WordPress plugin vulnerabilities: week 42, 2024
88 vulnerabilities published Oct 14 – Oct 20, 2024 in 73 plugins we track, by day.
11 critical 25 high 52 medium
Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
Sunday, October 20, 2024 · 5
-
critical 9.8 LiteSpeed Cache
-
high 8.8 VOD Infomaniak
-
medium 6.1 Endless Posts Navigation
-
high 8.8 MPG
-
critical 9.8 MemberHero
Saturday, October 19, 2024 · 3
-
medium 4.3 ElementInvader Addons for Elementor
-
medium 4.3 EventON
-
medium 6.1 Social Share Buttons
Friday, October 18, 2024 · 2
-
medium 5.4 RSS Feed Widget
-
medium 5.4 Arconix Shortcodes
Thursday, October 17, 2024 · 32
-
medium 4.8 Mailonix
-
high 7.1 CURCY
-
medium 5.9 Responsive Lightbox & Gallery
-
high 7.1 Omnipress
-
high 7.1 Ad Inserter
-
medium 5.4 Edwiser Bridge
-
medium 5.4 Themesflat Addons For Elementor
-
medium 6.5 PeproDev Ultimate Invoice
-
medium 5.4 Exclusive Addons for Elementor
-
high 8.6 Edwiser Bridge
-
medium 5.4 Pinpoint Booking System
-
critical 9.3 Customer Email Verification for WooCommerce
-
high 7.6 Surfer
-
high 8.5 Zoho CRM Lead Magnet
-
high 8.5 Fluent Support
-
high 7.1 easy.jobs
-
medium 5.9 Contact Form by Supsystic
-
medium 5.4 Contact Form Widget
-
high 7.1 Contact Form 7
-
high 7.5 Keep Backup Daily
-
high 7.6 ShortPixel Image Optimizer
-
medium 6.1 WP Photo Album Plus
-
medium 6.1 افزونه پیامک ووکامرس
-
medium 4.3 Forminator Forms
-
medium 4.3 Forminator Forms
-
high 7.6 Logo Slider
-
medium 6.1 Flexmls® IDX Plugin
-
critical 9.8 Timetics
-
medium 6.1 WP Extended
-
medium 4.3 Royal Addons for Elementor
-
medium 4.3 Calculated Fields Form
Wednesday, October 16, 2024 · 41
-
critical 9.8 Nextend Social Login and Register
-
medium 5.3 Leyka
-
high 8.8 LiteSpeed Cache
-
high 7.2 Unlimited Elements for Elementor
-
critical 9.1 Contact Form by Supsystic
-
medium 6.4 Zita Site Library for Elementor
-
medium 4.3 Sina Extension for Elementor
-
critical 9.8 Timetable and Event Schedule by MotoPress
-
high 8.8 WPvivid
-
critical 9.8 Frontend File Manager Plugin
-
medium 5.4 Accordion Slider
-
medium 6.5 Paytium
-
medium 4.3 Paytium
-
medium 4.3 Paytium
-
high 8.1 Paytium
-
medium 4.3 Paytium
-
medium 4.3 Paytium
-
medium 4.3 Paytium
-
medium 5.4 Paytium
-
high 7.5 Download Monitor
-
medium 6.1 Social Sharing Plugin
-
high 8.8 Post Grid
-
high 8.8 Essential Addons for Elementor
-
medium 4.3 Essential Addons for Elementor
-
medium 4.3 Premium Addons for Elementor
-
high 8.0 WP Fastest Cache
-
medium 6.5 WPvivid
-
critical 9.8 Speed Optimizer
-
medium 6.5 NextScripts
-
medium 6.1 ShopWP
-
medium 6.1 Formidable Forms
-
critical 9.8 File Manager
-
medium 6.1 MainWP Dashboard
-
medium 5.4 ElementInvader Addons for Elementor
-
medium 5.4 Community by PeepSo
-
medium 6.1 Locatoraid Store Locator
-
critical 9.8 GiveWP
-
medium 4.3 WP ULike
-
medium 6.1 Smart Online Order for Clover
Tuesday, October 15, 2024 · 5
-
medium 5.4 Smart Online Order for Clover
-
medium 6.1 WooCommerce
-
medium 4.3 Elementor Website Builder
-
medium 6.1 SlimStat Analytics
-
medium 5.3 WPIDE
Ran a vulnerable version? Check your site for signs of a hack
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.