WordPress plugin vulnerabilities: week 52, 2024

17 vulnerabilities published Dec 23 – Dec 29, 2024 in 17 plugins we track, by day.

1 high 16 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Sunday, December 29, 2024 · 1

medium 6.3 Ninja Forms

Remote code execution

CVE-2024-12238 · affected 3.8.22 and older · fixed in 3.8.25 *

Thursday, December 26, 2024 · 1

medium 4.7 Broken Link Checker

Server-side request forgery (SSRF)

CVE-2024-10903 · affected older than 2.4.2 · fixed in 2.4.2

Wednesday, December 25, 2024 · 7

medium 4.9 NEX-Forms

Cross-site request forgery (CSRF)

CVE-2024-10862 · affected 8.7.15 and older · fixed in 8.7.16 *
medium 6.1 Jetpack

Cross-site scripting (XSS)

CVE-2024-10858 · affected 13.0 up to (not including) 14.1 · fixed in 14.1
medium 4.3 Privacy Policy Generator, Terms & Conditions,…

Cross-site request forgery (CSRF)

CVE-2024-12636 · affected 3.2.7 and older · fixed in 3.2.8 *
high 7.5 WP Data Access

SQL injection

CVE-2024-12428 · affected 5.5.22 and older · fixed in 5.5.23 *
medium 4.3 Bit Form

Missing authorization check

CVE-2024-12190 · affected 2.17.3 and older · fixed in 2.17.4 *
medium 5.3 MarketKing

Missing authorization check

CVE-2024-12413 · affected 2.0.00 and older · fixed in 2.0.25 *
medium 6.5 Tourfic

SQL injection

CVE-2024-12032 · affected 2.15.3 and older · fixed in 2.15.4 *

Tuesday, December 24, 2024 · 7

medium 6.5 Booking calendar, Appointment Booking System

SQL injection

CVE-2024-10856 · affected 3.2.19 and older · fix not stated
medium 5.4 Responsive Blocks

Stored cross-site scripting (XSS)

CVE-2024-12268 · affected 1.9.7 and older · fixed in 1.9.8 *
medium 5.4 DirectoryPress

Stored cross-site scripting (XSS)

CVE-2024-10584 · affected 3.6.16 and older · fixed in 3.6.17 *
medium 6.4 Tracking Code Manager

Stored cross-site scripting (XSS)

CVE-2024-8721 · affected 2.3.0 and older · fixed in 2.4.0 *
medium 6.4 Simple Shopping Cart

Stored cross-site scripting (XSS)

CVE-2024-12622 · affected 5.0.7 and older · fixed in 5.0.8 *
medium 5.3 Advanced Google reCAPTCHA

Security issue

CVE-2024-12034 · affected 1.25 and older · fixed in 1.26 *
medium 4.3 Print Invoice & Delivery Notes for WooCommerce

Missing authorization check

CVE-2024-12210 · affected 5.4.0 and older · fixed in 5.4.1 *

Monday, December 23, 2024 · 1

medium 5.4 Ultimate Addons for Elementor

Stored cross-site scripting (XSS)

CVE-2024-11230 · affected 1.6.46 and older · fixed in 1.6.47 *

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Browse vulnerabilities

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Plugin versions, update dates and install counts: the wordpress.org Plugins API.
These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan