Wordfence Intelligence Weekly WordPress Vulnerability Report (May 6, 2024 to May 12, 2024)
🎉 Did you know we’re running a Bug Bounty Extravaganza again?
Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!
Last week, there were 187 vulnerabilities disclosed in 147 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 69 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 16,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 156 |
| Unpatched | 31 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 1 |
| Medium Severity | 149 |
| High Severity | 19 |
| Critical Severity | 18 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 89 |
| Cross-Site Request Forgery (CSRF) | 23 |
| Missing Authorization | 20 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 8 |
| Unrestricted Upload of File with Dangerous Type | 8 |
| Exposure of Sensitive Information to an Unauthorized Actor | 7 |
| Deserialization of Untrusted Data | 6 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 5 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Server-Side Request Forgery (SSRF) | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Insertion of Sensitive Information into Log File | 2 |
| Authentication Bypass by Spoofing | 1 |
| Authorization Bypass Through User-Controlled Key | 1 |
| Improper Access Control | 1 |
| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 1 |
| Improper Privilege Management | 1 |
| Incorrect Authorization | 1 |
| Insecure Storage of Sensitive Information | 1 |
| Unprotected Alternate Channel | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 20 | |
| 16 | |
| 9 | |
| 8 | |
| 8 | |
| 7 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Academy LMS | academy |
| ADFO – Custom data in admin dashboard | admin-form |
| Advanced Ads – Ad Manager & AdSense | advanced-ads |
| Affiliate Program Suite — SliceWP Affiliates | slicewp |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit | aiomatic-automatic-ai-content-writer |
| All Bootstrap Blocks | all-bootstrap-blocks |
| All-in-One Addons for Elementor – WidgetKit | widgetkit-for-elementor |
| Arigato Autoresponder and Newsletter | bft-autoresponder |
| Auto Affiliate Links | wp-auto-affiliate-links |
| AWSOM News Announcement | awsom-news-announcement |
| Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro | back-in-stock-notifier-for-woocommerce |
| Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Better Addons for Elementor | better-elementor-addons |
| Blocksy Companion | blocksy-companion |
| BlogLentor – Blog Designer Pack for Elementor | bloglentor-for-elementor |
| Breakdance | breakdance |
| Brizy – Page Builder | brizy |
| Brozzme Scroll Top | brozzme-scroll-top |
| Business Card | business-card-by-esterox-100 |
| canvasio3D Light | canvasio3d-light |
| Church Admin | church-admin |
| ClickCease Click Fraud Protection | clickcease-click-fraud-protection |
| Comments Evolved for WordPress | gplus-comments |
| Configure Login Timeout | configure-login-timeout |
| Contact List – Online Staff Directory & Address Book | contact-list |
| Content Blocks (Custom Post Widget) | custom-post-widget |
| Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor) | content-views-query-and-display-post-page |
| Custom Field Suite | custom-field-suite |
| Debug Info | debug-info |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Divi Builder | divi-builder |
| DS Site Message | ds-site-message |
| Dynamics 365 Integration | integration-dynamics |
| Easy Affiliate Links | easy-affiliate-links |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Edwiser Bridge – WordPress Moodle Integration | edwiser-bridge |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| Enter Addons – Ultimate Template Builder for Elementor | enteraddons |
| Envo's Templates & Widgets for Elementor and WooCommerce | envo-elementor-for-woocommerce |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Falang multilanguage for WordPress | falang |
| Featured Content Gallery | featured-content-gallery |
| Flo Forms – Easy Drag & Drop Form Builder | flo-forms |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| Forty Four – 404 Plugin for WordPress | forty-four |
| GDPR Compliance | gdpr-compliance |
| gee Search Plus, improved WordPress search | gsearch-plus |
| Ghost | ghost |
| Gianism | gianism |
| Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers | rafflepress |
| Gold Addons for Elementor | gold-addons-for-elementor |
| Graphina – Charts and Graphs For Elementor | graphina-elementor-charts-and-graphs |
| Gutenify – Visual Site Builder Blocks & Site Templates | gutenify |
| Heateor Social Login WordPress | heateor-social-login |
| Hostel | hostel |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player | html5-audio-player |
| If-So Dynamic Content – Elementor & All Page Builders Personalization | if-so |
| Image Hover Effects – Elementor Addon | image-hover-effects-addon-for-elementor |
| Import and export users and customers | import-users-from-csv-with-meta |
| Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms | integration-for-contact-form-7-and-pipedrive |
| Joli FAQ SEO – WordPress FAQ Plugin | joli-faq-seo |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| KKProgressbar2 Free – advanced progress bars | kkprogressbar |
| Kognetiks Chatbot for WordPress | chatbot-chatgpt |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Link Library | link-library |
| Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) | magical-addons-for-elementor |
| Meow Gallery | meow-gallery |
| Mesmerize Companion | mesmerize-companion |
| Mihdan: Yandex Turbo Feed | mihdan-yandex-turbo-feed |
| MoreConvert Wishlist for WooCommerce | smart-wishlist-for-more-convert |
| MotoPress Hotel Booking | motopress-hotel-booking-lite |
| Move Addons for Elementor | move-addons |
| Netgsm | netgsm |
| One Click Demo Import | one-click-demo-import |
| Orders Tracking for WooCommerce | woo-orders-tracking |
| ParcelWILL (Formerly ParcelPanel) – Shipment Tracking, Tracking & Order Tracking for WooCommerce | parcelpanel |
| Pk Favicon Manager | phpsword-favicon-manager |
| Playlist for Youtube | playlist-for-youtube |
| Pods – Custom Content Types and Fields | pods |
| Pootle Pagebuilder – WordPress Page builder | pootle-page-builder |
| Porto Theme - Functionality | porto-functionality |
| Post Grid Master — Post Grids & AJAX Filters | ajax-filter-posts |
| Prime Slider Addons for Elementor | bdthemes-prime-slider-lite |
| Propovoice: All-in-One Client Management System | propovoice |
| Pure Chat – Live Chat & More! | pure-chat |
| QuickieBar | quickiebar |
| Real 3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | real3d-flipbook-lite |
| Serial Numbers – Ultimate License Manager for Selling, Licensing & Securely Delivering Digital Content with WooCommerce | wc-serial-numbers |
| Shared Counts – Social Media Share Buttons | shared-counts |
| Shared Files – File Upload & Download Manager | shared-files |
| ShopBuilder – WooCommerce Builder For Elementor | shopbuilder |
| Shopping Cart & eCommerce Store | wp-easycart |
| ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization | shortpixel-adaptive-images |
| Simple Website Banner | corona-virus-covid-19-banner |
| Site Reviews | site-reviews |
| SKT Addons for Elementor | skt-addons-for-elementor |
| Soccer Engine – Soccer Plugin for WordPress | soccer-engine-lite |
| Social Connect | social-connect |
| Social Sharing Plugin – Social Warfare | social-warfare |
| SP Project & Document Manager | sp-client-document-manager |
| Spectra Pro | spectra-pro |
| SportsPress – Sports Club & League Manager | sportspress |
| Squelch Tabs and Accordions Shortcodes | squelch-tabs-and-accordions-shortcodes |
| Starter Templates – AI-Powered Templates for Elementor & Gutenberg | astra-sites |
| Startklar Elementor Addons | startklar-elmentor-forms-extwidgets |
| Sticky Banner | sticky-banner |
| Sticky Social Link | sticky-social-link |
| Stockholm Core | stockholm-core |
| Swift Performance Lite | swift-performance-lite |
| Table Maker | table-maker |
| The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
| Themify Shortcodes | themify-shortcodes |
| Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor | thim-elementor-kit |
| Timber | timber-library |
| TranslatePress – Translate Multilingual sites with AI Translation | translatepress-multilingual |
| TT Custom Post Type Creator | tt-custom-post-type-creator |
| Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor | ultimate-store-kit |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| Unyson | unyson |
| Viet Affiliate Link | viet-affiliate-link |
| Viet Nam Affiliate | viet-nam-affiliate |
| Visual Footer Credit Remover | visual-footer-credit-remover |
| WebinarPress – Webinar System for WordPress | wp-webinarsystem |
| weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot | wedocs |
| White Label CMS | white-label-cms |
| WOLF – WordPress Posts Bulk Editor and Manager Professional | bulk-editor |
| WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms | cf7-styler |
| WP Counter Up – Animated Number Counter & Milestone Showcase | wp-counter-up |
| WP Discourse | wp-discourse |
| WP etracker | wp-etracker |
| WP Fastest Cache – WordPress Cache Plugin | wp-fastest-cache |
| WP Favorite Posts | wp-favorite-posts |
| WP Job Manager | wp-job-manager |
| WP Latest Posts | wp-latest-posts |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars | wp-post-author |
| WP STAGING – WordPress Backup, Restore, Migration & Clone | wp-staging |
| WPCS ( WordPress Custom Search ) | wpcs-wp-custom-search |
| XML Sitemap & Google News | xml-sitemap-feed |
| Xpro Addons — 140+ Widgets for Elementor | xpro-elementor-addons |
| Yoast SEO – Advanced SEO with real-time guidance and built-in AI | wordpress-seo |
| Z-Downloads | z-downloads |
| Zotpress | zotpress |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Divi | Divi |
| Divi Extra | extra |
| Himalayas | himalayas |
| Porto | porto |
| raindrops | raindrops |
| Stockholm | stockholm |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
canvasio3D Light [canvasio3d-light]
Researcher
Affected Software
Researcher
Affected Software
Edwiser Bridge – WordPress Moodle Integration [edwiser-bridge]
Researcher
Affected Software
MotoPress Hotel Booking [motopress-hotel-booking-lite]
Researcher
Affected Software
Kognetiks Chatbot for WordPress [chatbot-chatgpt]
Researcher
Affected Software
Researcher
Affected Software
Porto [porto]
Researcher
Affected Software
Social Connect [social-connect]
Researcher
Affected Software
Startklar Elementor Addons [startklar-elmentor-forms-extwidgets]
Researcher
Affected Software
Stockholm [stockholm]
Researcher
Affected Software
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor [ultimate-store-kit]
Researcher
Affected Software
Researcher
Affected Software
Auto Affiliate Links [wp-auto-affiliate-links]
Researcher
Affected Software
KKProgressbar2 Free – advanced progress bars [kkprogressbar]
Researcher
Affected Software
Pk Favicon Manager [phpsword-favicon-manager]
Researcher
Affected Software
Startklar Elementor Addons [startklar-elmentor-forms-extwidgets]
Researcher
Affected Software
Z-Downloads [z-downloads]
Researchers
Affected Software
Breakdance [breakdance]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload
8.8
Affected Software
Researcher
Affected Software
Porto [porto]
Researcher
Affected Software
Porto Theme - Functionality [porto-functionality]
Researcher
Affected Software
Porto Theme - Functionality [porto-functionality]
Researcher
Affected Software
Spectra Pro [spectra-pro]
Researcher
Affected Software
Stockholm [stockholm]
Researcher
Affected Software
Stockholm Core [stockholm-core]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
XML Sitemap & Google News [xml-sitemap-feed]
Researcher
Affected Software
Advanced Ads – Ad Manager & AdSense [advanced-ads]
Researcher
Affected Software
KKProgressbar2 Free – advanced progress bars [kkprogressbar]
Researcher
Affected Software
One Click Demo Import [one-click-demo-import]
Researcher
Affected Software
Propovoice: All-in-One Client Management System [propovoice]
Researcher
Affected Software
Timber [timber-library]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
WP Fastest Cache – WordPress Cache Plugin [wp-fastest-cache]
Researcher
Affected Software
Brizy – Page Builder [brizy]
Researcher
Affected Software
Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro [back-in-stock-notifier-for-woocommerce]
Researcher
Affected Software
Orders Tracking for WooCommerce [woo-orders-tracking]
Researcher
Affected Software
Real 3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]
Researcher
Affected Software
Advanced Ads – Ad Manager & AdSense [advanced-ads]
Researcher
Affected Software
All Bootstrap Blocks [all-bootstrap-blocks]
Researcher
Affected Software
All-in-One Addons for Elementor – WidgetKit [widgetkit-for-elementor]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Better Addons for Elementor [better-elementor-addons]
Researcher
Affected Software
Blocksy Companion [blocksy-companion]
Researcher
Affected Software
BlogLentor – Blog Designer Pack for Elementor [bloglentor-for-elementor]
Researcher
Affected Software
Content Blocks (Custom Post Widget) [custom-post-widget]
Researcher
Affected Software
Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor) [content-views-query-and-display-post-page]
Researcher
Affected Software
WP Counter Up – Animated Number Counter & Milestone Showcase [wp-counter-up]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
Affected Software
Easy Affiliate Links [easy-affiliate-links]
Researcher
Researcher
Affected Software
Researcher
Affected Software
Enter Addons – Ultimate Template Builder for Elementor [enteraddons]
Researcher
Affected Software
Enter Addons – Ultimate Template Builder for Elementor [enteraddons]
Researcher
Affected Software
Envo's Templates & Widgets for Elementor and WooCommerce [envo-elementor-for-woocommerce]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Gallery Block (Meow Gallery) <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Meow Gallery [meow-gallery]
Researcher
Affected Software
Gold Addons for Elementor [gold-addons-for-elementor]
Researcher
Affected Software
Graphina – Charts and Graphs For Elementor [graphina-elementor-charts-and-graphs]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Heateor Social Login WordPress <= 1.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Heateor Social Login WordPress [heateor-social-login]
Researcher
Affected Software
Himalayas [himalayas]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player [html5-audio-player]
Researcher
Affected Software
Researcher
Affected Software
Image Hover Effects – Elementor Addon [image-hover-effects-addon-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) [magical-addons-for-elementor]
Researcher
Affected Software
Mesmerize Companion [mesmerize-companion]
Researcher
Affected Software
Mihdan: Yandex Turbo Feed [mihdan-yandex-turbo-feed]
Researcher
Affected Software
Move Addons for Elementor [move-addons]
Researcher
Affected Software
Pootle Pagebuilder – WordPress Page builder [pootle-page-builder]
Researcher
Affected Software
Prime Slider Addons for Elementor [bdthemes-prime-slider-lite]
Researcher
Affected Software
Pure Chat – Live Chat & More! [pure-chat]
Researcher
Affected Software
raindrops [raindrops]
Researcher
Affected Software
SKT Addons for Elementor [skt-addons-for-elementor]
Researcher
Affected Software
SKT Addons for Elementor [skt-addons-for-elementor]
Researcher
Affected Software
Researcher
The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
Themify Shortcodes [themify-shortcodes]
Researcher
Affected Software
Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor [thim-elementor-kit]
Researcher
Affected Software
Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor [thim-elementor-kit]
Researcher
Affected Software
Zotpress [zotpress]
Researcher
Affected Software
ADFO – Custom data in admin dashboard [admin-form]
Researcher
Affected Software
Stockholm Core [stockholm-core]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
WP etracker [wp-etracker]
Researcher
Affected Software
Researcher
Affected Software
gee Search Plus, improved WordPress search [gsearch-plus]
Researcher
Affected Software
Playlist for Youtube [playlist-for-youtube]
Researcher
Affected Software
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization [shortpixel-adaptive-images]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Post Grid Master — Post Grids & AJAX Filters [ajax-filter-posts]
Researcher
Affected Software
Swift Performance Lite [swift-performance-lite]
Researcher
Affected Software
Table Maker [table-maker]
Researcher
Affected Software
WP Latest Posts [wp-latest-posts]
Researcher
Affected Software
Academy LMS [academy]
Researcher
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Contact List – Online Staff Directory & Address Book [contact-list]
Researcher
Affected Software
Dynamics 365 Integration [integration-dynamics]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Flo Forms – Easy Drag & Drop Form Builder [flo-forms]
Researcher
Affected Software
Ghost [ghost]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
KKProgressbar2 Free – advanced progress bars [kkprogressbar]
Researcher
Affected Software
Researcher
Affected Software
MoreConvert Wishlist for WooCommerce [smart-wishlist-for-more-convert]
Researcher
Affected Software
MoreConvert Wishlist for WooCommerce [smart-wishlist-for-more-convert]
Researcher
Affected Software
Researcher
Affected Software
Shared Files – File Upload & Download Manager [shared-files]
Researcher
Affected Software
ShopBuilder – WooCommerce Builder For Elementor [shopbuilder]
Researcher
Affected Software
Shopping Cart & eCommerce Store [wp-easycart]
Researcher
Affected Software
Site Reviews [site-reviews]
Researchers
Affected Software
Researcher
Affected Software
White Label CMS [white-label-cms]
Researcher
Affected Software
WP Job Manager [wp-job-manager]
Researcher
Affected Software
Researcher
Affected Software
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
AWSOM News Announcement [awsom-news-announcement]
Researcher
Affected Software
Brozzme Scroll Top [brozzme-scroll-top]
Researcher
Comments Evolved for WordPress <= 1.6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Comments Evolved for WordPress [gplus-comments]
Researcher
Affected Software
Configure Login Timeout [configure-login-timeout]
Researcher
Affected Software
Simple Website Banner [corona-virus-covid-19-banner]
Researcher
Affected Software
Custom Field Suite [custom-field-suite]
Researcher
Affected Software
Debug Info [debug-info]
Researcher
Affected Software
Falang multilanguage for WordPress [falang]
Researcher
Affected Software
Featured Content Gallery [featured-content-gallery]
Researcher
Affected Software
Researcher
Affected Software
Forty Four – 404 Plugin for WordPress [forty-four]
Researcher
Affected Software
Gianism [gianism]
Researchers
Affected Software
QuickieBar [quickiebar]
Researcher
Affected Software
Sticky Banner [sticky-banner]
Researcher
Affected Software
Sticky Social Link [sticky-social-link]
Researcher
Affected Software
TT Custom Post Type Creator [tt-custom-post-type-creator]
Researcher
Affected Software
Viet Affiliate Link [viet-affiliate-link]
Researcher
Affected Software
Viet Nam Affiliate [viet-nam-affiliate]
Researcher
Affected Software
Visual Footer Credit Remover [visual-footer-credit-remover]
Researcher
Affected Software
Researcher
Affected Software
Researcher
WPCS ( WordPress Custom Search ) <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
WPCS ( WordPress Custom Search ) [wpcs-wp-custom-search]
Researcher
Affected Software
ADFO – Custom data in admin dashboard [admin-form]
Researcher
Affected Software
Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit [aiomatic-automatic-ai-content-writer]
Researcher
Affected Software
Arigato Autoresponder and Newsletter [bft-autoresponder]
Researcher
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Business Card [business-card-by-esterox-100]
Researcher
Affected Software
Business Card [business-card-by-esterox-100]
Researcher
Affected Software
Business Card [business-card-by-esterox-100]
Researcher
Affected Software
Business Card [business-card-by-esterox-100]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
Affected Software
ClickCease Click Fraud Protection [clickcease-click-fraud-protection]
Researcher
Affected Software
DS Site Message [ds-site-message]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
GDPR Compliance [gdpr-compliance]
Researcher
Affected Software
Researcher
Affected Software
Hostel [hostel]
Researcher
Affected Software
Import and export users and customers [import-users-from-csv-with-meta]
Researcher
Affected Software
Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms [integration-for-contact-form-7-and-pipedrive]
Researcher
Affected Software
Joli FAQ SEO – WordPress FAQ Plugin [joli-faq-seo]
Researcher
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) [magical-addons-for-elementor]
Researcher
Affected Software
Netgsm [netgsm]
Researcher
Affected Software
Netgsm [netgsm]
Researcher
Affected Software
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization [shortpixel-adaptive-images]
Researcher
Affected Software
Soccer Engine – Soccer Plugin for WordPress [soccer-engine-lite]
Researcher
Affected Software
Social Sharing Plugin – Social Warfare [social-warfare]
Researcher
SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update
4.3
Affected Software
SP Project & Document Manager [sp-client-document-manager]
Researcher
Affected Software
Squelch Tabs and Accordions Shortcodes [squelch-tabs-and-accordions-shortcodes]
Researcher
Affected Software
Researcher
Affected Software
TranslatePress – Translate Multilingual sites with AI Translation [translatepress-multilingual]
Researcher
Affected Software
Unyson [unyson]
Researcher
Affected Software
WebinarPress – Webinar System for WordPress [wp-webinarsystem]
Researcher
Affected Software
WP Discourse [wp-discourse]
Researcher
Affected Software
WP Favorite Posts [wp-favorite-posts]
Researcher
Affected Software
Researcher
Affected Software
Researcher
SportsPress – Sports Club & League Manager <= 2.7.20 - Missing Authorization to Notice Dismissal
3.5
Affected Software
SportsPress – Sports Club & League Manager [sportspress]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments
4:20 am
Thanks you are heroes!!