WordPress plugin vulnerabilities: week 1, 2025

89 vulnerabilities published Dec 30, 2024 – Jan 5, 2025 in 83 plugins we track, by day.

3 critical 17 high 69 medium

Dates are when the CVE record was published (UTC). Versions and fixes reflect our data as of 2026-11-04, so a fix may have shipped since.

“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.

Saturday, January 4, 2025 · 8

• high 8.8 UpdraftPlus

  PHP object injection

  CVE-2024-10957 · affected 1.23.8 to 1.24.11 · fixed in 1.24.12 *

• medium 6.5 Project Manager

  SQL injection

  CVE-2024-12195 · affected 2.6.16 and older · fixed in 2.6.17 *

• medium 6.1 Turnkey bbPress by WeaverTheme

  Reflected cross-site scripting (XSS)

  CVE-2024-12221 · affected 1.6.3 and older · fixed in 1.7 *

• medium 5.4 Taskbuilder

  Stored cross-site scripting (XSS)

  CVE-2024-11930 · affected 3.0.6 and older · fixed in 3.0.7 *

• medium 5.4 Scratch & Win

  Cross-site request forgery (CSRF)

  CVE-2024-12545 · affected 2.7.1 and older · fixed in 2.8.0 *

• medium 6.1 WP Compress

  Reflected cross-site scripting (XSS)

  CVE-2024-12047 · affected 6.30.03 and older · fixed in 6.30.26 *

• high 8.8 Backup Migration

  PHP object injection

  CVE-2024-10932 · affected 1.4.6 and older · fixed in 1.4.6.1 *

• medium 6.1 Media Library Assistant

  Reflected cross-site scripting (XSS)

  CVE-2024-11974 · affected 3.23 and older · fixed in 3.24 *

Friday, January 3, 2025 · 2

• high 7.3 WP Popular Posts

  Remote code execution

  CVE-2024-11733 · affected 7.1.0 and older · fixed in 7.2.0 *

• medium 4.3 WP Job Portal

  Missing authorization check

  CVE-2024-12132 · affected 2.2.4 and older · fixed in 2.2.5 *

Thursday, January 2, 2025 · 60

• medium 5.4 GiveWP

  Missing authorization check

  CVE-2023-23672 · affected 2.25.1 and older · fixed in 2.25.2

• medium 4.3 WP Fast Total Search

  Cross-site request forgery (CSRF)

  CVE-2024-38778 · affected 1.69.234 and older · fixed in 1.70.236

• high 8.8 MP3 Audio Player

  Missing authorization check

  CVE-2024-56266 · affected 5.8 and older · fixed in 5.9

• medium 5.4 Data Tables Generator by Supsystic

  Missing authorization check

  CVE-2024-56253 · affected 1.10.36 and older · fixed in 1.10.37

• medium 5.4 GeoDirectory

  Stored cross-site scripting (XSS)

  CVE-2024-56259 · affected 2.3.84 and older · fixed in 2.3.85

• medium 6.5 Magazine Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-56258 · affected 1.3.20 and older · fixed in 1.3.21

• medium 5.4 Enter Addons

  Stored cross-site scripting (XSS)

  CVE-2024-56252 · affected 2.1.9 and older · fixed in 2.2.1

• medium 4.3 Event Espresso

  Cross-site request forgery (CSRF)

  CVE-2024-56251 · affected 5.0.28 and older · fix not stated

• medium 6.5 Premium Blocks

  Stored cross-site scripting (XSS)

  CVE-2024-56245 · affected 2.1.42 and older · fixed in 2.1.43 *

• medium 6.5 Nexter Blocks

  Cross-site scripting (XSS)

  CVE-2024-56246 · affected 4.0.4 and older · fixed in 4.0.5

• high 7.2 WP Post Author

  SQL injection

  CVE-2024-56247 · affected 3.8.2 and older · fixed in 3.8.3

• critical 9.1 WPMasterToolKit (WPMTK)

  Arbitrary file upload

  CVE-2024-56249 · affected 1.13.1 and older · fixed in 1.14.0

• medium 4.9 WPMasterToolKit (WPMTK)

  Path traversal / file read

  CVE-2024-56248 · affected 1.13.1 and older · fixed in 1.14.0

• medium 5.4 Arconix Shortcodes

  Stored cross-site scripting (XSS)

  CVE-2024-56242 · affected 2.1.14 and older · fixed in 2.1.15

• medium 6.5 WPKoi Templates for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-56241 · affected 3.1.3 and older · fixed in 3.1.4

• medium 4.8 Contest Gallery

  Stored cross-site scripting (XSS)

  CVE-2024-56237 · affected 24.0.3 and older · fixed in 24.0.4

• medium 4.3 Event Tickets and Registration

  Cross-site request forgery (CSRF)

  CVE-2024-38762 · affected 5.11.0.4 and older · fixed in 5.11.0.5

• medium 6.5 Smartsupp

  Cross-site request forgery (CSRF)

  CVE-2024-38790 · affected 3.6 and older · fixed in 3.7

• medium 5.4 Telegram Bot & Channel

  Cross-site request forgery (CSRF)

  CVE-2024-38789 · affected 3.8.2 and older · fixed in 4.0.1

• medium 4.3 Leaky Paywall

  Cross-site request forgery (CSRF)

  CVE-2024-37540 · affected 4.21.2 and older · fixed in 4.21.3

• medium 4.3 Ultimate WordPress Auction

  Cross-site request forgery (CSRF)

  CVE-2024-37543 · affected 4.2.5 and older · fixed in 4.2.6

• medium 4.3 The Events Calendar

  Cross-site request forgery (CSRF)

  CVE-2024-37518 · affected 6.5.1.4 and older · fixed in 6.5.1.5

• medium 4.3 Falang multilanguage for WordPress

  Cross-site request forgery (CSRF)

  CVE-2024-37240 · affected 1.3.51 and older · fixed in 1.3.52

• medium 4.3 Loco Translate

  Cross-site request forgery (CSRF)

  CVE-2024-37236 · affected 2.6.9 and older · fixed in 2.6.10

• medium 4.3 WPAdverts

  Cross-site request forgery (CSRF)

  CVE-2024-37238 · affected 2.1.2 and older · fixed in 2.1.3

• medium 4.3 Groundhogg

  Cross-site request forgery (CSRF)

  CVE-2024-37235 · affected 3.4.2.3 and older · fixed in 3.4.3

• high 8.8 MasterStudy LMS WordPress Plugin

  Cross-site request forgery (CSRF)

  CVE-2024-37093 · affected 3.2.1 and older · fixed in 3.2.2

• medium 4.3 Flo Forms

  Missing authorization check

  CVE-2023-47692 · affected 1.0.41 and older · fixed in 1.0.42

• high 7.5 Ultra Addons for Contact Form 7

  Missing authorization check

  CVE-2023-47693 · affected 3.2.6 and older · fixed in 3.2.7

• medium 5.3 CoCart

  Missing authorization check

  CVE-2023-47241 · affected 3.11.2 and older · fixed in 3.12.0

• medium 4.3 Visitor Traffic Real Time Statistics

  Missing authorization check

  CVE-2023-47557 · affected 7.2 and older · fixed in 7.3

• high 7.5 WP Travel

  Missing authorization check

  CVE-2023-47224 · affected 7.8.0 and older · fixed in 7.8.1

• high 8.8 Delivery Date Time & Pickup for WooCommerce

  Missing authorization check

  CVE-2023-47179 · affected 2.4.6 and older · fixed in 2.4.7

• medium 6.5 WP CTA

  Missing authorization check

  CVE-2023-46644 · affected 1.5.8 and older · fixed in 1.5.9

• medium 6.5 Finale Lite

  Missing authorization check

  CVE-2023-47180 · affected 2.16.0 and older · fixed in 2.17.0

• critical 9.8 GiveWP

  Missing authorization check

  CVE-2023-47183 · affected 2.33.1 and older · fixed in 2.33.2

• medium 5.3 kk Star Ratings

  Missing authorization check

  CVE-2023-46639 · affected 5.4.5 and older · fixed in 5.4.6

• medium 5.3 YITH WooCommerce Product Add-Ons

  Missing authorization check

  CVE-2023-46635 · affected 4.2.0 and older · fixed in 4.2.1

• medium 5.3 Group Chat & Video Chat by AtomChat

  Missing authorization check

  CVE-2023-46606 · affected 1.1.4 and older · fixed in 1.1.5

• medium 5.3 DoLogin Security

  Missing authorization check

  CVE-2023-46608 · affected 3.7.1 and older · fixed in 3.8

• medium 6.5 Quill Forms

  Missing authorization check

  CVE-2023-46610 · affected 3.3.0 and older · fixed in 3.4.0

• medium 5.3 YOP Poll

  Authentication bypass

  CVE-2023-46611 · affected 6.5.28 and older · fixed in 6.5.29

• medium 5.3 MW WP Form

  Missing authorization check

  CVE-2023-46206 · affected 4.4.5 and older · fixed in 5.0.0

• high 7.3 Comments

  Missing authorization check

  CVE-2023-46309 · affected 7.6.10 and older · fixed in 7.6.11

• medium 4.3 ApplyOnline

  Missing authorization check

  CVE-2023-46080 · affected 2.5.3 and older · fixed in 2.5.4

• medium 5.3 Kali Forms

  Missing authorization check

  CVE-2023-46083 · affected 2.3.27 and older · fixed in 2.3.28

• medium 5.3 Poll Maker by AYS

  Missing authorization check

  CVE-2023-45766 · affected 4.7.1 and older · fixed in 4.7.2

• medium 5.3 Appointment Hour Booking

  Missing authorization check

  CVE-2023-45649 · affected 1.4.23 and older · fixed in 1.4.24

• medium 4.3 ERP

  Missing authorization check

  CVE-2023-45765 · affected 1.12.6 and older · fixed in 1.12.7

• medium 6.5 Kali Forms

  Missing authorization check

  CVE-2023-45275 · affected 2.3.28 and older · fixed in 2.3.29

• medium 4.3 WowStore

  Missing authorization check

  CVE-2023-45271 · affected 2.7.8 and older · fixed in 3.0.0

• medium 5.4 WebToffee WP Backup and Migration

  Missing authorization check

  CVE-2023-45636 · affected 1.4.1 and older · fixed in 1.4.2

• high 8.8 Comments

  Missing authorization check

  CVE-2023-45760 · affected 7.6.3 and older · fixed in 7.6.4

• high 8.8 BetterLinks

  Missing authorization check

  CVE-2023-45104 · affected 1.6.0 and older · fixed in 1.6.1

• medium 4.3 Bold Timeline Lite

  Missing authorization check

  CVE-2023-45110 · affected 1.1.9 and older · fixed in 1.2.0

• medium 4.3 Customer Reviews for WooCommerce

  Missing authorization check

  CVE-2023-45101 · affected 5.36.0 and older · fixed in 5.36.1

• medium 4.3 WP Custom Admin Interface

  Missing authorization check

  CVE-2023-44988 · affected 7.32 and older · fixed in 7.33

• medium 4.3 User Frontend

  Missing authorization check

  CVE-2023-45002 · affected 3.6.8 and older · fixed in 3.6.9

• medium 5.3 Schema App Structured Data

  Missing authorization check

  CVE-2023-44258 · affected 1.23.1 and older · fixed in 1.23.2

• high 7.1 HTML Forms

  Reflected cross-site scripting (XSS)

  CVE-2024-56060 · affected 1.4.1 and older · fixed in 1.4.2

Tuesday, December 31, 2024 · 19

• medium 5.4 Essential Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-56063 · affected 6.0.7 and older · fixed in 6.0.8

• medium 5.4 Royal Addons for Elementor

  Stored cross-site scripting (XSS)

  CVE-2024-56062 · affected 1.3.987 and older · fixed in 1.7.1

• high 8.8 RepairBuddy

  Privilege escalation

  CVE-2024-56061 · affected 3.8119 and older · fixed in 3.8120

• medium 4.3 Paytium

  Missing authorization check

  CVE-2024-51667 · affected 4.4.10 and older · fixed in 4.4.11

• medium 4.3 Smart Manager

  Missing authorization check

  CVE-2024-49687 · affected 8.45.0 and older · fixed in 8.46.0

• medium 6.5 Torod

  Missing authorization check

  CVE-2024-55995 · affected 1.7 and older · fixed in 1.8

• medium 6.5 WP-CRM System

  Missing authorization check

  CVE-2024-55991 · affected 3.2.9.1 and older · fixed in 3.4.0

• medium 5.9 Embed PDF Viewer

  Cross-site scripting (XSS)

  CVE-2024-56256 · affected 2.3.1 and older · fixed in 2.4.0

• high 8.8 Premium Addons for Elementor

  Missing authorization check

  CVE-2024-56225 · affected 4.10.56 and older · fixed in 4.10.57

• medium 4.3 Royal Addons for Elementor

  Missing authorization check

  CVE-2024-56227 · affected 1.7.1001 and older · fixed in 1.7.1002

• medium 6.1 Royal Addons for Elementor

  Reflected cross-site scripting (XSS)

  CVE-2024-56226 · affected 1.7.1001 and older · fixed in 1.7.1002

• high 7.1 Wishlist for WooCommerce

  Cross-site scripting (XSS)

  CVE-2024-56228 · affected 3.1.2 and older · fixed in 3.1.3

• medium 6.3 Download Manager

  Missing authorization check

  CVE-2024-56217 · affected 3.3.03 and older · fixed in 3.3.04

• medium 4.3 Widget Options

  Missing authorization check

  CVE-2024-56219 · affected 4.0.6.1 and older · fixed in 4.0.8

• medium 5.4 CodeBard Help Desk

  Cross-site request forgery (CSRF)

  CVE-2024-56222 · affected 1.1.1 and older · fixed in 1.1.2

• medium 4.3 DTX

  Cross-site request forgery (CSRF)

  CVE-2024-56218 · affected 5.0.1 and older · fixed in 5.0.2

• critical 9.8 SSL Wireless SMS Notification

  Privilege escalation

  CVE-2024-56220 · affected 3.6.0 and older · fixed in 3.7.0

• medium 6.5 Themify Builder

  File inclusion

  CVE-2024-56216 · affected 7.6.3 and older · fixed in 7.6.5

• high 8.8 Eventin

  Path traversal / file read

  CVE-2024-56213 · affected 4.0.7 and older · fixed in 4.0.9

Ran a vulnerable version? Check your site for signs of a hack

The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.

Scan free

Browse vulnerabilities

• Published this week
• Unpatched in the latest version
• By type of vulnerability

Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution

Where this data comes from

• Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
• Plugin versions, update dates and install counts: the wordpress.org Plugins API.
• These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.

← Check a plugin · Free hacked-site scan