WordPress plugin vulnerabilities: week 50, 2024

226 vulnerabilities published Dec 9 – Dec 15, 2024 in 198 plugins we track, by day.

18 critical 42 high 162 medium 4 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, December 14, 2024 · 10

• high 8.1 ACF Frontend Admin by DynamiApps

  Privilege escalation

  CVE-2024-11721 · affected 3.24.5 and older · fixed in 3.25.1 *

• medium 6.1 ACF Frontend Admin by DynamiApps

  Stored cross-site scripting (XSS)

  CVE-2024-11720 · affected 3.24.5 and older · fixed in 3.25.1 *

• critical 9.8 WP Job Portal

  Missing authorization check

  CVE-2024-11715 · affected 2.2.2 and older · fixed in 2.2.3 *

• medium 4.9 WP Job Portal

  SQL injection

  CVE-2024-11714 · affected 2.2.2 and older · fixed in 2.2.3 *

• medium 4.9 WP Job Portal

  SQL injection

  CVE-2024-11713 · affected 2.2.2 and older · fixed in 2.2.3 *

• medium 5.3 WP Job Portal

  Missing authorization check

  CVE-2024-11712 · affected 2.2.2 and older · fixed in 2.2.3 *

• high 7.5 WP Job Portal

  SQL injection

  CVE-2024-11711 · affected 2.2.1 and older · fixed in 2.2.2 *

• medium 4.9 WP Job Portal

  SQL injection

  CVE-2024-11710 · affected 2.2.2 and older · fixed in 2.2.3 *

• medium 6.1 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2024-10646 · affected 5.2.6 and older · fixed in 5.2.7 *

• medium 5.3 Tickera

  Information disclosure

  CVE-2024-12578 · affected 3.5.4.8 and older · fixed in 3.5.4.9 *

Friday, December 13, 2024 · 104

• high 7.1 FloristPress for Woo

  Reflected cross-site scripting (XSS)

  CVE-2024-54347 · affected 7.2.0 and older · fixed in 7.3.0

• high 8.8 Projectopia

  Authentication bypass

  CVE-2024-54336 · affected 5.1.7 and older · fixed in 5.1.8

• medium 6.5 GEO my WP

  Missing authorization check

  CVE-2024-54326 · affected 4.5.0.4 and older · fixed in 4.5.1

• high 7.1 Link Invoice Payment for WooCommerce

  Reflected cross-site scripting (XSS)

  CVE-2024-54328 · affected 1.7.2 and older · fixed in 2.0.0

• medium 5.4 New User Approve

  Missing authorization check

  CVE-2024-54323 · affected 2.6.2 and older · fixed in 2.6.4

• high 7.1 افزونه پیامک ووکامرس

  Reflected cross-site scripting (XSS)

  CVE-2024-54312 · affected 7.0.5 and older · fixed in 7.0.6

• medium 6.1 FormFacade

  Reflected cross-site scripting (XSS)

  CVE-2024-54301 · affected 1.3.6 and older · fixed in 1.3.7

• high 7.1 Simple Payment

  Reflected cross-site scripting (XSS)

  CVE-2024-54303 · affected 2.3.8 and older · fixed in 2.3.9

• high 7.1 VPSUForm

  Reflected cross-site scripting (XSS)

  CVE-2024-54302 · affected 3.0.0 and older · fixed in 3.0.1

• critical 9.8 affects latest 1.4.3 CoSchool LMS

  Authentication bypass

  CVE-2024-54296 · affected 1.4.3 and older · no fix listed yet

• medium 6.5 Awesome Support

  Missing authorization check

  CVE-2024-54289 · affected 6.3.1 and older · fixed in 6.3.2

• high 7.2 affects latest 1.4.2 WP Mega Menu

  PHP object injection

  CVE-2024-54282 · affected 1.4.2 and older · no fix listed yet

• medium 6.5 Radius Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-54272 · affected 2.1.2 and older · fixed in 2.2.0

• high 8.8 SiteOrigin Widgets Bundle

  Missing authorization check

  CVE-2024-54268 · affected 1.64.0 and older · fixed in 1.64.1

• medium 5.4 WPCargo Track & Trace

  Missing authorization check

  CVE-2024-54271 · affected 8.0.2 and older · fixed in 8.0.3 *

• high 7.1 Barcode Scanner (+Mobile App)

  Reflected cross-site scripting (XSS)

  CVE-2024-54265 · affected 1.6.6 and older · fixed in 1.6.7

• critical 9.9 Import Export For WooCommerce

  Arbitrary file upload

  CVE-2024-54262 · affected 1.6.2 and older · fix not stated

• medium 6.3 Pinpoint Booking System

  Missing authorization check

  CVE-2024-54252 · affected 2.9.9.5.7 and older · fixed in 2.9.9.5.8

• medium 6.5 Prodigy Commerce

  Cross-site scripting (XSS)

  CVE-2024-54250 · affected 3.0.8 and older · fixed in 3.0.9

• critical 9.8 Eyewear prescription form

  Privilege escalation

  CVE-2024-54239 · affected 4.0.18 and older · fixed in 4.0.19

• high 7.1 Ni WooCommerce Order Export

  Reflected cross-site scripting (XSS)

  CVE-2024-54231 · affected 3.1.6 and older · fix not stated

• medium 5.3 Brands for WooCommerce

  Missing authorization check

  CVE-2023-44149 · affected 3.8.2.2 and older · fixed in 3.8.2.3

• medium 4.3 rtMedia for WordPress, BuddyPress and bbPress

  Missing authorization check

  CVE-2023-41951 · affected 4.6.14 and older · fixed in 4.6.15

• medium 5.3 Fluent Forms

  Missing authorization check

  CVE-2023-41952 · affected 5.0.8 and older · fixed in 5.0.9

• medium 4.3 SAML Single Sign On

  Missing authorization check

  CVE-2023-41873 · affected 5.0.4 and older · fixed in 5.0.5

• medium 4.3 Slider Pro

  Missing authorization check

  CVE-2023-41865 · affected 4.8.6 and older · fixed in 4.8.7

• medium 4.3 WP Accessibility Helper (WAH)

  Missing authorization check

  CVE-2023-41869 · affected 0.6.2.4 and older · fixed in 0.6.2.5

• high 8.8 WP Crowdfunding

  Missing authorization check

  CVE-2023-41870 · affected 2.1.5 and older · fixed in 2.1.6

• critical 9.8 WP Directory Kit

  Missing authorization check

  CVE-2023-41875 · affected 1.2.6 and older · fixed in 1.2.7

• medium 4.3 Social Share, Social Login and Social Comments…

  Missing authorization check

  CVE-2023-41802 · affected 7.13.54 and older · fixed in 7.13.55

• medium 5.4 TelSender

  Missing authorization check

  CVE-2023-41683 · affected 1.14.11 and older · fixed in 1.14.12

• medium 6.5 ilGhera Support System for WooCommerce

  Cross-site request forgery (CSRF)

  CVE-2023-41686 · affected 1.2.2 and older · fixed in 1.2.3

• medium 5.4 Abandoned Cart Lite for WooCommerce

  Missing authorization check

  CVE-2023-41671 · affected 5.16.1 and older · fixed in 5.16.2

• high 8.1 Premmerce User Roles

  Missing authorization check

  CVE-2023-41130 · affected 1.0.12 and older · fixed in 1.0.13

• medium 4.3 ReviewX

  Missing authorization check

  CVE-2023-40670 · affected 1.6.17 and older · fixed in 1.6.18

• medium 5.4 Lasso Lite

  Missing authorization check

  CVE-2023-40678 · affected 117 and older · fixed in 118

• medium 4.3 Accordion Slider

  Missing authorization check

  CVE-2023-40331 · affected 1.9.6 and older · fixed in 1.9.7

• medium 5.4 Cost Calculator Builder

  Missing authorization check

  CVE-2023-40011 · affected 3.1.42 and older · fixed in 3.1.43

• critical 9.8 Easy Digital Downloads

  Missing authorization check

  CVE-2023-40005 · affected 3.1.5 and older · fixed in 3.2.0

• high 8.8 Mailmunch Forms for Mailchimp

  Missing authorization check

  CVE-2023-40203 · affected 3.1.4 and older · fixed in 3.1.5

• critical 9.8 Project Manager

  Missing authorization check

  CVE-2023-40003 · affected 2.6.7 and older · fixed in 2.6.8

• high 8.8 HUSKY

  Missing authorization check

  CVE-2023-40334 · affected 1.3.4.2 and older · fixed in 1.3.4.3

• medium 5.3 Accordion and Accordion Slider

  Missing authorization check

  CVE-2023-39996 · affected 1.2.4 and older · fixed in 1.2.5

• medium 4.3 Kadence Central

  Missing authorization check

  CVE-2023-40001 · affected 2.1.13 and older · fixed in 2.1.14

• critical 9.8 Customer Engagement System

  Missing authorization check

  CVE-2023-39997 · affected 1.10.19 and older · fixed in 1.10.20

• medium 4.3 Portfolio and Projects

  Missing authorization check

  CVE-2023-39995 · affected 1.3.7 and older · fixed in 1.3.8

• medium 4.3 Social Share Icons & Social Share Buttons

  Missing authorization check

  CVE-2023-38514 · affected 3.5.7 and older · fixed in 3.5.8

• high 7.5 Redirection for Contact Form 7

  Missing authorization check

  CVE-2023-39920 · affected 2.9.2 and older · fixed in 3.0.0

• high 8.8 Jupiter X Core

  Missing authorization check

  CVE-2023-38385 · affected 3.0.0 to 3.3.0 · fixed in 3.3.5

• critical 9.8 DirectoryPress

  Missing authorization check

  CVE-2023-37967 · affected 3.6.2 and older · fixed in 3.6.3

• medium 4.3 Quiz and Survey Master (QSM)

  Missing authorization check

  CVE-2023-37984 · affected 8.1.10 and older · fixed in 8.1.11

• medium 6.5 Notifima

  Missing authorization check

  CVE-2023-37971 · affected 2.0.1 and older · fixed in 2.0.2

• medium 6.5 School Management System

  Missing authorization check

  CVE-2023-37887 · affected 2.2.7 and older · fixed in 2.2.8

• medium 5.3 kk Star Ratings

  Missing authorization check

  CVE-2023-36528 · affected 5.4.3 and older · fixed in 5.4.4

• medium 4.3 Directorist

  Missing authorization check

  CVE-2023-35052 · affected 7.5.4 and older · fixed in 7.5.5

• medium 5.3 Gutenverse

  Missing authorization check

  CVE-2023-35875 · affected 1.8.5 and older · fixed in 1.8.6

• medium 5.3 The Events Calendar

  Missing authorization check

  CVE-2023-35777 · affected 6.1.2.2 and older · fixed in 6.1.3

• high 7.6 Surfer

  Missing authorization check

  CVE-2023-35037 · affected 1.3.2.357 and older · fixed in 1.3.3.379

• medium 5.3 Zippy

  Missing authorization check

  CVE-2023-34381 · affected 1.6.2 and older · fixed in 1.6.3

• high 8.8 Anti-Spam, Spam FireWall by CleanTalk

  Missing authorization check

  CVE-2023-33996 · affected 6.10 and older · fixed in 6.11

• medium 4.3 Photo Gallery by 10Web

  Missing authorization check

  CVE-2023-33995 · affected 1.8.15 and older · fixed in 1.8.16

• medium 4.3 Social Media Share Buttons & Social Sharing Ic…

  Missing authorization check

  CVE-2023-34009 · affected 2.8.1 and older · fixed in 2.8.2

• medium 6.5 Uncanny Toolkit for LearnDash

  Missing authorization check

  CVE-2023-34019 · affected 3.6.4.3 and older · fixed in 3.6.4.4

• medium 5.4 Booking Ultra Pro Appointments Booking Calenda…

  Missing authorization check

  CVE-2023-32601 · affected 1.1.12 and older · fixed in 1.1.13 *

• medium 4.3 WebToffee WP Backup and Migration

  Missing authorization check

  CVE-2023-33928 · affected 1.4.0 and older · fixed in 1.4.1

• medium 6.5 SlimStat Analytics

  Missing authorization check

  CVE-2023-33994 · affected 5.0.5.1 and older · fixed in 5.0.6

• high 7.5 Portfolio Gallery

  Missing authorization check

  CVE-2023-32585 · affected 1.4.6 and older · fixed in 1.4.7

• medium 5.4 GS Pinterest Portfolio

  Missing authorization check

  CVE-2023-32593 · affected 1.6.7 and older · fixed in 1.6.8

• medium 4.3 Injection Guard

  Missing authorization check

  CVE-2023-32574 · affected 1.2.1 and older · fixed in 1.2.2

• medium 5.4 WP-Chatbot for Messenger

  Missing authorization check

  CVE-2023-32581 · affected 4.7 and older · fixed in 4.8

• medium 6.5 Link Whisper Free

  Missing authorization check

  CVE-2023-32506 · affected 0.6.3 and older · fixed in 0.6.4

• medium 4.3 Depicter

  Missing authorization check

  CVE-2022-47176 · affected 1.9.0 and older · fixed in 1.9.1

• medium 6.5 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2022-47594 · affected 3.8.5 and older · fixed in 3.8.6

• critical 9.8 Survey Maker by AYS

  Missing authorization check

  CVE-2023-22697 · affected 3.2.0 and older · fixed in 3.2.1

• medium 5.3 WC Shop Sync

  Missing authorization check

  CVE-2022-47182 · affected 4.4.1 and older · fixed in 4.4.2

• medium 5.4 JS Help Desk

  Missing authorization check

  CVE-2022-46840 · affected 2.7.1 and older · fixed in 2.7.2

• critical 9.1 JS Help Desk

  Missing authorization check

  CVE-2022-46838 · affected 2.7.1 and older · fixed in 2.7.2

• medium 4.3 Printful Integration for WooCommerce

  Missing authorization check

  CVE-2022-47168 · affected 2.2.3 and older · fixed in 2.2.4

• medium 4.3 ALD

  Missing authorization check

  CVE-2022-46811 · affected 1.0.21 and older · fixed in 1.0.22

• low 3.5 Popup Maker

  Missing authorization check

  CVE-2022-45819 · affected 1.17.1 and older · fixed in 1.18.0

• medium 5.4 Robo Gallery

  Missing authorization check

  CVE-2022-45841 · affected 3.2.9 and older · fixed in 3.2.11

• medium 5.4 Sunshine Photo Cart

  Missing authorization check

  CVE-2022-45826 · affected 2.9.13 and older · fixed in 2.9.14

• medium 6.5 CURCY

  Missing authorization check

  CVE-2022-46796 · affected 2.1.25 and older · fixed in 2.1.26

• medium 6.5 Print Invoice & Delivery Notes for WooCommerce

  Missing authorization check

  CVE-2022-46795 · affected 4.7.2 and older · fixed in 4.7.3

• medium 6.5 Auto Affiliate Links

  Missing authorization check

  CVE-2022-45840 · affected 6.2.1.5 and older · fixed in 6.2.1.6

• critical 9.8 Formidable Forms

  Missing authorization check

  CVE-2022-45806 · affected 5.5.4 and older · fixed in 5.5.5

• medium 4.3 eRoom

  Missing authorization check

  CVE-2022-43472 · affected 1.4.6 and older · fixed in 1.4.7

• medium 6.1 MyParcel

  Reflected cross-site scripting (XSS)

  CVE-2024-9608 · affected 4.24.1 and older · fixed in 4.24.2 *

• high 8.1 MainWP Child

  Privilege escalation

  CVE-2024-10783 · affected 5.3.3 and older · fixed in 5.3.4 *

• medium 6.5 Simple Link Directory

  Remote code execution

  CVE-2024-12417 · affected 8.4.5 and older · fixed in 8.4.6 *

• medium 6.5 Coupon Affiliates

  Reflected cross-site scripting (XSS)

  CVE-2024-12421 · affected 5.16.7.1 and older · fixed in 5.17.0 *

• medium 6.5 WPMobile.App

  Remote code execution

  CVE-2024-12420 · affected 11.52 and older · fix not stated

• medium 5.4 MStore API

  Stored cross-site scripting (XSS)

  CVE-2024-12042 · affected 4.16.4 and older · fixed in 4.16.5 *

• medium 4.3 WP Crowdfunding

  Missing authorization check

  CVE-2024-11911 · affected 2.1.12 and older · fixed in 2.1.13 *

• medium 5.4 Beaver Builder Page Builder

  Stored cross-site scripting (XSS)

  CVE-2024-11832 · affected 2.8.4.4 and older · fixed in 2.8.5.3 *

• medium 5.4 WP Crowdfunding

  Stored cross-site scripting (XSS)

  CVE-2024-11910 · affected 2.1.15 and older · fixed in 2.1.16 *

• medium 6.4 Booking System Trafft

  Stored cross-site scripting (XSS)

  CVE-2024-11754 · affected 1.0.6 and older · fix not stated

• medium 4.3 Timetics

  Missing authorization check

  CVE-2024-11275 · affected 1.0.27 and older · fixed in 1.0.28 *

• medium 4.8 Kadence Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-12581 · affected 3.2.53 and older · fixed in 3.2.54 *

• medium 4.8 Image Widget

  Stored cross-site scripting (XSS)

  CVE-2024-10939 · affected older than 4.4.11 · fixed in 4.4.11

• medium 5.3 Minify HTML

  Denial of service

  CVE-2024-12579 · affected 2.1.10 and older · fixed in 2.1.11 *

• medium 6.1 Primer MyData for Woocommerce

  Reflected cross-site scripting (XSS)

  CVE-2024-11809 · affected 4.2.1 and older · fixed in 4.2.2 *

• medium 6.4 NewsmanApp

  Stored cross-site scripting (XSS)

  CVE-2024-11767 · affected 2.7.6 and older · fixed in 3.6.0 *

• low 3.7 AR for WordPress

  Missing authorization check

  CVE-2024-12300 · affected 7.3 and older · fixed in 7.4 *

Thursday, December 12, 2024 · 21

• medium 4.3 Essential Real Estate

  Missing authorization check

  CVE-2024-12329 · affected 5.1.6 and older · fixed in 5.1.7 *

• medium 4.3 Hash Form

  Missing authorization check

  CVE-2024-12201 · affected 1.2.1 and older · fixed in 1.2.2 *

• medium 4.4 NotificationX

  Stored cross-site scripting (XSS)

  CVE-2024-11727 · affected 2.9.3 and older · fixed in 2.9.4 *

• medium 4.3 WPLP Cookie Consent

  Missing authorization check

  CVE-2024-11724 · affected 3.6.5 and older · fixed in 3.6.6 *

• medium 4.3 Greenshift

  Information disclosure

  CVE-2024-11181 · affected 9.9.9.3 and older · fixed in 9.9.9.4 *

• medium 5.4 Unlimited Elements for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-10784 · affected 1.5.126 and older · fixed in 1.5.132 *

• medium 5.4 Popup Maker

  Stored cross-site scripting (XSS)

  CVE-2024-10583 · affected 1.20.2 and older · fixed in 1.20.3 *

• medium 4.8 LearnPress

  Stored cross-site scripting (XSS)

  CVE-2024-9881 · affected older than 4.2.7.2 · fixed in 4.2.7.2

• medium 4.8 Popup Builder

  Stored cross-site scripting (XSS)

  CVE-2024-9428 · affected older than 4.3.5 · fixed in 4.3.5

• medium 5.3 Accept Stripe Payments Using Contact Form 7

  Information disclosure

  CVE-2024-12255 · affected 2.5 and older · fixed in 2.6 *

• medium 4.3 ElementInvader Addons for Elementor

  Information disclosure

  CVE-2024-12059 · affected 1.3.1 and older · fixed in 1.3.2 *

• high 7.5 WP Courses LMS

  Missing authorization check

  CVE-2024-12172 · affected 3.2.21 and older · fixed in 3.2.22 *

• medium 4.3 Snippet Shortcodes

  Missing authorization check

  CVE-2024-12018 · affected 4.1.6 and older · fixed in 4.1.7 *

• high 7.2 AI Engine

  SQL injection

  CVE-2024-10499 · affected older than 2.6.5 · fixed in 2.6.5

• medium 4.7 Ajax Search Lite

  Stored cross-site scripting (XSS)

  CVE-2024-10568 · affected older than 4.12.4 · fixed in 4.12.4

• medium 6.1 Ninja Forms

  Stored cross-site scripting (XSS)

  CVE-2024-11052 · affected 3.8.19 and older · fixed in 3.8.25 *

• medium 4.8 LearnPress

  Stored cross-site scripting (XSS)

  CVE-2024-10010 · affected older than 4.2.7.2 · fixed in 4.2.7.2

• medium 6.5 Library Management System

  SQL injection

  CVE-2024-12406 · affected 3.2.0 and older · fixed in 3.2.1 *

• medium 6.5 SQL Chart Builder

  SQL injection

  CVE-2024-11430 · affected 2.3.6 and older · fixed in 2.3.7 *

• high 8.1 OAuth Single Sign On

  Authentication bypass

  CVE-2024-10111 · affected 6.26.3 and older · fixed in 6.26.4 *

• medium 6.1 Schema App Structured Data

  Reflected cross-site scripting (XSS)

  CVE-2024-11279 · affected 2.2.4 and older · fix not stated

Wednesday, December 11, 2024 · 1

• medium 5.3 Members

  Information disclosure

  CVE-2024-11008 · affected 3.2.10 and older · fixed in 3.2.11 *

Tuesday, December 10, 2024 · 3

• medium 5.3 LearnPress

  Information disclosure

  CVE-2024-11868 · affected 4.2.7.3 and older · fixed in 4.2.7.4 *

• high 7.3 Active Woot Products Tables for WooCommerce. 1…

  Remote code execution

  CVE-2024-10959 · affected 1.0.6.5 and older · fixed in 1.1.1 *

• medium 6.5 WPForms

  Missing authorization check

  CVE-2024-11205 · affected 1.8.4 to 1.9.2.1 · fixed in 1.9.2.2 *

Monday, December 9, 2024 · 87

• medium 4.3 Team Members

  File inclusion

  CVE-2024-52385 · affected 7.4 and older · fixed in 7.5

• medium 5.3 ProfilePress

  Missing authorization check

  CVE-2023-41953 · affected 4.13.1 and older · fixed in 4.13.2

• medium 6.5 News Kit Addons For Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-54260 · affected 1.4.2 and older · fixed in 1.4.3 *

• medium 6.3 Message Filter for Contact Form 7

  Missing authorization check

  CVE-2024-54254 · affected 1.6.3 and older · fixed in 1.6.3.1

• medium 6.5 Prodigy Commerce

  Missing authorization check

  CVE-2024-54251 · affected 3.1.2 and older · fixed in 3.1.3

• medium 5.4 Xpro Addons

  Cross-site scripting (XSS)

  CVE-2024-54253 · affected 1.4.6.5 and older · fixed in 1.4.6.6

• medium 6.1 Contact Form, Survey, Quiz & Popup Form Builder

  Cross-site scripting (XSS)

  CVE-2024-54223 · affected 1.7.1 and older · fixed in 1.7.2

• medium 4.3 Minimum and Maximum Quantity for WooCommerce

  Missing authorization check

  CVE-2024-54227 · affected 2.0.0 and older · fixed in 2.1.0

• medium 5.3 Sprout Invoices

  Missing authorization check

  CVE-2024-53819 · affected 20.8.0 and older · fixed in 20.8.1

• high 8.8 Tutor LMS Elementor Addons

  Missing authorization check

  CVE-2024-53816 · affected 2.1.5 and older · fixed in 2.1.6

• medium 6.5 Post Grid Blocks & Templates for News, Magazin…

  Cross-site scripting (XSS)

  CVE-2024-53818 · affected 4.1.15 and older · fixed in 4.1.16

• medium 5.4 FloristPress for Woo

  Missing authorization check

  CVE-2024-53798 · affected 7.3.0 and older · fixed in 7.4.0

• high 8.8 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2023-51360 · affected 4.2.0 and older · fixed in 4.2.1

• medium 5.3 All-in-one Sticky Floating Contact Form, Call,…

  Missing authorization check

  CVE-2023-51362 · affected 2.1.3 and older · fixed in 2.1.4

• high 8.2 MultiVendorX

  Missing authorization check

  CVE-2023-51355 · affected 4.0.23 and older · fixed in 4.0.24

• high 8.8 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2023-51359 · affected 4.2.0 and older · fixed in 4.2.1

• critical 9.8 MetForm

  Missing authorization check

  CVE-2023-50903 · affected 3.4.0 and older · fixed in 3.4.1

• medium 5.3 Poll Maker by AYS

  Missing authorization check

  CVE-2023-50904 · affected 4.8.0 and older · fixed in 4.8.1

• critical 9.8 Customer Engagement System

  Missing authorization check

  CVE-2023-51353 · affected 1.10.19 and older · fixed in 1.10.20

• medium 5.4 CatalogX Product Catalog, Product Enquiry & Qu…

  Missing authorization check

  CVE-2023-50899 · affected 5.0.2 and older · fixed in 5.0.3

• medium 5.3 Image Alt Text Manager

  Missing authorization check

  CVE-2023-50373 · affected 1.6.1 and older · fixed in 1.6.2

• medium 6.5 LA-Studio Element Kit for Elementor

  Missing authorization check

  CVE-2023-50884 · affected 1.1.5 and older · fixed in 1.1.6

• medium 4.3 Molongui Authorship

  Missing authorization check

  CVE-2023-50876 · affected 4.7.3 and older · fixed in 4.7.4

• medium 5.3 UserFeedback

  Missing authorization check

  CVE-2023-50887 · affected 1.0.10 and older · fixed in 1.0.11

• medium 4.3 Product Filter for WooCommerce by WBW

  Missing authorization check

  CVE-2023-50877 · affected 2.5.0 and older · fixed in 2.5.1

• medium 5.3 ProfilePress

  Missing authorization check

  CVE-2023-50882 · affected 4.13.2 and older · fixed in 4.13.3

• medium 6.5 Awesome Support

  Missing authorization check

  CVE-2023-49857 · affected 6.1.7 and older · fixed in 6.1.8

• medium 4.3 Login With Ajax

  Missing authorization check

  CVE-2023-49859 · affected 4.1 and older · fixed in 4.2

• medium 4.3 Shortcoder

  Missing authorization check

  CVE-2023-49849 · affected 6.3 and older · fixed in 6.3.1

• high 8.8 Smart Forms

  Missing authorization check

  CVE-2023-49856 · affected 2.6.84 and older · fixed in 2.6.85

• medium 5.3 WP Simple HTML Sitemap

  Missing authorization check

  CVE-2023-49850 · affected 2.7 and older · fixed in 2.8

• high 7.5 RegistrationMagic

  Missing authorization check

  CVE-2023-49831 · affected 5.2.3.0 and older · fixed in 5.2.3.1

• medium 4.3 Post Duplicator

  Missing authorization check

  CVE-2023-49835 · affected 2.31 and older · fixed in 2.32

• medium 5.3 Site Reviews

  Missing authorization check

  CVE-2023-49832 · affected 6.10.2 and older · fixed in 6.10.3

• medium 5.4 Awesome Support

  Missing authorization check

  CVE-2023-49757 · affected 6.1.10 and older · fixed in 6.1.11

• medium 4.3 Page Builder

  Missing authorization check

  CVE-2023-49196 · affected 1.7.7 and older · fixed in 1.7.8

• medium 5.3 Hubbub Lite

  Missing authorization check

  CVE-2023-49193 · affected 1.30.0 and older · fixed in 1.30.1

• medium 4.3 WP Booking System

  Missing authorization check

  CVE-2023-49758 · affected 2.0.19.2 and older · fixed in 2.0.19.3

• high 8.8 Eventin

  Missing authorization check

  CVE-2023-49756 · affected 3.3.52 and older · fixed in 3.3.53

• medium 6.5 Database for CF7

  Missing authorization check

  CVE-2023-49167 · affected 1.2.4 and older · fixed in 1.2.5

• medium 5.4 Awesome Support

  Missing authorization check

  CVE-2023-48324 · affected 6.1.4 and older · fixed in 6.1.5

• high 8.2 Accept Stripe Payments

  Missing authorization check

  CVE-2023-48286 · affected 2.0.79 and older · fixed in 2.0.80

• medium 4.3 Super Progressive Web Apps

  Missing authorization check

  CVE-2023-48277 · affected 2.2.21 and older · fixed in 2.2.22

• medium 4.3 Contact Form to Any API

  Missing authorization check

  CVE-2023-47871 · affected 1.1.6 and older · fixed in 1.1.7

• medium 6.5 WCMultiShipping

  Missing authorization check

  CVE-2023-48274 · affected 2.3.5 and older · fixed in 2.3.6

• medium 5.4 wpForo Forum

  Cross-site scripting (XSS)

  CVE-2023-47869 · affected 2.2.5 and older · fixed in 2.2.6

• high 8.8 MP3 Audio Player

  Missing authorization check

  CVE-2023-47822 · affected 4.10 and older · fixed in 4.10.1

• medium 5.4 WP Meta and Date Remover

  Missing authorization check

  CVE-2023-47836 · affected 2.3.0 and older · fixed in 2.3.1

• medium 4.3 BetterDocs

  Missing authorization check

  CVE-2023-47762 · affected 2.5.2 and older · fixed in 2.5.3

• medium 6.5 Ditty

  Missing authorization check

  CVE-2023-47764 · affected 3.1.24 and older · fixed in 3.1.25

• medium 4.3 miniOrange OTP Login, Verification and SMS Not…

  Missing authorization check

  CVE-2023-47776 · affected 4.2.1 and older · fixed in 4.2.2

• critical 9.8 WPCafe

  Missing authorization check

  CVE-2023-47805 · affected 2.2.22 and older · fixed in 2.2.23

• medium 4.3 WP Custom Admin Interface

  Missing authorization check

  CVE-2023-47763 · affected 7.31 and older · fixed in 7.32

• high 8.8 Gutenberg Essential Blocks

  Missing authorization check

  CVE-2023-47760 · affected 4.2.0 and older · fixed in 4.2.1

• high 8.6 Japanized for WooCommerce

  Missing authorization check

  CVE-2023-47698 · affected 2.6.4 and older · fixed in 2.6.5

• medium 6.1 Easy Appointments

  Stored cross-site scripting (XSS)

  CVE-2023-30748 · affected 3.10.7 and older · fixed in 3.11.1

• critical 9.8 File Manager for Google Drive

  Missing authorization check

  CVE-2023-32117 · affected 1.1.99 and older · fixed in 1.2.0

• high 8.8 WP Docs

  Missing authorization check

  CVE-2023-30873 · affected 1.9.8 and older · fixed in 1.9.9

• medium 5.4 WP Quick Post Duplicator

  Missing authorization check

  CVE-2023-31214 · affected 2.0 and older · fixed in 2.1

• medium 5.3 Featured Post Creative

  Missing authorization check

  CVE-2023-30488 · affected 1.2.7 and older · fixed in 1.2.8

• medium 5.3 User Registration & Membership

  Missing authorization check

  CVE-2023-29429 · affected 2.3.2.1 and older · fixed in 2.3.3

• medium 4.3 Site Reviews

  Missing authorization check

  CVE-2023-27625 · affected 6.5.0 and older · fixed in 6.6.0

• medium 5.3 Stock Ticker

  Missing authorization check

  CVE-2023-27626 · affected 3.23.0 and older · fixed in 3.23.1

• medium 6.3 TotalPoll for Polls and Contests

  Missing authorization check

  CVE-2023-27449 · affected 4.8.6 and older · fixed in 4.8.7

• medium 5.4 Apollo13 Framework Extensions

  Missing authorization check

  CVE-2023-25959 · affected 1.8.10 and older · fixed in 1.9.0

• medium 6.5 FileBird

  Missing authorization check

  CVE-2023-25966 · affected 5.1.4 and older · fixed in 5.1.5

• medium 4.3 WebberZone Top 10

  Missing authorization check

  CVE-2023-25993 · affected 3.2.3 and older · fixed in 3.2.4

• medium 5.3 Album and Image Gallery Plus Lightbox

  Missing authorization check

  CVE-2023-25060 · affected 1.6.2 and older · fixed in 1.6.3

• medium 5.4 Easy Table of Contents

  Missing authorization check

  CVE-2023-25469 · affected 2.0.45.2 and older · fixed in 2.0.46

• medium 5.3 Social Login, Social Sharing by miniOrange

  Missing authorization check

  CVE-2023-25455 · affected 7.6.0 and older · fixed in 7.6.1

• medium 4.3 We’re Open!

  Missing authorization check

  CVE-2023-25067 · affected 1.45 and older · fixed in 1.46

• high 7.5 Quick PayPal Payments

  Missing authorization check

  CVE-2023-25714 · affected 5.7.25 and older · fixed in 5.7.26

• high 8.8 Booking calendar, Appointment Booking System

  Missing authorization check

  CVE-2023-24407 · affected 3.2.3 and older · fixed in 3.2.4

• medium 4.3 Booking Calendar Contact Form

  Missing authorization check

  CVE-2023-25037 · affected 1.2.34 and older · fixed in 1.2.35

• medium 5.4 Reviews and Rating

  Missing authorization check

  CVE-2023-23986 · affected 4.14 and older · fixed in 4.15 *

• low 3.5 Social Login, Social Sharing by miniOrange

  Missing authorization check

  CVE-2023-24375 · affected 7.5.14 and older · fixed in 7.6.0

• medium 4.3 PayPal Brasil para WooCommerce

  Missing authorization check

  CVE-2023-25026 · affected 1.4.2 and older · fixed in 1.4.3

• medium 6.5 Quick Contact Form

  Missing authorization check

  CVE-2023-25035 · affected 8.0.3.1 and older · fixed in 8.0.4

• medium 5.3 Quick Event Manager

  Missing authorization check

  CVE-2023-23975 · affected 9.7.4 and older · fixed in 9.7.5

• medium 5.4 Cost of Goods

  Missing authorization check

  CVE-2023-23868 · affected 2.8.6 and older · fixed in 2.8.7

• critical 9.8 Spectra Legacy

  Missing authorization check

  CVE-2023-23834 · affected 2.3.0 and older · fixed in 2.3.1

• high 8.8 Spectra Legacy

  Missing authorization check

  CVE-2023-23825 · affected 2.3.0 and older · fixed in 2.3.1

• high 7.2 WP Time Slots Booking Form

  Missing authorization check

  CVE-2023-23895 · affected 1.1.82 and older · fixed in 1.1.83

• low 3.8 CP Multi View Events Calendar

  Missing authorization check

  CVE-2023-23814 · affected 1.4.13 and older · fixed in 1.4.15

• critical 9.8 Ebook Store

  Missing authorization check

  CVE-2023-22701 · affected 5.775 and older · fixed in 5.78

• medium 5.4 Tickera

  Cross-site request forgery (CSRF)

  CVE-2023-23726 · affected 3.5.1.0 and older · fixed in 3.5.1.1

• medium 6.1 Fluent Forms

  Stored cross-site scripting (XSS)

  CVE-2024-9651 · affected older than 5.2.1 · fixed in 5.2.1

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan