WordPress plugin vulnerabilities: week 51, 2024

51 vulnerabilities published Dec 16 – Dec 22, 2024 in 45 plugins we track, by day.

4 critical 12 high 34 medium 1 low

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, December 22, 2024 · 1

• medium 4.3 Element Pack Addons for Elementor

  Missing authorization check

  CVE-2024-11852 · affected 5.10.12 and older · fixed in 5.10.13 *

Saturday, December 21, 2024 · 12

• medium 4.9 Easy Digital Downloads

  Path traversal / file read

  CVE-2024-12875 · affected 3.3.2 and older · fixed in 3.3.3 *

• medium 6.5 WP BASE Booking of Appointments, Services and…

  Missing authorization check

  CVE-2024-12558 · affected 4.9.2 and older · fixed in 5.0.0 *

• medium 5.9 ACF Frontend Admin by DynamiApps

  SQL injection

  CVE-2024-11722 · affected 3.25.1 and older · fixed in 3.25.2 *

• medium 5.4 Elementor Website Builder

  Stored cross-site scripting (XSS)

  CVE-2024-10453 · affected 3.25.9 and older · fixed in 3.25.10 *

• medium 5.4 Shortcodes and extra features for Phlox theme

  Stored cross-site scripting (XSS)

  CVE-2024-9545 · affected 2.17.0 and older · fixed in 2.17.1 *

• medium 5.4 Shortcodes and extra features for Phlox theme

  Stored cross-site scripting (XSS)

  CVE-2024-12588 · affected 2.17.2 and older · fixed in 2.17.3 *

• medium 6.1 Ebook Store

  Reflected cross-site scripting (XSS)

  CVE-2024-12262 · affected 5.8001 and older · fixed in 6.20 *

• high 8.8 eCommerce Product Catalog

  Cross-site request forgery (CSRF)

  CVE-2024-12771 · affected 3.3.43 and older · fixed in 3.3.44 *

• medium 6.5 WP Docs

  SQL injection

  CVE-2024-12635 · affected 2.2.0 and older · fixed in 2.2.1 *

• medium 6.1 Ebook Store

  Reflected cross-site scripting (XSS)

  CVE-2024-11287 · affected 5.8001 and older · fixed in 6.20 *

• medium 6.4 Multi-column Tag Map

  Stored cross-site scripting (XSS)

  CVE-2024-11196 · affected 17.0.33 and older · fix not stated

• high 7.3 kk Star Ratings

  Remote code execution

  CVE-2024-11977 · affected 5.4.10 and older · fixed in 5.4.10.1 *

Friday, December 20, 2024 · 3

• high 7.5 Page and Post Restriction

  Information disclosure

  CVE-2024-11297 · affected 1.3.6 and older · fixed in 1.3.7 *

• medium 5.4 Serious Slider

  Stored cross-site scripting (XSS)

  CVE-2024-11108 · affected older than 1.2.7 · fixed in 1.2.7

• medium 4.8 Download Manager

  Stored cross-site scripting (XSS)

  CVE-2024-10706 · affected older than 3.3.03 · fixed in 3.3.03

Thursday, December 19, 2024 · 5

• critical 9.6 AutomatorWP

  Reflected cross-site scripting (XSS)

  CVE-2024-12626 · affected 5.0.9 and older · fixed in 5.8.5 *

• medium 6.5 Button Block

  Information disclosure

  CVE-2024-12560 · affected 1.1.5 and older · fixed in 1.1.6 *

• medium 5.3 Download Manager

  Missing authorization check

  CVE-2024-11768 · affected 3.3.03 and older · fixed in 3.3.04 *

• high 7.3 Download Manager

  Remote code execution

  CVE-2024-11740 · affected 3.3.03 and older · fixed in 3.3.04 *

• medium 6.5 Project Manager

  Information disclosure

  CVE-2024-10548 · affected 2.6.15 and older · fixed in 2.6.16 *

Wednesday, December 18, 2024 · 11

• medium 5.3 Paid Membership Subscriptions

  Information disclosure

  CVE-2024-11291 · affected 2.13.4 and older · fixed in 2.13.5 *

• medium 6.1 Affiliate Program Suite

  Cross-site request forgery (CSRF)

  CVE-2024-12454 · affected 1.1.23 and older · fixed in 1.1.24 *

• medium 4.3 Animation Addons

  Information disclosure

  CVE-2024-12340 · affected 1.1.6 and older · fixed in 1.1.7 *

• medium 5.4 Cost Calculator Builder

  Cross-site request forgery (CSRF)

  CVE-2024-10892 · affected older than 3.2.43 · fixed in 3.2.43

• medium 4.3 LifterLMS

  Missing authorization check

  CVE-2024-12596 · affected 7.8.5 and older · fixed in 7.8.6 *

• medium 6.4 Video Share VOD

  Stored cross-site scripting (XSS)

  CVE-2024-12449 · affected 2.6.30 and older · fixed in 2.7.2 *

• medium 6.1 AMP for WP

  Reflected cross-site scripting (XSS)

  CVE-2024-11254 · affected 1.1.1 and older · fixed in 1.1.2 *

• high 7.5 Collapsing Categories

  SQL injection

  CVE-2024-12025 · affected 3.0.8 and older · fixed in 3.0.9 *

• high 8.8 RepairBuddy

  Privilege escalation

  CVE-2024-12259 · affected 3.8120 and older · fixed in 3.8228 *

• high 8.1 WPC Shop as a Customer for WooCommerce

  Privilege escalation

  CVE-2024-12432 · affected 1.2.8 and older · fixed in 1.2.9 *

• medium 6.4 Easy Waveform Player

  Stored cross-site scripting (XSS)

  CVE-2024-11881 · affected 1.2.0 and older · fixed in 1.2.1 *

Tuesday, December 17, 2024 · 9

• low 3.7 Easy Digital Downloads

  Missing authorization check

  CVE-2024-9654 · affected 3.1 to 3.3.4 · fixed in 3.3.5 *

• medium 5.3 Calculated Fields Form

  Denial of service

  CVE-2024-12601 · affected 5.2.63 and older · fixed in 5.2.64 *

• medium 5.3 PPWP

  Information disclosure

  CVE-2024-11280 · affected 1.9.5 and older · fixed in 1.9.6 *

• high 8.8 s2Member

  Information disclosure

  CVE-2024-8326 · affected 241114 and older · fixed in 241216 *

• medium 6.1 EventPrime

  Stored cross-site scripting (XSS)

  CVE-2024-12024 · affected 4.0.7.3 and older · fixed in 4.0.7.4 *

• medium 6.1 WP BASE Booking of Appointments, Services and…

  Reflected cross-site scripting (XSS)

  CVE-2024-12469 · affected 4.9.1 and older · fixed in 4.9.2 *

• medium 5.3 Memberful

  Information disclosure

  CVE-2024-11294 · affected 1.73.9 and older · fixed in 1.74.1 *

• high 8.8 User Role Editor

  Cross-site request forgery (CSRF)

  CVE-2024-12293 · affected 4.64.3 and older · fixed in 4.64.4 *

• medium 6.1 PowerPack Lite for Beaver Builder

  Reflected cross-site scripting (XSS)

  CVE-2024-12239 · affected 1.3.0.5 and older · fixed in 1.3.1 *

Monday, December 16, 2024 · 10

• critical 9.8 WPBookit

  SQL injection

  CVE-2024-54280 · affected 1.6.0 and older · fix not stated

• medium 4.9 Bold Page Builder

  Path traversal / file read

  CVE-2024-54382 · affected 5.1.5 and older · fixed in 5.1.6

• medium 4.3 Falcon

  Missing authorization check

  CVE-2024-54384 · affected 2.8.3 and older · fixed in 2.8.4

• high 7.2 Radio Player

  Server-side request forgery (SSRF)

  CVE-2024-54385 · affected 2.0.83 and older · fixed in 2.0.85

• high 7.5 EduAdmin Booking

  File inclusion

  CVE-2024-54373 · affected 5.2.0 and older · fixed in 5.3.0

• critical 9.8 ForumWP

  PHP object injection

  CVE-2024-54367 · affected 2.1.0 and older · fixed in 2.1.1

• critical 9.3 Instant Appointment

  SQL injection

  CVE-2024-54361 · affected 1.2 and older · fix not stated

• medium 5.4 Online Booking & Scheduling Calendar by vcita

  Cross-site request forgery (CSRF)

  CVE-2024-54356 · affected 4.5 and older · fixed in 4.5.2

• high 8.8 WP Mailster

  Cross-site request forgery (CSRF)

  CVE-2024-54355 · affected 1.8.17.0 and older · fixed in 1.8.18.0

• medium 5.3 The Events Calendar

  Security issue

  CVE-2024-5333 · affected older than 6.8.2.1 · fixed in 6.8.2.1

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan