WordPress plugin vulnerabilities: week 26, 2024

33 vulnerabilities published Jun 24 – Jun 30, 2024 in 30 plugins we track, by day.

5 critical 4 high 24 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, June 29, 2024 · 8

high 8.8 WP Maps

SQL injection

CVE-2024-2386 · affected 4.6.1 and older · fixed in 4.6.2 *
medium 5.4 Kadence Blocks

Stored cross-site scripting (XSS)

CVE-2024-5819 · affected 3.2.45 and older · fixed in 3.2.46 *
medium 5.4 HappyAddons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-5790 · affected 3.11.1 and older · fixed in 3.11.2 *
medium 5.4 Stock Ticker

Stored cross-site scripting (XSS)

CVE-2024-6363 · affected 3.24.4 and older · fixed in 3.24.6 *
medium 5.4 Fast Page & Post Duplicator

Missing authorization check

CVE-2024-5942 · affected 6.0 and older · fix not stated
critical 9.8 UsersWP

SQL injection

CVE-2024-6265 · affected 1.2.10 and older · fixed in 1.2.11 *
high 7.5 Advanced File Manager

Information disclosure

CVE-2024-5598 · affected 5.2.4 and older · fixed in 5.2.13 *
medium 5.4 FunnelKit

Stored cross-site scripting (XSS)

CVE-2024-5192 · affected 3.3.1 and older · fixed in 3.3.1.1 *

Friday, June 28, 2024 · 6

medium 6.4 SimpLy Gallery

Stored cross-site scripting (XSS)

CVE-2024-5424 · affected 3.2.1 and older · fixed in 3.2.2 *
medium 6.4 Ultimate Post Kit

Stored cross-site scripting (XSS)

CVE-2024-5662 · affected 3.11.7 and older · fixed in 3.11.8 *
medium 6.1 Pagerank tools

Reflected cross-site scripting (XSS)

CVE-2024-5730 · affected 1.1.5 and older · fix not stated
medium 6.1 Simple AL Slider

Reflected cross-site scripting (XSS)

CVE-2024-5729 · affected 1.2.10 and older · fix not stated
medium 5.4 Easy Image Collage

Missing authorization check

CVE-2024-5863 · affected 1.13.5 and older · fixed in 1.13.6 *
medium 6.4 Stackable

Stored cross-site scripting (XSS)

CVE-2024-6296 · affected 3.13.1 and older · fixed in 3.13.2 *

Thursday, June 27, 2024 · 6

medium 5.4 The Plus Addons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-4983 · affected 5.6.0 and older · fixed in 5.6.1 *
medium 5.4 Create

Stored cross-site scripting (XSS)

CVE-2024-5601 · affected 1.9.7 and older · fixed in 1.9.8 *
medium 5.4 Interactive Content

Stored cross-site scripting (XSS)

CVE-2024-3111 · affected older than 1.15.8 · fixed in 1.15.8
medium 5.4 Addon Elements for Elementor (formerly Element…

Stored cross-site scripting (XSS)

CVE-2024-4570 · affected 1.13.5 and older · fixed in 1.13.6 *
medium 5.4 Addon Elements for Elementor (formerly Element…

Stored cross-site scripting (XSS)

CVE-2024-4569 · affected 1.13.5 and older · fixed in 1.13.6 *
medium 5.4 Kadence Blocks

Stored cross-site scripting (XSS)

CVE-2024-5289 · affected 3.2.42 and older · fixed in 3.2.43 *

Wednesday, June 26, 2024 · 7

critical 9.3 Email Subscribers & Newsletters by Icegram Exp…

SQL injection

CVE-2024-37252 · affected 5.7.25 and older · fixed in 5.7.26
medium 5.4 HT Mega Addons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-5215 · affected 2.5.5 and older · fixed in 2.5.6 *
medium 5.9 Easy Table of Contents

Cross-site scripting (XSS)

CVE-2024-5573 · affected older than 2.0.66 · fixed in 2.0.66
medium 6.5 Bookster

Missing authorization check

CVE-2024-5071 · affected 1.1.0 and older · fixed in 1.2.0 *
medium 5.4 Exclusive Addons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-5332 · affected 2.6.9.8 and older · fixed in 2.6.9.9 *
medium 5.4 HT Mega Addons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-5173 · affected 2.5.5 and older · fixed in 2.5.6 *
medium 6.1 WPLP Cookie Consent

Stored cross-site scripting (XSS)

CVE-2024-4869 · affected 3.2.0 and older · fixed in 3.3.0 *

Tuesday, June 25, 2024 · 4

critical 9.8 Quiz Maker by AYS

SQL injection

CVE-2024-6028 · affected 6.5.8.3 and older · fixed in 6.6.0.0 *
medium 4.3 Zita Site Library for Elementor

Missing authorization check

CVE-2024-3249 · affected 1.6.2 and older · fixed in 1.6.4 *
high 8.1 Logo Manager For Enamad

Cross-site request forgery (CSRF)

CVE-2024-4757 · affected 0.7.0 and older · fixed in 0.7.1 *
high 8.8 WPCafe

File inclusion

CVE-2024-5431 · affected 2.2.25 and older · fixed in 2.2.26 *

Monday, June 24, 2024 · 2

critical 9.1 Salon Booking System

Path traversal / file read

CVE-2024-37231 · affected 9.9 and older · fixed in 10.0
critical 9.8 InstaWP Connect

Arbitrary file upload

CVE-2024-37228 · affected 0.1.0.38 and older · fixed in 0.1.0.39

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan