WordPress plugin vulnerabilities: week 34, 2024

46 vulnerabilities published Aug 19 – Aug 25, 2024 in 35 plugins we track, by day.

10 critical 10 high 26 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, August 24, 2024 · 2

• high 8.8 Image Hotspot by DevVN

  PHP object injection

  CVE-2024-7656 · affected 1.2.5 and older · fixed in 1.2.6 *

• medium 5.3 MaxButtons

  Information disclosure

  CVE-2024-6499 · affected 9.7.8 and older · fixed in 9.8.0 *

Friday, August 23, 2024 · 3

• medium 5.4 Piotnet Addons For Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5502 · affected 2.4.30 and older · fixed in 2.4.31 *

• medium 4.8 WP Table Builder

  Stored cross-site scripting (XSS)

  CVE-2024-3282 · affected 1.5.0 and older · fixed in 1.5.1 *

• high 8.8 WPMR Google Feed Manager for WooCommerce

  Remote code execution

  CVE-2024-7258 · affected 2.8.0 and older · fixed in 2.9.0 *

Thursday, August 22, 2024 · 7

• critical 9.8 WSMS (formerly WP SMS)

  Missing authorization check

  CVE-2024-43331 · affected 6.9.3 and older · fixed in 6.9.4

• medium 6.5 User Private Files

  Missing authorization check

  CVE-2024-7848 · affected 2.1.0 and older · fixed in 2.1.1 *

• medium 5.4 Responsive Lightbox & Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-6870 · affected 2.4.7 and older · fixed in 2.4.8 *

• medium 5.4 Orbit Fox

  Stored cross-site scripting (XSS)

  CVE-2024-7778 · affected 2.10.36 and older · fixed in 2.10.37 *

• high 8.8 AcyMailing

  Arbitrary file upload

  CVE-2024-7384 · affected 9.7.2 and older · fixed in 9.11.1 *

• medium 4.3 Themify Builder

  Missing authorization check

  CVE-2024-7836 · affected 7.6.1 and older · fixed in 7.6.2 *

• medium 5.4 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5583 · affected 5.6.2 and older · fixed in 5.6.3 *

Wednesday, August 21, 2024 · 6

• critical 9.8 LiteSpeed Cache

  Privilege escalation

  CVE-2024-28000 · affected 6.3.0.1 and older · fixed in 6.4

• critical 9.8 Ultimate Store Kit

  PHP object injection

  CVE-2024-5335 · affected 1.6.4 and older · fixed in 2.0.0 *

• high 7.5 App Builder

  SQL injection

  CVE-2024-7651 · affected 4.3.3 and older · fix not stated

• medium 6.5 Smart Online Order for Clover

  Missing authorization check

  CVE-2024-7032 · affected 1.5.6 and older · fixed in 1.5.7 *

• medium 4.3 Smart Online Order for Clover

  Missing authorization check

  CVE-2024-7030 · affected 1.5.6 and older · fixed in 1.5.7 *

• medium 4.3 Event Espresso

  Missing authorization check

  CVE-2024-6883 · affected 4.10.46 and older · fix not stated

Tuesday, August 20, 2024 · 17

• medium 5.4 Popup Maker

  Stored cross-site scripting (XSS)

  CVE-2024-7054 · affected 1.19.0 and older · fixed in 1.19.1 *

• medium 5.4 Tutor LMS Elementor Addons

  Stored cross-site scripting (XSS)

  CVE-2024-5576 · affected 2.1.4 and older · fixed in 2.1.5 *

• medium 5.4 WP Last Modified Info

  Stored cross-site scripting (XSS)

  CVE-2024-6864 · affected 1.9.0 and older · fixed in 1.9.1 *

• medium 6.5 Bit Form

  Arbitrary file deletion

  CVE-2024-7782 · affected 2.0 to 2.13.4 · fixed in 2.13.5 *

• high 7.2 Bit Form

  SQL injection

  CVE-2024-7780 · affected 2.0 to 2.13.9 · fixed in 2.13.10 *

• critical 9.0 Bit Form

  Remote code execution

  CVE-2024-7777 · affected 2.0 to 2.13.9 · fixed in 2.13.10 *

• medium 4.8 Bit Form

  Cross-site scripting (XSS)

  CVE-2024-7775 · affected 2.0 to 2.13.9 · fixed in 2.13.10 *

• high 7.2 Bit Form

  SQL injection

  CVE-2024-7702 · affected 2.0 to 2.13.9 · fixed in 2.13.10 *

• medium 5.4 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-6575 · affected 5.6.2 and older · fixed in 5.6.3 *

• medium 5.4 The Plus Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-5763 · affected 5.6.2 and older · fixed in 5.6.3 *

• high 7.2 AdRotate Banner Manager

  Arbitrary file upload

  CVE-2022-1206 · affected 5.13.2 and older · fixed in 5.13.3 *

• medium 6.1 BP Profile Search

  Cross-site request forgery (CSRF)

  CVE-2024-7850 · affected 5.7.5 and older · fixed in 5.8 *

• medium 5.4 GiveWP

  Missing authorization check

  CVE-2024-5941 · affected 3.14.1 and older · fixed in 3.14.2 *

• high 8.8 WP EasyCart

  SQL injection

  CVE-2024-7827 · affected 5.7.2 and older · fixed in 5.7.3 *

• medium 5.3 GiveWP

  Missing authorization check

  CVE-2024-5940 · affected 3.13.0 and older · fixed in 3.14.0 *

• medium 5.3 GiveWP

  Missing authorization check

  CVE-2024-5939 · affected 3.13.0 and older · fixed in 3.14.0 *

• critical 9.8 GiveWP

  PHP object injection

  CVE-2024-5932 · affected 3.14.1 and older · fixed in 3.14.2 *

Monday, August 19, 2024 · 11

• critical 9.8 Points Management System For Gamification, Ran…

  PHP object injection

  CVE-2024-43354 · affected 2.7.2 and older · fixed in 2.7.3

• high 7.5 Landing Page Builder

  File inclusion

  CVE-2024-43345 · affected 1.5.2.0 and older · fixed in 1.5.2.1

• medium 6.1 RegistrationMagic

  Cross-site scripting (XSS)

  CVE-2024-43317 · affected 6.0.1.0 and older · fixed in 6.0.1.1

• critical 9.8 EmbedPress

  File inclusion

  CVE-2024-43328 · affected 4.0.9 and older · fixed in 4.0.10

• medium 5.3 Icegram Engage

  Authentication bypass

  CVE-2024-43272 · affected 3.1.24 and older · fixed in 3.1.25

• medium 6.1 Salon Booking System

  Open redirect

  CVE-2024-43280 · affected 10.8.1 and older · fixed in 10.9

• critical 9.0 Employee, Leave and Recruitment Management Sys…

  PHP object injection

  CVE-2024-43252 · affected 1.1.1 and older · fixed in 1.1.2

• medium 4.7 Easy PayPal & Stripe Buy Now Button

  Open redirect

  CVE-2024-43236 · affected 1.9 and older · fixed in 1.9.1

• critical 9.8 GiveWP

  PHP object injection

  CVE-2024-37099 · affected 3.14.1 and older · fixed in 3.14.2

• high 7.2 AI Engine

  Remote code execution

  CVE-2024-6451 · affected older than 2.5.1 · fixed in 2.5.1

• critical 9.8 GEO my WP

  Remote code execution

  CVE-2024-6330 · affected older than 4.5.0.2 · fixed in 4.5.0.2

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan