WordPress plugin vulnerabilities: week 45, 2024

54 vulnerabilities published Nov 4 – Nov 10, 2024 in 53 plugins we track, by day.

4 critical 13 high 37 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, November 10, 2024 · 2

medium 6.1 Form Maker by 10Web

Reflected cross-site scripting (XSS)

CVE-2024-10265 · affected 1.15.30 and older · fixed in 1.15.31 *
high 7.3 WP Photo Album Plus

Remote code execution

CVE-2024-10958 · affected 8.8.08.007 and older · fixed in 8.9.01.001 *

Saturday, November 9, 2024 · 18

medium 5.4 NMR Strava activities

Cross-site scripting (XSS)

CVE-2024-51603 · affected 1.0.7 and older · fixed in 1.0.8
medium 4.8 Bricksable for Bricks Builder

Stored cross-site scripting (XSS)

CVE-2024-51663 · affected 1.6.59 and older · fixed in 1.6.60
high 7.1 WOW Styler for CF7

Reflected cross-site scripting (XSS)

CVE-2024-51689 · affected 1.6.8 and older · fixed in 1.6.9
medium 5.4 aThemes Addons for Elementor

Cross-site scripting (XSS)

CVE-2024-51675 · affected 1.0.7 and older · fixed in 1.0.8
medium 4.8 JS Help Desk

Stored cross-site scripting (XSS)

CVE-2024-51670 · affected 2.8.7 and older · fixed in 2.8.8
medium 6.5 Spexo Addons for Elementor

Cross-site scripting (XSS)

CVE-2024-51674 · affected 1.0.5 and older · fixed in 1.0.6
medium 6.1 SysBasics Customize My Account for WooCommerce

Reflected cross-site scripting (XSS)

CVE-2024-10837 · affected 2.7.29 and older · fixed in 4.4.3 *
medium 4.3 Magical Addons For Elementor ( Theme Builder,…

Information disclosure

CVE-2024-10352 · affected 1.2.4 and older · fixed in 1.5.3 *
high 7.3 FOX

Remote code execution

CVE-2024-10640 · affected 1.4.2.2 and older · fixed in 1.4.8 *
high 7.3 Paid Membership Subscriptions

Remote code execution

CVE-2024-10261 · affected 2.13.0 and older · fixed in 2.13.1 *
critical 9.8 RegistrationMagic

Privilege escalation

CVE-2024-10508 · affected 6.0.2.6 and older · fixed in 6.0.2.7 *
high 7.2 Poll Maker by AYS

SQL injection

CVE-2024-9874 · affected 5.4.6 and older · fixed in 5.4.7 *
medium 6.1 Charitable

Reflected cross-site scripting (XSS)

CVE-2024-10876 · affected 1.8.3 and older · fixed in 1.8.3.1 *
medium 6.1 Contact Form 7

Reflected cross-site scripting (XSS)

CVE-2024-10683 · affected 2.3.1 and older · fixed in 2.3.2 *
medium 4.3 Envo Extra

Information disclosure

CVE-2024-10770 · affected 1.9.3 and older · fixed in 1.9.4 *
medium 6.4 Code Embed

Server-side request forgery (SSRF)

CVE-2024-10814 · affected 2.5 and older · fixed in 2.5.1 *
medium 4.3 Content Slider Block

Information disclosure

CVE-2024-10667 · affected 3.1.5 and older · fixed in 3.1.6 *
medium 4.3 SKT Addons for Elementor

Information disclosure

CVE-2024-10693 · affected 3.3 and older · fix not stated

Friday, November 8, 2024 · 4

medium 5.4 Ultimate Addons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-10325 · affected 1.6.45 and older · fixed in 1.6.46 *
medium 5.4 Points Management System For Gamification, Ran…

Stored cross-site scripting (XSS)

CVE-2024-10187 · affected 2.7.4 and older · fixed in 2.7.5 *
medium 5.4 Easy SVG Support

Stored cross-site scripting (XSS)

CVE-2024-10269 · affected 3.7 and older · fixed in 3.8 *
critical 9.6 Registrations for the Events Calendar

Cross-site scripting (XSS)

CVE-2024-7982 · affected older than 2.12.4 · fixed in 2.12.4

Thursday, November 7, 2024 · 3

medium 4.8 Safe SVG

Security issue

CVE-2024-8378 · affected older than 2.2.6 · fixed in 2.2.6
medium 4.3 Jetpack

Security issue

CVE-2024-9926 · affected 13.9 up to (not including) 13.9.1, 13.8 up to (not including) 13.8.2, 13.7 up to (not including) 13.7.1, 13.6 up to (not including) 13.6.1, 13.5 up to (not including) 13.5.1, 13.4 up to (not including) 13.4.4, 13.3 up to (not including) 13.3.2, 13.2 up to (not including) 13.2.3, 13.1 up to (not including) 13.1.4, 13.0 up to (not including) 13.0.1, 12.9 up to (not including) 12.9.4, 12.8 up to (not including) 12.8.2, 12.7 up to (not including) 12.7.2, 12.6 up to (not including) 12.6.3, 12.5 up to (not including) 12.5.1, 12.4 up to (not including) 12.4.1, 12.3 up to (not including) 12.3.1, 12.2 up to (not including) 12.2.2, 12.1 up to (not including) 12.1.2, 12.0 up to (not including) 12.0.2, 11.9 up to (not including) 11.9.3, 11.8 up to (not including) 11.8.6, 11.7 up to (not including) 11.7.3, 11.6 up to (not including) 11.6.2, 11.5 up to (not including) 11.5.3, 11.4 up to (not including) 11.4.2, 11.3 up to (not including) 11.3.4, 11.2 up to (not including) 11.2.2, 11.1 up to (not including) 11.1.4, 11.0 up to (not including) 11.0.2, 10.9 up to (not including) 10.9.3, 10.8 up to (not including) 10.8.2, 10.7 up to (not including) 10.7.2, 10.6 up to (not including) 10.6.2, 10.5 up to (not including) 10.5.3, 10.4 up to (not including) 10.4.2, 10.3 up to (not including) 10.3.2, 10.2 up to (not including) 10.2.3, 10.1 up to (not including) 10.1.2, 10.0 up to (not including) 10.0.2, 9.9 up to (not including) 9.9.3, 9.8 up to (not including) 9.8.3, 9.7 up to (not including) 9.7.3, 9.6 up to (not including) 9.6.4, 9.5 up to (not including) 9.5.5, 9.4 up to (not including) 9.4.4, 9.3 up to (not including) 9.3.5, 9.2 up to (not including) 9.2.4, 9.1 up to (not including) 9.1.3, 9.0 up to (not including) 9.0.5, 8.9 up to (not including) 8.9.4, 8.8 up to (not including) 8.8.5, 8.7 up to (not including) 8.7.4, 8.6 up to (not including) 8.6.4, 8.5 up to (not including) 8.5.3, 8.4 up to (not including) 8.4.5, 8.3 up to (not including) 8.3.3, 8.2 up to (not including) 8.2.6, 8.1 up to (not including) 8.1.4, 8.0 up to (not including) 8.0.3, 7.9 up to (not including) 7.9.4, 7.8 up to (not including) 7.8.4, 7.7 up to (not including) 7.7.6, 7.6 up to (not including) 7.6.4, 7.5 up to (not including) 7.5.7, 7.4 up to (not including) 7.4.5, 7.3 up to (not including) 7.3.5, 7.2 up to (not including) 7.2.5, 7.1 up to (not including) 7.1.5, 7.0 up to (not including) 7.0.5, 6.9 up to (not including) 6.9.4, 6.8 up to (not including) 6.8.5, 6.7 up to (not including) 6.7.4, 6.6 up to (not including) 6.6.5, 6.5 up to (not including) 6.5.4, 6.4 up to (not including) 6.4.6, 6.3 up to (not including) 6.3.7, 6.2 up to (not including) 6.2.5, 6.1 up to (not including) 6.1.5, 6.0 up to (not including) 6.0.4, 5.9 up to (not including) 5.9.4, 5.8 up to (not including) 5.8.4, 5.7 up to (not including) 5.7.5, 5.6 up to (not including) 5.6.5, 5.5 up to (not including) 5.5.5, 5.4 up to (not including) 5.4.4, 5.3 up to (not including) 5.3.4, 5.2 up to (not including) 5.2.5, 5.1 up to (not including) 5.1.4, 5.0 up to (not including) 5.0.3, 4.9 up to (not including) 4.9.3, 4.8 up to (not including) 4.8.5, 4.7 up to (not including) 4.7.4, 4.6 up to (not including) 4.6.3, 4.5 up to (not including) 4.5.3, 4.4 up to (not including) 4.4.5, 4.3 up to (not including) 4.3.5, 4.2 up to (not including) 4.2.5, 4.1.0 up to (not including) 4.1.4, 4.0.0 up to (not including) 4.0.7, 3.9.2 up to (not including) 3.9.10 · fixed in 13.9.1
medium 5.4 Prime Slider

Stored cross-site scripting (XSS)

CVE-2024-8442 · affected 3.15.18 and older · fixed in 3.15.19 *

Wednesday, November 6, 2024 · 10

medium 5.4 Event Post

Stored cross-site scripting (XSS)

CVE-2024-10186 · affected 5.9.6 and older · fixed in 5.9.7 *
medium 5.4 Pricing Table WordPress Plugin

Stored cross-site scripting (XSS)

CVE-2024-8323 · affected 3.2.6 and older · fix not stated
medium 5.4 Active Woot Products Tables for WooCommerce. 1…

Stored cross-site scripting (XSS)

CVE-2024-10168 · affected 1.0.6.4 and older · fixed in 1.1.1 *
medium 5.4 MapPress

Stored cross-site scripting (XSS)

CVE-2024-10715 · affected 2.94.1 and older · fixed in 2.94.2 *
high 8.1 Social Share, Social Login and Social Comments…

Authentication bypass

CVE-2024-9946 · affected 7.13.68 and older · fix not stated
medium 4.3 Tumult Hype Animations

Missing authorization check

CVE-2024-10543 · affected 1.9.14 and older · fixed in 1.9.17 *
high 8.1 Heateor Social Login WordPress

Authentication bypass

CVE-2024-10020 · affected 1.1.35 and older · fix not stated
medium 4.8 WP ULike

Cross-site scripting (XSS)

CVE-2024-7879 · affected older than 4.7.5 · fixed in 4.7.5
medium 6.1 WS Form LITE

Reflected cross-site scripting (XSS)

CVE-2024-10647 · affected 1.9.244 and older · fixed in 1.9.245 *
high 7.5 Everest Backup

Information disclosure

CVE-2024-10028 · affected 2.2.13 and older · fixed in 2.2.14 *

Tuesday, November 5, 2024 · 11

medium 4.3 DTX

Information disclosure

CVE-2024-10084 · affected 4.5 and older · fixed in 4.5.1 *
high 7.3 Tickera

Remote code execution

CVE-2024-10263 · affected 3.5.4.4 and older · fixed in 3.5.4.5 *
medium 5.4 Element Pack Addons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-9657 · affected 5.10.2 and older · fixed in 5.10.3 *
medium 4.3 Xpro Addons

Information disclosure

CVE-2024-10319 · affected 1.4.6 and older · fix not stated
medium 4.8 Photo Gallery by 10Web

Stored cross-site scripting (XSS)

CVE-2024-9878 · affected 1.8.30 and older · fixed in 1.8.31 *
medium 4.3 Zotpress

Missing authorization check

CVE-2024-7429 · affected 7.3.12 and older · fixed in 7.3.13 *
critical 9.8 Contest Gallery

SQL injection

CVE-2024-10687 · affected 24.0.3 and older · fixed in 24.0.9 *
medium 5.4 Basticom Framework

Stored cross-site scripting (XSS)

CVE-2024-9443 · affected 1.5.0 and older · fixed in 1.5.1 *
medium 6.1 Seriously Simple Podcasting

Reflected cross-site scripting (XSS)

CVE-2024-9667 · affected 3.5.0 and older · fixed in 3.6.0 *
high 8.1 Loginizer

Authentication bypass

CVE-2024-10097 · affected 1.9.2 and older · fixed in 1.9.3 *
medium 4.8 Pods

Stored cross-site scripting (XSS)

CVE-2024-9883 · affected older than 3.2.7.1 · fixed in 3.2.7.1

Monday, November 4, 2024 · 6

medium 5.4 Knowledge Base

Stored cross-site scripting (XSS)

CVE-2024-51677 · affected 2.2.0 and older · fixed in 2.2.1
high 7.2 BetterLinks

SQL injection

CVE-2024-51672 · affected 2.1.7 and older · fixed in 2.1.8
medium 4.3 Magical Addons For Elementor ( Theme Builder,…

Server-side request forgery (SSRF)

CVE-2024-51665 · affected 1.2.1 and older · fixed in 1.2.3
high 8.8 WP Hotel Booking

File inclusion

CVE-2024-51582 · affected 2.2.9 and older · fixed in 2.3.0
critical 9.8 Plug your WooCommerce into the largest catalog…

Arbitrary file upload

CVE-2024-50525 · affected 2.0.4 and older · fixed in 2.0.5
high 7.2 Media Library Assistant

Command injection

CVE-2024-51661 · affected 3.19 and older · fixed in 3.20

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan