Wordfence Intelligence Weekly WordPress Vulnerability Report (July 8, 2024 to July 14, 2024)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $10,400, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Last week, there were 264 vulnerabilities disclosed in 213 WordPress Plugins and 14 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 77 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 17,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File Upload
- BookingPress Appointment Booking <= 1.1.5 – Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 206 |
| Unpatched | 58 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 1 |
| Medium Severity | 206 |
| High Severity | 34 |
| Critical Severity | 23 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 113 |
| Missing Authorization | 41 |
| Cross-Site Request Forgery (CSRF) | 39 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 14 |
| Exposure of Sensitive Information to an Unauthorized Actor | 12 |
| Unrestricted Upload of File with Dangerous Type | 9 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 6 |
| Server-Side Request Forgery (SSRF) | 6 |
| Insertion of Sensitive Information into Log File | 5 |
| Authentication Bypass Using an Alternate Path or Channel | 4 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 4 |
| Improper Privilege Management | 3 |
| Authorization Bypass Through User-Controlled Key | 2 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Deserialization of Untrusted Data | 1 |
| Insertion of Sensitive Information into Externally-Accessible File or Directory | 1 |
| Use of Hard-coded Credentials | 1 |
| Use of Less Trusted Source | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 18 | |
| 15 | |
| 14 | |
| 14 | |
| 14 | |
| 13 | |
| 12 | |
| 11 | |
| 9 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Academy LMS | academy |
| Admin Dashboard RSS Feed | admin-dashboard-rss-feed |
| AdPush | adsense-plugin |
| Advanced AJAX Page Loader | advanced-ajax-page-loader |
| Advanced File Manager Shortcodes | file-manager-advanced-shortcode |
| Advanced post slider | advanced-post-slider |
| Amazing Hover Effects | amazing-hover-effects |
| Animated Typed JS Shortcode | animated-typed-js-shortcode |
| Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps | appmaker-woocommerce-mobile-app-manager |
| Arkhe Blocks | arkhe-blocks |
| Attachment File Icons (AF Icons) | attachment-file-icons |
| Auto Featured Image (Auto Post Thumbnail) | auto-post-thumbnail |
| Backup and Staging by WP Time Capsule | wp-time-capsule |
| Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
| BerqWP – All-In-One Optimization for Core Web Vitals, Cache, CDN, Images, CSS & JavaScript | searchpro |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| Blog, Posts and Category Filter for Elementor | blog-posts-and-category-for-elementor |
| Booking Ultra Pro Appointments Booking Calendar Plugin | booking-ultra-pro |
| Bradmax Player | bradmax-player |
| Branda – White Label & Branding, Free Login Page Customizer | branda-white-labeling |
| Business Card | business-card-by-esterox-100 |
| Calendar.online / Kalender.digital – Plugin | kalender-digital |
| Caxton – Create Pro page layouts in Gutenberg | caxton |
| Chained Quiz | chained-quiz |
| Change From Email | wp-from-email |
| Cliengo – Chatbot | cliengo |
| CodePen Embedded Pens Shortcode | codepen-embedded-pen-shortcode |
| codoc | codoc |
| Coming Soon Page – Responsive Coming Soon & Maintenance Mode | responsive-coming-soon-page |
| Comment Images Reloaded | comment-images-reloaded |
| ConeBlog – Elementor Blog Widgets | coneblog-widgets |
| Contact Form 7 Submission Summary & PDF Print | cf7-summary-and-print |
| Contact Form, Survey, Quiz & Popup Form Builder – ARForms | arforms-form-builder |
| CZ Loan Management | cz-loan-management |
| Default Thumbnail Plus | default-thumbnail-plus |
| DirectoryPress – Business Directory And Classified Ad Listing | directorypress |
| Donation Block For PayPal | donations-block |
| Download Button for Elementor | download-button-for-elementor |
| Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & More | duplicator |
| Dynamic Team Manager – Team Member Showcase with grid, slider, table Elementor widget & shortcode | wp-team-manager |
| Easy Google Adsense and Banner Ads Manager – AdsforWP | ads-for-wp |
| Easy Pixels | easy-pixels-by-jevnet |
| EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder | eazydocs |
| EleForms – All In One Form Integration including DB for Elementor | all-contact-form-integration-for-elementor |
| ElementInvader Addons for Elementor | elementinvader-addons-for-elementor |
| Email Encoder – Protect Email Addresses and Phone Numbers | email-encoder-bundle |
| EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents | embedpress |
| ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce | erp |
| Event Post | event-post |
| Event Tickets and Registration | event-tickets |
| EventON – Events Calendar | eventon-lite |
| Events Calendar for Google | events-calendar-for-google |
| ExS Widgets | exs-widgets |
| Extensions for Elementor | extensions-for-elementor |
| FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor | post-block |
| Featured Image Generator | featured-image-generator |
| Feeds for YouTube (YouTube video, channel, and gallery plugin) | feeds-for-youtube |
| Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database | form-vibes |
| FULL – Cliente | full-customer |
| Fusion Page Builder | fusion |
| GD Rating System | gd-rating-system |
| Generate PDF using Contact Form 7 | generate-pdf-using-contact-form-7 |
| Genesis Blocks | genesis-blocks |
| Get Use APIs – JSON Content Importer | json-content-importer |
| Goftino | goftino |
| Gravity Forms: Multiple Form Instances | gravity-forms-multiple-form-instances |
| Gum Addon for Elementor | gum-elementor-addon |
| Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns | essential-blocks |
| Gutenberg Forms – WordPress Form Builder Plugin | forms-gutenberg |
| GutSlider – All in One Slider and Carousel Blocks for Gutenberg | slider-blocks |
| Happy WooCommerce FAQs – Ultimate Product FAQ Plugin | faq-for-woocommerce |
| HitPay Payment Gateway for WooCommerce | hitpay-payment-gateway |
| Houzez CRM | houzez-crm |
| Houzez Theme - Functionality | houzez-theme-functionality |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| HTML Forms – Simple WordPress Forms Plugin | html-forms |
| Image Optimizer, Resizer and CDN – Sirv | sirv |
| Inline Related Posts | intelly-related-posts |
| InstaWP Connect – 1-click WP Staging & Migration | instawp-connect |
| Internal Link Juicer: SEO Auto Linker for WordPress | internal-links |
| iPanorama 360 – Advanced Virtual Tour Builder | ipanorama-360-virtual-tour-builder-lite |
| IQ Testimonials | iq-testimonials |
| Jetpack Boost – Website Speed, Performance and Critical CSS | jetpack-boost |
| Job Board Manager | job-board-manager |
| JSON API User | json-api-user |
| Just Custom Fields | just-custom-fields |
| Laposta | laposta |
| LearnDash LMS – Reports | wisdm-reports-for-learndash |
| Light Poll | light-poll |
| Link Library | link-library |
| Login by Auth0 | auth0 |
| Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) | magical-addons-for-elementor |
| Magical Posts Display – Elementor Advanced Posts widgets | magical-posts-display |
| MakeStories (for Google Web Stories) | makestories-helper |
| Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | master-addons |
| Master Popups | master-popups-lite |
| Matomo Analytics – Powerful, Privacy-First Insights for WordPress | matomo |
| MBE eShip | mail-boxes-etc |
| Media Hygiene: Remove or Delete Unused Images and More! | media-hygiene |
| Meks Smart Author Widget | meks-smart-author-widget |
| Meks Video Importer | meks-video-importer |
| Metorik – Reports & Email Automation for WooCommerce | metorik-helper |
| Modern Events Calendar | modern-events-calendar |
| Modern Events Calendar Lite | modern-events-calendar-lite |
| Moloni | moloni |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu) | mystickymenu |
| Notifications for Forms & WordPress Actions | notifier |
| oik | oik |
| Olive One Click Demo Import | olive-one-click-demo-import |
| Openpos - WooCommerce Point Of Sale(POS) | woocommerce-openpos |
| OSM – OpenStreetMap | osm |
| Packlink PRO for WooCommerce | packlink-pro-shipping |
| Paid Memberships Pro - Member Directory Add On | pmpro-member-directory |
| Panda Video | pandavideo |
| Payflex Payment Gateway | payflex-payment-gateway |
| PayPlus Payment Gateway | payplus-payment-gateway |
| PickPlugins Product Designer for WooCommerce | product-designer |
| Pie Register – User Registration, Profiles & Content Restriction | pie-register |
| Plugin Notes Plus | plugin-notes-plus |
| Plum: Spin Wheel & Email Pop-up | qodeblock |
| Post Layouts | post-layouts |
| Power BI Embedded for WordPress | embed-power-bi |
| PowerPress Podcasting plugin by Blubrry | powerpress |
| Predictive Search for WooCommerce | woocommerce-predictive-search |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Pricing Table | elfsight-pricing-table |
| Product Delivery Date for WooCommerce – Lite | product-delivery-date-for-woocommerce-lite |
| Product Table for WooCommerce by WBW | woo-product-tables |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| Qi Blocks | qi-blocks |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | quiz-master-next |
| Realtyna Organic IDX plugin + WPL Real Estate | real-estate-listing-realtyna-wpl |
| ReCaptcha Integration for WordPress | wp-recaptcha-integration |
| ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System | redi-restaurant-reservation |
| REPORTiT – Advanced Reporting for WooCommerce | ithemelandco-woo-report |
| Responsive Tabs | responsive-tabs |
| REVIEWS.io for WooCommerce | reviewscouk-for-woocommerce |
| ScrollTo Bottom | scrollto-bottom |
| ScrollTo Top | scrollto-top |
| SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue | happy-scss-compiler |
| Search & Replace | search-and-replace |
| Send email only on Reply to My Comment | send-email-only-on-reply-to-my-comment |
| Send Users Email – Email Subscribers, Email Marketing Newsletter | send-users-email |
| Seraphinite Accelerator Pro | seraphinite-accelerator-ext |
| Seraphinite Post .DOCX Source | seraphinite-post-docx-source |
| Simple Alert Boxes | simple-alert-boxes |
| Simple Popup Plugin | simple-popup-plugin |
| Simple Post Notes | simple-post-notes |
| Simple Responsive Slider | simple-responsive-slider |
| SimpleForm – Form Builder with Quiz, Poll and Lead Notifications | simple-form |
| SKT Addons for Elementor | skt-addons-for-elementor |
| SKT Skill Bar | skt-skill-bar |
| Sky Addons for Elementor | sky-elementor-addons |
| Slider by 10Web – Responsive Image Slider | slider-wd |
| SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) | slingblocks |
| SmartCrawl SEO checker, analyzer & optimizer | smartcrawl-seo |
| SmartText Rotator – Add Motion to Your Words | css3-rotating-words |
| Social Sharing Plugin – Kiwi | kiwi-social-share |
| SpiderContacts | spider-contacts |
| Spiffy Calendar | spiffy-calendar |
| SportsPress – Sports Club & League Manager | sportspress |
| SpreadsheetConverter Calculator | import-spreadsheets-from-microsoft-excel |
| Squelch Tabs and Accordions Shortcodes | squelch-tabs-and-accordions-shortcodes |
| Tabs For WPBakery Page Builder (formerly Visual Composer) | tabs-for-visual-composer |
| Taggbox – Free Social Media Widgets, Review Badges & Shoppable UGC | taggbox-widget |
| Team Members | team-members |
| Timeline Module for Beaver Builder | timeline-for-beaver-builder |
| Titan Anti-spam & Security – Brute Force Protection, 2FA & Spam Filter | anti-spam |
| TOCHAT.BE | tochat-be |
| Tutor LMS – eLearning and online course solution | tutor |
| Typebot | typebot |
| Ultimate Classified Listings – Classifieds, Directory & Marketplace | ultimate-classified-listings |
| UltraAddons for Elementor | ultraaddons-elementor-lite |
| Uncanny Automator Pro | uncanny-automator-pro |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| User Activity Log Pro | user-activity-log-pro |
| User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | profile-builder |
| UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds | userfeedback-lite |
| UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP | userswp |
| VK All in One Expansion Unit | vk-all-in-one-expansion-unit |
| Wallet for WooCommerce | woo-wallet |
| Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments | wallet-system-for-woocommerce |
| WappPress – Convert Site to App Fast – WordPress to Mobile App Builder | wapppress-builds-android-app-for-website |
| Web Directory Free | web-directory-free |
| Webico Slider Flatsome Addons | webico-slider-flatsome-addons |
| Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices | woocommerce-wholesale-prices |
| Widgets Reset | widgets-reset |
| WooCommerce Customers Manager | woocommerce-customers-manager |
| WP Accessibility Helper (WAH) | wp-accessibility-helper |
| WP Affiliate Platform | wp-affiliate-platform |
| WP Ajax Contact Form | wp-ajax-contact-form |
| WP Announcement | Dynamic Announcement, Banner, & Countdown Timer for Effective Promotions | sp-announcement |
| WP Event Aggregator: Import Eventbrite events, Meetup events, social events and any iCal Events into Event Calendar | wp-event-aggregator |
| WP Fast Total Search – The Power of Indexed Search | fulltext-search |
| WP GoToWebinar | wp-gotowebinar |
| WP Links Page | wp-links-page |
| WP Multisite Content Copier/Updater | wp-multisite-content-copier |
| WP Photo Album Plus | wp-photo-album-plus |
| WP Popups – WordPress Popup builder | wp-popups-lite |
| WP Total Branding – Complete branding solution for WordPress | wp-total-branding |
| WP Travel Engine – Tour Booking Plugin – Tour Operator Software | wp-travel-engine |
| WP User Switch | wp-user-switch |
| WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 | wp2speed |
| WPBITS Addons For Elementor Page Builder | wpbits-addons-for-elementor |
| WPCS – WordPress Currency Switcher Professional | currency-switcher |
| WpStickyBar – Sticky Bar, Sticky Header | wpstickybar-sticky-bar-sticky-header |
| YITH WooCommerce Ajax Product Filter | yith-woocommerce-ajax-navigation |
| Zephyr Project Manager | zephyr-project-manager |
| Zoho Campaigns | zoho-campaigns |
| Zoho CRM Lead Magnet | zoho-crm-forms |
| پلاگین پرداخت دلخواه | pardakht-delkhah |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| BuddyBoss Theme | buddyboss-theme |
| Counterpoint | counterpoint |
| i-amaze | i-amaze |
| i-transform | i-transform |
| Noo JobMonster | noo-jobmonster |
| Oceanic | oceanic |
| OnePress | onepress |
| Patricia Blog | patricia-blog |
| Patricia Lite | patricia-lite |
| Point | point |
| Popularis Verse | popularis-verse |
| Responsive Mobile | responsive-mobile |
| SmartMag | smartmag-responsive-retina-wordpress-magazine |
| SociallyViral | sociallyviral |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
CZ Loan Management [cz-loan-management]
Researcher
Affected Software
Openpos - WooCommerce Point Of Sale(POS) [woocommerce-openpos]
Researcher
Affected Software
WpStickyBar – Sticky Bar, Sticky Header [wpstickybar-sticky-bar-sticky-header]
Researcher
Affected Software
DirectoryPress – Business Directory And Classified Ad Listing [directorypress]
Researcher
Affected Software
OSM – OpenStreetMap [osm]
Researcher
Affected Software
PayPlus Payment Gateway [payplus-payment-gateway]
Researcher
Affected Software
Backup and Staging by WP Time Capsule [wp-time-capsule]
Researcher
Affected Software
Booking Ultra Pro Appointments Booking Calendar Plugin [booking-ultra-pro]
Researcher
Affected Software
Event Post [event-post]
Researcher
Affected Software
Gutenberg Forms – WordPress Form Builder Plugin [forms-gutenberg]
Researcher
Affected Software
InstaWP Connect – 1-click WP Staging & Migration [instawp-connect]
Researcher
Affected Software
IQ Testimonials [iq-testimonials]
Researcher
Affected Software
Noo JobMonster [noo-jobmonster]
Researcher
Affected Software
JSON API User [json-api-user]
Researcher
Affected Software
Researcher
Affected Software
Product Table for WooCommerce by WBW [woo-product-tables]
Researcher
Affected Software
Search & Replace [search-and-replace]
Researcher
Affected Software
Researcher
Import Spreadsheets from Microsoft Excel <= 10.1.4 - Authenticated (Editor+) Arbitrary File Upload
9.1
Affected Software
SpreadsheetConverter Calculator [import-spreadsheets-from-microsoft-excel]
Researcher
Affected Software
Noo JobMonster [noo-jobmonster]
Researcher
Affected Software
Realtyna Organic IDX plugin + WPL Real Estate [real-estate-listing-realtyna-wpl]
Researcher
Affected Software
Spiffy Calendar [spiffy-calendar]
Researcher
Affected Software
Openpos - WooCommerce Point Of Sale(POS) [woocommerce-openpos]
Researcher
Affected Software
Advanced AJAX Page Loader [advanced-ajax-page-loader]
Researcher
Affected Software
Advanced File Manager Shortcodes [file-manager-advanced-shortcode]
Researcher
Affected Software
Advanced File Manager Shortcodes [file-manager-advanced-shortcode]
Researcher
Affected Software
Attachment File Icons (AF Icons) [attachment-file-icons]
Researcher
Affected Software
Default Thumbnail Plus [default-thumbnail-plus]
Researcher
Affected Software
Events Calendar for Google [events-calendar-for-google]
Researcher
Affected Software
ExS Widgets [exs-widgets]
Researcher
Affected Software
Researcher
Affected Software
GD Rating System [gd-rating-system]
Researcher
Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
8.8
Affected Software
Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]
Researcher
Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
Affected Software
Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]
Researcher
Affected Software
Houzez CRM [houzez-crm]
Researcher
Affected Software
Houzez Theme - Functionality [houzez-theme-functionality]
Researcher
Affected Software
Modern Events Calendar [modern-events-calendar]
Modern Events Calendar Lite [modern-events-calendar-lite]
Researcher
Affected Software
Panda Video [pandavideo]
Researcher
Affected Software
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researchers
Affected Software
ScrollTo Bottom [scrollto-bottom]
Researcher
Affected Software
ScrollTo Top [scrollto-top]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Wallet for WooCommerce [woo-wallet]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WP User Switch [wp-user-switch]
Researcher
Barcode Scanner with Inventory & Order Manager <= 1.6.1 - Authenticated (Subscriber+) SQL Injection
8.5
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Business Card [business-card-by-esterox-100]
Researcher
Affected Software
Donation Block For PayPal [donations-block]
Researcher
Affected Software
Easy Pixels [easy-pixels-by-jevnet]
Researcher
Affected Software
EventON – Events Calendar [eventon-lite]
Researcher
Affected Software
FULL – Cliente [full-customer]
Researcher
Affected Software
TOCHAT.BE [tochat-be]
Researcher
Affected Software
Researcher
Affected Software
Cliengo – Chatbot [cliengo]
Researcher
Premium Addons for Elementor <= 4.10.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.5
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
WPCS – WordPress Currency Switcher Professional [currency-switcher]
Researcher
Affected Software
Advanced post slider [advanced-post-slider]
Researcher
Affected Software
Amazing Hover Effects [amazing-hover-effects]
Researcher
Affected Software
Arkhe Blocks [arkhe-blocks]
Researcher
Affected Software
Blog, Posts and Category Filter for Elementor [blog-posts-and-category-for-elementor]
Researcher
Affected Software
Booking Ultra Pro Appointments Booking Calendar Plugin [booking-ultra-pro]
Researcher
Affected Software
Bradmax Player [bradmax-player]
Researcher
Affected Software
Calendar.online / Kalender.digital – Plugin [kalender-digital]
Researcher
Affected Software
Researcher
CodePen Embedded Pens Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
CodePen Embedded Pens Shortcode [codepen-embedded-pen-shortcode]
Researcher
Affected Software
ConeBlog – Elementor Blog Widgets [coneblog-widgets]
Researcher
Download Button for Elementor <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Download Button for Elementor [download-button-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
ElementInvader Addons for Elementor [elementinvader-addons-for-elementor]
Researcher
Affected Software
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns [essential-blocks]
Researcher
Affected Software
Extensions for Elementor [extensions-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Feeds for YouTube (YouTube video, channel, and gallery plugin) [feeds-for-youtube]
Researcher
Affected Software
Fusion Page Builder [fusion]
Researcher
Affected Software
Genesis Blocks [genesis-blocks]
Researchers
Affected Software
Goftino [goftino]
Researcher
Affected Software
GutSlider – All in One Slider and Carousel Blocks for Gutenberg [slider-blocks]
Researcher
Affected Software
Job Board Manager [job-board-manager]
Researchers
Affected Software
Get Use APIs – JSON Content Importer [json-content-importer]
Researcher
Magical Addons For Elementor <= 1.1.41 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) [magical-addons-for-elementor]
Researcher
Magical Addons For Elementor <= 1.1.41 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) [magical-addons-for-elementor]
Researcher
Affected Software
Magical Posts Display – Elementor Advanced Posts widgets [magical-posts-display]
Researcher
Affected Software
Researcher
Affected Software
Meks Smart Author Widget [meks-smart-author-widget]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode
6.4
Affected Software
oik [oik]
Researcher
Affected Software
OnePress [onepress]
Researcher
Affected Software
OSM – OpenStreetMap [osm]
Researcher
Affected Software
Panda Video [pandavideo]
Researcher
Affected Software
Post Layouts [post-layouts]
Researcher
Power BI Embedded for WordPress <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Power BI Embedded for WordPress [embed-power-bi]
Researcher
Affected Software
PowerPress Podcasting plugin by Blubrry [powerpress]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Qi Blocks [qi-blocks]
Researcher
Affected Software
Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker [quiz-master-next]
Researcher
Affected Software
Responsive Mobile [responsive-mobile]
Researcher
Affected Software
Responsive Tabs [responsive-tabs]
Researcher
Affected Software
REVIEWS.io for WooCommerce [reviewscouk-for-woocommerce]
Researcher
Seraphinite Post .DOCX Source <= 2.16.9 - Authenticated (Subscriber+) Server-Side Request Forgery
6.4
Affected Software
Seraphinite Post .DOCX Source [seraphinite-post-docx-source]
Researcher
Affected Software
Simple Alert Boxes [simple-alert-boxes]
Researcher
Affected Software
SKT Addons for Elementor [skt-addons-for-elementor]
Researcher
Affected Software
SKT Skill Bar [skt-skill-bar]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
Squelch Tabs and Accordions Shortcodes [squelch-tabs-and-accordions-shortcodes]
Researcher
Tabs For WPBakery Page Builder <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Tabs For WPBakery Page Builder (formerly Visual Composer) [tabs-for-visual-composer]
Researcher
Affected Software
Team Members [team-members]
Researcher
Affected Software
Typebot [typebot]
Researcher
Affected Software
UltraAddons for Elementor [ultraaddons-elementor-lite]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
VK All in One Expansion Unit <= 9.99.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
VK All in One Expansion Unit [vk-all-in-one-expansion-unit]
Researcher
Affected Software
WappPress – Convert Site to App Fast – WordPress to Mobile App Builder [wapppress-builds-android-app-for-website]
Researcher
Affected Software
Webico Slider Flatsome Addons [webico-slider-flatsome-addons]
Researcher
Affected Software
WooCommerce Customers Manager [woocommerce-customers-manager]
Researcher
Affected Software
Researcher
Affected Software
WP GoToWebinar [wp-gotowebinar]
Researcher
Affected Software
WP Photo Album Plus [wp-photo-album-plus]
Researcher
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]
Researcher
Affected Software
WPBITS Addons For Elementor Page Builder [wpbits-addons-for-elementor]
Researcher
Affected Software
WPBITS Addons For Elementor Page Builder [wpbits-addons-for-elementor]
Researcher
Affected Software
Happy WooCommerce FAQs – Ultimate Product FAQ Plugin [faq-for-woocommerce]
Researcher
Affected Software
Zoho Campaigns [zoho-campaigns]
Researcher
Affected Software
AdPush [adsense-plugin]
Researcher
Affected Software
Appmaker – Convert WooCommerce to Android & iOS Native Mobile Apps [appmaker-woocommerce-mobile-app-manager]
Researcher
Affected Software
Contact Form, Survey, Quiz & Popup Form Builder – ARForms [arforms-form-builder]
Researcher
Affected Software
codoc [codoc]
Researcher
Affected Software
Contact Form 7 Submission Summary & PDF Print [cf7-summary-and-print]
Researcher
Affected Software
Counterpoint [counterpoint]
Researcher
Affected Software
Link Library [link-library]
Researcher
Affected Software
Login by Auth0 [auth0]
Researcher
Affected Software
MBE eShip [mail-boxes-etc]
Researcher
Affected Software
WP Multisite Content Copier/Updater [wp-multisite-content-copier]
Researcher
Affected Software
Plum: Spin Wheel & Email Pop-up [qodeblock]
Researcher
Affected Software
Send email only on Reply to My Comment [send-email-only-on-reply-to-my-comment]
Researcher
Affected Software
Send email only on Reply to My Comment [send-email-only-on-reply-to-my-comment]
Researcher
Affected Software
Simple Responsive Slider [simple-responsive-slider]
Researcher
Affected Software
SpiderContacts [spider-contacts]
Researcher
Affected Software
Ultimate Classified Listings – Classifieds, Directory & Marketplace [ultimate-classified-listings]
Researcher
Affected Software
Ultimate Classified Listings – Classifieds, Directory & Marketplace [ultimate-classified-listings]
Researcher
Affected Software
Ultimate Classified Listings – Classifieds, Directory & Marketplace [ultimate-classified-listings]
Researcher
Affected Software
Uncanny Automator Pro [uncanny-automator-pro]
Researcher
Affected Software
Web Directory Free [web-directory-free]
Researchers
Affected Software
Predictive Search for WooCommerce [woocommerce-predictive-search]
Researcher
Affected Software
REPORTiT – Advanced Reporting for WooCommerce [ithemelandco-woo-report]
Researcher
Affected Software
WP Ajax Contact Form [wp-ajax-contact-form]
Researcher
Affected Software
WpStickyBar – Sticky Bar, Sticky Header [wpstickybar-sticky-bar-sticky-header]
Researcher
Affected Software
YITH WooCommerce Ajax Product Filter [yith-woocommerce-ajax-navigation]
Researcher
Affected Software
Zoho CRM Lead Magnet [zoho-crm-forms]
Researcher
Affected Software
Jetpack Boost – Website Speed, Performance and Critical CSS [jetpack-boost]
Researcher
Affected Software
Researcher
Affected Software
WP Total Branding – Complete branding solution for WordPress [wp-total-branding]
Researcher
Affected Software
Cliengo – Chatbot [cliengo]
Researcher
Affected Software
Cliengo – Chatbot [cliengo]
Researcher
Affected Software
SCSS Happy Compiler – Compile SCSS to CSS & Automatic Enqueue [happy-scss-compiler]
Researcher
Affected Software
Researcher
Affected Software
LearnDash LMS – Reports [wisdm-reports-for-learndash]
Researcher
Affected Software
Pricing Table [elfsight-pricing-table]
Researcher
Affected Software
WooCommerce Customers Manager [woocommerce-customers-manager]
Researcher
WooCommerce Customers Manager < 30.1 - Cross-Site Request Forgery to Customer Deletion via 'Delete'
5.4
Affected Software
WooCommerce Customers Manager [woocommerce-customers-manager]
Researcher
Affected Software
WP Affiliate Platform [wp-affiliate-platform]
Researcher
Affected Software
Branda – White Label & Branding, Free Login Page Customizer [branda-white-labeling]
Researcher
Affected Software
Chained Quiz [chained-quiz]
Researcher
Affected Software
Coming Soon Page – Responsive Coming Soon & Maintenance Mode [responsive-coming-soon-page]
Researcher
Affected Software
Researcher
Affected Software
EleForms – All In One Form Integration including DB for Elementor [all-contact-form-integration-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Gravity Forms: Multiple Form Instances [gravity-forms-multiple-form-instances]
Researcher
Affected Software
HitPay Payment Gateway for WooCommerce [hitpay-payment-gateway]
Researcher
Affected Software
iPanorama 360 – Advanced Virtual Tour Builder [ipanorama-360-virtual-tour-builder-lite]
Researcher
Affected Software
Laposta [laposta]
Researcher
Affected Software
MBE eShip [mail-boxes-etc]
Researcher
Affected Software
Olive One Click Demo Import [olive-one-click-demo-import]
Researcher
Affected Software
Payflex Payment Gateway [payflex-payment-gateway]
Researcher
Affected Software
Plum: Spin Wheel & Email Pop-up [qodeblock]
Researcher
Affected Software
Pricing Table [elfsight-pricing-table]
Researcher
Affected Software
Product Delivery Date for WooCommerce – Lite [product-delivery-date-for-woocommerce-lite]
Researcher
Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
5.3
Affected Software
PickPlugins Product Designer for WooCommerce [product-designer]
Researcher
Affected Software
ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System [redi-restaurant-reservation]
Researcher
Affected Software
Send Users Email – Email Subscribers, Email Marketing Newsletter [send-users-email]
Researcher
Affected Software
SmartCrawl SEO checker, analyzer & optimizer [smartcrawl-seo]
Researcher
Affected Software
SmartMag [smartmag-responsive-retina-wordpress-magazine]
Researcher
Affected Software
Social Sharing Plugin – Kiwi [kiwi-social-share]
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Wholesale Suite – B2B, Dynamic Pricing & WooCommerce Wholesale Prices [woocommerce-wholesale-prices]
Researcher
Affected Software
Openpos - WooCommerce Point Of Sale(POS) [woocommerce-openpos]
Researcher
Affected Software
WP Accessibility Helper (WAH) [wp-accessibility-helper]
Researcher
Affected Software
WP Popups – WordPress Popup builder [wp-popups-lite]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Zephyr Project Manager [zephyr-project-manager]
Researcher
Affected Software
Admin Dashboard RSS Feed [admin-dashboard-rss-feed]
Researchers
Affected Software
Change From Email [wp-from-email]
Researcher
Affected Software
Email Encoder – Protect Email Addresses and Phone Numbers [email-encoder-bundle]
Researcher
Affected Software
Affected Software
Gum Addon for Elementor [gum-elementor-addon]
Researcher
Affected Software
Inline Related Posts [intelly-related-posts]
Researcher
Affected Software
Master Popups [master-popups-lite]
Researcher
My Sticky Bar (formerly myStickymenu) <= 2.7.1 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
Affected Software
Researcher
Affected Software
Plugin Notes Plus [plugin-notes-plus]
Researcher
Affected Software
ReCaptcha Integration for WordPress [wp-recaptcha-integration]
Researcher
Affected Software
Simple Popup Plugin [simple-popup-plugin]
Researcher
Affected Software
Simple Post Notes [simple-post-notes]
Researcher
Affected Software
Slider by 10Web – Responsive Image Slider [slider-wd]
Researcher
Affected Software
SportsPress – Sports Club & League Manager [sportspress]
Researcher
Timeline Module for Beaver Builder <= 1.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting
4.4
Affected Software
Timeline Module for Beaver Builder [timeline-for-beaver-builder]
Researcher
Affected Software
Notifications for Forms & WordPress Actions [notifier]
Researcher
Affected Software
Researcher
Affected Software
Zephyr Project Manager [zephyr-project-manager]
Researcher
Affected Software
Auto Featured Image (Auto Post Thumbnail) [auto-post-thumbnail]
Researcher
Affected Software
BuddyBoss Theme [buddyboss-theme]
Researcher
Affected Software
Comment Images Reloaded [comment-images-reloaded]
Researcher
Affected Software
SmartText Rotator – Add Motion to Your Words [css3-rotating-words]
Researcher
Affected Software
Researcher
Affected Software
Event Post [event-post]
Researcher
Affected Software
Event Tickets and Registration [event-tickets]
Researcher
Affected Software
Featured Image Generator [featured-image-generator]
Researcher
Affected Software
Generate PDF using Contact Form 7 [generate-pdf-using-contact-form-7]
Researcher
Affected Software
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
HTML Forms – Simple WordPress Forms Plugin [html-forms]
Researcher
Affected Software
i-amaze [i-amaze]
Researcher
Affected Software
i-transform [i-transform]
Researcher
Affected Software
Internal Link Juicer: SEO Auto Linker for WordPress [internal-links]
Researcher
Affected Software
Just Custom Fields [just-custom-fields]
Researcher
Affected Software
Just Custom Fields [just-custom-fields]
Researcher
Affected Software
Light Poll [light-poll]
Researcher
Affected Software
MakeStories (for Google Web Stories) [makestories-helper]
Researcher
Affected Software
Researcher
Affected Software
MBE eShip [mail-boxes-etc]
Researcher
Affected Software
Media Hygiene: Remove or Delete Unused Images and More! [media-hygiene]
Researcher
Affected Software
Meks Video Importer [meks-video-importer]
Researcher
Affected Software
Metorik – Reports & Email Automation for WooCommerce [metorik-helper]
Researcher
Affected Software
Oceanic [oceanic]
Researcher
Affected Software
Packlink PRO for WooCommerce [packlink-pro-shipping]
Researcher
Affected Software
Paid Memberships Pro - Member Directory Add On [pmpro-member-directory]
Researcher
Affected Software
پلاگین پرداخت دلخواه [pardakht-delkhah]
Researcher
Affected Software
Patricia Blog [patricia-blog]
Researcher
Affected Software
Patricia Lite [patricia-lite]
Researcher
Affected Software
Point [point]
Researcher
Affected Software
Popularis Verse [popularis-verse]
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Seraphinite Accelerator Premium <= 2.21.13 - Cross-Site Request Forgery to Arbitrary File Deletion
4.3
Affected Software
Seraphinite Accelerator Pro [seraphinite-accelerator-ext]
Researcher
Affected Software
Seraphinite Post .DOCX Source [seraphinite-post-docx-source]
Researcher
Affected Software
SociallyViral [sociallyviral]
Researcher
Affected Software
Taggbox – Free Social Media Widgets, Review Badges & Shoppable UGC [taggbox-widget]
Researcher
Affected Software
Researcher
Affected Software
User Activity Log Pro [user-activity-log-pro]
Researcher
Affected Software
Widgets Reset [widgets-reset]
Researcher
Affected Software
WP Ajax Contact Form [wp-ajax-contact-form]
Researcher
Affected Software
WP Fast Total Search – The Power of Indexed Search [fulltext-search]
Researcher
Affected Software
WP GoToWebinar [wp-gotowebinar]
Researcher
WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update
4.3
Affected Software
WP Links Page [wp-links-page]
Researcher
Affected Software
Happy WooCommerce FAQs – Ultimate Product FAQ Plugin [faq-for-woocommerce]
Researcher
Affected Software
Academy LMS [academy]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments