WordPress plugin vulnerabilities: week 47, 2024

83 vulnerabilities published Nov 18 – Nov 24, 2024 in 75 plugins we track, by day.

4 critical 17 high 61 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, November 23, 2024 · 13

• medium 6.4 워드프레스 결제 심플페이

  Stored cross-site scripting (XSS)

  CVE-2024-11228 · affected 5.1.4 and older · fix not stated

• medium 5.4 Rescue Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2024-11199 · affected 2.9 and older · fixed in 3.0 *

• medium 6.1 Wishlist for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2024-10519 · affected 3.0.8 up to (not including) 3.1.3 · fixed in 3.1.3

• critical 9.8 FluentSMTP

  PHP object injection

  CVE-2024-9511 · affected 2.2.82 and older · fixed in 2.2.83 *

• medium 6.1 Formidable Forms

  Reflected cross-site scripting (XSS)

  CVE-2024-11188 · affected 6.16.1.2 and older · fixed in 6.16.2 *

• high 8.8 LA-Studio Element Kit for Elementor

  File inclusion

  CVE-2024-10873 · affected 1.4.2 and older · fixed in 1.6.0 *

• medium 4.3 WP Travel Engine

  Missing authorization check

  CVE-2024-10606 · affected 6.2.1 and older · fixed in 6.2.2 *

• medium 6.1 PeachPay

  Reflected cross-site scripting (XSS)

  CVE-2024-11362 · affected 1.112.0 and older · fixed in 1.114.0 *

• medium 6.4 Quotes llama

  Stored cross-site scripting (XSS)

  CVE-2024-10874 · affected 3.0.0 and older · fixed in 3.0.1 *

• medium 4.3 Enter Addons

  Information disclosure

  CVE-2024-10868 · affected 2.1.9 and older · fixed in 2.2.2 *

• high 7.5 Product Table for WooCommerce

  Information disclosure

  CVE-2024-10813 · affected 3.5.1 and older · fixed in 3.5.2 *

• medium 4.3 WP User Manager

  Missing authorization check

  CVE-2024-10537 · affected 2.9.11 and older · fixed in 2.9.12 *

• medium 4.3 WP User Manager

  Missing authorization check

  CVE-2024-10216 · affected 2.9.11 and older · fixed in 2.9.12 *

Friday, November 22, 2024 · 6

• medium 6.6 GEO my WP

  Security issue

  CVE-2024-9422 · affected 4.0 up to (not including) 4.5 · fixed in 4.5

• medium 6.1 MailMunch

  Reflected cross-site scripting (XSS)

  CVE-2024-8735 · affected 3.1.8 and older · fixed in 3.1.9 *

• high 8.1 Sky Addons for Elementor

  Cross-site request forgery (CSRF)

  CVE-2024-11601 · affected 2.6.1 and older · fixed in 2.6.2 *

• high 8.1 Sky Addons for Elementor

  Missing authorization check

  CVE-2024-11104 · affected 2.6.2 and older · fixed in 2.6.4 *

• medium 6.1 Premium Packages

  Reflected cross-site scripting (XSS)

  CVE-2024-11225 · affected 5.9.3 and older · fixed in 5.9.4 *

• medium 5.5 SimpLy Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-10034 · affected 3.2.4.2 and older · fixed in 3.2.4.3 *

Thursday, November 21, 2024 · 23

• high 7.5 Simple Membership

  Information disclosure

  CVE-2024-11088 · affected 4.5.5 and older · fixed in 4.5.6 *

• medium 4.1 Taskbuilder

  SQL injection

  CVE-2024-9828 · affected older than 3.0.5 · fixed in 3.0.5

• medium 4.8 Formidable Forms

  Stored cross-site scripting (XSS)

  CVE-2024-9768 · affected older than 6.14.1 · fixed in 6.14.1

• medium 4.3 Sky Addons for Elementor

  Information disclosure

  CVE-2024-9542 · affected 2.6.1 and older · fixed in 2.6.2 *

• medium 6.1 Branda

  Reflected cross-site scripting (XSS)

  CVE-2024-9371 · affected 3.4.21 and older · fixed in 3.4.22 *

• medium 6.1 Run Contests, Raffles, and Giveaways with Cont…

  Reflected cross-site scripting (XSS)

  CVE-2024-11456 · affected 2.0.3 and older · fixed in 2.0.5 *

• medium 6.1 Community by PeepSo

  Reflected cross-site scripting (XSS)

  CVE-2024-11447 · affected 7.0.3.0 and older · fix not stated

• medium 6.1 salavat counter Plugin

  Reflected cross-site scripting (XSS)

  CVE-2024-11435 · affected 0.9.4 and older · fix not stated

• medium 6.1 Theater for WordPress

  Reflected cross-site scripting (XSS)

  CVE-2024-11371 · affected 0.18.6.2 and older · fix not stated

• medium 6.1 WPAdverts

  Reflected cross-site scripting (XSS)

  CVE-2024-10890 · affected 2.1.7 and older · fixed in 2.1.8 *

• high 7.2 Activity Log

  Stored cross-site scripting (XSS)

  CVE-2024-10788 · affected 2.11.1 and older · fixed in 2.11.2 *

• medium 4.3 If-So Dynamic Content

  Information disclosure

  CVE-2024-10796 · affected 1.9.2.1 and older · fixed in 1.9.2.2 *

• medium 5.4 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-10785 · affected 3.3.3 and older · fixed in 3.3.4 *

• medium 6.1 WPFunnels

  Reflected cross-site scripting (XSS)

  CVE-2024-10792 · affected 3.5.5 and older · fixed in 3.5.6 *

• medium 6.1 Friendly Functions for Welcart

  Cross-site request forgery (CSRF)

  CVE-2024-10726 · affected 1.2.4 and older · fixed in 1.2.5 *

• medium 6.1 affiliate-toolkit

  Reflected cross-site scripting (XSS)

  CVE-2024-10675 · affected 3.6.7 and older · fixed in 3.6.8 *

• medium 6.5 Button Block

  Information disclosure

  CVE-2024-10671 · affected 1.1.4 and older · fixed in 1.1.5 *

• medium 4.3 Ultimate Member

  Missing authorization check

  CVE-2024-10528 · affected 2.8.9 and older · fixed in 2.9.0 *

• medium 6.1 Co-marquage service-public.fr

  Reflected cross-site scripting (XSS)

  CVE-2024-10522 · affected 0.5.76 and older · fixed in 0.5.77 *

• high 7.5 Tutor LMS

  SQL injection

  CVE-2024-10400 · affected 2.7.6 and older · fixed in 2.7.7 *

• medium 5.3 Tutor LMS

  Missing authorization check

  CVE-2024-10393 · affected 2.7.6 and older · fixed in 2.7.7 *

• medium 5.4 Innovs WPBakery Visual Composer WHMCS Elements

  Stored cross-site scripting (XSS)

  CVE-2024-10172 · affected 1.0.4 and older · fix not stated

• medium 6.4 Premium Packages

  Stored cross-site scripting (XSS)

  CVE-2024-10164 · affected 5.9.3 and older · fixed in 5.9.4 *

Wednesday, November 20, 2024 · 14

• medium 4.3 PublishPress Revisions

  Information disclosure

  CVE-2024-11154 · affected 3.5.15 and older · fixed in 3.5.16 *

• medium 5.3 Project Manager

  Missing authorization check

  CVE-2024-10520 · affected 2.6.14 and older · fixed in 2.6.15 *

• medium 5.4 Getwid

  Stored cross-site scripting (XSS)

  CVE-2024-10872 · affected 2.0.12 and older · fixed in 2.0.13 *

• medium 6.5 MStore API

  SQL injection

  CVE-2024-11179 · affected 4.15.7 and older · fixed in 4.15.8 *

• medium 6.4 Save as PDF Plugin by PDFCrowd

  Stored cross-site scripting (XSS)

  CVE-2024-10891 · affected 4.2.1 and older · fixed in 4.5.8 *

• medium 5.4 Yaad Sarig Payment Gateway For WC

  Missing authorization check

  CVE-2024-10665 · affected 2.2.4 and older · fixed in 2.2.5 *

• medium 6.1 Booster for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2024-9239 · affected 7.2.3 and older · fixed in 7.2.4 *

• medium 6.1 404 Solution

  Reflected cross-site scripting (XSS)

  CVE-2024-11277 · affected 2.35.19 and older · fixed in 2.36.10 *

• medium 6.1 Mailmunch Forms for Mailchimp

  Reflected cross-site scripting (XSS)

  CVE-2024-8726 · affected 3.2.3 and older · fixed in 3.2.4 *

• high 8.1 ProfileGrid

  Missing authorization check

  CVE-2024-10900 · affected 5.9.3.6 and older · fixed in 5.9.3.7 *

• high 7.3 Product Table & List Builder for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2024-10899 · affected 3.8.6 and older · fixed in 3.8.7 *

• high 8.1 Image Optimizer, Resizer and CDN

  Denial of service

  CVE-2024-10855 · affected 7.3.0 and older · fixed in 7.3.3 *

• medium 4.3 The Plus Addons for Elementor

  Information disclosure

  CVE-2024-10365 · affected 6.0.3 and older · fixed in 6.0.4 *

• medium 6.1 Restaurant Menu

  Reflected cross-site scripting (XSS)

  CVE-2024-9653 · affected 2.4.2 and older · fixed in 2.4.3 *

Tuesday, November 19, 2024 · 18

• medium 4.8 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2024-50430 · affected 2.8.3.7 and older · fixed in 2.8.3.9

• high 8.8 ARMember

  Cross-site request forgery (CSRF)

  CVE-2022-47424 · affected 4.0.5 and older · fixed in 4.0.6

• medium 4.3 Disable Admin Notices

  Cross-site request forgery (CSRF)

  CVE-2024-52420 · affected 1.4.0 and older · fixed in 1.4.1

• medium 6.5 Flipbox Addon for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-51870 · affected 1.0.4 and older · fixed in 1.0.5

• medium 6.5 Bread & Butter

  Cross-site scripting (XSS)

  CVE-2024-51802 · affected 7.4.857 and older · fixed in 7.5.880

• low 2.7 Otter Blocks

  Missing authorization check

  CVE-2024-51671 · affected 3.0.3 and older · fixed in 3.0.4

• high 7.1 e-shopsカート2

  Cross-site request forgery (CSRF)

  CVE-2024-51648 · affected 1.0.3 and older · fixed in 1.0.4

• high 8.8 Bold Page Builder

  Missing authorization check

  CVE-2024-50417 · affected 5.1.3 and older · fixed in 5.1.4

• medium 4.8 Ninja Forms

  Stored cross-site scripting (XSS)

  CVE-2024-50515 · affected 3.8.16 and older · fixed in 3.8.18

• medium 4.8 Ninja Forms

  Stored cross-site scripting (XSS)

  CVE-2024-50514 · affected 3.8.16 and older · fixed in 3.8.18

• medium 5.9 Post Grid Blocks & Templates for News, Magazin…

  Stored cross-site scripting (XSS)

  CVE-2024-50513 · affected 4.1.15 and older · fixed in 4.1.16

• medium 4.3 Sunshine Photo Cart

  Missing authorization check

  CVE-2024-49697 · affected 3.2.9 and older · fixed in 3.2.10

• medium 4.3 WPVR

  Missing authorization check

  CVE-2024-49680 · affected 8.5.5 and older · fixed in 8.5.6

• medium 6.4 GD Rating System

  Stored cross-site scripting (XSS)

  CVE-2024-11198 · affected 3.6.1 and older · fixed in 3.6.2 *

• high 8.8 Classified Listing

  Privilege escalation

  CVE-2024-11194 · affected 3.1.15.1 and older · fixed in 3.1.16 *

• critical 9.8 GamiPress

  Remote code execution

  CVE-2024-11036 · affected 7.1.5 and older · fixed in 7.9.9 *

• medium 5.4 MP3 Audio Player

  Stored cross-site scripting (XSS)

  CVE-2024-10268 · affected 5.8 and older · fixed in 5.9 *

• medium 6.1 MailPoet

  Stored cross-site scripting (XSS)

  CVE-2024-10103 · affected older than 5.3.2 · fixed in 5.3.2

Monday, November 18, 2024 · 9

• medium 4.9 CYAN Backup

  Path traversal / file read

  CVE-2024-52390 · affected 2.5.3 and older · fixed in 2.5.4

• medium 5.4 WP Job Portal

  Stored cross-site scripting (XSS)

  CVE-2024-52389 · affected 2.2.0 and older · fixed in 2.2.1

• medium 5.3 Google for WooCommerce

  Information disclosure

  CVE-2024-10486 · affected 2.8.6 and older · fixed in 2.8.7 *

• medium 5.4 Themify Builder

  Stored cross-site scripting (XSS)

  CVE-2024-52423 · affected 7.6.5 and older · fixed in 7.6.6

• critical 9.8 My Geo Posts Free

  PHP object injection

  CVE-2024-52433 · affected 1.2 and older · fix not stated

• critical 9.1 Customer Engagement System

  PHP object injection

  CVE-2024-52434 · affected 1.10.29 and older · fixed in 1.10.30

• high 7.2 Post SMTP

  SQL injection

  CVE-2024-52436 · affected 2.9.9 and older · fixed in 2.9.10

• high 7.2 Premium Packages

  SQL injection

  CVE-2024-52435 · affected 6.0.5 and older · fixed in 6.0.6 *

• high 8.8 Event Tickets with Ticket Scanner

  PHP object injection

  CVE-2024-52427 · affected 2.3.11 and older · fixed in 2.3.12

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan