WordPress plugin vulnerabilities: week 43, 2024

47 vulnerabilities published Oct 21 – Oct 27, 2024 in 44 plugins we track, by day.

6 critical 12 high 29 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, October 26, 2024 · 10

• critical 9.8 Wp Social Login and Register Social Counter

  Authentication bypass

  CVE-2024-9501 · affected 3.0.7 and older · fixed in 3.0.8 *

• high 8.8 Forminator Forms

  Missing authorization check

  CVE-2024-10402 · affected 1.35.1 and older · fixed in 1.36.0 *

• medium 5.4 WP Crowdfunding

  Stored cross-site scripting (XSS)

  CVE-2024-10117 · affected 2.1.11 and older · fixed in 2.1.12 *

• high 8.8 School Management System

  Privilege escalation

  CVE-2024-9637 · affected 2.2.10 and older · fixed in 2.2.11 *

• medium 4.3 Download Monitor

  Missing authorization check

  CVE-2024-10092 · affected 5.0.12 and older · fixed in 5.0.13 *

• critical 9.8 WatchTowerHQ

  Authentication bypass

  CVE-2024-9933 · affected 3.10.1 and older · fixed in 3.10.4 *

• medium 6.1 FormFacade

  Reflected cross-site scripting (XSS)

  CVE-2024-9613 · affected 1.3.6 and older · fixed in 1.3.7 *

• high 7.2 Poll Maker by AYS

  SQL injection

  CVE-2024-9475 · affected 5.4.6 and older · fixed in 5.4.7 *

• medium 4.8 Poll Maker by AYS

  Stored cross-site scripting (XSS)

  CVE-2024-9462 · affected 5.4.6 and older · fixed in 5.4.7 *

• medium 5.4 ElementsKit Elementor Addons

  Stored cross-site scripting (XSS)

  CVE-2024-10091 · affected 3.2.9 and older · fixed in 3.3.0 *

Friday, October 25, 2024 · 6

• medium 5.4 WP-Members Membership Plugin

  Stored cross-site scripting (XSS)

  CVE-2024-10374 · affected 3.4.9.5 and older · fixed in 3.4.9.6 *

• high 8.8 AMP for WP

  Cross-site request forgery (CSRF)

  CVE-2024-9598 · affected 1.0.99.1 and older · fixed in 1.0.99.2 *

• critical 9.8 App Builder

  Privilege escalation

  CVE-2024-9302 · affected 5.3.7 and older · fix not stated

• high 8.8 Mapster WP Maps

  Privilege escalation

  CVE-2024-9235 · affected 1.5.0 and older · fixed in 1.6.0 *

• high 8.1 BuddyPress

  Path traversal / file read

  CVE-2024-10011 · affected 14.1.0 and older · fixed in 14.2.1 *

• critical 9.8 Comments

  Authentication bypass

  CVE-2024-9488 · affected 7.6.24 and older · fixed in 7.6.25 *

Thursday, October 24, 2024 · 16

• medium 4.8 Robo Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-49696 · affected 3.2.21 and older · fixed in 3.2.22

• medium 6.4 Adminify

  Stored cross-site scripting (XSS)

  CVE-2024-8959 · affected 4.0.1.6 and older · fixed in 4.0.1.6.1 *

• medium 6.5 Event Booking Manager for WooCommerce

  Cross-site scripting (XSS)

  CVE-2024-49703 · affected 4.2.5 and older · fixed in 4.2.6

• medium 5.3 Schema & Structured Data for WP & AMP

  Missing authorization check

  CVE-2024-49683 · affected 1.3.5 and older · fixed in 1.36

• medium 6.1 Simple Membership

  Open redirect

  CVE-2024-49682 · affected 4.5.3 and older · fixed in 4.5.4

• high 7.6 Product Filter for WooCommerce by WBW

  SQL injection

  CVE-2024-49691 · affected 2.7.0 and older · fixed in 2.7.1

• critical 9.3 WP Sessions Time Monitoring Full Automatic

  SQL injection

  CVE-2024-49681 · affected 1.0.9 and older · fixed in 1.1.0

• medium 6.1 Extra Product Options Builder for WooCommerce

  Stored cross-site scripting (XSS)

  CVE-2024-9214 · affected 1.2.133 and older · fix not stated

• medium 5.4 WP Recipe Maker

  Stored cross-site scripting (XSS)

  CVE-2024-9650 · affected 9.6.1 and older · fixed in 9.7.2 *

• medium 6.1 DearFlip

  Reflected cross-site scripting (XSS)

  CVE-2024-8717 · affected 2.3.32 and older · fixed in 2.3.52 *

• medium 4.3 Ultimate Addons for Elementor

  Information disclosure

  CVE-2024-10050 · affected 1.6.43 and older · fixed in 1.6.44 *

• medium 6.3 MultiVendorX

  Cross-site request forgery (CSRF)

  CVE-2024-9943 · affected 4.2.4 and older · fixed in 4.2.42 *

• medium 4.3 MultiVendorX

  Missing authorization check

  CVE-2024-9531 · affected 4.2.4 and older · fixed in 4.2.42 *

• medium 4.3 HurryTimer

  Missing authorization check

  CVE-2024-8667 · affected 2.10.0 and older · fixed in 2.11.0 *

• medium 6.1 EventPrime

  Stored cross-site scripting (XSS)

  CVE-2024-9865 · affected 4.0.4.7 and older · fixed in 4.0.4.8 *

• medium 6.1 Terms descriptions

  Reflected cross-site scripting (XSS)

  CVE-2024-9374 · affected 3.4.6 and older · fixed in 3.4.7 *

Wednesday, October 23, 2024 · 6

• high 8.8 Qi Blocks

  File inclusion

  CVE-2024-49690 · affected 1.3.2 and older · fixed in 1.3.3

• high 7.2 Backup and Staging by WP Time Capsule

  PHP object injection

  CVE-2024-49684 · affected 1.22.21 and older · fixed in 1.22.22

• medium 5.4 Shortcodes Ultimate

  Stored cross-site scripting (XSS)

  CVE-2024-8500 · affected 7.2.2 and older · fixed in 7.3.0 *

• medium 4.3 Qi Addons For Elementor

  Information disclosure

  CVE-2024-9530 · affected 1.8.0 and older · fixed in 1.8.1 *

• critical 9.8 Responsive Lightbox & Gallery

  Missing authorization check

  CVE-2024-43924 · affected 2.4.7 and older · fixed in 2.4.8

• medium 5.4 WP RSS Aggregator

  Missing authorization check

  CVE-2024-9583 · affected 4.23.12 and older · fixed in 4.23.13 *

Tuesday, October 22, 2024 · 3

• medium 6.1 WP-Members Membership Plugin

  Reflected cross-site scripting (XSS)

  CVE-2024-9231 · affected 3.4.9.5 and older · fixed in 3.4.9.6 *

• medium 4.3 News Kit Addons For Elementor

  Information disclosure

  CVE-2024-9541 · affected 1.2.1 and older · fixed in 1.2.2 *

• medium 5.3 All-in-One WP Migration and Backup

  Information disclosure

  CVE-2024-8852 · affected 7.86 and older · fixed in 7.97 *

Monday, October 21, 2024 · 6

• medium 6.5 ProfileGrid

  Missing authorization check

  CVE-2024-49273 · affected 5.9.3 and older · fixed in 5.9.3.1

• medium 4.3 Simple Custom Post Order

  Missing authorization check

  CVE-2024-49321 · affected 2.5.7 and older · fixed in 2.5.8

• medium 5.4 WPVR

  Missing authorization check

  CVE-2024-49293 · affected 8.5.4 and older · fixed in 8.5.5

• high 7.2 FunnelKit Automations

  SQL injection

  CVE-2024-47328 · affected 3.1.2 and older · fixed in 3.2.0

• high 8.8 Appointment Booking Plugin

  Cross-site request forgery (CSRF)

  CVE-2024-43945 · affected 4.9.91 and older · fixed in 5.1.0 *

• high 7.2 TS Poll

  SQL injection

  CVE-2024-8625 · affected older than 2.4.0 · fixed in 2.4.0

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan