WordPress plugin vulnerabilities: week 46, 2024

52 vulnerabilities published Nov 11 – Nov 17, 2024 in 43 plugins we track, by day.

7 critical 7 high 37 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, November 16, 2024 · 10

• critical 9.9 User Management

  Arbitrary file upload

  CVE-2024-52403 · affected 1.1 and older · fixed in 1.2

• medium 5.3 Classified Listing

  File inclusion

  CVE-2024-52386 · affected 3.1.16 and older · fixed in 3.1.17

• medium 5.3 404 Solution

  Information disclosure

  CVE-2024-11094 · affected 2.35.17 and older · fixed in 2.36.10 *

• medium 6.4 Mapster WP Maps

  Stored cross-site scripting (XSS)

  CVE-2024-10592 · affected 1.6.0 and older · fixed in 1.7.1 *

• medium 4.3 Customer Reviews for WooCommerce

  Missing authorization check

  CVE-2024-10614 · affected 5.61.0 and older · fixed in 5.61.1 *

• critical 9.8 Backup and Staging by WP Time Capsule

  Arbitrary file upload

  CVE-2024-8856 · affected 1.22.21 and older · fixed in 1.22.22 *

• high 8.8 Post Grid Blocks & Templates for News, Magazin…

  Remote code execution

  CVE-2024-10728 · affected 4.1.16 and older · fix not stated

• high 8.8 Real3D Flipbook

  Arbitrary file upload

  CVE-2024-9849 · affected 4.8 and older · fixed in 4.8.5 *

• medium 5.3 Popup Box

  Missing authorization check

  CVE-2024-10861 · affected 4.9.7 and older · fixed in 4.9.8 *

• medium 4.3 Popularis Extra

  Information disclosure

  CVE-2024-10795 · affected 1.2.7 and older · fixed in 1.2.8 *

Friday, November 15, 2024 · 8

• medium 5.7 Essential Addons for Elementor

  Information disclosure

  CVE-2024-8979 · affected 6.0.9 and older · fixed in 6.0.10 *

• medium 5.7 Essential Addons for Elementor

  Information disclosure

  CVE-2024-8978 · affected 6.0.9 and older · fixed in 6.0.10 *

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-8961 · affected 6.0.7 and older · fixed in 6.0.8 *

• medium 6.1 Hide My WP Ghost

  Reflected cross-site scripting (XSS)

  CVE-2024-10825 · affected 5.3.01 and older · fixed in 5.3.02 *

• medium 6.1 WP Activity Log

  Stored cross-site scripting (XSS)

  CVE-2024-10793 · affected 5.2.1 and older · fixed in 5.2.2 *

• medium 6.1 LearnPress

  Reflected cross-site scripting (XSS)

  CVE-2024-9609 · affected 4.0.4 and older · fixed in 4.0.5 *

• medium 4.3 Tutor LMS Elementor Addons

  Missing authorization check

  CVE-2024-10897 · affected 2.1.5 and older · fixed in 2.1.6 *

• critical 9.8 Really Simple Security

  Authentication bypass

  CVE-2024-10924 · affected 9.0.0 to 9.1.1.1 · fixed in 9.5.9 *

Thursday, November 14, 2024 · 7

• high 8.8 WOLF

  Path traversal / file read

  CVE-2024-52396 · affected 1.0.8.3 and older · fixed in 1.0.8.4

• high 7.2 Podlove Podcast Publisher

  PHP object injection

  CVE-2024-52393 · affected 4.1.15 and older · fixed in 4.1.17

• high 7.5 Ai Auto Tool Content Writing Assistant All in…

  Missing authorization check

  CVE-2024-52383 · affected 2.1.2 and older · fixed in 2.1.3

• critical 10.0 Instant AI Image Generator

  Arbitrary file upload

  CVE-2024-52377 · affected 1.5.2 and older · fixed in 1.5.3

• high 8.8 WPvivid

  PHP object injection

  CVE-2024-10962 · affected 0.9.107 and older · fixed in 0.9.108 *

• critical 9.8 Chartify

  File inclusion

  CVE-2024-10571 · affected 2.9.5 and older · fixed in 3.0.0 *

• medium 5.4 Simple File List

  Reflected cross-site scripting (XSS)

  CVE-2024-10146 · affected older than 6.1.13 · fixed in 6.1.13

Wednesday, November 13, 2024 · 17

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-9682 · affected 1.7.1001 and older · fixed in 1.7.1002 *

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-9668 · affected 1.7.1001 and older · fixed in 1.7.1002 *

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-9059 · affected 1.7.1001 and older · fixed in 1.7.1002 *

• medium 6.1 Advanced Form Integration

  Reflected cross-site scripting (XSS)

  CVE-2024-10877 · affected 1.92.0 and older · fixed in 1.120.0 *

• medium 4.8 VK All in One Expansion Unit

  Cross-site scripting (XSS)

  CVE-2024-52268 · affected older than 9.100.1.0 · fixed in 9.100.1.0

• medium 5.3 Hash Elements

  Missing authorization check

  CVE-2024-10802 · affected 1.4.7 and older · fixed in 1.4.8 *

• critical 9.8 Advanced Order Export For WooCommerce

  PHP object injection

  CVE-2024-10828 · affected 3.5.5 and older · fixed in 3.5.6 *

• high 7.3 Project Manager

  Missing authorization check

  CVE-2024-10174 · affected 2.6.13 and older · fixed in 2.6.14 *

• medium 4.3 Kognetiks Chatbot

  Cross-site request forgery (CSRF)

  CVE-2024-11143 · affected 2.1.8 and older · fixed in 2.1.9 *

• medium 6.1 Kognetiks Chatbot

  Reflected cross-site scripting (XSS)

  CVE-2024-10684 · affected 2.1.7 and older · fixed in 2.1.8 *

• medium 4.3 Kognetiks Chatbot

  Missing authorization check

  CVE-2024-10531 · affected 2.1.7 and older · fixed in 2.1.8 *

• medium 6.1 Product Delivery Date for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2024-10882 · affected 2.8.0 and older · fixed in 2.8.1 *

• medium 4.3 WPForms

  Cross-site request forgery (CSRF)

  CVE-2024-10593 · affected 1.9.1.6 and older · fixed in 1.9.2.1 *

• medium 4.3 Kognetiks Chatbot

  Missing authorization check

  CVE-2024-10530 · affected 2.1.7 and older · fixed in 2.1.8 *

• medium 5.3 Kognetiks Chatbot

  Missing authorization check

  CVE-2024-10529 · affected 2.1.7 and older · fixed in 2.1.8 *

• medium 6.1 Razorpay Payment Button Plugin

  Reflected cross-site scripting (XSS)

  CVE-2024-10851 · affected 2.4.6 and older · fixed in 2.4.7 *

• medium 6.1 Razorpay Payment Button Elementor Plugin

  Reflected cross-site scripting (XSS)

  CVE-2024-10850 · affected 1.2.5 and older · fix not stated

Tuesday, November 12, 2024 · 7

• medium 5.4 JetWidgets For Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-10323 · affected 1.0.18 and older · fixed in 1.0.19 *

• medium 5.9 RSS Feed Widget

  Stored cross-site scripting (XSS)

  CVE-2024-9836 · affected older than 3.0.0 · fixed in 3.0.0

• medium 4.8 RSS Feed Widget

  Reflected cross-site scripting (XSS)

  CVE-2024-9835 · affected older than 3.0.1 · fixed in 3.0.1

• medium 5.4 Admin and Site Enhancements (ASE)

  Stored cross-site scripting (XSS)

  CVE-2024-10790 · affected 7.5.1 and older · fixed in 7.5.2 *

• medium 6.1 Business Essentials for Contact Form 7

  Reflected cross-site scripting (XSS)

  CVE-2024-10685 · affected 1.0.6 and older · fixed in 1.0.7 *

• low 2.7 MPG

  Arbitrary file deletion

  CVE-2024-10672 · affected 4.0.2 and older · fixed in 4.0.3 *

• medium 5.4 HappyAddons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-10538 · affected 3.12.5 and older · fixed in 3.12.6 *

Monday, November 11, 2024 · 3

• medium 5.4 OSM

  Cross-site scripting (XSS)

  CVE-2024-52355 · affected 6.1.2 and older · fixed in 6.1.3

• medium 5.4 Responsive Addons for Elementor

  Cross-site scripting (XSS)

  CVE-2024-52358 · affected 1.5.4 and older · fixed in 1.6.0

• critical 9.8 RepairBuddy

  Arbitrary file upload

  CVE-2024-51793 · affected 3.8115 and older · fixed in 3.8116

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan