WordPress plugin vulnerabilities: week 41, 2024

41 vulnerabilities published Oct 7 – Oct 13, 2024 in 38 plugins we track, by day.

2 critical 7 high 32 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, October 12, 2024 · 8

• medium 4.3 Addon Elements for Elementor (formerly Element…

  Information disclosure

  CVE-2024-8902 · affected 1.13.8 and older · fixed in 1.13.9 *

• high 7.2 WP Post Author

  SQL injection

  CVE-2024-8757 · affected 3.8.1 and older · fixed in 3.10.0 *

• medium 5.4 Rescue Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2024-9696 · affected 2.8 and older · fixed in 2.9 *

• medium 5.4 TablePress

  Stored cross-site scripting (XSS)

  CVE-2024-9595 · affected 2.4.2 and older · fixed in 2.4.3 *

• medium 6.4 Category Icon

  Stored cross-site scripting (XSS)

  CVE-2024-8915 · affected 1.0.0 and older · fixed in 1.0.1 *

• medium 5.3 Stackable

  Cross-site request forgery (CSRF)

  CVE-2024-8760 · affected 3.13.6 and older · fixed in 3.13.7 *

• critical 9.8 Iptanus File Upload

  Path traversal / file read

  CVE-2024-9047 · affected 4.24.11 and older · fixed in 4.24.12 *

• high 8.8 Bot for Telegram on WooCommerce

  Missing authorization check

  CVE-2024-9821 · affected 1.2.7 and older · fix not stated

Friday, October 11, 2024 · 11

• medium 6.5 Tainacan

  SQL injection

  CVE-2024-48040 · affected 0.21.8 and older · fixed in 0.21.9

• high 8.5 Backup and Staging by WP Time Capsule

  SQL injection

  CVE-2024-48020 · affected 1.22.21 and older · fixed in 1.22.22

• medium 4.9 Bit Form

  Path traversal / file read

  CVE-2024-9507 · affected 2.15.2 and older · fixed in 2.15.3 *

• medium 6.4 PowerPress Podcasting plugin by Blubrry

  Stored cross-site scripting (XSS)

  CVE-2024-9543 · affected 11.9.18 and older · fixed in 11.9.19 *

• medium 6.5 ShopLentor

  Information disclosure

  CVE-2024-9538 · affected 2.9.8 and older · fixed in 2.9.9 *

• medium 6.1 Download Plugins and Themes in ZIP from Dashbo…

  Reflected cross-site scripting (XSS)

  CVE-2024-9232 · affected 1.9.1 and older · fixed in 1.9.2 *

• critical 9.8 GutenKit

  Arbitrary file upload

  CVE-2024-9234 · affected 2.1.0 and older · fixed in 2.1.1 *

• medium 6.1 PublishPress Revisions

  Reflected cross-site scripting (XSS)

  CVE-2024-9436 · affected 3.5.14 and older · fixed in 3.5.15 *

• medium 6.1 Tainacan

  Reflected cross-site scripting (XSS)

  CVE-2024-9221 · affected 0.21.10 and older · fixed in 0.21.11 *

• medium 4.3 The Plus Addons for Elementor

  Information disclosure

  CVE-2024-8913 · affected 5.6.11 and older · fixed in 5.6.12 *

• medium 6.5 Comments Import & Export

  Path traversal / file read

  CVE-2024-7514 · affected 2.3.7 and older · fixed in 2.3.8 *

Thursday, October 10, 2024 · 10

• medium 6.1 EventPrime

  Open redirect

  CVE-2024-47648 · affected 4.0.4.5 and older · fixed in 4.0.4.6

• high 7.5 TI WooCommerce Wishlist

  SQL injection

  CVE-2024-9156 · affected 2.8.2 and older · fixed in 2.9.0 *

• medium 4.3 Brevo

  Cross-site request forgery (CSRF)

  CVE-2024-8477 · affected 3.1.87 and older · fixed in 3.1.88 *

• high 7.2 TS Poll

  SQL injection

  CVE-2024-9022 · affected 2.4.0 and older · fixed in 2.4.1 *

• medium 4.3 Youzify

  Missing authorization check

  CVE-2024-9067 · affected 1.3.0 and older · fixed in 1.3.1 *

• medium 4.3 Notification for Telegram

  Missing authorization check

  CVE-2024-9685 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 6.1 Maximum Products per User for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2024-9205 · affected 4.2.8 and older · fixed in 4.2.9 *

• medium 5.4 Curator.io

  Stored cross-site scripting (XSS)

  CVE-2024-9057 · affected 1.9.1 and older · fixed in 1.9.2 *

• medium 5.3 QA Assistants

  Missing authorization check

  CVE-2024-8513 · affected 4.1.1.1 and older · fixed in 4.1.2.0 *

• medium 5.4 Youzify

  Stored cross-site scripting (XSS)

  CVE-2024-8987 · affected 1.3.0 and older · fixed in 1.3.1 *

Wednesday, October 9, 2024 · 3

• high 7.6 Zoho Flow

  SQL injection

  CVE-2024-47334 · affected 2.7.1 and older · fixed in 2.8.1

• medium 6.4 Embed PDF Viewer

  Stored cross-site scripting (XSS)

  CVE-2024-9451 · affected 2.4.4 and older · fixed in 2.4.5 *

• medium 4.8 Photo Gallery by 10Web

  Stored cross-site scripting (XSS)

  CVE-2024-5968 · affected older than 1.8.28 · fixed in 1.8.28

Tuesday, October 8, 2024 · 7

• medium 6.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-8482 · affected 1.3.986 and older · fixed in 1.3.987 *

• medium 4.3 Robo Gallery

  Missing authorization check

  CVE-2024-8431 · affected 3.2.21 and older · fixed in 3.2.22 *

• medium 4.8 Survey Maker by AYS

  Stored cross-site scripting (XSS)

  CVE-2024-8488 · affected 4.9.5 and older · fix not stated

• medium 6.1 WPML Multilingual & Multicurrency for WooComme…

  Reflected cross-site scripting (XSS)

  CVE-2024-8629 · affected 5.3.7 and older · fixed in 5.3.8 *

• medium 5.4 Image Optimizer, Resizer and CDN

  Stored cross-site scripting (XSS)

  CVE-2024-8964 · affected 7.2.9 and older · fixed in 7.3.0 *

• medium 4.8 Custom Twitter Feeds

  Stored cross-site scripting (XSS)

  CVE-2024-8983 · affected older than 2.2.3 · fixed in 2.2.3

• medium 5.4 Relevanssi

  Stored cross-site scripting (XSS)

  CVE-2024-9021 · affected older than 4.23.1 · fixed in 4.23.1

Monday, October 7, 2024 · 2

• high 7.6 Bit Form

  SQL injection

  CVE-2024-47335 · affected 2.13.11 and older · fixed in 2.13.12

• medium 5.3 Directory Listings WordPress plugin

  Information disclosure

  CVE-2024-47344 · affected 2.1.5 and older · fixed in 2.1.6

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan