WordPress plugin vulnerabilities: week 40, 2024

103 vulnerabilities published Sep 30 – Oct 6, 2024 in 97 plugins we track, by day.

1 critical 25 high 77 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Thursday, October 3, 2024 · 1

high 7.5 Social Web Suite

Path traversal / file read

CVE-2024-8352 · affected 4.1.11 and older · fix not stated

Wednesday, October 2, 2024 · 10

medium 5.4 Ajax Load More

Stored cross-site scripting (XSS)

CVE-2024-8505 · affected 7.1.2 and older · fixed in 7.1.3 *
medium 5.4 Ibtana

Stored cross-site scripting (XSS)

CVE-2024-8282 · affected 1.2.4.4 and older · fixed in 1.2.4.5 *
medium 6.1 YML for Yandex Market

Reflected cross-site scripting (XSS)

CVE-2024-9378 · affected 4.7.2 and older · fixed in 4.7.3 *
medium 6.1 BerqWP

Reflected cross-site scripting (XSS)

CVE-2024-9344 · affected 2.1.1 and older · fixed in 2.1.2 *
medium 6.1 Magazine Blocks

Reflected cross-site scripting (XSS)

CVE-2024-9218 · affected 1.3.14 and older · fixed in 1.3.15 *
medium 6.1 Paid Membership Subscriptions

Reflected cross-site scripting (XSS)

CVE-2024-9222 · affected 2.12.8 and older · fixed in 2.12.9 *
medium 6.1 SEOPress

Reflected cross-site scripting (XSS)

CVE-2024-9225 · affected 8.1.1 and older · fixed in 8.2 *
medium 5.4 Demo Importer Plus

Stored cross-site scripting (XSS)

CVE-2024-9172 · affected 2.0.1 and older · fixed in 2.0.2 *
medium 6.3 Email Subscribers & Newsletters by Icegram Exp…

Remote code execution

CVE-2024-8254 · affected 5.7.34 and older · fixed in 5.7.35 *
high 8.8 WP Hotel Booking

Arbitrary file upload

CVE-2024-7855 · affected 2.1.2 and older · fixed in 2.1.3 *

Tuesday, October 1, 2024 · 6

medium 6.1 Search Analytics for WP

Reflected cross-site scripting (XSS)

CVE-2024-9209 · affected 1.4.10 and older · fixed in 1.4.11 *
medium 6.1 Store Exporter

Reflected cross-site scripting (XSS)

CVE-2024-8793 · affected 2.7.2.1 and older · fixed in 2.7.3 *
medium 6.4 Geo Mashup

Stored cross-site scripting (XSS)

CVE-2024-8990 · affected 1.13.13 and older · fixed in 1.13.14 *
medium 6.1 DK PDF

Reflected cross-site scripting (XSS)

CVE-2024-8727 · affected 1.9.6 and older · fixed in 1.9.7 *
medium 6.4 Stars Testimonials

Stored cross-site scripting (XSS)

CVE-2024-8989 · affected 3.3.1 and older · fixed in 3.3.2 *
high 7.1 Broken Link Checker

Reflected cross-site scripting (XSS)

CVE-2024-8981 · affected 2.4.0 and older · fixed in 2.4.1 *

Monday, September 30, 2024 · 2

high 7.2 Cost Calculator Builder

SQL injection

CVE-2024-8379 · affected older than 3.2.29 · fixed in 3.2.29
medium 4.8 Slider by 10Web

Stored cross-site scripting (XSS)

CVE-2024-8283 · affected older than 1.2.59 · fixed in 1.2.59

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan