WordPress plugin vulnerabilities: week 37, 2024

47 vulnerabilities published Sep 9 – Sep 15, 2024 in 40 plugins we track, by day.

15 high 32 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, September 15, 2024 · 8

• medium 5.4 Custom Query Blocks

  Cross-site scripting (XSS)

  CVE-2024-44059 · affected 5.3.1 and older · fixed in 5.4.0

• medium 6.1 Spiffy Calendar

  Reflected cross-site scripting (XSS)

  CVE-2024-45458 · affected 4.9.13 and older · fixed in 4.9.14

• medium 5.4 Spiffy Calendar

  Stored cross-site scripting (XSS)

  CVE-2024-45457 · affected 4.9.13 and older · fixed in 4.9.14

• medium 6.1 Product Slider, Product Grid, Product Masonry

  Reflected cross-site scripting (XSS)

  CVE-2024-45459 · affected 1.13.50 and older · fixed in 1.13.51

• medium 5.4 WP Meta SEO

  Stored cross-site scripting (XSS)

  CVE-2024-45456 · affected 4.5.13 and older · fixed in 4.5.14

• medium 4.8 WP Meta SEO

  Stored cross-site scripting (XSS)

  CVE-2024-45455 · affected 4.5.13 and older · fixed in 4.5.14

• medium 5.4 Custom Field Template

  Stored cross-site scripting (XSS)

  CVE-2024-44062 · affected 2.6.5 and older · fixed in 2.6.6 *

• medium 5.4 Happyforms

  Stored cross-site scripting (XSS)

  CVE-2024-44063 · affected 1.26.0 and older · fixed in 1.26.1

Saturday, September 14, 2024 · 6

• high 8.8 OTP Login With Phone Number, OTP Verification

  Privilege escalation

  CVE-2024-6482 · affected 1.7.49 and older · fixed in 1.7.50 *

• medium 6.1 WP Booking System

  Reflected cross-site scripting (XSS)

  CVE-2024-8797 · affected 2.0.19.8 and older · fixed in 2.0.19.9 *

• medium 6.1 Waitlist Woocommerce ( Back in stock notifier )

  Reflected cross-site scripting (XSS)

  CVE-2024-8724 · affected 2.7.5 and older · fixed in 2.7.6 *

• high 7.2 Backuply

  SQL injection

  CVE-2024-8669 · affected 1.3.4 and older · fixed in 1.3.5 *

• high 8.8 BuddyForms

  Privilege escalation

  CVE-2024-8246 · affected 2.8.11 and older · fixed in 2.8.12 *

• high 7.3 FOX

  Remote code execution

  CVE-2024-8271 · affected 1.4.2.1 and older · fixed in 1.4.8 *

Friday, September 13, 2024 · 11

• medium 6.1 PDF Thumbnail Generator

  Reflected cross-site scripting (XSS)

  CVE-2024-8737 · affected 1.3 and older · fixed in 1.4 *

• medium 6.5 MStore API

  Missing authorization check

  CVE-2024-8269 · affected 4.15.3 and older · fixed in 4.15.4 *

• medium 6.1 Affiliate Program Suite

  Reflected cross-site scripting (XSS)

  CVE-2024-8714 · affected 1.1.20 and older · fixed in 1.1.21 *

• high 8.8 MStore API

  Arbitrary file upload

  CVE-2024-8242 · affected 4.15.3 and older · fixed in 4.15.4 *

• high 8.8 Stream

  Cross-site request forgery (CSRF)

  CVE-2024-7423 · affected 4.0.1 and older · fixed in 4.0.2 *

• high 7.2 WP Editor

  PHP object injection

  CVE-2022-2446 · affected 1.2.9 and older · fixed in 1.2.9.1 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-8742 · affected 6.0.3 and older · fixed in 6.0.4 *

• medium 6.1 affects latest 1.1.7 WP Test Email

  Reflected cross-site scripting (XSS)

  CVE-2024-8664 · affected 1.1.7 and older · no fix listed yet

• medium 4.3 Classified Listing

  Missing authorization check

  CVE-2024-7888 · affected older than 3.1.8 · fixed in 3.1.8

• medium 4.7 AI Engine

  SQL injection

  CVE-2024-6723 · affected older than 2.4.8 · fixed in 2.4.8

• high 7.2 Appointment Booking Calendar

  Remote code execution

  CVE-2024-7129 · affected older than 1.6.7.43 · fix not stated

Thursday, September 12, 2024 · 4

• high 7.5 LearnPress

  SQL injection

  CVE-2024-8529 · affected 4.2.7 and older · fixed in 4.2.7.1 *

• high 7.5 LearnPress

  SQL injection

  CVE-2024-8522 · affected 4.2.7 and older · fixed in 4.2.7.1 *

• medium 4.8 Giveaways and Contests by RafflePress

  Stored cross-site scripting (XSS)

  CVE-2024-6887 · affected older than 1.12.16 · fixed in 1.12.16

• medium 4.3 Easy Property Listings

  Cross-site request forgery (CSRF)

  CVE-2024-3163 · affected older than 3.5.4 · fixed in 3.5.4

Wednesday, September 11, 2024 · 7

• medium 5.4 Elementor Website Builder

  Stored cross-site scripting (XSS)

  CVE-2024-5416 · affected 3.23.4 and older · fixed in 3.24.0-beta1 *

• high 8.1 WP Delicious

  Remote code execution

  CVE-2024-7626 · affected 1.6.9 and older · fixed in 1.7.0 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-8440 · affected 6.0.3 and older · fixed in 6.0.4 *

• medium 4.8 Logo Slider

  Stored cross-site scripting (XSS)

  CVE-2024-7716 · affected older than 3.6.9 · fixed in 3.6.9

• medium 5.3 HTML5 Video Player

  Missing authorization check

  CVE-2024-7727 · affected 2.5.32 and older · fixed in 2.5.33 *

• medium 4.3 HTML5 Video Player

  Missing authorization check

  CVE-2024-7721 · affected 2.5.34 and older · fixed in 2.5.35 *

• high 8.8 Post Grid

  Privilege escalation

  CVE-2024-8253 · affected 2.2.87 to 2.2.90 · fixed in 2.2.91 *

Tuesday, September 10, 2024 · 9

• medium 5.3 EventPrime

  Missing authorization check

  CVE-2024-8369 · affected 4.0.4.3 and older · fixed in 4.0.4.4 *

• medium 5.4 Master Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-6282 · affected 2.0.6.4 and older · fixed in 2.0.6.5 *

• high 8.8 File Manager

  Arbitrary file upload

  CVE-2024-7770 · affected 6.5.5 and older · fixed in 6.5.6 *

• medium 5.4 Nova Blocks by Pixelgrade

  Stored cross-site scripting (XSS)

  CVE-2024-8241 · affected 2.1.7 and older · fixed in 2.1.8 *

• medium 4.3 Tutor LMS

  Cross-site request forgery (CSRF)

  CVE-2023-2919 · affected 2.7.4 and older · fixed in 2.7.5 *

• medium 4.8 Community by PeepSo

  Stored cross-site scripting (XSS)

  CVE-2024-7655 · affected 6.4.5.0 and older · fix not stated

• medium 4.8 Community by PeepSo

  Stored cross-site scripting (XSS)

  CVE-2024-7618 · affected 6.4.5.0 and older · fix not stated

• high 7.3 Affiliate Super Assistent

  Remote code execution

  CVE-2024-8478 · affected 1.5.3 and older · fixed in 1.5.4 *

• high 8.8 Frontend Dashboard

  Privilege escalation

  CVE-2024-8268 · affected 2.2.4 and older · fixed in 2.2.5 *

Monday, September 9, 2024 · 2

• medium 4.8 Popup Maker

  Stored cross-site scripting (XSS)

  CVE-2024-5561 · affected older than 1.19.1 · fixed in 1.19.1

• medium 6.1 Forminator Forms

  Cross-site scripting (XSS)

  CVE-2024-45625 · affected older than 1.34.1 · fixed in 1.34.1

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan