Wordfence Intelligence Weekly WordPress Vulnerability Report (May 13, 2024 to May 19, 2024)
🎉 Did you know we’re running a Bug Bounty Extravaganza again?
Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!
Last week, there were 119 vulnerabilities disclosed in 91 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 49 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-700 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-699 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 112 |
| Unpatched | 7 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 97 |
| High Severity | 13 |
| Critical Severity | 9 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 68 |
| Missing Authorization | 17 |
| Cross-Site Request Forgery (CSRF) | 8 |
| Authorization Bypass Through User-Controlled Key | 3 |
| Deserialization of Untrusted Data | 3 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 3 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 3 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3 |
| Unrestricted Upload of File with Dangerous Type | 3 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Exposure of Sensitive Information to an Unauthorized Actor | 1 |
| Improper Access Control | 1 |
| Improper Authentication | 1 |
| Improper Authorization | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 12 | |
| 8 | |
| 8 | |
| 8 | |
| 6 | |
| 6 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Advanced Custom Fields Pro | advanced-custom-fields-pro |
| AI Popup | popup-more |
| All-in-One Video Gallery | all-in-one-video-gallery |
| Alt Text AI – Automatically generate image alt text for SEO and accessibility | alttext-ai |
| Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin | simply-schedule-appointments |
| ARforms | arforms |
| Borderless – Addons and Templates for Elementor | borderless |
| BuddyBoss Platform | buddyboss-platform |
| Builder for WooCommerce product reviews shortcodes – ReviewShort | woo-product-reviews-shortcode |
| Chauffeur Taxi Booking System for WordPress | chauffeur-booking-system |
| Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer | clearfy |
| Contact Form Widget | new-contact-form-widget |
| ConvertPlus | convertplug |
| Copymatic – AI Content Writer & Generator | copymatic |
| Cost Calculator Builder PRO | cost-calculator-builder-pro |
| Custom Post Type Attachment | custom-post-type-pdf-attachment |
| DethemeKit for Elementor | dethemekit-for-elementor |
| Download Plugins and Themes in ZIP from Dashboard | download-plugins-dashboard |
| Easy Notify Lite | easy-notify-lite |
| Elegant Blocks – Amazing Gutenberg Blocks | elegant-blocks |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| Envo Extra | envo-extra |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Exclusive Addons for Elementor | exclusive-addons-for-elementor |
| Fast Custom Social Share by CodeBard | fast-custom-social-share-by-codebard |
| Fastly | fastly |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FS Product Inquiry | fs-product-inquiry |
| FundEngine – Donation and Crowdfunding Platform | wp-fundraising-donation |
| Gallery by Visual Portfolio | visual-portfolio |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | essential-blocks |
| Happy Addons for Elementor | happy-elementor-addons |
| iframe | iframe |
| ImageMagick Sharpen Resized Images | imagemagick-sharpen-resized-images |
| Import and export users and customers | import-users-from-csv-with-meta |
| Insert or Embed Articulate Content into WordPress | insert-or-embed-articulate-content-into-wordpress |
| Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms | cf7-hubspot |
| Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms | cf7-salesforce |
| JCH Optimize | jch-optimize |
| Jetpack – WP Security, Backup, Speed, & Growth | jetpack |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Kognetiks Chatbot for WordPress | chatbot-chatgpt |
| Landing Page Builder – Coming Soon page, Maintenance Mode, Lead Page, WordPress Landing Pages | page-builder-add |
| Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase | logo-slider-wp |
| Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid | magazine-blocks |
| Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | master-addons |
| Mega Elements – Addons for Elementor | mega-elements-addons-for-elementor |
| Menu Icons by Themeisle – Add Icons to Navigation Menus | menu-icons |
| Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization | optimole-wp |
| Order Export & Order Import for WooCommerce | order-import-export-for-woocommerce |
| Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content | password-protected |
| Penci Soledad Data Migrator | penci-data-migrator |
| Picture Gallery – Frontend Image Uploads, AJAX Photo List | picture-gallery |
| Piotnet Addons For Elementor | piotnet-addons-for-elementor |
| Popup Maker – Responsive popup, Exit Intent Pop up, Email Optins, Autoresponder & More | popup-maker-wp |
| Post and Page Builder by BoldGrid – Visual Drag and Drop Editor | post-and-page-builder |
| Post Grid Addon for Elementor | post-grid-elementor-addon |
| Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | radio-player |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema | reviewx |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| Salon Booking System – Free Version | salon-booking-system |
| ShiftController Employee Shift Scheduling | shiftcontroller |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Simple Ajax Chat – Add a Fast, Secure Chat Box | simple-ajax-chat |
| Simple Basic Contact Form | simple-basic-contact-form |
| Sina Extension for Elementor | sina-extension-for-elementor |
| Swift Framework | socialdriver-framework |
| Sydney Toolbox | sydney-toolbox |
| Tagembed Social Feeds Widget | tagembed-widget |
| Testimonial Carousel For Elementor | testimonials-carousel-elementor |
| The Events Calendar | the-events-calendar |
| Tutor LMS Pro | tutor-pro |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Addons for Elementor | header-footer-elementor |
| Visualizer – Tables & Charts Manager with Built-in AI Generator | visualizer |
| WBULKiT – Bulk Edit Posts & Pages | ithemeland-bulk-posts-editing-lite |
| weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce | wemail |
| WordPress Automatic Plugin | wp-automatic |
| WP Backpack | wp-backpack |
| WP Compress – Instant Performance & Speed Optimization | wp-compress-image-optimizer |
| Wp EMember | wp-eMember |
| WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content | wp-rss-aggregator |
| WP Stacker | wp-stacker |
| WPB Addons for Elementor – News Ticker, Timeline, Team & More Widgets | wpb-elementor-addons |
| WPZOOM Addons for Elementor – Starter Templates & Widgets | wpzoom-elementor-addons |
| WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce | wp-sms |
| Xpro Addons — 140+ Widgets for Elementor | xpro-elementor-addons |
| YITH WooCommerce Gift Cards | yith-woocommerce-gift-cards |
| Yoast SEO – Advanced SEO with real-time guidance and built-in AI | wordpress-seo |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| ChaosTheory | chaostheory |
| Consus | consus |
| EmpowerWP | empowerwp |
| Ketos | ketos |
| Niveau | niveau |
| Oasis | oasis |
| Skyline WP | skyline-wp |
| Zeka | zeka |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
ARforms [arforms]
Researcher
Affected Software
Kognetiks Chatbot for WordPress [chatbot-chatgpt]
Researcher
Affected Software
Researcher
Affected Software
Copymatic – AI Content Writer & Generator [copymatic]
Researcher
Affected Software
Penci Soledad Data Migrator [penci-data-migrator]
Researcher
Affected Software
Researcher
Affected Software
Chauffeur Taxi Booking System for WordPress [chauffeur-booking-system]
Researcher
Affected Software
Salon Booking System – Free Version [salon-booking-system]
Researcher
Affected Software
All-in-One Video Gallery [all-in-one-video-gallery]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Tutor LMS Pro [tutor-pro]
Researcher
Affected Software
Tutor LMS Pro [tutor-pro]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
ConvertPlus [convertplug]
Researcher
Affected Software
ShiftController Employee Shift Scheduling [shiftcontroller]
Researcher
Affected Software
Tutor LMS Pro [tutor-pro]
Researcher
Affected Software
Order Export & Order Import for WooCommerce [order-import-export-for-woocommerce]
Researcher
Affected Software
Simple Basic Contact Form [simple-basic-contact-form]
Researcher
Affected Software
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
Affected Software
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin [simply-schedule-appointments]
Researcher
Affected Software
Borderless – Addons and Templates for Elementor [borderless]
Researcher
Affected Software
Borderless – Addons and Templates for Elementor [borderless]
Researcher
Affected Software
ChaosTheory [chaostheory]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Cost Calculator Builder PRO [cost-calculator-builder-pro]
Researcher
Affected Software
Custom Post Type Attachment [custom-post-type-pdf-attachment]
Researcher
Affected Software
DethemeKit for Elementor [dethemekit-for-elementor]
Researcher
Affected Software
DethemeKit for Elementor [dethemekit-for-elementor]
Researcher
Affected Software
Elegant Blocks – Amazing Gutenberg Blocks [elegant-blocks]
Researcher
Affected Software
Ultimate Addons for Elementor [header-footer-elementor]
Researcher
Affected Software
Envo Extra [envo-extra]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Essential Addons for Elementor <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]
Researcher
Affected Software
Exclusive Addons for Elementor [exclusive-addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
iframe [iframe]
Researcher
Affected Software
Researcher
Affected Software
Insert or Embed Articulate Content into WordPress [insert-or-embed-articulate-content-into-wordpress]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Researcher
Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
6.4
Affected Software
Mega Elements – Addons for Elementor [mega-elements-addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Picture Gallery – Frontend Image Uploads, AJAX Photo List [picture-gallery]
Researcher
Affected Software
Piotnet Addons For Elementor [piotnet-addons-for-elementor]
Researcher
Affected Software
Easy Notify Lite [easy-notify-lite]
Researcher
Affected Software
Researcher
Affected Software
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor [post-and-page-builder]
Researcher
Affected Software
Post Grid Addon for Elementor [post-grid-elementor-addon]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
Sina Extension for Elementor [sina-extension-for-elementor]
Researcher
Affected Software
Sina Extension for Elementor [sina-extension-for-elementor]
Researcher
Swift Framework < 2024.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
Swift Framework [socialdriver-framework]
Researcher
Affected Software
Sydney Toolbox [sydney-toolbox]
Researcher
Affected Software
Testimonial Carousel For Elementor [testimonials-carousel-elementor]
Researcher
Affected Software
Gallery by Visual Portfolio [visual-portfolio]
Researcher
Affected Software
WordPress Automatic Plugin [wp-automatic]
Researcher
Affected Software
WPZOOM Addons for Elementor – Starter Templates & Widgets [wpzoom-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
FS Product Inquiry [fs-product-inquiry]
Researcher
Affected Software
FS Product Inquiry [fs-product-inquiry]
Researcher
Affected Software
Researcher
Affected Software
WP RSS Aggregator – RSS Import, Feed to Post, Autoblogging, AI Content [wp-rss-aggregator]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Wp EMember [wp-eMember]
Researcher
Affected Software
WP Stacker [wp-stacker]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researchers
Affected Software
Builder for WooCommerce product reviews shortcodes – ReviewShort [woo-product-reviews-shortcode]
Researcher
Affected Software
Contact Form Widget [new-contact-form-widget]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
FundEngine – Donation and Crowdfunding Platform [wp-fundraising-donation]
Researcher
Affected Software
YITH WooCommerce Gift Cards [yith-woocommerce-gift-cards]
Researcher
Affected Software
Ultimate Addons for Elementor [header-footer-elementor]
Researcher
Download Plugins and Themes from Dashboard <= 1.8.5 - Authenticated (Admin+) Arbitrary File Download
4.9
Affected Software
Download Plugins and Themes in ZIP from Dashboard [download-plugins-dashboard]
Researcher
Affected Software
ARforms [arforms]
Researcher
Affected Software
ImageMagick Sharpen Resized Images [imagemagick-sharpen-resized-images]
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
AI Popup [popup-more]
Researcher
Affected Software
Simple Ajax Chat – Add a Fast, Secure Chat Box [simple-ajax-chat]
Researcher
Affected Software
WP Backpack [wp-backpack]
Researcher
Affected Software
Researcher
Affected Software
BuddyBoss Platform [buddyboss-platform]
Researcher
Affected Software
BuddyBoss Platform [buddyboss-platform]
Researcher
Affected Software
WBULKiT – Bulk Edit Posts & Pages [ithemeland-bulk-posts-editing-lite]
Researcher
Affected Software
WBULKiT – Bulk Edit Posts & Pages [ithemeland-bulk-posts-editing-lite]
Researcher
Affected Software
Researcher
Affected Software
EmpowerWP [empowerwp]
Researcher
Affected Software
Fast Custom Social Share by CodeBard [fast-custom-social-share-by-codebard]
Researcher
Affected Software
Fastly [fastly]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
JCH Optimize [jch-optimize]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Tagembed Social Feeds Widget [tagembed-widget]
Researcher
Affected Software
WP Compress – Instant Performance & Speed Optimization [wp-compress-image-optimizer]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments