Wordfence Intelligence Weekly WordPress Vulnerability Report (December 18, 2023 to December 31, 2023)

🎉Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now!

Over the last two weeks, there were 263 vulnerabilities disclosed in 217 WordPress Plugins and 3 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 42 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

---

New Firewall Rules Deployed Last Two Weeks

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

• Directory Traversal via HTTP Headers

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

---

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status	Number of Vulnerabilities
Unpatched	43
Patched	220

---

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating	Number of Vulnerabilities
Low Severity	1
Medium Severity	212
High Severity	30
Critical Severity	20

---

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE	Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)	77
Missing Authorization	51
Cross-Site Request Forgery (CSRF)	47
Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)	30
Unrestricted Upload of File with Dangerous Type	9
Deserialization of Untrusted Data	7
Information Exposure Through Log Files	7
Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)	5
Information Exposure	4
Protection Mechanism Failure	3
Authorization Bypass Through User-Controlled Key	3
Server-Side Request Forgery (SSRF)	2
URL Redirection to Untrusted Site (‘Open Redirect’)	2
Storage of Sensitive Data in a Mechanism without Access Control	2
Weak Password Recovery Mechanism for Forgotten Password	2
Improper Input Validation	2
Improper Privilege Management	1
Reliance on IP Address for Authentication	1
External Control of File Name or Path	1
Information Exposure Through Debug Information	1
Use of Less Trusted Source	1
Improper Authentication	1
Improper Authorization	1
Improper Access Control	1
Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)	1
Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)	1

---

Researchers That Contributed to WordPress Security Last Week

Researcher Name	Number of Vulnerabilities
Rafie Muhammad	61
Brandon James Roldan (tomorrowisnew)	24
Muhammad Daffa	23
Ngô Thiên An (ancorn_)	16
LVT-tholv2k	14
emad	11
Abdi Pranata	10
Joshua Chan	10
Nguyen Xuan Chien	9
Abu Hurayra (HurayraIIT)	9
Mika	6
Skalucy	6
Dave Jong	6
thiennv	5
resecured.io	5
Revan Arifio	5
Huynh Tien Si	3
wpdabh	3
Le Ngoc Anh	3
Dmitrii Ignatyev	3
DoYeon Park (p6rkdoye0n)	3
Hiroho Shimada	2
Kyle Sanchez	2
Hung -mov Nguyen	2
Webbernaut	2
Nguyen Anh Tien	2
Jeongwoo-Lee(Roronoa)	2
Elliot	1
István Márton (Wordfence Vulnerability Researcher)	1
Taihei Shimamine	1
Rein Daelman (trein)	1
Robert DeVore	1
Marc-Alexandre Montpas	1
Vladislav Pokrovsky (ΞX.MI)	1
Yuchen Ji	1
Fariq Fadillah Gusti Insani (fariqfgi)	1
Yudistira Arya	1
Lucio Sá	1
Francesco Carlucci	1
Benmalek Aymen (centaurus)	1
Nex Team	1
Françoa Taffarel	1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

---

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name	Software Slug
404 Solution	404-solution
AI Power: Complete AI Pack – Powered by GPT-4	gpt3-ai-content-generator
AMP for WP – Accelerated Mobile Pages	accelerated-mobile-pages
ARI Stream Quiz – WordPress Quizzes Builder	ari-stream-quiz
ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup	armember-membership
Accredible Certificates & Open Badges	accredible-certificates
Active Products Tables for WooCommerce. Professional products tables for WooCommerce store	profit-products-tables-for-woocommerce
Add Any Extension to Pages	add-any-extension-to-pages
Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More	advanced-access-manager
Advanced Category Template	advanced-category-template
Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms	advanced-form-integration
Affiliates Manager	affiliates-manager
All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs – My Sticky Elements	mystickyelements
Apollo13 Framework Extensions	apollo13-framework-extensions
Appointment & Event Booking Calendar Plugin – Webba Booking	webba-booking-lite
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin	simply-schedule-appointments
Author Box, Guest Author and Co-Authors for Your Posts – Molongui	molongui-authorship
Auto Amazon Links – Amazon Associates Affiliate Plugin	amazon-auto-links
Awesome Support – WordPress HelpDesk & Support Plugin	awesome-support
BERTHA AI. Your AI co-pilot for WordPress and Chrome	bertha-ai-free
Back Button Widget	back-button-widget
Backup Migration	backup-backup
Beaver Builder – WordPress Page Builder	beaver-builder-lite-version
Block IPs for Gravity Forms	gf-block-ips
Booking Calendar | Appointment Booking | BookIt	bookit
Booking Manager	booking-manager
Booking for Appointments and Events Calendar – Amelia	ameliabooking
BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin	bookingpress-appointment-booking
Booster Elite for WooCommerce	booster-elite-for-woocommerce
Branda – White Label WordPress, Custom Login Page Customizer	branda-white-labeling
Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content	brave-popup-builder
BuddyPress	buddypress
Build App Online	build-app-online
BulkGate SMS Plugin for WooCommerce	woosms-sms-module-for-woocommerce
Business Directory Plugin – Easy Listing Directories for WordPress	business-directory-plugin
CBX Bookmark & Favorite	cbxwpbookmark
CRM Perks Forms – WordPress Form Builder	crm-perks-forms
CSS & JavaScript Toolbox	css-javascript-toolbox
CURCY – Multi Currency for WooCommerce	UNKNOWN-CVE-2023-50831-1
Calculated Fields Form	calculated-fields-form
Checkout Mestres WP	checkout-mestres-wp
Clockwork SMS Notfications	mediaburst-email-to-sms
Clone	wp-clone-by-wp-academy
Colibri Page Builder	colibri-page-builder
Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce	enhanced-e-commerce-for-woocommerce-store
Crowdsignal Dashboard – Polls, Surveys & more	polldaddy
Currency Converter Widget – Exchange Rates	currency-converter-widget
Custom 404 Pro	custom-404-pro
Custom Post Carousels with Owl	dd-post-carousel
Custom Twitter Feeds – A Tweets Widget or X Feed Widget	custom-twitter-feeds
Customer Reviews for WooCommerce	customer-reviews-woocommerce
Customize My Account for WooCommerce	customize-my-account-for-woocommerce
Dan’s Embedder for Google Calendar	dans-gcal
Database Cleaner: Clean, Optimize & Repair	database-cleaner
Defender Security – Malware Scanner, Login Security & Firewall	defender-security
Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan	antihacker
Doofinder WP & WooCommerce Search	doofinder-for-woocommerce
Duplicator – WordPress Migration & Backup Plugin	duplicator
Dynamic Content for Elementor	dynamic-content-for-elementor
E2Pdf – Export To Pdf Tool for WordPress	e2pdf
Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy)	easy-digital-downloads
Easy PayPal & Stripe Buy Now Button	wp-ecommerce-paypal
Easy Video Player	easy-video-player
Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress	plugins-on-steroids
Enable Media Replace	enable-media-replace
EnvíaloSimple: Email Marketing y Newsletters	envialosimple-email-marketing-y-newsletters-gratis
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates	essential-blocks
Event Monster – Event Management, Tickets Booking, Upcoming Event	event-monster
Events Shortcodes For The Events Calendar	template-events-calendar
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin	everest-backup
Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!	everest-forms
Export Media URLs	export-media-urls
FOX – Currency Switcher Professional for WooCommerce	woocommerce-currency-switcher
FastDup – Fastest WordPress Migration & Duplicator	fastdup
Floating Button	floating-button
Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin	fluent-support
Form plugin for WordPress – Zoho Forms	zoho-forms
Frontend Admin by DynamiApps	acf-frontend-form-element
Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits	funnel-builder
FunnelKit Checkout	woofunnels-aero-checkout
GEO my WordPress	geo-my-wp
GeoDirectory – WordPress Business Directory Plugin, or Classified Directory	geodirectory
Google Photos Gallery with Shortcodes	google-picasa-albums-viewer
HT Mega – Absolute Addons For Elementor	ht-mega-for-elementor
HTML Forms	html-forms
HUSKY – Products Filter for WooCommerce Professional	woocommerce-products-filter
Happy Addons for Elementor	happy-elementor-addons
HashBar – WordPress Notification Bar	hashbar-wp-notification-bar
Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building	icegram
If-So Dynamic Content Personalization	if-so
Image Optimizer, Resizer and CDN – Sirv	sirv
Image Source Control Lite – Show Image Credits and Captions	image-source-control-isc
Impreza – WordPress Website and WooCommerce Builder	impreza
Inline Image Upload for BBPress	image-upload-for-bbpress
Insert or Embed Articulate Content into WordPress	insert-or-embed-articulate-content-into-wordpress
Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site	integrate-google-drive
JS Help Desk – Best Help Desk & Support Plugin	js-support-ticket
JSM file_get_contents() Shortcode	wp-file-get-contents
JVM Gutenberg Rich Text Icons	jvm-rich-text-icons
Job Manager & Career – Manage job board listings, and recruitments	job-manager-career
LA-Studio Element Kit for Elementor	lastudio-element-kit
Limit Login Attempts Reloaded	limit-login-attempts-reloaded
Loan Repayment Calculator and Application Form	quick-interest-slider
Local Delivery Drivers for WooCommerce	local-delivery-drivers-for-woocommerce
Login Lockdown – Protect Login Form	login-lockdown
Login as User or Customer	login-as-customer-or-user
Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation	gs-logo-slider
MC4WP: Mailchimp for WordPress	mailchimp-for-wp
MF Gig Calendar	mf-gig-calendar
MStore API	mstore-api
Mail logging – WP Mail Catcher	wp-mail-catcher
Malware Scanner	miniorange-malware-protection
Media File Renamer: Rename Files (Manual, Auto & AI)	media-file-renamer
Menu Image, Icons made easy	menu-image
Metform Elementor Contact Form Builder	metform
Most And Least Read Posts Widget	most-and-least-read-posts-widget
Multi Step Form	multi-step-form
MultiVendorX Marketplace – WooCommetrce MultiVendor Marketplace Solution	dc-woocommerce-multi-vendor
My Agile Privacy – The only GDPR solution for WordPress that you can truly trust	myagileprivacy
NEX-Forms – Ultimate Form Builder – Contact forms and much more	nex-forms-express-wp-form-builder
New User Approve	new-user-approve
NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images	nitropack
Page Generator	page-generator
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction	paid-member-subscriptions
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions	paid-memberships-pro
Pay with Vipps for WooCommerce	woo-vipps
Photo Gallery by 10Web – Mobile-Friendly Image Gallery	photo-gallery
Piotnet Forms	piotnetforms
Poll Maker – Best WordPress Poll Plugin	poll-maker
Pre* Party Resource Hints	pre-party-browser-hints
Product Catalog Simple	post-type-x
Product Code for WooCommerce	product-code-for-woocommerce
Product Feed Manager – WooCommerce to Google Shopping, Social Catalogs, and 170+ Popular Marketplaces	best-woocommerce-feed
Product Filter by WBW	woo-product-filter
Product Table by WBW	woo-product-tables
Product Vendors	woocommerce-product-vendors
ProfileGrid – User Profiles, Memberships, Groups and Communities	profilegrid-user-profiles-groups-and-communities
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress	quiz-master-next
Rate my Post – WP Rating System	rate-my-post
Recipe Maker For Your Food Blog from Zip Recipes	zip-recipes
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit	wp-marketing-automations
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login	custom-registration-form-builder-with-submission-manager
Rencontre – Dating Site	rencontre
Republish Old Posts	republish-old-posts
Restaurant Reservations	nd-restaurant-reservations
Rise Blocks – A Complete Gutenberg Page Builder	rise-blocks
Schema & Structured Data for WP & AMP	schema-and-structured-data-for-wp
Send Users Email	send-users-email
Sensei LMS – Online Courses, Quizzes, & Learning	sensei-lms
Seos Contact Form	seos-contact-form
Simple Counter	abwp-simple-counter
Simple Job Board	simple-job-board
Simple Membership	simple-membership
Simple Staff List	simple-staff-list
Slider by Soliloquy – Responsive Image Slider for WordPress	soliloquy-lite
Spam protection, Anti-Spam, FireWall by CleanTalk	cleantalk-spam-protect
Split Test For Elementor	split-test-for-elementor
Squirrly SEO – Advanced Pack	squirrly-seo-pack
Sticky Chat Widget: WhatsApp, Messenger, Click to chat, SMS, Email, Messages, Call Button, Contact form and more Chat buttons	sticky-chat-widget
Stock Ticker	stock-ticker
Store Locator WordPress	agile-store-locator
Strong Testimonials	strong-testimonials
Stylish Price List – Price Table Builder & QR Code Restaurant Menu	stylish-price-list
SureFeedback Client Site	projecthuddle-child-site
TerraClassifieds – Simple Classifieds Plugin	terraclassifieds
Theme per user	theme-per-user
Themify Icons	themify-icons
Thrive Automator	thrive-automator
Ultimate Addons for Beaver Builder	bb-ultimate-addon
Ultimate Addons for WPBakery	Ultimate_VC_Addons
Ultimate Dashboard – Custom WordPress Dashboard	ultimate-dashboard
Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin	uncanny-automator
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds	userfeedback-lite
Verge3D Publishing and E-Commerce	verge3d
WP Adminify – WordPress Dashboard Customization | Custom Login | Admin Columns | Dashboard Widget | Media Library Folders	adminify
WP Affiliate Disclosure	wp-affiliate-disclosure
WP Chat App	wp-whatsapp
WP Crowdfunding	wp-crowdfunding
WP Edit Username	wp-edit-username
WP Frontend Profile	wp-front-end-profile
WP Go Maps (formerly WP Google Maps)	wp-google-maps
WP Job Portal – A Complete Job Board	wp-job-portal
WP MLM SOFTWARE PLUGIN	wp-mlm
WP Mail Log	wp-mail-log
WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce	wp-optin-wheel
WP Remote Site Search	wp-remote-site-search
WP Review Slider	wp-facebook-reviews
WP Shortcodes Plugin — Shortcodes Ultimate	shortcodes-ultimate
WP Simple Booking Calendar	wp-simple-booking-calendar
WP Stripe Checkout	wp-stripe-checkout
WP Tabs – Responsive Tabs Plugin for WordPress	wp-expand-tabs-free
WP User Profile Avatar	wp-user-profile-avatar
WPC Product Bundles for WooCommerce	woo-product-bundle
WPCS – WordPress Currency Switcher Professional	currency-switcher
WS Form LITE – Drag & Drop Contact Form Builder for WordPress	ws-form
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition	webinar-ignition
Welcart e-Commerce	usc-e-shop
White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard	white-label
WooCommerce Easy Duplicate Product	woo-easy-duplicate-product
WooCommerce Menu Extension	woocommerce-menu-extension
WooCommerce PDF Invoice Builder, Create invoices, packing slips and more	woo-pdf-invoice-builder
WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels	print-invoices-packing-slip-labels-for-woocommerce
WooCommerce Per Product Shipping	woocommerce-shipping-per-product
WooCommerce Ship to Multiple Addresses	woocommerce-shipping-multiple-addresses
WooCommerce Stripe Payment Gateway	woocommerce-gateway-stripe
WooCommerce Warranty Requests	woocommerce-warranty
WooPayments – Fully Integrated Solution Built and Supported by Woo	woocommerce-payments
Woocommerce Shipping Canada Post	woocommerce-shipping-canada-post
WordPress Infinite Scroll – Ajax Load More	ajax-load-more
WordPress.com Editing Toolkit	full-site-editing
YITH WooCommerce Product Add-Ons	yith-woocommerce-product-add-ons
ZeroBounce Email Verification & Validation	zerobounce
eCommerce Product Catalog Plugin for WordPress	ecommerce-product-catalog
iframe	iframe
iframe Shortcode	iframe-shortcode
uncode-core	uncode-core
weForms – Easy Drag & Drop Contact Form Builder For WordPress	weforms

---

WordPress Themes with Reported Vulnerabilities Last Week

Software Name	Software Slug
BuddyBoss Theme	buddyboss-theme
Divi	Divi
TheGem	thegem

---

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

BERTHA AI Plugin <= 1.11.10.7 – Unauthenticated Arbitrary File Upload

---

WebinarIgnition <= 3.05.0 – Missing Authorization to Unauthenticated Privilege Escalation

---

Piotnet Forms Plugin <= 1.0.25 – Unauthenticated Arbitrary File Upload

---

WP Clone <= 2.4.2 – Sensitive Information Exposure

---

Rencontre – Dating Site <= 3.10.1 – Unauthenticated Arbitrary File Upload

---

Login as User or Customer (User Switching) <= 3.8 – Authentication Bypass

---

Build App Online <= 1.0.19 – Account Takeover via Weak Password Reset Mechanism

---

Frontend Admin by DynamiApps Plugin <= 3.18.3 – Unauthenticated Arbitrary File Upload

---

JS Help Desk <= 2.8.1 – Unauthenticated SQL Injection via email and trackingid

---

Checkout Mestres WP <= 7.1.9.6 – Authentication Bypass via Password Reset

---

Checkout Mestres WP <= 7.1.9.6 – Missing Authorization to Unauthenticated Arbitrary Options Update

---

WP Frontend Profile <= 1.3.1 – Unauthenticated Privilege Escalation

---

WP MLM Unilevel <= 4.0 – Unauthenticated Privilege Escalation

---

TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload

---

Rencontre – Dating Site <= 3.10.1 – Privilege Escalation

---

WP MLM <= 4.0 – Unauthenticated Arbitrary File Upload

---

Theme per user <= 1.0.1 – Unauthenticated PHP Object Injection

---

Active Products Tables for WooCommerce <= 1.0.6 – Unauthenticated PHP Object Injection

---

Checkout Mestres WP <= 7.1.9.6 – Unauthenticated SQL Injection

---

WebinarIgnition <= 3.05.0 – Unauthenticated SQL Injection

---

Recipe Maker For Your Food Blog from Zip Recipes <= 8.1.0 – Authenticated(Contributor+) SQL Injection

---

WP Mail Log Plugin <= 1.1.2 – Authenticated(Contributor+) Arbitrary File Upload

---

Ultimate Addons for Beaver Builder <= 1.35.14 – Authenticated(Contributor+) Privilege Escalation

---

ARI Stream Quiz <= 1.3.0 – Authenticated (Contributor+) PHP Object Injection

---

TerraClassifieds <= 2.0.3 – Cross-Site Request Forgery

---

Verge3D <= 4.5.2 – Authenticated(Subscriber+) Arbitrary File Upload

---

Rencontre – Dating Site <= 3.11.1 – Authenticated (Subscriber+) PHP Object Injection

---

MF Gig Calendar <=1.2.1 – Authenticated(Contributor+) SQL Injection

---

Job Manager & Career – Manage job board listings, and recruitments <= 1.4.4 – Cross-Site Request Forgery to PHP Object Injection

---

Booking Manager <= 2.1.5 – Authenticated(Contributor+) SQL Injection via Shortcode

---

JVM rich text icons <= 1.2.6 – Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion

---

Uncode Core <= 2.8.8 – Privilege Escalation

---

Events Shortcodes & Templates For The Events Calendar <= 2.3.1 – Authenticated (Contributor+) SQL Injection via shortcode

---

ARMember <= 4.0.10 – Authenticated(Subscriber+) Privilege Escalation

---

JVM rich text icons <= 1.2.3 – Authenticated(Subscriber+) Arbitrary File Upload

---

BookingPress <= 1.0.72 – Authenticated (Contributor+) SQL Injection

---

Build App Online <= 1.0.19 – Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update

---

Most And Least Read Posts Widget <=2.5.16 – Authenticated(Contributor+) SQL Injection via Widget settings

---

Uncode Core <= 2.8.8 – Authenticated (Subscriber+) Arbitrary File Deletion

---

Backup Migration 1.0.8 – 1.3.9 – Remote File Inclusion via content-dir

---

Backup Migration <= 1.3.9 – Unauthenticated Path Traversal to Arbitrary File Deletion

---

Everest Backup <= 2.1.9 – Sensitive Information Exposure via Log File

---

WP Stripe Checkout <= 1.2.2.37 – Sensitive Information Exposure via Debug Log

---

WC Marketplace <= 4.0.23 – Missing Authorization via mvx_save_dashpages

---

WebinarIgnition <= 3.05.0 – Authenticated(Subscriber+) PHP Object Injection

---

Local Delivery Drivers for WooCommerce <= 1.9.0 – Missing Authorization to Driver Account Takeover

---

Custom 404 Pro <= 3.10.0 – Unauthenticated Stored Cross-Site Scripting via logging

---

WooCommerce PDF Invoices <= 4.2.1 – Authenticated(Shop Manager+) Arbitrary Options Update via JSON Import

---

Welcart e-Commerce <= 2.9.3 – Authenticated(Editor+) SQL Injection

---

Backup Migration <= 1.3.9 – Authenticated (Admin+) OS Command Injection via url

---

Clockwork SMS Notfications <= 3.0.4 – Authenticated(Administrator+) SQL Injection

---

Media File Renamer <= 5.7.7 – Authenticated(Administrator+) Remote Code Execution

---

E2Pdf <= 1.20.23 – Authenticated(Administrator+) SQL Injection

---

404 Solution <= 2.34.0 – Authenticated(Administrator+) SQL Injection

---

Mail logging – WP Mail Catcher <= 2.1.3 – Authenticated(Administrator+) SQL Injection

---

WP Adminify <= 3.1.6 – Authenticated(Administrator+) SQL Injection

---

Page Generator <= 1.7.1 – Authenticated(Administrator+) SQL Injection

---

Simply Schedule Appointments <= 1.6.5.27 – Authenticated(Administrator+) SQL Injection

---

Pre* Party Resource Hints <= 1.8.18 – Authenticated(Administrator+) SQL Injection

---

Login Lockdown – Protect Login Form <= 2.06 – Authenticated(Administrator+) SQL Injection

---

YITH WooCommerce Product Add-Ons <= 4.3.0 – Authenticated(Shop Manager+) PHP Object Injection

---

Fluent Support <= 1.7.6 – Authenticated(Administrator+) SQL Injection

---

Automation By Autonami <= 2.6.1 – Authenticated(Administrator+) SQL Injection

---

Store Locator WordPress <= 1.4.14 – Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion

---

Squirrly SEO – Advanced Pack <= 2.3.8 – Authenticated(Administrator+) SQL Injection

---

GEO my WordPress <= 4.0.2 – Authenticated(Administrator+) SQL Injection

---

RegistrationMagic Plugin <= 5.2.4.5 – Authenticated(Administrator+) SQL Injection

---

WS Form LITE <= 1.9.170 – Authenticated(Administrator+) SQL Injection

---

GeoDirectory <= 2.3.28 – Authenticated(Administrator+) SQL Injection

---

Funnel Builder for WordPress by FunnelKit <= 2.14.3 – Authenticated(Administrator+) SQL Injection

---

Advanced Form Integration <= 1.75.0 – Authenticated(Administrator+) SQL Injection

---

BookIt <= 2.4.3 – Authenticated(Administrator+) SQL Injection

---

EnvíaloSimple <= 2.1 Unauthenticated PHP Object Injection

---

WooCommerce Stripe Payment Gateway <= 7.6.1 – Insecure Direct Object Reference via update_payment_intent_ajax

---

Affiliates Manager <= 2.9.31 – Cross-Site Request Forgery via multiple AJAX actions

---

FunnelKit Checkout <= 3.10.3 – Unauthenticated Arbitrary Content Deletion

---

Piotnet Forms <= 1.0.25 – Missing Authorization via multiple AJAX actions

---

weForms <= 1.6.18 – Missing Authorization via export_form_entries

---

Sensei LMS <= 4.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Schema & Structured Data for WP & AMP <= 1.23 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Product Code for WooCommerce <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Icegram <= 3.1.19 – Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message

---

Insert or Embed Articulate Content into WordPress <= 4.3000000021 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

WooCommerce Menu Extension <= 1.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Active Products Tables for WooCommerce <= 1.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

WP Crowdfunding <= 2.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Pay with Vipps for WooCommerce <= 1.14.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Colibri Page Builder <= 1.0.239 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Booking for Appointments and Events Calendar – Amelia <= 1.0.85 – Stored Cross-Site Scripting via Shortcode

---

My Agile Privacy <= 2.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode

---

WP Tabs <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Currency Converter Widget <= 3.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Colibri Page Builder <= 1.0.240 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Zoho Forms <= 3.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Advanced Access Manager <= 6.9.15 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

WP Affiliate Disclosure <= 1.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via $id

---

Seos Contact Form <= 1.8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

HashBar – WordPress Notification Bar <= 1.4.1 – Authenticated (Author+) Stored Cross-Site Scripting

---

WPCS – WordPress Currency Switcher Professional <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

WP Remote Site Search <= 1.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

CURCY – Multi Currency for WooCommerce <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

If-So Dynamic Content Personalization <= 1.6.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Auto Amazon Links <= 5.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Limit Login Attempts Reloaded <= 2.25.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Divi <= 4.23.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

iframe Shortcode <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

Restaurant Reservations <= 1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

CSS & JavaScript Toolbox <= 11.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

---

WordPress.com Editing Toolkit <= 3.78784 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

BuddyPress <= 11.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Stock Ticker <= 3.23.4 – Authenticated (Contributor+) Stored Cross-Site Scritping

---

Back Button Widget <= 1.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Easy Video Player <= 1.2.2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

AMP for WP – Accelerated Mobile Pages <= 1.0.92 – Authenticated (Contributor+) Cross-Site Scripting via Shortcode

---

WP User Profile Avatar <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Dan’s Embedder for Google Calendar <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

CBX Bookmark & Favorite <= 1.7.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Easy Digital Downloads <= 3.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

WordPress Infinite Scroll – Ajax Load More <= 6.1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Themify Icons <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Advanced Access Manager <= 6.9.18 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

---

Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting

---

Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting Vulnerability via environment_mode

---

WP Google Maps <= 9.0.27 – Unauthenticated Stored Cross-Site Scripting via REST API

---

New User Approve <= 2.5.1 – Cross-Site Request Forgery via admin_notices

---

HT Mega – Absolute Addons For Elementor <= 2.3.8 – Reflected Cross-Site Scripting

---

Impreza <= 8.17.4 – Reflected Cross-Site Scripting

---

TheGem <= 5.9.1 – Reflected Cross-Site Scripting

---

Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 – Reflected Cross-Site Scripting

---

Google Photos Gallery with Shortcodes <= 4.0.2 – Reflected Cross-Site Scripting

---

Uncode Core <= 2.8.6 – Reflected Cross-Site Scripting

---

HTML Forms <= 1.3.28 – Authenticated (Administrator+) Cross-Site Scripting

---

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.5 – Authenticated (Admin+) SQL Injection

---

ZeroBounce Email Verification & Validation <= 1.0.11 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Stylish Price List <= 7.0.17 – Missing Authorization

---

JSM file_get_contents() Shortcode <= 2.7.0 – Authenticated (Contributor+) Server-Side Request Forgery via Shortcode

---

Simple Staff List <= 2.2.4 – Missing Authorization via ajax_flush_rewrite_rules and staff_member_export

---

ARI Stream Quiz <= 1.2.32 – Cross-Site Request Forgery

---

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

Happy Addons for Elementor <= 3.9.1.1 – Server Side Request Forgery (SSRF)

---

Molongui <= 4.7.3 – Missing Authorization

---

FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

---

Doofinder for WooCommerce <= 2.0.33 – Missing Authorization via multiple AJAX actions

---

Business Directory Plugin <= 6.3.9 – Missing Authorization via dispatch

---

Essential Blocks for Gutenberg <= 4.2.0 – Incorrect Authorization Checks

---

WooCommerce Warranty Requests <= 2.2.7 – Missing Authorization

---

Block IPs for Gravity Forms <= 1.0.1 – Cross-Site Request Forgery

---

WP Optin Wheel <= 1.4.2 – Sensitive Information Exposure via Log File

---

Rate my Post – WP Rating System <= 3.4.2 – IP Address Spoofing

---

Customer Reviews for WooCommerce <= 5.38.1 – Missing Authorization via CR_Manual

---

Poll Maker <= 4.8.0 – Missing Authorization

---

Paid Memberships Pro <= 2.12.5 – Missing Authorization via API

---

AI Power: Complete AI Pack – Powered by GPT-4 <= 1.8.1 – Missing Authorization to Sensitive Data Exposure

---

Database Cleaner <= 0.9.8 – Sensitive Information Exposure via Log File

---

Beaver Builder – WordPress Page Builder <= 2.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

---

RegistrationMagic <= 5.2.5.0 – IP Spoofing

---

MC4WP <= 4.9.9 – Missing Authorization via listen

---

Product Catalog Simple <= 1.7.6 – Sensitive Information Exposure via Product CSV

---

Uncanny Automator <= 5.1.0.2 – Sensitive Information Exposure via Log File

---

LA-Studio Element Kit for Elementor <= 1.1.5 – Missing Authorization

---

WooCommerce Canada Post Shipping <= 2.8.3 – Missing Authorization

---

Branda <= 3.4.14 – IP Address Spoofing

---

Send Users Email <= 1.4.3 – Sensitive Information Exposure via Error Logs

---

User Feedback <= 1.0.10 – Missing Authorization

---

WooPayments – Fully Integrated Solution Built and Supported by Woo <= 6.6.2 – Unauthenticated Insecure Direct Object Reference

---

404 Solution <= 2.33.0 – Sensitive Information Exposure via Log File

---

WP User Profile Avatar <= 1.0.0 – Authenticated (Author+) Insecure Direct Object Reference to Avatar Deletion/Update

---

Awesome Support <= 6.1.5 – Missing Authorization via wpas_load_reply_history

---

RegistrationMagic <= 5.2.5.0 – Form Submission Limit Bypass

---

Quiz And Survey Master <= 8.1.16 – Missing Authorization

---

Defender Security <= 4.1.0 – Sensitive Information Exposure via Log File

---

Metform Elementor Contact Form Builder <= 3.4.0 – Missing Authorization via submit

---

Affiliates Manager <= 2.9.30 – Sensitive Information Exposure via Log File

---

Conversios.io <= 6.5.0 – Missing Authorization

---

eCommerce Product Catalog <= 3.3.26 – Sensitive Information Exposure via CSV Files

---

FastDup <= 2.1.7 – Sensitive Information Exposure via Log File

---

All-in-one Floating Contact Form – My Sticky Elements <= 2.1.3 – Missing Authorization

---

WooCommerce Warranty Requests <= 2.2.7 – Missing Authorization

---

Everest Forms <= 2.0.3 – Unauthorized Form Submission via Disabled Forms

---

BuddyBoss Theme <= 2.4.60 – Missing Authorization

---

Easy Digital Downloads <= 3.1.5 – Missing Authorization

---

Image Source Control <= 2.17.0 – Sensitive Information Exposure via Log File

---

WooCommerce Product Vendors <= 2.2.2 – Missing Authorization

---

Malware Scanner <= 4.7.1 – IP Spoofing

---

WooCommerce Product Vendors <= 2.2.1 – Missing Authorization

---

iFrame <= 4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via srcdoc

---

Enable Media Replace <= 4.1.4 – Reflected Cross-Site Scripting

---

Menu Image, Icons made easy <= 3.10 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Ultimate Dashboard <= 3.7.11 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Accredible Certificates & Open Badges <= 1.4.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Photo Gallery by 10Web <= 1.8.18 – Authenticated (Administrator+) Stored Cross-Site Scripting via Widget

---

Everest Forms <= 2.0.4.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WP Review Slider <= 12.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

WP Chat App <= 3.4.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.17 – Authenticated (Admin+) Stored Cross-Site Scripting

---

Brave Popup Builder <= 0.6.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Sticky Chat Widget <= 1.1.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Event Management Tickets Booking <= 1.3.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Multi Step Form <= 1.7.13 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Custom Post Carousels with Owl <= 1.4.6 – Authenticated (Editor+) Stored Cross-Site Scripting

---

CRM Perks Forms <= 1.1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

---

Simple Counter <= 1.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

WP Edit Username <= 1.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

---

Loan Repayment Calculator and Application Form <= 2.9.3 – Authenticated (Admin+) Stored Cross-Site Scripting

---

WooCommerce Easy Duplicate Product <= 0.3.0.7 – Missing Authorization via wedp_duplicate_product_action

---

EnvíaloSimple <= 2.1 – Cross-Site Request Forgery

---

Simple Job Board <= 2.10.6 – Cross-Site Request Forgery

---

Webba Booking <= 4.5.33 – Cross-Site Request Forgery

---

Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 – Cross-Site Request Forgery via apbct_settings__update_account_email

---

Custom Twitter Feeds (Tweets Widget) <= 2.1.2 – Cross-Site Request Forgery

---

Republish Old Posts <= 1.21 – Cross-Site Request Forgery via rop_options_page

---

Advanced Access Manager <= 6.9.18 – Authenticated (Author+) Open Redirect

---

Floating Button <= 6.0 – Cross-Site Request Forgery via process_bulk_action

---

Rise Blocks – A Complete Gutenberg Page Builder <= 3.1 – Cross-Site Request Forgery

---

WP Simple Booking Calendar <= 2.0.8.4 – Cross-Site Request Forgery

---

Icegram <= 3.1.18 – Cross-Site Request Forgery via save_campaign_preview

---

White Label <= 2.9.0 – Cross-Site Request Forgery via white_label_reset_wl_admins

---

Ultimate Addons for Beaver Builder <= 1.35.13 – Authenticated(Contributor+) Directory Traversal to Arbitrary File Download

---

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.3 – Cross-Site Request Forgery

---

Duplicator <= 1.5.7 – Cross-Site Request Forgery via views/tools/diagnostics/information.php

---

Quiz And Survey Master <= 8.1.18 – Cross-Site Request Forgery

---

Thrive Automator <= 1.17 – Cross-Site Request Forgery

---

Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 – Cross-Site Request Forgery

---

WPC Product Bundles for WooCommerce <= 7.3.1 – Cross-Site Request Forgery

---

GPT3 AI Content Writer <= 1.8.12 – Cross-Site Request Forgery

---

Apollo13 Framework Extensions <= 1.9.1 – Cross-Site Request Forgery

---

WooCommerce Ship to Multiple Addresses <= 3.8.9 – Missing Authorization

---

WooCommerce PDF Invoice Builder <= 1.2.101 – Cross-Site Request Forgery

---

Paid Member Subscriptions <= 2.10.4 – Cross-Site Request Forgery via ajax_add_log_entry

---

HT Mega <= 2.3.3 – Cross-Site Request Forgery via Several Functions

---

FunnelKit Checkout <= 3.10.3 – Authenticated(Subscriber+) Missing Authorization to Arbitrary Plugin Activation

---

ProfileGrid <= 5.6.6 – Missing Authorization

---

Dynamic Content for Elementor < 2.12.5 – Cross-Site Request Forgery

---

Product Filter by WBW <= 2.5.0 – Missing Authorization via getListForTbl

---

Export Media URLs <= 1.0 – Cross-Site Request Forgery

---

Calculated Fields Form <= 1.2.28 – Authenticated (Contributor+) Open Redirect via Shortcode

---

Inline Image Upload for BBPress <= 1.1.18 – Cross-Site Request Forgery via hm_bbpui_admin_page

---

WooCommerce Shipping Per Product <= 2.5.4 – Missing Authorization

---

Easy PayPal Buy Now Button <= 1.8.1 – Cross-Site Request Forgery

---

BulkGate SMS Plugin for WooCommerce <= 3.0.2 – Missing Authorization via Multiple AJAX Actions

---

FunnelKit Checkout <= 3.10.3 – Authenticated(Subscriber+) Missing Authorization to Settings Change

---

Booster Elite for WooCommerce <= 7.1.2 – Authenticated(Subscriber+) Content Injection

---

MStore API <= 4.10.1 – Cross-Site Request Forgery

---

Add Any Extension to Pages <= 1.4 – Cross-Site Request Forgery via aaetp_options_page

---

Sirv <= 7.1.2 – Missing Authorization via sirv_disconnect

---

Integrate Google Drive <= 1.3.3 – Missing Authorization via save_settings

---

Anti Hacker <= 4.34 – Cross-Site Request Forgery via antihacker_ajax_scan

---

NEX-Forms – Ultimate Form Builder <= 8.5.2 – Cross-Site Request Forgery

---

Split Test For Elementor <= 1.6.9 – Cross-Site Request Forgery

---

GS Logo Slider <= 3.5.1 – Cross-Site Request Forgery

---

WP Job Portal <= 2.0.6 – Cross-Site Request Forgery

---

ProjectHuddle Client Site <= 1.0.34 – Missing Authorization via ph_child_ajax_notice_handler

---

Slider by Soliloquy <= 2.7.2 – Missing Authorization

---

Awesome Support <= 6.1.5 – Cross-Site Request Forgery

---

Advanced Category Template <= 0.1 – Cross-Site Request Forgery

---

NitroPack <= 1.10.2 – Cross-Site Request Forgery

---

Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 – Cross-Site Request Forgery via update_rating

---

Strong Testimonials <= 3.1.10 – Cross-Site Request Forgery

---

Eazy Plugin Manager <= 4.1.2 – Missing Authorization via update_options

---

Ultimate Addons for WPBakery <= 3.19.17 – Cross-Site Request Forgery

---

Product Table by WBW <= 1.8.6 – Cross-Site Request Forgery via saveGroup

---

Customize My Account for WooCommerce <= 1.8.3 – Cross-Site Request Forgery via restore_my_account_tabs

---

Product Feed Manager <= 7.3.15 – Authenticated (Admin+) Directory Traversal

---

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.