Wordfence Intelligence Weekly WordPress Vulnerability Report (September 23, 2024 to September 29, 2024)
📢 Did you know Wordfence runs a Bug Bounty Program for all WordPress plugins and themes at no cost to vendors? Through October 7th, 2024, XSS vulnerabilities in all plugins and themes with >=1,000 Active Installs are in scope for all researchers. In addition, through October 14th, 2024, researchers can earn up to $31,200, for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we handle all the rest.
Last week, there were 189 vulnerabilities disclosed in 164 WordPress Plugins and 2 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 74 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 18,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- Wechat Social login <= 1.3.0 – Authentication Bypass
- Wechat Social login <= 1.3.0 – Unauthenticated Arbitrary File Upload
- Echo RSS Feed Post Generator <= 5.4.6 – Unauthenticated Privilege Escalation
- WordPress & WooCommerce Affiliate Program <= 8.4.1 – Authentication Bypass to Account Takeover and Privilege Escalation
- WAF-RULE-748 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-749 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-750 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-752 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 155 |
| Unpatched | 34 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 141 |
| High Severity | 23 |
| Critical Severity | 23 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 98 |
| Missing Authorization | 26 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 15 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 14 |
| Cross-Site Request Forgery (CSRF) | 8 |
| Exposure of Sensitive Information to an Unauthorized Actor | 6 |
| Authorization Bypass Through User-Controlled Key | 4 |
| Deserialization of Untrusted Data | 4 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 4 |
| Unrestricted Upload of File with Dangerous Type | 3 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Exposure of Sensitive Information Through Metadata | 1 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 1 |
| Unverified Password Change | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 19 | |
| 12 | |
| 11 | |
| 11 | |
| 8 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 012 Ps Multi Languages | 012-ps-multi-languages |
| ABC APP CREATOR | abcapp-creator |
| Absolute Reviews | absolute-reviews |
| Accordions | accordions |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| AnWP Football Leagues | football-leagues-by-anwppro |
| ARI Fancy Lightbox – Popup for WordPress | ari-fancy-lightbox |
| BA Book Everything | ba-book-everything |
| Beam me up Scotty – Back to Top Button | beam-me-up-scotty |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder | bit-form |
| Bold Page Builder | bold-page-builder |
| Bulk NoIndex & NoFollow Toolkit | bulk-noindex-nofollow-toolkit-by-mad-fish |
| Category Dropdown by GCS Design | wp-category-dropdown |
| Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More | charitable |
| Charity Addon for Elementor | charity-addon-for-elementor |
| Chartify – WordPress Chart Plugin | chart-builder |
| Checkout Mestres do WP for WooCommerce | checkout-mestres-wp |
| Cities Shipping Zones for WooCommerce | cities-shipping-zones-for-woocommerce |
| Classic Editor and Classic Widgets | classic-editor-and-classic-widgets |
| ClickSold IDX | clicksold-wordpress-plugin |
| Common Tools for Site | common-tools-for-site |
| Community by PeepSo – Download from PeepSo.com | peepso-core |
| Confetti Fall Animation | confetti-fall-animation |
| Contact Form 7 Campaign Monitor Extension | contact-form-7-campaign-monitor-extension |
| Contact Form to Any API | contact-form-to-any-api |
| Crowdsignal Dashboard – Polls, Surveys & more | polldaddy |
| CSS JS Files | css-js-files |
| CubeWP Forms | cubewp-forms |
| Daily Prayer Time | daily-prayer-time-for-mosques |
| Directory Listings WordPress plugin – uListing | ulisting |
| Download Manager | download-manager |
| Download Monitor | download-monitor |
| Easy Appointment Booking & Scheduling System – Webba Booking Calendar | webba-booking-lite |
| Easy Digital Downloads – eCommerce Payments and Subscriptions made easy | easy-digital-downloads |
| Easy Mega Menu for WordPress – ThemeHunk | themehunk-megamenu-plus |
| Easy PayPal Events & Tickets | easy-paypal-events-tickets |
| ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor | elementskit-lite |
| ElementsReady Addons for Elementor | element-ready-lite |
| Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress | email-subscribers |
| EU/UK VAT Validation Manager for WooCommerce | eu-vat-for-woocommerce |
| Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) | wp-event-solution |
| Fluent Support – Helpdesk & Customer Support Ticket System | fluent-support |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce | wp-marketing-automations |
| Garden Gnome Package | garden-gnome-package |
| GEO my WP | geo-my-wp |
| GF Custom Style | gf-custom-style |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) | graphicsly |
| Gum Addon for Elementor | gum-elementor-addon |
| GutenGeek Free Gutenberg Blocks for WordPress | gtg-advanced-blocks |
| Happy Addons for Elementor | happy-elementor-addons |
| HT Mega Addons for Elementor – Elementor Widgets & Template Builder | ht-mega-for-elementor |
| HUSKY – Products Filter Professional for WooCommerce | woocommerce-products-filter |
| IdeaPush | ideapush |
| Instant Chat Floating Button for WordPress Websites | instant-chat-wp |
| JoomSport – for Sports: Team & League, Football, Hockey & more | joomsport-sports-league-results-management |
| Joy Of Text Lite – SMS messaging for WordPress. | joy-of-text |
| Jupiter X Core | jupiterx-core |
| king_IE | king-ie |
| Kodex Posts likes | kodex-posts-likes |
| Koko Analytics – Privacy-Friendly WordPress Analytics | koko-analytics |
| LatePoint Plugin | latepoint |
| LiteSpeed Cache | litespeed-cache |
| Livemesh Addons by Elementor | addons-for-elementor |
| Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase | logo-slider-wp |
| Loops & Logic | tangible-loops-and-logic |
| Mail logging – WP Mail Catcher | wp-mail-catcher |
| MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. | mailoptin |
| Mapplic Lite | mapplic-lite |
| MapPress Maps for WordPress | mappress-google-maps-for-wordpress |
| MAS Static Content | mas-static-content |
| Material Design Icons | material-design-icons |
| MDTF – Meta Data and Taxonomies Filter | wp-meta-data-filter-and-taxonomy-filter |
| Medical Addon for Elementor | medical-addon-for-elementor |
| Mega Elements – Addons for Elementor | mega-elements-addons-for-elementor |
| Meta Slider and Carousel with Lightbox | meta-slider-and-carousel-with-lightbox |
| MH Board | mh-board |
| Move Addons for Elementor | move-addons |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| Multi Step for Contact Form 7 | cf7-multi-step |
| Multipurpose Ticket Booking Manager (Bus/Train/Ferry/Boat/Shuttle) | bus-booking-manager |
| Newsletters | newsletters-lite |
| NiceJob | nicejob |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Nokaut Offers Box | nokaut-offers-box |
| OneElements – Best Elementor Addons | oneelements-ultimate-addons-for-elementor |
| OSM – OpenStreetMap | osm |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| PiWeb Product Enquiry or product catalog for WooCommerce | enquiry-quotation-for-woocommerce |
| Pixel Cat – Conversion Pixel Manager | facebook-conversion-pixel |
| Podiant | podiant |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Polls CP | cp-polls |
| Post Grid | post-grid |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Primary Addon for Elementor | primary-addon-for-elementor |
| Prisna GWT – Google Website Translator | google-website-translator |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| PWA for WP – Progressive Web Apps Made Simple | pwa-for-wp |
| Quads Ads Manager for Google AdSense | quick-adsense-reloaded |
| Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | radio-player |
| REST API TO MiniProgram | rest-api-to-miniprogram |
| Restaurant & Cafe Addon for Elementor | restaurant-cafe-addon-for-elementor |
| Review & testimonial widgets | trustmary |
| Revolut Gateway for WooCommerce | revolut-gateway-for-woocommerce |
| Salon Booking System – Free Version | salon-booking-system |
| Secure Copy Content Protection and Content Locking | secure-copy-content-protection |
| Seriously Simple Stats | seriously-simple-stats |
| Share This Image | share-this-image |
| ShiftController Employee Shift Scheduling | shiftcontroller |
| ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | woolentor-addons |
| Sight – Professional Image Gallery and Portfolio | sight |
| Simple Calendar – Google Calendar Plugin | google-calendar-events |
| Simple LDAP Login | simple-ldap-login |
| Simple Popup Plugin | simple-popup-plugin |
| Sky Addons for Elementor | sky-elementor-addons |
| Special Text Boxes | wp-special-textboxes |
| Stape Conversion Tracking | gtm-server-side |
| Starter Templates – AI-Powered Templates for Elementor & Gutenberg | astra-sites |
| Store Hours for WooCommerce | order-hours-scheduler-for-woocommerce |
| Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers | sunshine-photo-cart |
| Super Testimonials | sola-testimonials |
| Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! | templately |
| Terms descriptions | terms-descriptions |
| Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam | bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang |
| The Events Calendar | the-events-calendar |
| Themedy Toolbox | themedy-toolbox |
| Themesflat Addons For Elementor | themesflat-addons-for-elementor |
| Themify – WooCommerce Product Filter | themify-wc-product-filter |
| Truepush – Most Affordable Web Push Notifications | truepush-free-web-push-notifications |
| Uncanny Groups for LearnDash | uncanny-learndash-groups |
| Use Any Font | Custom Font Uploader | use-any-font |
| UsersControl – Users Profile, Free or Paid Subscriptions, User Access Restriction & Members Directory | users-control |
| Vmax Project Manager | vmax-project-manager |
| VR Calendar | vr-calendar-sync |
| W3 Total Cache | w3-total-cache |
| WCFM – Frontend Manager for WooCommerce | wc-frontend-manager |
| Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode | coming-soon |
| Wheel of Life: Coaching and Assessment Tool for Life Coach | wheel-of-life |
| WooEvents - Calendar and Event Booking | woo-events |
| WordPress Visitors | nm-visitors |
| WP Abstracts | wp-abstracts-manuscripts-manager |
| WP Datepicker | wp-datepicker |
| WP Easy Gallery – WordPress Gallery Plugin | wp-easy-gallery |
| WP Free SSL | wp-free-ssl |
| WP GPX Maps | wp-gpx-maps |
| WP MultiTasking – WP Utilities | wp-multitasking |
| WP Newsletter Subscription | wp-newsletter-subscription |
| WP Simple HTML Sitemap | wp-simple-html-sitemap |
| WP Ticket Ultra Help Desk & Support Plugin | wp-ticket-ultra |
| WP Timeline – Vertical and Horizontal timeline plugin | wp-timelines |
| WP Travel – Ultimate Travel Booking System, Tour Management Engine | wp-travel |
| WP-DownloadManager | wp-downloadmanager |
| WP-WebAuthn | wp-webauthn |
| WPExperts Square For GiveWP | wpexperts-square-for-give |
| WPGSI: Spreadsheet Integration | wpgsi |
| WPSPX | wpspx |
| WPZOOM Shortcodes | wpzoom-shortcodes |
| WS Form LITE – Drag & Drop Contact Form Builder | ws-form |
| XT Ajax Add To Cart for WooCommerce | xt-woo-ajax-add-to-cart |
| Zoho Flow – No-Code Workflow Automation | zoho-flow |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Catch Base | catch-base |
| Viala | viala |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Daily Prayer Time [daily-prayer-time-for-mosques]
Researcher
Affected Software
MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]
Researcher
Affected Software
WP Easy Gallery – WordPress Gallery Plugin [wp-easy-gallery]
Researcher
Affected Software
ABC APP CREATOR [abcapp-creator]
Researcher
Affected Software
Contact Form 7 Campaign Monitor Extension [contact-form-7-campaign-monitor-extension]
Researcher
Affected Software
Researcher
GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection
9.8
Affected Software
Researcher
Instant Chat Floating Button for WordPress Websites <= 1.0.5 - Unauthenticated Local File Inclusion
9.8
Affected Software
Instant Chat Floating Button for WordPress Websites [instant-chat-wp]
Researcher
Affected Software
LatePoint Plugin [latepoint]
Researcher
Affected Software
MH Board [mh-board]
Researcher
Affected Software
Podiant [podiant]
Researcher
Affected Software
REST API TO MiniProgram [rest-api-to-miniprogram]
Researcher
Affected Software
The Events Calendar [the-events-calendar]
Researcher
Affected Software
Researcher
Affected Software
Vmax Project Manager [vmax-project-manager]
Researcher
Affected Software
VR Calendar [vr-calendar-sync]
Researcher
Affected Software
WP Newsletter Subscription [wp-newsletter-subscription]
Researcher
Affected Software
WP Ticket Ultra Help Desk & Support Plugin [wp-ticket-ultra]
Researcher
Affected Software
WP Timeline – Vertical and Horizontal timeline plugin [wp-timelines]
Researcher
Affected Software
WPSPX [wpspx]
Researcher
Affected Software
Prisna GWT – Google Website Translator [google-website-translator]
Researcher
Affected Software
WooEvents - Calendar and Event Booking [woo-events]
Researcher
Affected Software
WP Simple HTML Sitemap [wp-simple-html-sitemap]
Researcher
BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover
8.8
Affected Software
BA Book Everything [ba-book-everything]
Researcher
Affected Software
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) [wp-event-solution]
Researcher
Affected Software
PiWeb Product Enquiry or product catalog for WooCommerce [enquiry-quotation-for-woocommerce]
Researcher
Affected Software
WCFM – Frontend Manager for WooCommerce [wc-frontend-manager]
Researcher
Affected Software
WP Timeline – Vertical and Horizontal timeline plugin [wp-timelines]
Researcher
Affected Software
Jupiter X Core [jupiterx-core]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
Multi Step for Contact Form 7 [cf7-multi-step]
Researcher
Affected Software
REST API TO MiniProgram [rest-api-to-miniprogram]
Researcher
MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution
7.3
Affected Software
MDTF – Meta Data and Taxonomies Filter [wp-meta-data-filter-and-taxonomy-filter]
Researcher
Affected Software
Special Text Boxes [wp-special-textboxes]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Bit Form – Contact Form Plugin <= 2.13.10 - Authenticated (Administrator+) Arbitrary File Upload
7.2
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Checkout Mestres do WP for WooCommerce [checkout-mestres-wp]
Researcher
Cities Shipping Zones for WooCommerce <= 1.2.7 - Authenticated (Shop Manager+) Local File Inclusion
7.2
Affected Software
Cities Shipping Zones for WooCommerce [cities-shipping-zones-for-woocommerce]
Researcher
Affected Software
Contact Form to Any API [contact-form-to-any-api]
Researcher
Affected Software
CubeWP Forms [cubewp-forms]
Researcher
Affected Software
Easy Digital Downloads – eCommerce Payments and Subscriptions made easy [easy-digital-downloads]
Researcher
Affected Software
Researcher
Affected Software
Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam [bck-tu-dong-xac-nhan-thanh-toan-chuyen-khoan-ngan-hang]
Researcher
Affected Software
Uncanny Groups for LearnDash [uncanny-learndash-groups]
Researcher
Affected Software
WordPress Visitors [nm-visitors]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
Classic Editor and Classic Widgets [classic-editor-and-classic-widgets]
Researcher
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
Affected Software
012 Ps Multi Languages [012-ps-multi-languages]
Researcher
Affected Software
Absolute Reviews [absolute-reviews]
Researcher
Affected Software
Accordions [accordions]
Researcher
Affected Software
AnWP Football Leagues [football-leagues-by-anwppro]
Researcher
Affected Software
ARI Fancy Lightbox – Popup for WordPress [ari-fancy-lightbox]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Affected Software
Catch Base [catch-base]
Researcher
Affected Software
Charity Addon for Elementor [charity-addon-for-elementor]
Researcher
Affected Software
Common Tools for Site [common-tools-for-site]
Researcher
Affected Software
Confetti Fall Animation [confetti-fall-animation]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
ElementsReady Addons for Elementor [element-ready-lite]
Researcher
Affected Software
Garden Gnome Package [garden-gnome-package]
Researcher
GF Custom Style <= 2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
GF Custom Style [gf-custom-style]
Researcher
Affected Software
Researcher
Affected Software
Gum Addon for Elementor [gum-elementor-addon]
Researcher
Affected Software
Gum Addon for Elementor [gum-elementor-addon]
Researcher
Affected Software
GutenGeek Free Gutenberg Blocks for WordPress [gtg-advanced-blocks]
Researcher
Affected Software
king_IE [king-ie]
Researcher
Affected Software
Livemesh Addons by Elementor [addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Mapplic Lite [mapplic-lite]
Researcher
Affected Software
Material Design Icons [material-design-icons]
Researcher
Affected Software
Medical Addon for Elementor [medical-addon-for-elementor]
Researcher
Affected Software
Mega Elements – Addons for Elementor [mega-elements-addons-for-elementor]
Researcher
Affected Software
Meta Slider and Carousel with Lightbox [meta-slider-and-carousel-with-lightbox]
Researcher
Affected Software
Move Addons for Elementor [move-addons]
Researcher
Affected Software
NiceJob [nicejob]
Researcher
Affected Software
OneElements – Best Elementor Addons [oneelements-ultimate-addons-for-elementor]
Researcher
Affected Software
OSM – OpenStreetMap [osm]
Researcher
Post Grid and Gutenberg Blocks <= 2.2.89 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Post Grid [post-grid]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Primary Addon for Elementor [primary-addon-for-elementor]
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
Researcher
Affected Software
Restaurant & Cafe Addon for Elementor [restaurant-cafe-addon-for-elementor]
Researcher
Review & testimonial widgets <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Review & testimonial widgets [trustmary]
Researcher
Affected Software
ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin [woolentor-addons]
Researcher
Affected Software
Simple Popup Plugin [simple-popup-plugin]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
Super Testimonials [sola-testimonials]
Researcher
Affected Software
Themedy Toolbox [themedy-toolbox]
Researcher
Themesflat Addons For Elementor <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Themesflat Addons For Elementor [themesflat-addons-for-elementor]
Researcher
Affected Software
Category Dropdown by GCS Design [wp-category-dropdown]
Researcher
WP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode
6.4
Affected Software
WP GPX Maps [wp-gpx-maps]
Researcher
Affected Software
WP-WebAuthn [wp-webauthn]
Researcher
Affected Software
WPZOOM Shortcodes [wpzoom-shortcodes]
Researcher
Affected Software
WPGSI: Spreadsheet Integration [wpgsi]
Researcher
Affected Software
Beam me up Scotty – Back to Top Button [beam-me-up-scotty]
Researcher
Affected Software
Bulk NoIndex & NoFollow Toolkit [bulk-noindex-nofollow-toolkit-by-mad-fish]
Researcher
Affected Software
Chartify – WordPress Chart Plugin [chart-builder]
Researcher
Affected Software
EU/UK VAT Validation Manager for WooCommerce [eu-vat-for-woocommerce]
Researcher
Affected Software
GEO my WP [geo-my-wp]
Researcher
Affected Software
Stape Conversion Tracking [gtm-server-side]
Researcher
Affected Software
Kodex Posts likes [kodex-posts-likes]
Researcher
Affected Software
Koko Analytics – Privacy-Friendly WordPress Analytics [koko-analytics]
Researcher
Affected Software
Loops & Logic [tangible-loops-and-logic]
Researcher
Affected Software
Newsletters [newsletters-lite]
Researcher
Affected Software
Pixel Cat – Conversion Pixel Manager [facebook-conversion-pixel]
Researcher
Affected Software
Secure Copy Content Protection and Content Locking [secure-copy-content-protection]
Researcher
Affected Software
Seriously Simple Stats [seriously-simple-stats]
Researcher
Affected Software
Share This Image [share-this-image]
Researcher
Affected Software
Simple Calendar – Google Calendar Plugin [google-calendar-events]
Researcher
Affected Software
Simple LDAP Login [simple-ldap-login]
Researcher
Affected Software
Store Hours for WooCommerce [order-hours-scheduler-for-woocommerce]
Researcher
Affected Software
Viala [viala]
Researcher
Affected Software
Mail logging – WP Mail Catcher [wp-mail-catcher]
Researcher
Affected Software
WP Timeline – Vertical and Horizontal timeline plugin [wp-timelines]
Researcher
Affected Software
WP-DownloadManager [wp-downloadmanager]
Researcher
Affected Software
Researcher
Affected Software
XT Ajax Add To Cart for WooCommerce [xt-woo-ajax-add-to-cart]
Researcher
Affected Software
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
Researcher
Affected Software
BA Book Everything [ba-book-everything]
Researcher
Affected Software
Community by PeepSo – Download from PeepSo.com [peepso-core]
Researcher
Affected Software
EU/UK VAT Validation Manager for WooCommerce [eu-vat-for-woocommerce]
Researcher
Affected Software
Fluent Support – Helpdesk & Customer Support Ticket System [fluent-support]
Researcher
Affected Software
HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter]
Researcher
Affected Software
Researcher
Affected Software
Revolut Gateway for WooCommerce [revolut-gateway-for-woocommerce]
Researchers
Affected Software
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Researcher
Affected Software
Truepush – Most Affordable Web Push Notifications [truepush-free-web-push-notifications]
Researcher
Affected Software
Researcher
Affected Software
Wheel of Life: Coaching and Assessment Tool for Life Coach [wheel-of-life]
Researcher
Affected Software
WP Datepicker [wp-datepicker]
Researcher
Affected Software
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce [wp-marketing-automations]
Researcher
Affected Software
Researcher
Affected Software
CSS JS Files [css-js-files]
Researcher
Affected Software
WPExperts Square For GiveWP [wpexperts-square-for-give]
Researcher
Affected Software
Zoho Flow – No-Code Workflow Automation [zoho-flow]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Download Manager [download-manager]
Researcher
Affected Software
Kodex Posts likes [kodex-posts-likes]
Researcher
MapPress Maps for WordPress <= 2.92.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
MapPress Maps for WordPress [mappress-google-maps-for-wordpress]
Researcher
Affected Software
Multipurpose Ticket Booking Manager (Bus/Train/Ferry/Boat/Shuttle) [bus-booking-manager]
Researcher
Affected Software
Nokaut Offers Box [nokaut-offers-box]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researchers
Affected Software
ShiftController Employee Shift Scheduling [shiftcontroller]
Researcher
Affected Software
Terms descriptions [terms-descriptions]
Researcher
Affected Software
Themify – WooCommerce Product Filter [themify-wc-product-filter]
Researcher
Affected Software
ClickSold IDX [clicksold-wordpress-plugin]
Researcher
Affected Software
WP Abstracts [wp-abstracts-manuscripts-manager]
Researcher
Affected Software
WP Datepicker [wp-datepicker]
Researcher
Affected Software
WP MultiTasking – WP Utilities [wp-multitasking]
Researcher
Affected Software
Researcher
Affected Software
Quads Ads Manager for Google AdSense [quick-adsense-reloaded]
Researcher
Affected Software
Easy Appointment Booking & Scheduling System – Webba Booking Calendar [webba-booking-lite]
Researcher
Affected Software
Crowdsignal Dashboard – Polls, Surveys & more [polldaddy]
Researcher
Affected Software
Download Monitor [download-monitor]
Researcher
Affected Software
Easy Mega Menu for WordPress – ThemeHunk [themehunk-megamenu-plus]
Researcher
Affected Software
Easy PayPal Events & Tickets [easy-paypal-events-tickets]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure
4.3
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
HT Mega Addons for Elementor – Elementor Widgets & Template Builder [ht-mega-for-elementor]
Researcher
Affected Software
JoomSport – for Sports: Team & League, Football, Hockey & more [joomsport-sports-league-results-management]
Researcher
Affected Software
Joy Of Text Lite – SMS messaging for WordPress. [joy-of-text]
Researcher
MAS Static Content <= 1.0.8 - Authenticated (Contributor+) Private Static Content Page Disclosure
4.3
Affected Software
MAS Static Content [mas-static-content]
Researcher
Affected Software
Nokaut Offers Box [nokaut-offers-box]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
PWA for WP – Progressive Web Apps Made Simple [pwa-for-wp]
Researcher
Affected Software
Salon Booking System – Free Version [salon-booking-system]
Researcher
Affected Software
Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers [sunshine-photo-cart]
Researcher
Affected Software
Themesflat Addons For Elementor [themesflat-addons-for-elementor]
Researcher
Affected Software
Use Any Font | Custom Font Uploader [use-any-font]
Researcher
Affected Software
WP Easy Gallery – WordPress Gallery Plugin [wp-easy-gallery]
Researcher
WP Free SSL – Free SSL Certificate for WordPress and force HTTPS <= 1.2.7 - Missing Authorization
4.3
Affected Software
WP Free SSL [wp-free-ssl]
Researcher
Affected Software
W3 Total Cache [w3-total-cache]
Researcher
Affected Software
Uncanny Groups for LearnDash [uncanny-learndash-groups]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments