WordPress plugin vulnerabilities: week 24, 2024
108 vulnerabilities published Jun 10 – Jun 16, 2024 in 97 plugins we track, by day.
9 critical 20 high 78 medium 1 low
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Saturday, June 15, 2024 · 7
-
medium 6.4 Stratum Widgets for Elementor
-
critical 9.9 Woody Code Snippets
-
medium 5.4 Shariff Wrapper
-
medium 6.4 Restaurant Menu
-
medium 5.4 Jeg Kit for Elementor
-
medium 6.4 Popup Builder
-
high 8.1 Popup Builder
Friday, June 14, 2024 · 17
-
high 8.8 Folders
-
medium 4.3 Folders
-
medium 4.3 SureFeedback Client Site
-
medium 5.4 Kadence Blocks
-
medium 5.4 WP Go Maps
-
medium 6.1 Inquiry cart
-
medium 5.4 FooGallery Photo Gallery
-
medium 5.3 Ninja Tables
-
medium 6.5 The Events Calendar
Security issue
-
medium 5.3 Everest Forms
-
critical 9.8 Canto
-
high 7.3 Timetics
-
medium 4.3 Schema App Structured Data
-
medium 5.4 Business Directory Plugin
-
medium 5.3 Quiz and Survey Master (QSM)
-
medium 5.3 WP Dummy Content Generator
-
critical 9.8 SendPress Newsletters
Thursday, June 13, 2024 · 7
-
medium 5.4 Cooked
-
low 2.7 Easy WP SMTP
-
medium 5.4 EmbedPress
-
medium 5.4 PowerPack Addons for Elementor
-
medium 5.4 Ultimate Addons for Elementor
-
medium 6.1 Themify Builder
-
high 7.5 Download Manager
Wednesday, June 12, 2024 · 17
-
medium 5.4 WooCommerce
-
medium 5.4 Download Manager
-
medium 5.4 Events Manager
-
critical 9.8 InstaWP Connect
-
high 8.8 weForms
-
medium 5.4 Download Manager
-
medium 6.3 File Manager for Google Drive
-
medium 6.3 ProfileGrid
-
high 7.3 Awesome Support
-
medium 5.4 Element Pack Addons for Elementor
-
medium 6.4 Divi Torque Lite
-
medium 6.1 Social Sharing Plugin
-
medium 5.4 Premium Addons for Elementor
-
medium 5.4 BuddyPress
-
high 8.1 Slideshow Gallery LITE
Tuesday, June 11, 2024 · 45
-
medium 5.4 Import and export users and customers
-
medium 5.4 Tagembed
-
high 8.8 Podlove Podcast Publisher
-
medium 5.3 FundEngine
-
medium 4.3 ACF Photo Gallery Field
-
medium 4.3 Revolut Gateway for WooCommerce
-
medium 4.3 MailerLite
-
medium 5.3 Contact List
-
medium 5.3 MoreConvert Wishlist for WooCommerce
-
medium 5.3 weMail
-
medium 5.3 Radio Player
-
medium 4.3 Welcart e-Commerce
-
medium 5.3 Happyforms
-
medium 4.3 Ninja Tables
-
medium 5.3 MC4WP
-
critical 9.8 Post SMTP
-
medium 4.3 Slider by Soliloquy
-
medium 5.3 WP EasyCart
-
medium 4.3 Photo Gallery by 10Web
-
medium 6.3 WOW Styler for CF7
-
medium 6.5 If-So Dynamic Content
-
high 8.6 MultiVendorX
-
medium 5.4 Essential Addons for Elementor
-
medium 5.3 Leyka
-
medium 5.3 weDocs
-
medium 5.4 WebToffee WP Backup and Migration
-
medium 5.3 MoreConvert Wishlist for WooCommerce
-
medium 6.3 SportsPress
-
medium 4.3 Elementor Website Builder
-
medium 6.3 Conversion Tracking for WooCommerce
-
high 8.8 Tutor LMS
-
medium 6.4 Ocean Extra
-
high 7.5 MetForm
-
critical 9.9 Blog2Social
-
medium 5.3 Vsourz Form Entries for Contact Form 7
-
medium 5.3 Vsourz Form Entries for Contact Form 7
-
medium 5.4 ShopLentor
-
critical 9.8 Build App Online
-
medium 5.4 SiteOrigin Widgets Bundle
-
medium 5.3 WPS Hide Login
-
medium 4.8 Custom Field Template
-
medium 5.4 Custom Field Template
-
medium 4.3 Custom Field Template
-
medium 5.4 Custom Field Template
Monday, June 10, 2024 · 15
-
medium 5.3 PPOM
-
medium 4.9 Database Cleaner
-
medium 5.3 YITH WooCommerce Product Add-Ons
-
medium 6.3 Netgsm
-
medium 6.3 Giveaways and Contests by RafflePress
-
high 8.8 Awesome Support
-
high 7.3 iPages
-
critical 9.8 WP Time Slots Booking Form
-
high 8.8 LA-Studio Element Kit for Elementor
-
high 8.8 Tickera
-
high 8.8 Image Gallery
-
high 8.8 Responsive Slideshow
-
high 8.8 12 Step Meeting List
-
critical 9.8 Booking for Appointments and Events Calendar
-
high 8.8 PilotPress
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.