WordPress plugin vulnerabilities: week 36, 2024

34 vulnerabilities published Sep 2 – Sep 8, 2024 in 26 plugins we track, by day.

3 critical 7 high 23 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, September 7, 2024 · 2

• medium 6.5 Pinpoint Booking System

  SQL injection

  CVE-2024-7112 · affected 2.9.9.5.0 and older · fixed in 2.9.9.5.1 *

• medium 5.3 Cost Calculator Builder

  Security issue

  CVE-2024-6010 · affected 3.2.1 and older · fixed in 3.2.2 *

Friday, September 6, 2024 · 9

• medium 5.4 Enter Addons

  Stored cross-site scripting (XSS)

  CVE-2024-7611 · affected 2.1.8 and older · fixed in 2.2.2 *

• high 8.8 ForumWP

  Privilege escalation

  CVE-2024-8428 · affected 2.0.2 and older · fixed in 2.1.0 *

• medium 4.3 Revision Manager TMC

  Missing authorization check

  CVE-2024-7622 · affected 2.8.19 and older · fixed in 2.8.20 *

• critical 9.8 WPCOM Member

  Privilege escalation

  CVE-2024-7493 · affected 1.5.2.1 and older · fixed in 1.5.7 *

• medium 4.3 Frontend Post Submission Manager Lite

  Missing authorization check

  CVE-2024-8427 · affected 1.2.2 and older · fixed in 1.2.3 *

• high 7.2 LifterLMS

  SQL injection

  CVE-2024-7349 · affected 7.7.5 and older · fixed in 7.7.6 *

• low 3.5 WP ULike

  Cross-site scripting (XSS)

  CVE-2024-6792 · affected 4.7.1 up to (not including) 4.7.2.1 · fixed in 4.7.2.1

• high 8.8 Newsletters

  Privilege escalation

  CVE-2024-8247 · affected 4.9.9.2 and older · fixed in 4.9.9.3 *

• high 8.8 Image Optimizer, Resizer and CDN

  Remote code execution

  CVE-2024-8480 · affected 7.2.7 and older · fixed in 7.2.8 *

Thursday, September 5, 2024 · 8

• medium 5.3 Geo Controller

  Missing authorization check

  CVE-2024-7381 · affected 8.6.9 and older · fixed in 8.8.0 *

• medium 4.3 Geo Controller

  Missing authorization check

  CVE-2024-7380 · affected 8.7.3 and older · fixed in 8.8.0 *

• medium 5.4 RD Station

  Stored cross-site scripting (XSS)

  CVE-2024-6894 · affected 5.3.2 and older · fixed in 5.4.0 *

• medium 6.5 Booking for Appointments and Events Calendar

  Missing authorization check

  CVE-2024-6332 · affected 1.2.4 and older · fixed in 1.2.5 *

• medium 5.4 Form Vibes

  Missing authorization check

  CVE-2024-5309 · affected 1.4.12 and older · fixed in 1.4.13 *

• medium 5.4 Share This Image

  Stored cross-site scripting (XSS)

  CVE-2024-8363 · affected 2.02 and older · fixed in 2.03 *

• medium 5.3 Ivory Search

  Information disclosure

  CVE-2024-6835 · affected 5.5.6 and older · fixed in 5.5.7 *

• high 8.1 File Manager

  Remote code execution

  CVE-2024-7627 · affected 6.0 to 6.5.5 · fixed in 6.5.6 *

Wednesday, September 4, 2024 · 14

• medium 6.1 Advanced Custom Fields (ACF®)

  Cross-site scripting (XSS)

  CVE-2024-45429 · affected 6.3.5 and older · fixed in 6.3.6 *

• critical 9.8 MultiVendorX

  Privilege escalation

  CVE-2024-8289 · affected 4.2.0 and older · fixed in 4.2.42 *

• high 7.5 PixelYourSite

  Information disclosure

  CVE-2024-7870 · affected 9.7.1 and older · fixed in 9.7.2 *

• medium 5.4 WP Extended

  Missing authorization check

  CVE-2024-8123 · affected 3.0.8 and older · fixed in 3.0.9 *

• medium 4.3 WP Extended

  Missing authorization check

  CVE-2024-8121 · affected 3.0.8 and older · fixed in 3.0.9 *

• medium 6.1 WP Extended

  Reflected cross-site scripting (XSS)

  CVE-2024-8119 · affected 3.0.8 and older · fixed in 3.0.9 *

• medium 6.1 WP Extended

  Reflected cross-site scripting (XSS)

  CVE-2024-8117 · affected 3.0.8 and older · fixed in 3.0.9 *

• medium 6.5 WP Extended

  Information disclosure

  CVE-2024-8106 · affected 3.0.8 and older · fixed in 3.0.9 *

• medium 6.5 WP Extended

  Path traversal / file read

  CVE-2024-8104 · affected 3.0.8 and older · fixed in 3.0.9 *

• high 8.8 WP Extended

  Privilege escalation

  CVE-2024-8102 · affected 3.0.8 and older · fixed in 3.0.9 *

• medium 4.8 Secure Copy Content Protection and Content Loc…

  Stored cross-site scripting (XSS)

  CVE-2024-6889 · affected older than 4.1.7 · fixed in 4.1.7

• medium 4.8 Secure Copy Content Protection and Content Loc…

  Stored cross-site scripting (XSS)

  CVE-2024-6888 · affected older than 4.1.7 · fixed in 4.1.7

• medium 6.1 Sign-up Sheets

  Reflected cross-site scripting (XSS)

  CVE-2024-6020 · affected older than 2.2.13 · fixed in 2.2.13

• critical 9.8 WP Job Portal

  File inclusion

  CVE-2024-7950 · affected 2.1.6 and older · fixed in 2.1.7 *

Monday, September 2, 2024 · 1

• medium 6.1 Ninja Forms

  Reflected cross-site scripting (XSS)

  CVE-2024-7354 · affected 3.8.6 up to (not including) 3.8.11 · fixed in 3.8.11

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan