Wordfence Intelligence Weekly WordPress Vulnerability Report (March 11, 2024 to March 17, 2024)
🎉 Did you know we’re running a Bug Bounty Extravaganza again?
Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!
Last week, there were 167 vulnerabilities disclosed in 129 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 70 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 14,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-684 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 156 |
| Unpatched | 11 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 140 |
| High Severity | 20 |
| Critical Severity | 7 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 110 |
| Missing Authorization | 18 |
| Cross-Site Request Forgery (CSRF) | 15 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 4 |
| Deserialization of Untrusted Data | 3 |
| Improper Control of Generation of Code ('Code Injection') | 3 |
| Exposure of Sensitive Information to an Unauthorized Actor | 2 |
| Server-Side Request Forgery (SSRF) | 2 |
| Unrestricted Upload of File with Dangerous Type | 2 |
| Authorization Bypass Through User-Controlled Key | 1 |
| Exposure of Sensitive Information Through Data Queries | 1 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 1 |
| Improper Input Validation | 1 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 |
| Incorrect Authorization | 1 |
| Insufficiently Protected Credentials | 1 |
| Missing Critical Step in Authentication | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 18 | |
| 12 | |
| 12 | |
| 8 | |
| 8 | |
| 7 | |
| 6 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Accordions | accordions |
| Addon Elements for Elementor (formerly Elementor Addon Elements) | addon-elements-for-elementor-page-builder |
| Advanced Access Manager – Access Governance for WordPress | advanced-access-manager |
| Advanced Sermons | advanced-sermons |
| Anti-Malware Security and Brute-Force Firewall | gotmls |
| AntiSpam for Contact Form 7 | cf7-antispam |
| ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup | armember-membership |
| Auto Affiliate Links | wp-auto-affiliate-links |
| Awesome Support – WordPress HelpDesk & Support Plugin | awesome-support |
| Backuply – Backup, Restore, Migrate and Clone | backuply |
| Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| Builder for WooCommerce product reviews shortcodes – ReviewShort | woo-product-reviews-shortcode |
| Bulgarisation for WooCommerce | bulgarisation-for-woocommerce |
| Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) | burst-statistics |
| Calendarista Basic Edition – WordPress appointment booking system | calendarista-basic-edition |
| Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails | woo-cart-abandonment-recovery |
| Contact Form 7 | contact-form-7 |
| Contact Form 7 – PayPal & Stripe Add-on | contact-form-7-paypal-add-on |
| Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress | contact-form-plugin |
| Contact Forms by Cimatti | contact-forms |
| Coupon Affiliates – Affiliate Plugin for WooCommerce | woo-coupon-usage |
| Crisp – Live Chat and Chatbot | crisp |
| Cryptocurrency Widgets – Price Ticker & Coins List | cryptocurrency-price-ticker-widget |
| CWW Companion | cww-companion |
| Database for Contact Form 7 | cf7-database |
| Download Manager Pro | download-manager |
| DSGVO All in one for WP | dsgvo-all-in-one-for-wp |
| Easy Social Feed – Social Photos Gallery and Post Feed for WordPress | easy-facebook-likebox |
| ElementInvader Addons for Elementor | elementinvader-addons-for-elementor |
| Elements Plus! | elements-plus |
| ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | elementskit-lite |
| Email Subscription Popup — Newsletter & GDPR Consent | email-subscribe |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI | everest-forms |
| Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media | evergreen-content-poster |
| Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) | extensions-for-cf7 |
| f(x) Private Site | fx-private-site |
| Five Star Restaurant Menu and Food Ordering | food-and-drink-menu |
| Free Downloads WooCommerce | download-now-for-woocommerce |
| FV Flowplayer Video Player | fv-wordpress-flowplayer |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| HT Easy GA4 – Google Analytics WordPress Plugin | ht-easy-google-analytics |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| Hubbub Lite – Fast, free social sharing and follow buttons | social-pug |
| HUSKY – Products Filter Professional for WooCommerce | woocommerce-products-filter |
| Hustle – Email Marketing, Lead Generation, Optins, Popups | wordpress-popup |
| Inline Related Posts | intelly-related-posts |
| JetWidgets For Elementor | jetwidgets-for-elementor |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Knight Lab Timeline | knight-lab-timelinejs |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… | ladipage |
| Link Library | link-library |
| Link Whisper Free | link-whisper |
| Livemesh Addons by Elementor | addons-for-elementor |
| Malware Scanner | miniorange-malware-protection |
| MasterStudy LMS WordPress Plugin – for Online Courses and Education | masterstudy-lms-learning-management-system |
| MJM Clinic | mjm-clinic |
| Mollie Forms | mollie-forms |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| News Announcement Scroll | news-announcement-scroll |
| Newsletter2Go | newsletter2go |
| oik | oik |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| OxyExtras | oxyextras |
| Page Builder Gutenberg Blocks – CoBlocks | coblocks |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Permalink Manager Lite | permalink-manager |
| Pie Register – User Registration, Profiles & Content Restriction | pie-register |
| Post Grid | post-grid |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Premmerce Permalink Manager for WooCommerce | woo-permalink-manager |
| Prime Slider Addons for Elementor | bdthemes-prime-slider-lite |
| Property Hive | propertyhive |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Related Posts for WordPress | related-posts-for-wp |
| Scrollsequence – Cinematic Scroll Image Animation Plugin | scrollsequence |
| Shariff Wrapper | shariff |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Simple Job Board | simple-job-board |
| Site Reviews | site-reviews |
| Sitekit | sitekit |
| Sky Addons for Elementor | sky-elementor-addons |
| Smart Online Order for Clover | clover-online-orders |
| Social Media Share Buttons | social-media-builder |
| Specific Content For Mobile – Customize the mobile version without redirections | specific-content-for-mobile |
| Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals | wp-cloudflare-page-cache |
| SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent | supportcandy |
| Survey Maker by AYS | survey-maker |
| Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | tablesome |
| Team Circle Image Slider With Lightbox | circle-image-slider-with-lightbox |
| The Moneytizer | the-moneytizer |
| Themify – WooCommerce Product Filter | themify-wc-product-filter |
| Ticket Tailor — Event Ticketing & Registration | ticket-tailor |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Addons for Elementor | header-footer-elementor |
| Ultimate Gift Cards for WooCommerce | woo-gift-cards-lite |
| User profile | user-profile |
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | userswp |
| Video Conferencing with Zoom | video-conferencing-with-zoom-api |
| Visual Composer Website Builder | visualcomposer |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| WC Shop Sync – Square Payment Gateway and Product Synchronization for WooCommerce | woosquare |
| Web Application Firewall – website security | web-application-firewall |
| weForms – Easy Drag & Drop Contact Form Builder For WordPress | weforms |
| WEN Responsive Columns | wen-responsive-columns |
| WooCommerce License Manager | fs-license-manager |
| WooThumbs for WooCommerce by Iconic | iconic-woothumbs |
| Word Replacer Pro | word-replacer-ultra |
| WordPress Automatic Plugin | wp-automatic |
| WP Armour – Honeypot Anti Spam | honeypot |
| WP Calameo | wp-calameo |
| WP Fusion Lite – Marketing Automation and CRM Integration for WordPress | wp-fusion-lite |
| WP Go Maps – Google Map, OpenStreetMap, Leaflet Map | wp-google-maps |
| WP Popups – WordPress Popup builder | wp-popups-lite |
| WP Recipe Maker | wp-recipe-maker |
| WP Responsive Tabs horizontal vertical and accordion Tabs | responsive-horizontal-vertical-and-accordion-tabs |
| WP SendFox | wp-sendfox |
| WP Statistics – Simple, privacy-friendly Google Analytics alternative | wp-statistics |
| wp-mpdf | wp-mpdf |
| WPBakery Page Builder Addons by Livemesh | addons-for-visual-composer |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping | wp-product-feed-manager |
| WPZOOM Addons for Beaver Builder | wpzoom-addons-for-beaver-builder |
| YITH WooCommerce Product Add-Ons | yith-woocommerce-product-add-ons |
| Zippy | zippy |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Blossom Spa | blossom-spa |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
WordPress Automatic Plugin [wp-automatic]
Researcher
Affected Software
WordPress Automatic Plugin [wp-automatic]
Researcher
Affected Software
Web Application Firewall – website security [web-application-firewall]
Malware Scanner [miniorange-malware-protection]
Researcher
Affected Software
Researcher
Affected Software
Premmerce Permalink Manager for WooCommerce [woo-permalink-manager]
Researcher
Affected Software
Simple Job Board [simple-job-board]
Researcher
Anti-Malware Security and Brute-Force Firewall <= 4.21.96 - Unauthenticated Remote Code Execution
9.0
Affected Software
Researcher
Affected Software
WordPress Automatic Plugin [wp-automatic]
Researcher
Affected Software
HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter]
Researchers
Affected Software
News Announcement Scroll [news-announcement-scroll]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Social Media Share Buttons [social-media-builder]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Hustle – Email Marketing, Lead Generation, Optins, Popups [wordpress-popup]
Researcher
Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.68 - Information Exposure via get_posts API Endpoint
7.5
Affected Software
Post Grid [post-grid]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Bulgarisation for WooCommerce [bulgarisation-for-woocommerce]
Researcher
Affected Software
Bulgarisation for WooCommerce [bulgarisation-for-woocommerce]
Researcher
Affected Software
Contact Forms by Cimatti [contact-forms]
Researcher
Affected Software
Researcher
Affected Software
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) [extensions-for-cf7]
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Zippy [zippy]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
WPZOOM Addons for Beaver Builder [wpzoom-addons-for-beaver-builder]
Researcher
Affected Software
WPZOOM Addons for Beaver Builder [wpzoom-addons-for-beaver-builder]
Researcher
Affected Software
WPZOOM Addons for Beaver Builder [wpzoom-addons-for-beaver-builder]
Researcher
Affected Software
WPZOOM Addons for Beaver Builder [wpzoom-addons-for-beaver-builder]
Researcher
Affected Software
WPZOOM Addons for Beaver Builder [wpzoom-addons-for-beaver-builder]
Researcher
Affected Software
Researcher
Affected Software
Crisp – Live Chat and Chatbot [crisp]
Researcher
Affected Software
CWW Companion [cww-companion]
Researcher
Affected Software
Database for Contact Form 7 [cf7-database]
Researcher
Affected Software
Download Manager Pro [download-manager]
Researcher
Affected Software
Easy Social Feed – Social Photos Gallery and Post Feed for WordPress [easy-facebook-likebox]
Researcher
Affected Software
ElementInvader Addons for Elementor [elementinvader-addons-for-elementor]
Researcher
Affected Software
Addon Elements for Elementor (formerly Elementor Addon Elements) [addon-elements-for-elementor-page-builder]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Ultimate Addons for Elementor [header-footer-elementor]
Researcher
Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links
6.4
Affected Software
Elements Plus! [elements-plus]
Researcher
ElementsKit Elementor addons <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Five Star Restaurant Menu and Food Ordering [food-and-drink-menu]
Researcher
Free Downloads WooCommerce <= 3.5.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Free Downloads WooCommerce [download-now-for-woocommerce]
Researcher
FV Flowplayer Video Player <= 7.5.41.7212 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researchers
Affected Software
HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter]
Researcher
Affected Software
JetWidgets For Elementor [jetwidgets-for-elementor]
Researcher
Affected Software
Knight Lab Timeline [knight-lab-timelinejs]
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
Newsletter2Go [newsletter2go]
Researcher
Affected Software
oik [oik]
Researcher
Affected Software
Researcher
Affected Software
Page Builder Gutenberg Blocks – CoBlocks [coblocks]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Prime Slider Addons for Elementor [bdthemes-prime-slider-lite]
Researcher
Affected Software
Prime Slider Addons for Elementor [bdthemes-prime-slider-lite]
Researcher
Affected Software
Researcher
Affected Software
Scrollsequence – Cinematic Scroll Image Animation Plugin [scrollsequence]
Researcher
Affected Software
Shariff Wrapper [shariff]
Researcher
Affected Software
Shariff Wrapper [shariff]
Researcher
Shariff Wrapper <= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Shariff Wrapper [shariff]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Site Reviews <= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name
6.4
Affected Software
Site Reviews [site-reviews]
Researcher
Affected Software
Site Reviews [site-reviews]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Smart Online Order for Clover <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Smart Online Order for Clover [clover-online-orders]
Researcher
Affected Software
Researcher
Affected Software
The Moneytizer [the-moneytizer]
Researcher
Affected Software
Ticket Tailor — Event Ticketing & Registration [ticket-tailor]
Researcher
Affected Software
User profile [user-profile]
Researcher
Affected Software
Researcher
Affected Software
Video Conferencing with Zoom [video-conferencing-with-zoom-api]
Researcher
Affected Software
WEN Responsive Columns [wen-responsive-columns]
Researcher
Affected Software
WP Calameo [wp-calameo]
Researcher
Affected Software
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]
Researcher
Affected Software
WP Responsive Tabs horizontal vertical and accordion Tabs [responsive-horizontal-vertical-and-accordion-tabs]
Researcher
Affected Software
WPBakery Page Builder Addons by Livemesh [addons-for-visual-composer]
Researcher
Affected Software
Advanced Sermons [advanced-sermons]
Researcher
Affected Software
AntiSpam for Contact Form 7 [cf7-antispam]
Researcher
Affected Software
Researcher
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Calendarista Basic Edition – WordPress appointment booking system [calendarista-basic-edition]
Researcher
Affected Software
Contact Form 7 – PayPal & Stripe Add-on [contact-form-7-paypal-add-on]
Researcher
Affected Software
Contact Form 7 [contact-form-7]
Researcher
Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_address
6.1
Affected Software
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress [contact-form-plugin]
Researcher
Contact Form by BestWebSoft <= 4.2.8 - Reflected Cross-Site Scripting via cntctfrm_contact_subject
6.1
Affected Software
Contact Form by BestWebSoft – Advanced WP Contact Form Builder for WordPress [contact-form-plugin]
Researcher
Affected Software
Coupon Affiliates – Affiliate Plugin for WooCommerce [woo-coupon-usage]
Researcher
Affected Software
Email Subscription Popup — Newsletter & GDPR Consent [email-subscribe]
Researcher
Affected Software
Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media [evergreen-content-poster]
Researcher
Affected Software
Researcher
Affected Software
HT Easy GA4 – Google Analytics WordPress Plugin [ht-easy-google-analytics]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
Link Whisper Free [link-whisper]
Researcher
Affected Software
OxyExtras [oxyextras]
Researcher
Affected Software
Permalink Manager Lite [permalink-manager]
Researcher
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login [custom-registration-form-builder-with-submission-manager]
Researcher
Affected Software
Specific Content For Mobile – Customize the mobile version without redirections [specific-content-for-mobile]
Researcher
Affected Software
Researcher
Affected Software
Themify – WooCommerce Product Filter [themify-wc-product-filter]
Researcher
Affected Software
Researcher
Affected Software
WooCommerce License Manager [fs-license-manager]
Researcher
Affected Software
WooThumbs for WooCommerce by Iconic [iconic-woothumbs]
Researcher
Affected Software
WP Armour – Honeypot Anti Spam [honeypot]
Researcher
Affected Software
wp-mpdf [wp-mpdf]
Researcher
Affected Software
YITH WooCommerce Product Add-Ons [yith-woocommerce-product-add-ons]
Researcher
Affected Software
Blossom Spa [blossom-spa]
Researcher
Affected Software
Advanced Access Manager – Access Governance for WordPress [advanced-access-manager]
Researcher
Affected Software
Researcher
Affected Software
MJM Clinic [mjm-clinic]
Researcher
WooCommerce Google Feed Manager <= 2.2.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting
5.5
Affected Software
WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping [wp-product-feed-manager]
Researcher
Affected Software
Accordions [accordions]
Researcher
Affected Software
Easy Social Feed – Social Photos Gallery and Post Feed for WordPress [easy-facebook-likebox]
Researcher
Affected Software
Related Posts for WordPress [related-posts-for-wp]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
f(x) Private Site [fx-private-site]
Researcher
Affected Software
Researcher
Affected Software
Team Circle Image Slider With Lightbox [circle-image-slider-with-lightbox]
Researcher
Affected Software
Ultimate Gift Cards for WooCommerce [woo-gift-cards-lite]
Researcher
Affected Software
Word Replacer Pro [word-replacer-ultra]
Researcher
Affected Software
Researcher
Themify – WooCommerce Product Filter <= 1.4.3 - Authenticated (Admin+) Stored Cross-Site Scripting
4.8
Affected Software
Themify – WooCommerce Product Filter [themify-wc-product-filter]
Researcher
Affected Software
Researcher
Affected Software
Inline Related Posts [intelly-related-posts]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Survey Maker by AYS [survey-maker]
Researcher
Affected Software
Visual Composer Website Builder [visualcomposer]
Researcher
Affected Software
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map [wp-google-maps]
Researchers
Affected Software
WP Popups – WordPress Popup builder [wp-popups-lite]
Researcher
Affected Software
WP Recipe Maker [wp-recipe-maker]
Researcher
Affected Software
Researcher
Affected Software
Auto Affiliate Links [wp-auto-affiliate-links]
Researcher
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]
Researcher
Builder for WooCommerce reviews shortcodes – ReviewShort <= 1.01.3 - Cross-Site Request Forgery
4.3
Affected Software
Builder for WooCommerce product reviews shortcodes – ReviewShort [woo-product-reviews-shortcode]
Researcher
Affected Software
Cryptocurrency Widgets – Price Ticker & Coins List [cryptocurrency-price-ticker-widget]
Researcher
Affected Software
DSGVO All in one for WP [dsgvo-all-in-one-for-wp]
Researcher
Affected Software
Easy Social Feed – Social Photos Gallery and Post Feed for WordPress [easy-facebook-likebox]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
MasterStudy LMS <= 3.2.13 - Missing Authorization to Sensitive Information Exposure in search_posts
4.3
Affected Software
MasterStudy LMS WordPress Plugin – for Online Courses and Education [masterstudy-lms-learning-management-system]
Researcher
Affected Software
Mollie Forms [mollie-forms]
Researcher
Affected Software
Mollie Forms [mollie-forms]
Researcher
Affected Software
Super Page Cache – Cloudflare Cache, Page Speed & Core Web Vitals [wp-cloudflare-page-cache]
Researcher
Affected Software
Themify – WooCommerce Product Filter [themify-wc-product-filter]
Researcher
Affected Software
Researcher
Affected Software
Cart Abandonment Recovery for WooCommerce – Recover Lost Sales with Automated Emails [woo-cart-abandonment-recovery]
Researcher
Affected Software
WP SendFox [wp-sendfox]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments