WordPress plugin vulnerabilities: week 44, 2024

170 vulnerabilities published Oct 28 – Nov 3, 2024 in 139 plugins we track, by day.

22 critical 44 high 103 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, November 2, 2024 · 3

• medium 6.1 Forumax

  Reflected cross-site scripting (XSS)

  CVE-2024-9896 · affected 1.2.5 and older · fixed in 1.2.6 *

• medium 5.4 Element Pack Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-9868 · affected 5.10.1 and older · fixed in 5.10.2 *

• medium 5.4 Element Pack Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-10310 · affected 5.10.1 and older · fixed in 5.10.2 *

Friday, November 1, 2024 · 100

• high 8.8 HappyAddons for Elementor

  Missing authorization check

  CVE-2024-48045 · affected 3.12.3 and older · fixed in 3.12.4

• high 8.8 ShortPixel Image Optimizer

  Missing authorization check

  CVE-2024-48044 · affected 5.6.3 and older · fixed in 5.6.4

• high 8.8 Addon Elements for Elementor (formerly Element…

  Missing authorization check

  CVE-2024-47361 · affected 1.13.6 and older · fixed in 1.13.7

• high 8.8 CubeWP Framework

  Missing authorization check

  CVE-2024-48039 · affected 1.1.15 and older · fixed in 1.1.16

• critical 9.8 Depicter

  Cross-site request forgery (CSRF)

  CVE-2024-47359 · affected 3.2.2 and older · fixed in 3.5.0

• critical 9.8 Popup Maker

  Missing authorization check

  CVE-2024-47358 · affected 1.19.2 and older · fixed in 1.20.0

• high 8.8 Strong Testimonials

  Missing authorization check

  CVE-2024-47362 · affected 3.1.16 and older · fixed in 3.1.17

• high 8.8 Quads Ads Manager for Google AdSense

  Missing authorization check

  CVE-2024-47317 · affected 2.0.84 and older · fixed in 2.0.85

• high 8.8 Sunshine Photo Cart

  Missing authorization check

  CVE-2024-47314 · affected 3.2.8 and older · fixed in 3.2.9

• critical 9.8 Fluent Support

  Missing authorization check

  CVE-2024-47302 · affected 1.8.0 and older · fixed in 1.8.1

• critical 9.8 Sunshine Photo Cart

  Missing authorization check

  CVE-2024-44038 · affected 3.2.9 and older · fixed in 3.2.10

• critical 9.8 Templately

  Missing authorization check

  CVE-2024-47308 · affected 3.1.2 and older · fixed in 3.1.3

• critical 9.8 Wheel of Life

  Missing authorization check

  CVE-2024-47311 · affected 1.1.8 and older · fixed in 1.1.9

• high 8.8 JoomSport

  Missing authorization check

  CVE-2024-44031 · affected 5.6.3 and older · fixed in 5.6.4

• high 8.8 WPML Multilingual & Multicurrency for WooComme…

  Missing authorization check

  CVE-2024-44006 · affected 5.3.6 and older · fixed in 5.3.7

• high 8.8 GeoDirectory

  Missing authorization check

  CVE-2024-43981 · affected 2.3.70 and older · fixed in 2.3.71

• high 8.8 Payment forms, Buy now buttons, and Invoicing…

  Missing authorization check

  CVE-2024-43973 · affected 2.8.11 and older · fixed in 2.8.12

• high 8.8 The Plus Addons for Elementor

  Missing authorization check

  CVE-2024-43932 · affected 5.6.2 and older · fixed in 5.6.3

• medium 4.3 WP Crowdfunding

  Missing authorization check

  CVE-2024-43937 · affected 2.1.10 and older · fixed in 2.1.11

• high 8.8 Envira Gallery

  Missing authorization check

  CVE-2024-43925 · affected 1.8.14 and older · fixed in 1.8.15

• high 8.8 JoomSport

  Missing authorization check

  CVE-2024-43355 · affected 5.3.0 and older · fixed in 5.5.7

• high 8.8 Order Tracking

  Missing authorization check

  CVE-2024-43343 · affected 3.3.12 and older · fixed in 3.3.13

• critical 9.8 Timetics

  Missing authorization check

  CVE-2024-43923 · affected 1.0.23 and older · fixed in 1.0.24

• critical 9.8 ReviewX

  Missing authorization check

  CVE-2024-43323 · affected 1.6.28 and older · fixed in 1.6.29

• high 8.8 Asset CleanUp

  Missing authorization check

  CVE-2024-43314 · affected 1.3.9.3 and older · fixed in 1.3.9.4

• high 8.8 Photo Engine (Media Organizer & Lightroom)

  Missing authorization check

  CVE-2024-43332 · affected 6.4.0 and older · fixed in 6.4.1

• high 8.8 Barcode Generator

  Missing authorization check

  CVE-2024-43310 · affected 3.4.9 and older · fixed in 3.4.10

• medium 5.3 Atarim

  Missing authorization check

  CVE-2024-43290 · affected 4.0.1 and older · fixed in 4.0.2

• high 8.8 HTML5 Video Player

  Missing authorization check

  CVE-2024-43296 · affected 2.5.30 and older · fixed in 2.5.31

• medium 6.3 Presto Player

  Missing authorization check

  CVE-2024-43285 · affected 3.0.2 and older · fixed in 3.0.3

• high 8.8 Recipe Card Blocks Lite

  Missing authorization check

  CVE-2024-43293 · affected 3.3.1 and older · fixed in 3.3.2

• critical 9.8 JS Help Desk

  Missing authorization check

  CVE-2024-43274 · affected 2.8.6 and older · fixed in 2.8.7

• medium 5.3 UsersWP

  Missing authorization check

  CVE-2024-43277 · affected 1.2.15 and older · fixed in 1.2.16

• medium 5.3 WP BackItUp Community Edition

  Missing authorization check

  CVE-2024-43270 · affected 1.50 and older · fix not stated

• medium 5.4 WP BackItUp Community Edition

  Missing authorization check

  CVE-2024-43268 · affected 1.50 and older · fix not stated

• medium 5.4 Clearfy Cache

  Missing authorization check

  CVE-2024-43260 · affected 2.2.4 and older · fixed in 2.2.5

• high 8.8 Smart Online Order for Clover

  Missing authorization check

  CVE-2024-43254 · affected 1.5.6 and older · fixed in 1.5.7

• critical 9.8 Smart Online Order for Clover

  Missing authorization check

  CVE-2024-43253 · affected 1.5.6 and older · fixed in 1.5.7

• high 7.1 Meta Box

  Missing authorization check

  CVE-2024-43235 · affected 5.9.10 and older · fixed in 5.9.11

• high 8.8 EventPrime

  Missing authorization check

  CVE-2024-43223 · affected 4.0.3.2 and older · fixed in 4.0.4.0

• medium 4.3 Search Analytics for WP

  Missing authorization check

  CVE-2024-43229 · affected 1.4.9 and older · fixed in 1.4.10

• medium 4.3 Social Slider Feed

  Missing authorization check

  CVE-2024-43215 · affected 2.2.2 and older · fixed in 2.2.5

• medium 5.9 MailChimp Subscribe Form, Optin Builder, PopUp…

  Stored cross-site scripting (XSS)

  CVE-2024-43211 · affected 4.0.9.9 and older · fixed in 4.1 *

• high 7.5 Travelly

  Missing authorization check

  CVE-2024-43212 · affected 1.7.7 and older · fixed in 1.7.8

• high 8.8 Easy Digital Downloads

  Missing authorization check

  CVE-2024-43162 · affected 3.2.12 and older · fixed in 3.3.1

• medium 5.3 Masteriyo LMS

  Missing authorization check

  CVE-2024-43159 · affected 1.11.6 and older · fixed in 1.12.0

• high 7.5 Masteriyo LMS

  Missing authorization check

  CVE-2024-43158 · affected 1.11.4 and older · fixed in 1.11.5

• medium 6.3 AMP for WP

  Missing authorization check

  CVE-2024-43146 · affected 1.0.96.1 and older · fixed in 1.0.97

• medium 6.4 Registrations for the Events Calendar

  Missing authorization check

  CVE-2024-43143 · affected 2.12.1 and older · fixed in 2.12.2

• high 8.8 Tutor LMS

  Missing authorization check

  CVE-2024-43142 · affected 2.7.3 and older · fixed in 2.7.4

• medium 4.3 Aruba HiSpeed Cache

  Missing authorization check

  CVE-2024-43119 · affected 2.0.12 and older · fixed in 2.0.13

• medium 6.5 Robin Image Optimizer

  Missing authorization check

  CVE-2024-43122 · affected 1.6.9 and older · fixed in 1.7.0

• high 8.8 Sunshine Photo Cart

  Missing authorization check

  CVE-2024-43136 · affected 3.2.1 and older · fixed in 3.2.2

• medium 4.3 Waitlist Woocommerce ( Back in stock notifier )

  Missing authorization check

  CVE-2024-43134 · affected 2.6 and older · fixed in 2.6.1

• high 8.8 Hummingbird Performance

  Missing authorization check

  CVE-2024-43118 · affected 3.9.1 and older · fixed in 3.9.2

• medium 5.3 Sign-up Sheets

  Missing authorization check

  CVE-2024-39654 · affected 2.2.12 and older · fixed in 2.2.13

• high 7.3 YMC Filter

  Missing authorization check

  CVE-2024-39664 · affected 2.8.33 and older · fixed in 2.8.34

• medium 5.3 Icegram Engage

  Missing authorization check

  CVE-2024-39625 · affected 3.1.24 and older · fixed in 3.1.25

• medium 6.5 Social Feed Gallery

  Missing authorization check

  CVE-2024-39640 · affected 4.3.9 and older · fixed in 4.4.0

• low 3.5 Iptanus File Upload

  Missing authorization check

  CVE-2024-39639 · affected 4.24.7 and older · fixed in 4.24.8

• high 8.8 Youzify

  Missing authorization check

  CVE-2024-39635 · affected 1.2.6 and older · fixed in 1.2.8

• medium 5.3 ConveyThis AI Multilingual Translation

  Missing authorization check

  CVE-2024-38792 · affected 234 and older · fixed in 235

• medium 5.3 Custom Query Blocks

  Missing authorization check

  CVE-2024-38794 · affected 5.2.0 and older · fixed in 5.3.0

• medium 5.4 Security Optimizer

  Missing authorization check

  CVE-2024-38774 · affected 1.5.0 and older · fixed in 1.5.1

• medium 5.3 Arconix Shortcodes

  Missing authorization check

  CVE-2024-38769 · affected 2.1.11 and older · fixed in 2.1.12

• medium 6.5 Atarim

  Missing authorization check

  CVE-2024-38771 · affected 4.0 and older · fixed in 4.0.1

• medium 5.3 Wholesale Suite

  Missing authorization check

  CVE-2024-38745 · affected 2.1.12 and older · fixed in 2.2.0

• medium 4.3 Auto Featured Image (Auto Post Thumbnail)

  Missing authorization check

  CVE-2024-38719 · affected 4.1.2 and older · fixed in 4.1.3

• high 8.8 EmbedPress

  Missing authorization check

  CVE-2024-38707 · affected 4.0.4 and older · fixed in 4.0.5

• medium 4.3 WP Fast Total Search

  Missing authorization check

  CVE-2024-38714 · affected 1.68.232 and older · fixed in 1.69.234

• medium 5.3 Product Delivery Date for WooCommerce

  Missing authorization check

  CVE-2024-38702 · affected 2.7.2 and older · fixed in 2.7.3

• medium 5.3 WP Accessibility Helper (WAH)

  Missing authorization check

  CVE-2024-37926 · affected 0.6.2.9 and older · fixed in 0.6.3

• medium 5.3 Chained Quiz

  Missing authorization check

  CVE-2024-37921 · affected 1.3.2.8 and older · fixed in 1.3.2.9

• medium 6.5 Charitable

  Missing authorization check

  CVE-2024-37510 · affected 1.8.1.7 and older · fixed in 1.8.1.8

• medium 5.3 Charitable

  Missing authorization check

  CVE-2024-37506 · affected 1.8.1.7 and older · fixed in 1.8.1.8

• medium 6.3 Featured Image from URL (FIFU)

  Missing authorization check

  CVE-2024-37516 · affected 4.8.2 and older · fixed in 4.8.3

• high 8.8 Spectra Legacy

  Missing authorization check

  CVE-2024-37517 · affected 2.13.7 and older · fixed in 2.13.8

• medium 5.4 The Post Grid

  Missing authorization check

  CVE-2024-37483 · affected 7.7.4 and older · fixed in 7.7.5

• medium 4.3 The Post Grid

  Missing authorization check

  CVE-2024-37482 · affected 7.7.4 and older · fixed in 7.7.5

• medium 6.5 The Post Grid

  Missing authorization check

  CVE-2024-37481 · affected 7.7.4 and older · fixed in 7.7.5

• critical 9.8 CRM Perks Forms

  Missing authorization check

  CVE-2024-37463 · affected 1.1.5 and older · fixed in 1.1.6

• medium 5.3 Noptin

  Missing authorization check

  CVE-2024-37456 · affected 3.4.2 and older · fixed in 3.4.3

• high 8.8 ProfileGrid

  Missing authorization check

  CVE-2024-37453 · affected 5.8.7 and older · fixed in 5.8.8

• medium 4.3 Church Admin

  Missing authorization check

  CVE-2024-37440 · affected 4.4.4 and older · fixed in 4.4.5

• medium 5.3 Timetics

  Missing authorization check

  CVE-2024-37427 · affected 1.0.21 and older · fixed in 1.0.22

• medium 5.4 E2Pdf

  Missing authorization check

  CVE-2024-37415 · affected 1.20.27 and older · fixed in 1.23.00

• medium 5.3 Featured Image from URL (FIFU)

  Missing authorization check

  CVE-2024-37276 · affected 4.8.1 and older · fixed in 4.8.2

• medium 5.3 Progress Planner

  Missing authorization check

  CVE-2024-37411 · affected 0.9.1 and older · fixed in 0.9.2

• medium 5.3 ElementsKit Elementor Addons

  Missing authorization check

  CVE-2024-37255 · affected 3.1.4 and older · fixed in 3.2.0

• medium 4.3 File Manager

  Missing authorization check

  CVE-2024-37254 · affected 7.2.7 and older · fixed in 7.2.8

• medium 6.5 AliNext

  Stored cross-site scripting (XSS)

  CVE-2024-37214 · affected 3.3.5 and older · fixed in 3.3.7

• medium 4.3 Property Hive

  Missing authorization check

  CVE-2024-37204 · affected 2.0.9 and older · fixed in 2.0.10

• medium 5.3 Ibtana

  Missing authorization check

  CVE-2024-37123 · affected 1.2.3.3 and older · fixed in 1.2.3.4

• medium 4.3 Popup Box

  Missing authorization check

  CVE-2024-37096 · affected 4.5.1 and older · fixed in 4.5.2

• medium 4.3 Envira Gallery

  Missing authorization check

  CVE-2024-37095 · affected 1.8.7.3 and older · fixed in 1.8.8

• critical 9.8 MasterStudy LMS WordPress Plugin

  Missing authorization check

  CVE-2024-37094 · affected 3.2.12 and older · fixed in 3.2.13

• medium 6.4 Otter Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-10367 · affected 3.0.4 and older · fixed in 3.0.5 *

• medium 6.4 Group Chat & Video Chat by AtomChat

  Stored cross-site scripting (XSS)

  CVE-2024-10232 · affected 1.1.5 and older · fixed in 1.1.6 *

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-9655 · affected 3.3.1 and older · fixed in 3.3.2 *

• medium 5.4 MPG

  Missing authorization check

  CVE-2024-7424 · affected 4.0.1 and older · fixed in 4.0.2 *

Thursday, October 31, 2024 · 6

• high 8.8 Custom Twitter Feeds

  Cross-site request forgery (CSRF)

  CVE-2024-49685 · affected 2.2.3 and older · fixed in 2.2.4

• high 8.8 Podlove Podcast Publisher

  Cross-site request forgery (CSRF)

  CVE-2024-43984 · affected 4.1.13 and older · fixed in 4.1.14

• medium 4.3 WPMobile.App

  Stored cross-site scripting (XSS)

  CVE-2024-43933 · affected 11.48 and older · fixed in 11.49

• medium 6.4 Gift Cards (Gift Vouchers and Packages) (WooCo…

  Stored cross-site scripting (XSS)

  CVE-2024-9165 · affected 4.4.4 and older · fixed in 4.4.5 *

• medium 5.3 Forminator Forms

  Missing authorization check

  CVE-2024-9700 · affected 1.36.0 and older · fixed in 1.36.1 *

• critical 9.8 AI Puffer

  Arbitrary file upload

  CVE-2024-10392 · affected 1.8.89 and older · fixed in 1.8.90 *

Wednesday, October 30, 2024 · 8

• critical 9.8 Greenshift

  Missing authorization check

  CVE-2024-50419 · affected 9.7 and older · fixed in 9.8

• critical 10.0 AR for WooCommerce

  Arbitrary file upload

  CVE-2024-50510 · affected 6.3 and older · fixed in 7.0

• medium 5.4 Download Manager

  Cross-site scripting (XSS)

  CVE-2024-8444 · affected older than 3.3.00 · fixed in 3.3.00

• high 7.2 WPAdverts

  Stored cross-site scripting (XSS)

  CVE-2024-10108 · affected 2.1.6 and older · fixed in 2.1.7 *

• medium 6.1 Pricing Table WordPress Plugin

  Reflected cross-site scripting (XSS)

  CVE-2024-8871 · affected 3.2.5 and older · fix not stated

• medium 4.3 Download Monitor

  Missing authorization check

  CVE-2024-10399 · affected 5.0.13 and older · fixed in 5.0.14 *

• medium 6.1 Subscribe to Comments

  Reflected cross-site scripting (XSS)

  CVE-2024-8792 · affected 2.3 and older · fixed in 2.3.1 *

• medium 4.9 Code Explorer

  Security issue

  CVE-2023-5816 · affected 1.4.5 and older · fix not stated

Tuesday, October 29, 2024 · 31

• medium 5.3 SEOPress

  Missing authorization check

  CVE-2024-50454 · affected 8.1.1 and older · fixed in 8.2

• medium 5.3 Breeze Cache

  Missing authorization check

  CVE-2024-50422 · affected 2.1.14 and older · fixed in 2.1.15

• medium 6.5 Templately

  Missing authorization check

  CVE-2024-50424 · affected 3.1.5 and older · fixed in 3.1.6

• medium 5.4 Templately

  Missing authorization check

  CVE-2024-50423 · affected 3.1.5 and older · fixed in 3.1.6

• medium 5.3 PDF Invoices & Packing Slips for WooCommerce

  Missing authorization check

  CVE-2024-50421 · affected 3.8.6 and older · fixed in 3.8.7

• medium 6.5 WP Booking System

  Information disclosure

  CVE-2024-50425 · affected 2.0.19.10 and older · fixed in 2.0.19.11

• high 8.8 SEOPress

  Missing authorization check

  CVE-2024-50456 · affected 8.1.1 and older · fixed in 8.2

• high 8.8 SEOPress

  Missing authorization check

  CVE-2024-50455 · affected 8.1.1 and older · fixed in 8.2

• high 8.8 Crypto

  Cross-site request forgery (CSRF)

  CVE-2024-9990 · affected 2.15 and older · fixed in 2.16 *

• critical 9.8 Crypto

  Authentication bypass

  CVE-2024-9989 · affected 2.18 and older · fixed in 2.19 *

• critical 9.8 Crypto

  Authentication bypass

  CVE-2024-9988 · affected 2.19 and older · fixed in 2.20 *

• medium 5.4 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2024-9505 · affected 2.8.4.2 and older · fixed in 2.8.4.3 *

• medium 5.4 Arconix Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2024-10226 · affected 2.1.13 and older · fixed in 2.1.14 *

• medium 6.1 ERP

  Reflected cross-site scripting (XSS)

  CVE-2024-47640 · affected 1.13.2 and older · fixed in 1.13.3

• medium 6.4 Newsletters

  Stored cross-site scripting (XSS)

  CVE-2024-10181 · affected 4.9.9.4 and older · fixed in 4.9.9.5 *

• medium 5.4 AffiliateX

  Stored cross-site scripting (XSS)

  CVE-2024-49692 · affected 1.2.9 and older · fixed in 1.2.9.1

• medium 5.4 WPKoi Templates for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-49679 · affected 3.1.0 and older · fixed in 3.1.1

• medium 5.4 Premium Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-10266 · affected older than 4.10.61 · fixed in 4.10.61

• medium 5.4 SMS Alert

  Stored cross-site scripting (XSS)

  CVE-2024-10233 · affected 3.7.5 and older · fixed in 3.8.0 *

• critical 9.8 LiteSpeed Cache

  Privilege escalation

  CVE-2024-50550 · affected 6.5.1 and older · fixed in 6.5.2

• medium 4.3 WPC Smart Messages for WooCommerce

  Missing authorization check

  CVE-2024-10437 · affected 4.2.1 and older · fixed in 4.2.2 *

• medium 6.4 affiliate-toolkit

  Stored cross-site scripting (XSS)

  CVE-2024-10227 · affected 3.6.5 and older · fixed in 3.6.8 *

• high 8.8 WPC Smart Messages for WooCommerce

  File inclusion

  CVE-2024-10436 · affected 4.2.1 and older · fixed in 4.2.2 *

• critical 10.0 aDirectory

  Arbitrary file upload

  CVE-2024-50420 · affected 1.3 and older · fixed in 1.3.1

• medium 4.8 Survey Maker by AYS

  Stored cross-site scripting (XSS)

  CVE-2024-50426 · affected 5.0.2 and older · fixed in 5.0.3

• critical 9.9 SurveyJS

  Arbitrary file upload

  CVE-2024-50427 · affected 1.9.136 and older · fixed in 1.12.4

• medium 6.5 Time Slot

  Cross-site scripting (XSS)

  CVE-2024-50418 · affected 1.3.6 and older · fixed in 1.3.7

• medium 5.9 Import and export users and customers

  Stored cross-site scripting (XSS)

  CVE-2024-50413 · affected 1.27.5 and older · fixed in 1.27.6

• medium 4.3 Exclusive Addons for Elementor

  Information disclosure

  CVE-2024-10312 · affected 2.7.4 and older · fixed in 2.7.5 *

• medium 6.5 Masteriyo LMS

  Missing authorization check

  CVE-2024-10008 · affected 1.13.3 and older · fixed in 1.13.4 *

• medium 5.4 Masteriyo LMS

  Stored cross-site scripting (XSS)

  CVE-2024-10000 · affected 1.13.3 and older · fixed in 1.13.4 *

Monday, October 28, 2024 · 22

• critical 10.0 AR for WordPress

  Arbitrary file upload

  CVE-2024-50496 · affected 6.6 and older · fixed in 7.0

• medium 5.9 Breeze Cache

  Stored cross-site scripting (XSS)

  CVE-2024-50431 · affected 2.1.14 and older · fixed in 2.1.15

• medium 5.4 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2024-50437 · affected 2.3.80 and older · fixed in 2.3.81

• medium 6.5 Post Grid

  Cross-site scripting (XSS)

  CVE-2024-50432 · affected 2.2.93 and older · fixed in 2.2.94

• medium 5.4 Sky Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2024-50433 · affected 2.5.15 and older · fixed in 2.5.16

• medium 6.5 Magazine Blocks

  Cross-site scripting (XSS)

  CVE-2024-50429 · affected 1.3.15 and older · fixed in 1.3.18

• medium 4.8 Firelight Lightbox

  Stored cross-site scripting (XSS)

  CVE-2024-50460 · affected 2.3.3 and older · fixed in 2.3.4

• medium 5.4 EmbedPress

  Stored cross-site scripting (XSS)

  CVE-2024-50461 · affected 4.0.14 and older · fixed in 4.1.0

• medium 5.4 MDTF

  Cross-site scripting (XSS)

  CVE-2024-50451 · affected 1.3.3.4 and older · fixed in 1.3.3.5

• medium 5.4 Envo's Templates & Widgets for Elementor and W…

  Stored cross-site scripting (XSS)

  CVE-2024-50447 · affected 1.4.19 and older · fixed in 1.4.20

• medium 6.1 YITH WooCommerce Product Add-Ons

  Cross-site scripting (XSS)

  CVE-2024-50448 · affected 4.14.1 and older · fixed in 4.14.2

• medium 5.4 Astra Widgets

  Stored cross-site scripting (XSS)

  CVE-2024-50439 · affected 1.2.14 and older · fixed in 1.2.15

• medium 6.1 Church Admin

  Reflected cross-site scripting (XSS)

  CVE-2024-50438 · affected 5.0.0 and older · fixed in 5.0.0

• medium 5.4 Cozy Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-50441 · affected 2.0.15 and older · fixed in 2.0.16

• medium 5.4 Post Grid Blocks & Templates for News, Magazin…

  Cross-site scripting (XSS)

  CVE-2024-50443 · affected 4.1.12 and older · fixed in 4.1.13

• medium 5.4 Cozy Blocks

  Cross-site scripting (XSS)

  CVE-2024-50502 · affected 2.0.18 and older · fixed in 2.0.19

• medium 6.5 Premium SEO Pack

  SQL injection

  CVE-2024-50465 · affected 1.6.001 and older · fix not stated

• medium 6.1 Sunshine Photo Cart

  Open redirect

  CVE-2024-50463 · affected 3.2.9 and older · fixed in 3.2.11

• high 7.2 Royal Addons for Elementor

  Security issue

  CVE-2024-50442 · affected 1.3.980 and older · fixed in 1.3.981

• critical 9.8 MDTF

  Remote code execution

  CVE-2024-50450 · affected 1.3.3.4 and older · fixed in 1.3.3.5

• high 8.8 WPC Shop as a Customer for WooCommerce

  PHP object injection

  CVE-2024-50416 · affected 1.2.6 and older · fixed in 1.2.7

• high 7.2 All-in-One WP Migration and Backup

  Remote code execution

  CVE-2024-9162 · affected 7.86 and older · fixed in 7.97 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan