
-
medium 5.4 Themesflat Addons For Elementor
-
medium 5.4 Themesflat Addons For Elementor
-
high 8.8 OTP Login & Register Woocommerce
-
medium 5.4 The Moneytizer
-
high 8.1 The Moneytizer
Wednesday, June 5, 2024 · 19
-
high 8.8 Unlimited Elements for Elementor
-
medium 4.3 Five Star Restaurant Menu and Food Ordering
-
medium 5.4 Download Manager
-
medium 5.4 EmbedPress
-
high 8.8 LifterLMS
-
medium 5.4 Shortcodes Ultimate
-
medium 4.3 ProfileGrid
-
medium 5.4 Weaver Xtreme Theme Support
-
medium 5.4 Responsive Starter Templates
-
medium 5.4 Brizy
-
medium 4.3 Mollie Forms
-
critical 9.8 Email Subscribers & Newsletters by Icegram Exp…
-
medium 5.4 Brizy
-
medium 6.1 Brizy
-
medium 5.4 Brizy
-
medium 5.4 Brizy
-
medium 5.3 BuddyForms
Weak randomness
-
medium 5.3 LearnPress
-
medium 6.1 Newsletter
Tuesday, June 4, 2024 · 44
-
medium 6.3 Spiffy Calendar
-
critical 9.8 File Manager for Google Drive
-
critical 9.8 Netgsm
-
medium 5.4 Picture Gallery
-
medium 6.1 Event Tickets with Ticket Scanner
-
medium 5.4 Save as PDF Plugin by PDFCrowd
-
medium 5.4 Visual Composer Website Builder
-
medium 4.8 Brave
-
medium 6.1 Brevo
-
medium 5.4 Themesflat Addons For Elementor
-
medium 6.1 WPvivid Backup for MainWP
-
high 8.8 Sina Extension for Elementor
-
medium 6.5 Better Addons for Elementor
-
low 3.7 All-In-One Security (AIOS)
-
medium 5.3 RegistrationMagic
Security issue
-
high 7.5 RegistrationMagic
-
medium 5.3 Branda
-
low 3.7 Ultimate Dashboard
-
medium 5.3 WP Photo Album Plus
-
low 3.7 WPS Hide Login
-
medium 5.3 Captcha Code
Security issue
-
medium 5.3 Restricted Site Access
-
high 8.8 Booster for WooCommerce
-
medium 6.5 Contact Form Email
Security issue
-
medium 5.3 Spam Protection
-
medium 5.3 Form Maker by 10Web
Security issue
-
medium 5.3 Accept Stripe Payments
-
high 8.8 ARMember
-
high 7.5 Admin and Site Enhancements (ASE)
-
medium 6.1 Comments
-
medium 4.3 Content Pilot
-
medium 5.3 Antispam Bee
-
medium 5.4 Discussion Board
-
medium 6.5 Pinpoint Booking System
Security issue
-
medium 6.4 OttoKit
-
medium 5.3 Hide My WP Ghost
Security issue
-
high 7.2 Unlimited Elements for Elementor
-
medium 4.3 Contact Form Email
-
medium 4.3 Essential Real Estate
-
medium 6.4 Download Attachments
-
medium 5.4 Essential Real Estate
-
critical 9.1 The Events Calendar
-
medium 5.4 Simple Ajax Chat
-
medium 4.3 Admin Notices Manager
Monday, June 3, 2024 · 20
-
medium 4.3 CP Multi View Events Calendar
-
medium 4.3 Calculated Fields Form
-
high 8.8 CP Contact Form with PayPal
-
low 3.7 Event Espresso
-
critical 9.8 Booking calendar, Appointment Booking System
Security issue
-
medium 4.3 Search in Place
-
medium 5.3 Spectra Legacy
-
medium 6.1 Spectra Legacy
-
medium 5.3 Spectra Legacy
Security issue
-
medium 5.4 ShopLentor
-
medium 5.9 YITH WooCommerce Wishlist
-
high 7.1 FV Flowplayer Video Player
-
high 7.6 WP TripAdvisor Review Slider
-
medium 5.4 Tainacan
-
medium 6.1 Tainacan
-
medium 5.3 Contact Form Widget
-
medium 4.9 Ninja Tables
-
medium 4.9 Blocksy Companion
-
medium 4.4 Church Admin
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.