Wordfence Intelligence Weekly WordPress Vulnerability Report (February 19, 2024 to February 25, 2024)


🎉 Did you know we’re running a Bug Bounty Extravaganza again?

Earn over 6x our usual bounty rates, up to $10,000,  for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!


Last week, there were 88 vulnerabilities disclosed in 61 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 37 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 14,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.


New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.


Total Unpatched & Patched Vulnerabilities Last Week

Patch Status Number of Vulnerabilities
Patched 71
Unpatched 17


Total Vulnerabilities by CVSS Severity Last Week

Severity Rating Number of Vulnerabilities
Low Severity 1
Medium Severity 73
High Severity 12
Critical Severity 2


Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE Number of Vulnerabilities
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 27
Missing Authorization 15
Cross-Site Request Forgery (CSRF) 14
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 12
Improper Access Control 6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 3
Information Exposure 3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2
Deserialization of Untrusted Data 1
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') 1
Improper Privilege Management 1
Server-Side Request Forgery (SSRF) 1
Unprotected Storage of Credentials 1
Unrestricted Upload of File with Dangerous Type 1


Researchers That Contributed to WordPress Security Last Week

Researcher Name Number of Vulnerabilities
10
10
8
6
6
4
4
4
3
3
2
2
2
2
2
1
1
1
1
1
1
1
1
1
1
1
1
Sh
1
1
1
1
1
1
1
1
1
1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.


WordPress Plugins with Reported Vulnerabilities Last Week

Software Name Software Slug
3D FlipBook – PDF Flipbook WordPress interactive-3d-flipbook-powered-physics-engine
Academy LMS – eLearning and online course solution for WordPress academy
Addon Library addon-library
Admin side data storage for Contact Form 7 admin-side-data-storage-for-contact-form-7
Advanced Social Feeds Widget & Shortcode advanced-facebook-twitter-widget
Archivist – Custom Archive Templates archivist-custom-archive-templates
Backup Bolt backup-bolt
BackWPup – WordPress Backup Plugin backwpup
Beaver Builder – WordPress Page Builder beaver-builder-lite-version
Brizy – Page Builder brizy
Change Table Prefix change-table-prefix
Colibri Page Builder colibri-page-builder
Coming Soon Maintenance Mode coming-soon-maintenance-mode
Contact Form builder with drag & drop for WordPress – Kali Forms kali-forms
Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce cost-of-goods-for-woocommerce
Custom Order Statuses for WooCommerce custom-order-statuses-for-woocommerce
Database Reset wordpress-database-reset
Digits: WordPress Mobile Number Signup and Login digits
Elementor Addon Elements addon-elements-for-elementor-page-builder
Enhanced Text Widget enhanced-text-widget
Enjoy Social Feed plugin for WordPress website enjoy-instagram-instagram-responsive-images-gallery-and-carousel
Error Log Viewer by BestWebSoft error-log-viewer
Event Tickets and Registration event-tickets
Fancy Product Designer fancy-product-designer
Featured Image from URL (FIFU) featured-image-from-url
File Manager Pro wp-file-manager-pro
FormFacade – WordPress plugin for Google Forms formfacade
Heureka heureka
Innovs HR – Complete Human Resource Management System for Your Business innovs-hr-manager
Jobs for WordPress job-postings
KODO Qiniu kodo-qiniu
Link Library link-library
Maintenance Page maintenance-page
Oliver POS – A WooCommerce Point of Sale (POS) oliver-pos
Page Builder: Pagelayer – Drag and Drop website builder pagelayer
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress wp-user-avatar
Password Protected – Ultimate Plugin to Protect WordPress Site, Pages & WooCommerce Store password-protected
PeproDev Ultimate Invoice pepro-ultimate-invoice
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio play-ht
Plugin Groups plugin-groups
Product Catalog Mode For WooCommerce woocommerce-catalog-enquiry
RegistrationMagic – User Registration Plugin with Custom Registration Forms custom-registration-form-builder-with-submission-manager
Relevanssi – A Better Search relevanssi
Scalable Vector Graphics (SVG) scalable-vector-graphics-svg
Schema & Structured Data for WP & AMP schema-and-structured-data-for-wp
Simple Job Board simple-job-board
Social Sharing Plugin – Sassy Social Share sassy-social-share
SuperFaktura WooCommerce woocommerce-superfaktura
Tabs Shortcode and Widget tabs-shortcode-and-widget
Tutor LMS – eLearning and online course solution tutor
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds userfeedback-lite
Widget for Social Page Feeds facebook-pagelike-widget
WooCommerce Google Sheet Connector wc-gsheetconnector
WordPress User Registration Forms by Formidable Forms formidable-registration
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce wp-event-manager
WP Shortcodes Plugin — Shortcodes Ultimate shortcodes-ultimate
wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables
WPify Woo Czech wpify-woo
YARPP – Yet Another Related Posts Plugin yet-another-related-posts-plugin
YML for Yandex Market yml-for-yandex-market


WordPress Themes with Reported Vulnerabilities Last Week

Software Name Software Slug
Colibri WP colibri-wp


Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

CVSS Rating
Critical (9.1)
CVE-ID
CVE-2024-0365
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
Fancy Product Designer
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1710
Patch Status
Unpatched
Published
Feb 23, 2024
Affected Software
Addon Library
Researcher
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1311
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
Brizy – Page Builder
Researcher
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-0203
Patch Status
Patched
Published
Feb 22, 2024
CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1358
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Elementor Addon Elements
Researcher
CVSS Rating
High (7.5)
CVE-ID
CVE-2024-25933
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
PeproDev Ultimate Invoice
Researcher
CVSS Rating
High (7.3)
CVE-ID
CVE-2024-0702
Patch Status
Patched
Published
Feb 19, 2024
CVSS Rating
High (7.2)
CVE-ID
CVE-2024-1776
Patch Status
Unpatched
Published
Feb 22, 2024
CVSS Rating
High (7.1)
CVE-ID
CVE-2024-25932
Patch Status
Unpatched
Published
Feb 20, 2024
Affected Software
Change Table Prefix
Researcher
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-1559
Patch Status
Patched
Published
Feb 19, 2024
Affected Software
Link Library
Researcher
CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-1108
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
Plugin Groups
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1081
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0897
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1291
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
Brizy – Page Builder
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1296
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
Brizy – Page Builder
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1293
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
Brizy – Page Builder
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1393
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Elementor Addon Elements
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1392
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Elementor Addon Elements
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1391
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Elementor Addon Elements
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1422
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Elementor Addon Elements
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1496
Patch Status
Patched
Published
Feb 19, 2024
Affected Software
Featured Image from URL (FIFU)
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-25934
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0820
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Jobs for WordPress
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1448
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2023-7085
Patch Status
Unpatched
Published
Feb 20, 2024
Affected Software
Scalable Vector Graphics (SVG)
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1586
Patch Status
Patched
Published
Feb 19, 2024
Researcher
CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0719
Patch Status
Unpatched
Published
Feb 20, 2024
Affected Software
Tabs Shortcode and Widget
Researcher
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-1810
Patch Status
Patched
Published
Feb 23, 2024
Researcher
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2023-7015
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
File Manager Pro
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-0976
Patch Status
Patched
Published
Feb 23, 2024
CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-1365
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
YML for Yandex Market
Researcher
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1038
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-25930
Patch Status
Unpatched
Published
Feb 20, 2024
Researcher
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1758
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
SuperFaktura WooCommerce
Researcher
CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1128
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1779
Patch Status
Unpatched
Published
Feb 22, 2024
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2023-7236
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
Backup Bolt
Researcher
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1475
Patch Status
Patched
Published
Feb 19, 2024
Affected Software
Coming Soon Maintenance Mode
Researcher
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0779
Patch Status
Unpatched
Published
Feb 20, 2024
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2023-6821
Patch Status
Patched
Published
Feb 20, 2024
Researcher
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1370
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Maintenance Page
Researcher
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1462
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Maintenance Page
Researcher
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1380
Patch Status
Patched
Published
Feb 22, 2024
Affected Software
Relevanssi – A Better Search
Researcher
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0593
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
Simple Job Board
Researcher
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1562
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1492
Patch Status
Patched
Published
Feb 19, 2024
Affected Software
WPify Woo Czech
Researcher
CVSS Rating
Medium (4.7)
CVE-ID
CVE-2024-1501
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
Database Reset
Researcher
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-0951
Patch Status
Unpatched
Published
Feb 20, 2024
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-0559
Patch Status
Patched
Published
Feb 20, 2024
Affected Software
Enhanced Text Widget
Researcher
CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-0973
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Widget for Social Page Feeds
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1777
Patch Status
Unpatched
Published
Feb 22, 2024
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1778
Patch Status
Unpatched
Published
Feb 22, 2024
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1165
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
Brizy – Page Builder
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1362
Patch Status
Patched
Published
Feb 22, 2024
Affected Software
Colibri Page Builder
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1361
Patch Status
Patched
Published
Feb 22, 2024
Affected Software
Colibri Page Builder
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1360
Patch Status
Patched
Published
Feb 22, 2024
Affected Software
Colibri WP
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1218
Patch Status
Patched
Published
Feb 19, 2024
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-0780
Patch Status
Unpatched
Published
Feb 20, 2024
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1053
Patch Status
Patched
Published
Feb 21, 2024
Affected Software
Event Tickets and Registration
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-25931
Patch Status
Unpatched
Published
Feb 20, 2024
Affected Software
Heureka
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
Unknown
Patch Status
Patched
Published
Feb 23, 2024
Affected Software
KODO Qiniu
Researcher(s): Unknown
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-25929
Patch Status
Patched
Published
Feb 20, 2024
Researcher
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-25935
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1288
Patch Status
Patched
Published
Feb 19, 2024
CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1133
Patch Status
Patched
Published
Feb 20, 2024
CVSS Rating
Low (2.2)
CVE-ID
CVE-2023-5775
Patch Status
Patched
Published
Feb 23, 2024


As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

Did you enjoy this post? Share it!

Comments

No Comments