Wordfence Intelligence Weekly WordPress Vulnerability Report (April 8, 2024 to April 14, 2024)
🎉 Did you know we’re running a Bug Bounty Extravaganza again?
Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!
Last week, there were 222 vulnerabilities disclosed in 218 WordPress Plugins, 22 WordPress Themes, and one in WordPress Core that have been added to the Wordfence Intelligence Vulnerability Database, and there were 69 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 15,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 – Authenticated (Contributor+) Stored Cross-Site Scripting
- WordPress Core < 6.5.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block
- WAF-RULE-690 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 196 |
| Unpatched | 26 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 198 |
| High Severity | 11 |
| Critical Severity | 13 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Cross-Site Request Forgery (CSRF) | 103 |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 63 |
| Missing Authorization | 24 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 14 |
| Deserialization of Untrusted Data | 3 |
| Exposure of Sensitive Information to an Unauthorized Actor | 3 |
| Server-Side Request Forgery (SSRF) | 3 |
| Improper Authorization | 2 |
| Improper Input Validation | 2 |
| Unrestricted Upload of File with Dangerous Type | 2 |
| URL Redirection to Untrusted Site ('Open Redirect') | 2 |
| Improper Access Control | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 53 | |
| 12 | |
| 11 | |
| 9 | |
| 7 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Account Engagement | pardot |
| ActiveCampaign – The autonomous marketing platform | activecampaign-subscription-forms |
| Ads.txt Admin | ads-txt-admin |
| Advanced Cron Manager – debug & control | advanced-cron-manager |
| Advanced iFrame | advanced-iframe |
| Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress | advanced-page-visit-counter |
| Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters | advanced-post-block |
| AffiEasy | affieasy |
| AIKit - WordPress AI Automatic Writer, Chatbot, Writing Assistant & Content Repurposer / OpenAI GPT | aikit-wordpress-ai-writing-assistant-using-gpt3 |
| All-in-One Addons for Elementor – WidgetKit | widgetkit-for-elementor |
| Appointment Bookings for Zoom GoogleMeet and more – Wappointment | wappointment |
| AppPresser – Mobile App Framework | apppresser |
| Asgaros Forum | asgaros-forum |
| Aspose.Words – Import and Export word documents | aspose-doc-exporter |
| AWP Classifieds | another-wordpress-classifieds-plugin |
| BA Book Everything | ba-book-everything |
| Backup Migration | backup-backup |
| BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | woo-bulk-editor |
| Before And After: Lead Capture Forms For WordPress | before-and-after |
| Benchmark Email Lite | benchmark-email-lite |
| BizCalendar Web | bizcalendar-web |
| Blocksy Companion | blocksy-companion |
| Bold Page Builder | bold-page-builder |
| Booking for Appointments and Events Calendar – Amelia | ameliabooking |
| Boostify Header Footer Builder for Elementor | boostify-header-footer-builder |
| Build 5 Star Reviews on Google Reviews, Yelp, Facebook… easily and risk-free | RRatingg | 5-stars-rating-funnel |
| bunny.net – WordPress CDN Plugin | bunnycdn |
| Button Generator – Easily Create Custom Buttons with Icons and Analytics | button-generation |
| BWL Advanced FAQ Manager | bwl-advanced-faq-manager |
| Calendarista Basic Edition – WordPress appointment booking system | calendarista-basic-edition |
| Carousel Slider | carousel-slider |
| Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | wp-carousel-free |
| CBX Bookmark & Favorite | cbxwpbookmark |
| Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode | chat-viber |
| ChatHelp – Click to Chat Button, WooCommerce Chat to Order & Floating Chat Form | chat-help |
| Church Admin | church-admin |
| Church Content – Sermons, Events and More | church-theme-content |
| Citadela Directory | citadela-directory |
| Click To Dial – Wp Click To Call Support | click-to-dial |
| Click To Email – Chat Bubble & Mail Button for WP | click-to-mail |
| Clone | wp-clone-by-wp-academy |
| Contact Form Plugin | contact-form-lite |
| Convert Post Types | convert-post-types |
| Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress | counter-box |
| Crony Cronjob Manager | crony |
| Currency per Product for WooCommerce | currency-per-product-for-woocommerce |
| Customily Product Personalizer | customily-v2 |
| Dashboard To-Do List | dashboard-to-do-list |
| Dashboard Welcome for Elementor | dashboard-welcome-for-elementor |
| Disable Comments | WPZest | disable-comments-wpz |
| Download Manager | downloadmanager |
| Duplicate Page, Hide Title, Custom CSS & JS, Exclude Search, Template Info – Pagely | current-template-name |
| Duplicate Post | copy-delete-posts |
| E2Pdf – Export Pdf Tool for WordPress | e2pdf |
| Easy Logo | easylogo |
| Easy Table Rate Shipping for WooCommmerce | easy-table-rate-shipping-for-woocommerce |
| eCommerce Product Catalog Plugin for WordPress | ecommerce-product-catalog |
| Element Pack Addons for Elementor – Widgets, Templates and Addons | bdthemes-element-pack-lite |
| ELEX WooCommerce Dynamic Pricing and Discounts | elex-woocommerce-dynamic-pricing-and-discounts |
| Email Marketing for WooCommerce by Omnisend | omnisend-connect |
| Enhanced Text Widget | enhanced-text-widget |
| Entryway – WP Login & Logout Redirect | wp-login-and-logout-redirect |
| eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams | eroom-zoom-meetings-webinar |
| Essential Grid Gallery WordPress Plugin | essential-grid |
| Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar | mage-eventpress |
| Events Slider, Events Carousel, Events Grid, Events Timeline and Events Filter Bar for The Events Calendar – Eventful | eventful |
| EWWW Image Optimizer | ewww-image-optimizer |
| Exclusive Addons for Elementor | exclusive-addons-for-elementor |
| Extra Product Options Builder for WooCommerce | additional-product-fields-for-woocommerce |
| EZ Form Calculator | ez-form-calculator |
| F4 Improvements | f4-improvements |
| Favicon by RealFaviconGenerator | favicon-by-realfavicongenerator |
| Filter Custom Fields & Taxonomies Light | filter-custom-fields-taxonomies-light |
| Finale Lite – Sales Countdown Timer & Discount for WooCommerce | finale-woocommerce-sales-countdown-timer-discount |
| Find Duplicates | find-duplicates |
| FlexTable – Data Table Sync with Google Sheets | sheets-to-wp-table-live-sync |
| Float menu – awesome floating side menu | float-menu |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Forms to Zapier, Integromat, IFTTT, Workato, Automate.io, elastic.io, Built.io, APIANT, Webhook | forms-to-zapier |
| Freshdesk (official) | freshdesk-support |
| FV Flowplayer Video Player | fv-wordpress-flowplayer |
| Gallery Box | gallery-box |
| GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | gamipress |
| Genesis Blocks | genesis-blocks |
| GEO my WP | geo-my-wp |
| Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) | gift-voucher |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| GP Unique ID | gp-unique-id |
| GS Posts Widget | posts-widget |
| Gutenberg | gutenberg |
| Gutenverse – WordPress Blocks, Page Builder & Site Editor | gutenverse |
| Happy WooCommerce FAQs – Ultimate Product FAQ Plugin | faq-for-woocommerce |
| Hosting Benchmark tool | wpbenchmark |
| IDonate – Blood Donation, Request And Donor Management System | idonate |
| Import Users from CSV | import-users-from-csv |
| Inline Related Posts | intelly-related-posts |
| InstaWP Connect – 1-click WP Staging & Migration | instawp-connect |
| Intagrate Lite | instagrate-to-wordpress |
| IP2Location Country Blocker | ip2location-country-blocker |
| Ivory Search – WordPress Search Plugin | add-search-to-menu |
| Job Postings | job-postings |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Kattene | kattene |
| Kimili Flash Embed | kimili-flash-embed |
| Lead Form Builder & Contact Form | lead-form-builder |
| Leadinfo | leadinfo |
| Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) | leaflet-maps-marker |
| Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator | legal-pages |
| Libsyn Publisher Hub | libsyn-podcasting |
| LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes | lifterlms |
| Link Whisper Free | link-whisper |
| Live Composer – Free WordPress Website Builder | live-composer-page-builder |
| Livemesh Addons by Elementor | addons-for-elementor |
| Load More Anything | ajax-load-more-anything |
| Login With Ajax – Fast Logins, 2FA, Redirects | login-with-ajax |
| Login | Login Page | Login Logo | Rename Login Page | Custom Login Page | Temporary Users | Rebrand Login | Login Captcha | feather-login-page |
| Mail logging – WP Mail Catcher | wp-mail-catcher |
| Mailmunch Forms for Mailchimp | mailchimp-forms-by-mailmunch |
| Marker.io – Visual Website Feedback | marker-io |
| Matterport Shortcode | shortcode-gallery-for-matterport-showcase |
| Membership Plugin – Kadence Memberships | restrict-content |
| MihanPanel – User Login , Registration and Dashboard | mihanpanel-lite |
| Modal Window – create popup modal window | modal-window |
| MultiParcels Shipping For WooCommerce | multiparcels-shipping-for-woocommerce |
| MWW Disclaimer Buttons | mww-disclaimer-buttons |
| Newsletter – Send awesome emails from WordPress | newsletter |
| NextMove Lite – Thank You Page for WooCommerce | woo-thank-you-page-nextmove-lite |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| No-Bot Registration | no-bot-registration |
| Novelist | novelist |
| Ocean Extra | ocean-extra |
| Order Delivery Date for WooCommerce | order-delivery-date-for-woocommerce |
| OTP Login With Phone Number, OTP Verification | login-with-phone-number |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| Ovic Addon Toolkit | ovic-addon-toolkit |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| POEditor | poeditor |
| Pop-up | pop-up-pop-up |
| Popup Box – Easily Create WordPress Popups | popup-box |
| Popup Like box – Page Plugin | ays-facebook-popup-likebox |
| Post Type Builder | themify-ptb |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Premmerce Product Filter for WooCommerce | premmerce-woocommerce-product-filter |
| Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages | unlimited-elementor-inner-sections-by-boomdevs |
| Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More | purple-xmls-google-product-feed-for-woocommerce |
| Product Input Fields for WooCommerce | product-input-fields-for-woocommerce |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| Realtyna Organic IDX plugin + WPL Real Estate | real-estate-listing-realtyna-wpl |
| ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System | redi-restaurant-reservation |
| Redirection | redirect-redirection |
| Remove Footer Credit | remove-footer-credit |
| Responsive Slider – Sangar Slider | sangar-slider-lite |
| RestroPress – Online Food Ordering System | restropress |
| RSS Redirect & Feedburner Alternative | feedburner-alternative-and-rss-redirect |
| Save as Image Plugin by PDFCrowd | save-as-image-by-pdfcrowd |
| Save as PDF Plugin by PDFCrowd | save-as-pdf-by-pdfcrowd |
| Search Keyword Redirect | wp-search-keyword-redirect |
| SEO Booster | seo-booster |
| Shipping Live Rates and Access Points for UPS for WooCommerce | flexible-shipping-ups |
| Shipping Live Rates for USPS for WooCommerce | flexible-shipping-usps |
| Shopkeeper Extender | shopkeeper-extender |
| Shopping Cart & eCommerce Store | wp-easycart |
| Short URL | shorten-url |
| Side Menu Lite – Sticky Floating Side Menu | side-menu-lite |
| Simple Post Notes | simple-post-notes |
| Siteimprove | siteimprove |
| Slider Revolution | revslider |
| Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | ml-slider |
| Smart Forms – when you need more than just a contact form | smart-forms |
| Smart Popup by Supsystic | popup-by-supsystic |
| Smart Slider 3 | smart-slider-3 |
| Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | custom-facebook-feed |
| Social Media Social Share Icon | add-social-share |
| Social Proof Popups & Real-Time Notifications – Herd Effects | mwp-herd-effect |
| Social Share Icons & Social Share Buttons | ultimate-social-media-plus |
| Spotlight Social Feeds – Block, Shortcode, and Widget | spotlight-social-photo-feeds |
| SSL Mixed Content Fix | http-https-remover |
| Sticky Buttons – Floating Buttons Builder | sticky-buttons |
| Subscribe2 – Form, Email Subscribers & Newsletters | subscribe2 |
| Sync Post With Other Site | sync-post-with-other-site |
| Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | tablesome |
| The Events Calendar | the-events-calendar |
| Top Bar | top-bar |
| TOP Table Of Contents | top-table-of-contents |
| Translate WordPress with ConveyThis – AI Multilingual Plugin | conveythis-translate |
| Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Plugin | tour-booking-manager |
| TWIPLA (Visitor Analytics IO) – Privacy-First Website Stats, Session Recordings, Heatmaps, Polls and Surveys | visitor-analytics-io |
| Ultimate Before After Image Slider & Gallery – BEAF | beaf-before-and-after-gallery |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| Ultimate Posts Widget | ultimate-posts-widget |
| Ultimate Product Catalog | ultimate-product-catalogue |
| Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor | ultimate-store-kit |
| User Activity Log Pro | user-activity-log-pro |
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | userswp |
| Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | wallet-system-for-woocommerce |
| WebinarIgnition – Live, Automated & Evergreen Webinar System also for WooCommerce | webinar-ignition |
| Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode | coming-soon |
| Welcart e-Commerce | usc-e-shop |
| WOLF – WordPress Posts Bulk Editor and Manager Professional | bulk-editor |
| WordPress Flipbook by Supsystic | digital-publications-by-supsystic |
| Wow Skype Buttons | mwp-skype |
| WP Accessibility Helper (WAH) | wp-accessibility-helper |
| WP Activity Log Premium | wp-security-audit-log-premium |
| WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets | wp-all-import |
| WP Client Reports | wp-client-reports |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| WP Encryption – No.1 HTTPS plugin & One Click Free SSL Cert, HTTPS Redirect, SSL Security | wp-letsencrypt-ssl |
| WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar | wp-event-aggregator |
| WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics | wp-google-analytics-events |
| WP Radio – Worldwide Online Radio Stations Directory for WordPress | wp-radio |
| WP Synchro – The Ultimate WordPress Migration Tool | wpsynchro |
| WP2LEADS | WordPress und KlickTipp einfach verbinden – WooCommerce und KlickTipp einfach verbinden | wp2leads |
| WPBakery Page Builder | js_composer |
| WPC Smart Quick View for WooCommerce | woo-smart-quick-view |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| WPZOOM Social Feed Widget & Block | instagram-widget-by-wpzoom |
| Zoho Campaigns | zoho-campaigns |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Blocksy | blocksy |
| CityLogic | citylogic |
| Decode | decode |
| Default Mag | default-mag |
| Emmet Lite | emmet-lite |
| Gridsby | gridsby |
| HappenStance | happenstance |
| i-excel | i-excel |
| i-max | i-max |
| Lightning | lightning |
| Namaha | namaha |
| NewsXpress | newsxpress |
| Panoramic | panoramic |
| PopularFX | popularfx |
| Sarada Lite | sarada-lite |
| Sensible WP | sensible-wp |
| Shopstar! | shopstar |
| Sliding Door | sliding-door |
| Soledad | soledad |
| Spa and Salon | spa-and-salon |
| The Conference | the-conference |
| X-T9 | x-t9 |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]
Researcher
Affected Software
AIKit - WordPress AI Automatic Writer, Chatbot, Writing Assistant & Content Repurposer / OpenAI GPT [aikit-wordpress-ai-writing-assistant-using-gpt3]
Researcher
Affected Software
BA Book Everything [ba-book-everything]
Researcher
Affected Software
Find Duplicates [find-duplicates]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
User Activity Log Pro [user-activity-log-pro]
Researcher
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
Affected Software
Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress [advanced-page-visit-counter]
Researcher
Affected Software
BWL Advanced FAQ Manager [bwl-advanced-faq-manager]
Researcher
Affected Software
CBX Bookmark & Favorite [cbxwpbookmark]
Researcher
Affected Software
Disable Comments | WPZest [disable-comments-wpz]
Researcher
Affected Software
Researcher
Affected Software
Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More [purple-xmls-google-product-feed-for-woocommerce]
Researcher
Affected Software
Shopping Cart & eCommerce Store [wp-easycart]
Researcher
Affected Software
WP Activity Log Premium [wp-security-audit-log-premium]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Citadela Directory [citadela-directory]
Researcher
Affected Software
Researcher
Affected Software
Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel [wp-carousel-free]
Researcher
Affected Software
Customily Product Personalizer [customily-v2]
Researcher
Affected Software
Import Users from CSV [import-users-from-csv]
Researcher
Affected Software
Translate WordPress with ConveyThis – AI Multilingual Plugin [conveythis-translate]
Researcher
Affected Software
WordPress [wordpress]
Researchers
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Affected Software
Lead Form Builder & Contact Form [lead-form-builder]
Researcher
Advanced iFrame <= 2024.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Advanced iFrame [advanced-iframe]
Researcher
Affected Software
All-in-One Addons for Elementor – WidgetKit [widgetkit-for-elementor]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
6.4
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Contact Form Plugin [contact-form-lite]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Genesis Blocks [genesis-blocks]
Researcher
Affected Software
Researcher
Patch Status
Patched
Patched
Published
Apr 9, 2024
Apr 9, 2024
Affected Software
Gutenberg [gutenberg]
Researchers
Affected Software
Researcher
Affected Software
Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) [leaflet-maps-marker]
Researcher
Affected Software
Libsyn Publisher Hub [libsyn-podcasting]
Researcher
Affected Software
Ocean Extra [ocean-extra]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Premium Addons for Elementor <= 4.10.24 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Slider Revolution [revslider]
Researchers
Affected Software
Shopkeeper Extender [shopkeeper-extender]
Researcher
Affected Software
Researcher
Affected Software
Smart Slider 3 [smart-slider-3]
Researcher
Affected Software
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPBakery Page Builder [js_composer]
Researcher
Affected Software
WPBakery Page Builder [js_composer]
Researcher
Affected Software
WPBakery Page Builder [js_composer]
Researcher
Affected Software
WPBakery Page Builder [js_composer]
Researcher
Affected Software
BizCalendar Web [bizcalendar-web]
Affected Software
EZ Form Calculator [ez-form-calculator]
Researcher
Affected Software
Freshdesk (official) [freshdesk-support]
Researcher
Affected Software
Job Postings [job-postings]
Researcher
Affected Software
Post Type Builder [themify-ptb]
Researcher
Affected Software
Short URL [shorten-url]
Researcher
Affected Software
WP Google Analytics Events – No-Code Custom Event Tracking for Google Analytics [wp-google-analytics-events]
Researcher
Affected Software
Finale Lite – Sales Countdown Timer & Discount for WooCommerce [finale-woocommerce-sales-countdown-timer-discount]
Researcher
Affected Software
ActiveCampaign – The autonomous marketing platform [activecampaign-subscription-forms]
Researcher
Affected Software
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Shipping Live Rates for USPS for WooCommerce [flexible-shipping-usps]
Researcher
Affected Software
Welcart e-Commerce [usc-e-shop]
Researcher
Affected Software
Build 5 Star Reviews on Google Reviews, Yelp, Facebook… easily and risk-free | RRatingg [5-stars-rating-funnel]
Researcher
Affected Software
Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters [advanced-post-block]
Researcher
Affected Software
Researcher
Affected Software
Blocksy Companion [blocksy-companion]
Researcher
Affected Software
Download Manager [downloadmanager]
Researcher
Affected Software
Element Pack Addons for Elementor – Widgets, Templates and Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
ELEX WooCommerce Dynamic Pricing and Discounts [elex-woocommerce-dynamic-pricing-and-discounts]
Researcher
Affected Software
Essential Grid Gallery WordPress Plugin [essential-grid]
Researcher
Affected Software
GP Unique ID [gp-unique-id]
Researcher
Affected Software
Leadinfo [leadinfo]
Researcher
Affected Software
Premmerce Product Filter for WooCommerce [premmerce-woocommerce-product-filter]
Researcher
Affected Software
Membership Plugin – Kadence Memberships [restrict-content]
Researcher
Affected Software
Soledad [soledad]
Researcher
Affected Software
Advanced Cron Manager – debug & control [advanced-cron-manager]
Researcher
Affected Software
bunny.net – WordPress CDN Plugin [bunnycdn]
Researcher
Affected Software
Carousel Slider [carousel-slider]
Researcher
Affected Software
F4 Improvements [f4-improvements]
Researcher
Affected Software
Intagrate Lite [instagrate-to-wordpress]
Researcher
Affected Software
MWW Disclaimer Buttons [mww-disclaimer-buttons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
POEditor [poeditor]
Researcher
Affected Software
Popup Like box – Page Plugin [ays-facebook-popup-likebox]
Researcher
Affected Software
Remove Footer Credit [remove-footer-credit]
Researcher
Affected Software
Save as Image Plugin by PDFCrowd [save-as-image-by-pdfcrowd]
Researchers
Affected Software
Save as PDF Plugin by PDFCrowd [save-as-pdf-by-pdfcrowd]
Researchers
Affected Software
Search Keyword Redirect [wp-search-keyword-redirect]
Researcher
Affected Software
Researcher
Affected Software
Top Bar [top-bar]
Researcher
Affected Software
Researcher
Affected Software
Entryway – WP Login & Logout Redirect [wp-login-and-logout-redirect]
Researcher
Affected Software
WPC Smart Quick View for WooCommerce [woo-smart-quick-view]
Researcher
Affected Software
Ads.txt Admin [ads-txt-admin]
Researcher
Affected Software
AffiEasy [affieasy]
Researcher
Affected Software
Booking for Appointments and Events Calendar – Amelia [ameliabooking]
Researcher
Affected Software
AppPresser – Mobile App Framework [apppresser]
Researcher
Affected Software
Subscribe2 – Form, Email Subscribers & Newsletters [subscribe2]
FlexTable – Data Table Sync with Google Sheets [sheets-to-wp-table-live-sync]
Dashboard Welcome for Elementor [dashboard-welcome-for-elementor]
Happy WooCommerce FAQs – Ultimate Product FAQ Plugin [faq-for-woocommerce]
Load More Anything [ajax-load-more-anything]
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar [mage-eventpress]
Duplicate Page, Hide Title, Custom CSS & JS, Exclude Search, Template Info – Pagely [current-template-name]
Exclusive Addons for Elementor [exclusive-addons-for-elementor]
TOP Table Of Contents [top-table-of-contents]
Researcher
Affected Software
Asgaros Forum [asgaros-forum]
Researcher
Affected Software
Aspose.Words – Import and Export word documents [aspose-doc-exporter]
Researcher
Affected Software
AWP Classifieds [another-wordpress-classifieds-plugin]
Researcher
Affected Software
Ultimate Before After Image Slider & Gallery – BEAF [beaf-before-and-after-gallery]
Researcher
Affected Software
Before And After: Lead Capture Forms For WordPress [before-and-after]
Researcher
Affected Software
Benchmark Email Lite [benchmark-email-lite]
Researcher
Affected Software
Blocksy [blocksy]
Researcher
Affected Software
Button Generator – Easily Create Custom Buttons with Icons and Analytics [button-generation]
Researcher
Affected Software
Calendarista Basic Edition – WordPress appointment booking system [calendarista-basic-edition]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
Church Content – Sermons, Events and More <= 2.6 - Cross-Site Request Forgery to Notice Dismissal
4.3
Affected Software
Church Content – Sermons, Events and More [church-theme-content]
Researcher
Affected Software
Citadela Directory [citadela-directory]
Researcher
Affected Software
Researcher
Affected Software
Convert Post Types [convert-post-types]
Researcher
Counter Box – WordPress plugin for countdown, timer, counter <= 1.2.3 - Cross-Site Request Forgery
4.3
Affected Software
Researcher
Affected Software
Crony Cronjob Manager [crony]
Researcher
Affected Software
Currency per Product for WooCommerce [currency-per-product-for-woocommerce]
Researcher
Affected Software
Dashboard To-Do List [dashboard-to-do-list]
Researcher
Affected Software
WordPress Flipbook by Supsystic [digital-publications-by-supsystic]
Researcher
Affected Software
IP2Location Country Blocker [ip2location-country-blocker]
Researcher
Affected Software
Researcher
Affected Software
eCommerce Product Catalog Plugin for WordPress [ecommerce-product-catalog]
Researcher
Affected Software
ELEX WooCommerce Dynamic Pricing and Discounts [elex-woocommerce-dynamic-pricing-and-discounts]
Researcher
Affected Software
Email Marketing for WooCommerce by Omnisend [omnisend-connect]
Researcher
Affected Software
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams [eroom-zoom-meetings-webinar]
Researcher
Affected Software
EWWW Image Optimizer [ewww-image-optimizer]
Researcher
Affected Software
Extra Product Options Builder for WooCommerce [additional-product-fields-for-woocommerce]
Researcher
Affected Software
Favicon by RealFaviconGenerator [favicon-by-realfavicongenerator]
Researcher
Affected Software
Researcher
Affected Software
Filter Custom Fields & Taxonomies Light [filter-custom-fields-taxonomies-light]
Researcher
Affected Software
Float menu – awesome floating side menu [float-menu]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Herd Effects – fake notifications and social proof plugin <= 5.2.6 - Cross-Site Request Forgery
4.3
Affected Software
Social Proof Popups & Real-Time Notifications – Herd Effects [mwp-herd-effect]
Researcher
Import any XML or CSV File to WordPress <= 3.7.3 - Cross-Site Request Forgery to Notice Dismissal
4.3
Affected Software
Researcher
Affected Software
Redirection [redirect-redirection]
Clone [wp-clone-by-wp-academy]
Pop-up [pop-up-pop-up]
SSL Mixed Content Fix [http-https-remover]
Social Share Icons & Social Share Buttons [ultimate-social-media-plus]
Ultimate Posts Widget [ultimate-posts-widget]
Backup Migration [backup-backup]
RSS Redirect & Feedburner Alternative [feedburner-alternative-and-rss-redirect]
Social Media Social Share Icon [add-social-share]
Enhanced Text Widget [enhanced-text-widget]
Researcher
Affected Software
Inline Related Posts [intelly-related-posts]
Researcher
Affected Software
Ivory Search – WordPress Search Plugin [add-search-to-menu]
Researcher
Affected Software
Kimili Flash Embed [kimili-flash-embed]
Researcher
Affected Software
Researcher
Affected Software
Libsyn Publisher Hub [libsyn-podcasting]
Researcher
Affected Software
Researcher
Affected Software
Link Whisper Free [link-whisper]
Researcher
Affected Software
Login With Ajax – Fast Logins, 2FA, Redirects [login-with-ajax]
Researcher
Affected Software
OTP Login With Phone Number, OTP Verification [login-with-phone-number]
Researcher
Affected Software
Mailmunch Forms for Mailchimp [mailchimp-forms-by-mailmunch]
Researcher
Affected Software
Marker.io – Visual Website Feedback [marker-io]
Researcher
Affected Software
MihanPanel – User Login , Registration and Dashboard [mihanpanel-lite]
Researcher
Affected Software
Modal Window – create popup modal window [modal-window]
Researcher
Affected Software
MultiParcels Shipping For WooCommerce [multiparcels-shipping-for-woocommerce]
Researcher
Affected Software
Sliding Door [sliding-door]
CityLogic [citylogic]
Lightning [lightning]
i-max [i-max]
Default Mag [default-mag]
Shopstar! [shopstar]
HappenStance [happenstance]
Emmet Lite [emmet-lite]
X-T9 [x-t9]
i-excel [i-excel]
Researcher
Affected Software
Newsletter – Send awesome emails from WordPress [newsletter]
Researcher
Affected Software
NewsXpress [newsxpress]
Researcher
Affected Software
NextMove Lite – Thank You Page for WooCommerce [woo-thank-you-page-nextmove-lite]
Researcher
Affected Software
No-Bot Registration [no-bot-registration]
Researcher
Affected Software
Novelist [novelist]
Researcher
Affected Software
Order Delivery Date for WooCommerce [order-delivery-date-for-woocommerce]
Researcher
Affected Software
Ovic Addon Toolkit [ovic-addon-toolkit]
Researcher
Affected Software
Live Composer – Free WordPress Website Builder [live-composer-page-builder]
Researcher
Affected Software
Account Engagement [pardot]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
PopularFX [popularfx]
Researcher
Affected Software
Popup Box – Easily Create WordPress Popups [popup-box]
Researcher
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Affected Software
Post Type Builder [themify-ptb]
Researcher
Affected Software
Product Input Fields for WooCommerce [product-input-fields-for-woocommerce]
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System [redi-restaurant-reservation]
Researcher
Affected Software
Lead Form Builder & Contact Form [lead-form-builder]
Researcher
Affected Software
Lead Form Builder & Contact Form [lead-form-builder]
Researcher
RestroPress <= 3.1.2 - Cross-Site Request Forgery via rpress_orders_list_table_process_bulk_actions
4.3
Affected Software
RestroPress – Online Food Ordering System [restropress]
Researcher
Affected Software
Responsive Slider – Sangar Slider [sangar-slider-lite]
Researcher
Affected Software
Sarada Lite [sarada-lite]
Researcher
Affected Software
SEO Booster [seo-booster]
Researcher
Affected Software
Side Menu Lite – Sticky Floating Side Menu [side-menu-lite]
Researcher
Affected Software
Simple Post Notes [simple-post-notes]
Researcher
Affected Software
Siteimprove [siteimprove]
Researcher
Affected Software
Smash Balloon Social Post Feed – Simple Social Feeds for WordPress [custom-facebook-feed]
Researcher
Affected Software
Soledad [soledad]
Researcher
Affected Software
Soledad [soledad]
Researcher
Affected Software
Spa and Salon [spa-and-salon]
Researcher
Affected Software
Spotlight Social Feeds – Block, Shortcode, and Widget [spotlight-social-photo-feeds]
Researcher
Affected Software
Sticky Buttons – Floating Buttons Builder [sticky-buttons]
Researcher
Affected Software
Sync Post With Other Site [sync-post-with-other-site]
Researcher
Affected Software
Researcher
Affected Software
The Conference [the-conference]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Ultimate Product Catalog [ultimate-product-catalogue]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Shipping Live Rates and Access Points for UPS for WooCommerce [flexible-shipping-ups]
Researcher
Affected Software
Hosting Benchmark tool [wpbenchmark]
Researcher
Affected Software
Wow Skype Buttons [mwp-skype]
Researcher
Affected Software
WP Accessibility Helper (WAH) [wp-accessibility-helper]
Researcher
Affected Software
WP Client Reports [wp-client-reports]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Affected Software
Shopping Cart & eCommerce Store [wp-easycart]
Researcher
Affected Software
Researcher
Affected Software
Mail logging – WP Mail Catcher [wp-mail-catcher]
Researcher
Affected Software
Matterport Shortcode [shortcode-gallery-for-matterport-showcase]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Plugin [tour-booking-manager]
Researcher
Affected Software
WPZOOM Social Feed Widget & Block [instagram-widget-by-wpzoom]
Researcher
Affected Software
Zoho Campaigns [zoho-campaigns]
Researcher
Affected Software
Zoho Campaigns [zoho-campaigns]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments