Wordfence Intelligence Weekly WordPress Vulnerability Report (November 11, 2024 to November 17, 2024)
🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through December 9th, 2024:
- All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
- All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
- Minimum bounty of $5 for all valid in-scope submissions.
- All researchers earn automatic bonuses of between 5% to 180% for valid submissions
- Pending report limits are increased for all
- It’s possible to earn up to $31,200 for high impact vulnerabilities!
Last week, there were 185 vulnerabilities disclosed in 169 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 56 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 20,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WordPress GDPR <= 2.0.2 – Missing Authorization to Unauthenticated Arbitrary User Deletion
- WAF-RULE-766 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-767 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-768 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-769 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 117 |
| Unpatched | 68 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 111 |
| High Severity | 42 |
| Critical Severity | 30 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 69 |
| Missing Authorization | 25 |
| Unrestricted Upload of File with Dangerous Type | 24 |
| Cross-Site Request Forgery (CSRF) | 15 |
| Deserialization of Untrusted Data | 11 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 8 |
| Authorization Bypass Through User-Controlled Key | 5 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 5 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 5 |
| Authentication Bypass Using an Alternate Path or Channel | 4 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Exposure of Sensitive Information to an Unauthorized Actor | 2 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 2 |
| Dependency on Vulnerable Third-Party Component | 1 |
| Exposure of Data Element to Wrong Session | 1 |
| External Control of File Name or Path | 1 |
| Improper Neutralization of Special Elements Used in a Template Engine | 1 |
| Improper Privilege Management | 1 |
| Insertion of Sensitive Information into Log File | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 22 | |
| 17 | |
| 14 | |
| 10 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 3DPrint Lite | 3dprint-lite |
| 404 Error Monitor | 404-error-monitor |
| 404 Solution | 404-solution |
| Admin and Site Enhancements (ASE) | admin-site-enhancements |
| Ads Booster by Ads Pro | free-wp-booster-by-ads-pro |
| Advanced Form Integration — Connect Forms to 200+ Apps | advanced-form-integration |
| Advanced Order Export For WooCommerce | woo-order-export-lite |
| Advanced Personalization | personalization-by-flowcraft |
| Agentic Help Desk Plugin for WordPress – Live Chat, AI Chatbot & Ticketing – ThriveDesk | thrivedesk |
| Ai Auto Tool Content Writing Assistant All in One | ai-auto-tool |
| AJAX Login and Registration modal popup + inline form | ajax-login-and-registration-modal-popup |
| AJAX Random Posts | ajax-random-posts |
| AP Twig Bridge | ap-twig-bridge |
| Aqua SVG Sprite | aqua-svg-sprite |
| Automatic Multilingual Translation by Autoglot | autoglot |
| AWcode Toolkit | awcode-toolkit |
| B-Banner Slider | b-banner-slider |
| Backup and Staging by WP Time Capsule | wp-time-capsule |
| Blogger 301 Redirect | blogger-301-redirect |
| Boat Rental Plugin for WordPress | boat-rental-system |
| Booking Calendar | booking |
| Boostify Header Footer Builder for Elementor | boostify-header-footer-builder |
| Bounce Handler MailPoet 3 | bounce-handler-mailpoet |
| BuddyPress Builder for Elementor – BuddyBuilder | stax-buddy-builder |
| BulkPress | bulkpress |
| Business Essentials for Contact Form 7 | cf7-redirect-thank-you-page |
| Buy one click WooCommerce | buy-one-click-woocommerce |
| CDI – Collect and Deliver Interface for Woocommerce | collect-and-deliver-interface-for-woocommerce |
| CF7 Reply Manager | cf7-reply-manager |
| Chartify – WordPress Chart Plugin | chart-builder |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Constant Contact Forms by MailMunch | constant-contact-forms-by-mailmunch |
| Content Template Engine | content-template-engine |
| Convert Docx2post | convert-docx2post |
| ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators | convertcalculator |
| Copy Anything to Clipboard for WordPress – Copy Button, Copy Text & Copy Code | copy-the-code |
| CSV to HTML | csv-to-html |
| Customer Reviews for WooCommerce | customer-reviews-woocommerce |
| CYAN Backup | cyan-backup |
| Datasets Manager by Arttia Creative | datasets-manager-by-arttia-creative |
| Devexhub Gallery | devexhub-gallery |
| DigiPass | digipass |
| Disable Admin Notices – Hide Dashboard Notifications | disable-admin-notices |
| DK White Label | dk-white-label |
| Do That Task | do-that-task |
| DPortfolio | dportfolio |
| Drop Shadow Boxes | drop-shadow-boxes |
| Drozd – Addons for Elementor | drozd-addons-for-elementor |
| Easy CSV Importer BETA | easy-csv-importer |
| Easy Popup Lightbox Maker | easy-popup-lightbox-maker |
| EKC Tournament Manager | ekc-tournament-manager |
| EleForms – All In One Form Integration including DB for Elementor | all-contact-form-integration-for-elementor |
| Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| Essential Addons for Elementor – Popular Elementor Templates & Widgets | essential-addons-for-elementor-lite |
| Event Tickets with Ticket Scanner | event-tickets-with-ticket-scanner |
| Exclusive Content Password Protect | exclusive-content-password-protect |
| Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme | exclusive-divi |
| External Database Based Actions | external-database-based-actions |
| Floating Buttons for WooCommerce | shop-assistant-for-woocommerce-jarvis |
| Full Screen (Page) Background Image Slideshow | full-screen-page-background-image-slideshow |
| Futurio Extra | futurio-extra |
| Gallerio | gallerio |
| Gallery Manager | fancy-gallery |
| Global Gateway e4 | Payeezy Gateway | | globe-gateway-e4 |
| GPX Viewer | gpx-viewer |
| Hacklog DownloadManager | hacklog-downloadmanager |
| Happy Addons for Elementor | happy-elementor-addons |
| Hash Elements | hash-elements |
| Hebrew Dates | hebrewdates |
| Hide Links | hide-links |
| Hive Support | AI-Powered Help Desk, Live Chat and Chatbot | hive-support |
| Instant AI Image Generator – Create & Import Images | ai-image |
| JetWidgets For Elementor | jetwidgets-for-elementor |
| Job Manager by JobScore | job-manager-by-jobscore |
| jwp-a11y | jwp-a11y |
| KBucket: Your Curated Content in WordPress | kbucket |
| kineticPay for WooCommerce | kineticpay-for-woocommerce |
| Kognetiks Chatbot for WordPress | chatbot-chatgpt |
| LearnPress – Backup & Migration Tool | learnpress-import-export |
| Linear | linear |
| Lis Video Gallery | lis-video-gallery |
| LUNA RADIO PLAYER | lu-radioplayer |
| Mapster WP Maps | mapster-wp-maps |
| Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits | master-addons |
| Matix Popup Builder | medma-matix |
| MooWoodle – WordPress Moodle LMS Integration, Sell Moodle Courses via WooCommerce | moowoodle |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| MultiManager WP – Manage All Your WordPress Sites Easily | multimanager-wp |
| Music Player for Elementor – Audio Player & Podcast Player | music-player-for-elementor |
| My Geo Posts Free | my-geo-posts-free |
| NiceJob | nicejob |
| NIX Anti-Spam Light | nix-anti-spam-light |
| PDF Generator for WordPress Elementor | pdf-generator-addon-for-elementor-page-builder |
| PeproDev WooCommerce Receipt Uploader | pepro-bacs-receipt-upload-for-woocommerce |
| Photo Gallery by 10Web – Mobile-Friendly Image Gallery | photo-gallery |
| Picsmize | picsmize |
| Pie Register Premium | pie-register-premium |
| PJW Mime Config | pjw-mime-config |
| Podlove Podcast Publisher | podlove-podcasting-plugin-for-wordpress |
| Popularis Extra | popularis-extra |
| Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | ays-popup-box |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App | post-smtp |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Print PDF Generator and Publisher | nopeamedia |
| Product Delivery Date for WooCommerce – Lite | product-delivery-date-for-woocommerce-lite |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | wedevs-project-manager |
| Push Notifications for WordPress by PushAssist | push-notification-for-wp-by-pushassist |
| Radio Buttons and Swatches for WooCommerce | variations-radio-buttons-for-woocommerce |
| Razorpay Payment Button Elementor Plugin | razorpay-payment-button-elementor |
| Razorpay Payment Button Plugin | razorpay-payment-button |
| Real WP Shop Lite Ajax eCommerce Shopping Cart | real-wp-shop-lite |
| Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder | real3d-flipbook-lite |
| Really Simple Security Pro | really-simple-ssl-pro |
| Really Simple Security Pro multisite | really-simple-ssl-pro-multisite |
| Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) | really-simple-ssl |
| Referrer Detector | referrer-detector |
| Relais 2FA | relais-2fa |
| Reservit Hotel | reservit-hotel |
| Royal Addons for Elementor – Addons and Templates Kit for Elementor | royal-elementor-addons |
| Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation | ai-content-generator |
| SAML IDP (Identity Provider) – Login with Website Users | miniorange-wp-as-saml-idp |
| Shipping with Venipak for WooCommerce | wc-venipak-shipping |
| Simple Local Avatars | simple-local-avatars |
| Simple Pricing Table | simple-pricing-table |
| Simple Side Tab | simple-side-tab |
| SimpleForm Contact Form Submissions | simpleform-contact-form-submissions |
| SimpleForm – Contact form made simple | simpleform |
| SK WP Settings Backup | sk-wp-settings-backup |
| SKT Donation – Charity and Fundraising Plugin | skt-donation |
| Slickstream: Engagement and Conversions | slick-engagement |
| Smart Popup by Supsystic | popup-by-supsystic |
| Social Proof (Testimonial) Slider | social-proof-testimonials-slider |
| Steel | steel |
| Styler for Ninja Forms | styler-for-ninja-forms-lite |
| SVG Case Study | case-study |
| SVGPlus | svgplus |
| Team Members – Multi Language Supported Team Plugin | team-showcase-supreme |
| Themify Builder | themify-builder |
| Tutor LMS Elementor Addons | tutor-lms-elementor-addons |
| Twigify | twigify |
| Uix Slideshow | uix-slideshow |
| User Management | user-management |
| W3SPEEDSTER | w3speedster-wp |
| WDES Responsive Mobile Menu | wdes-responsive-mobile-menu |
| WOLF – WordPress Posts Bulk Editor and Manager Professional | bulk-editor |
| WooCommerce Upload Files | woocommerce-upload-files |
| WordPress BasePress Migration Tools | basepress-migration-tools |
| WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto | tripetto |
| WordPress GDPR | wordpress-gdpr |
| WordPress User Extra Fields | wp-user-extra-fields |
| WordPress Video Robot - The Ultimate Video Importer | wp-video-robot |
| WP Activity Log | wp-security-audit-log |
| WP AdCenter – Ad Manager & Adsense Ads | wpadcenter |
| WP Chat App | wp-whatsapp |
| WP Ghost (Hide My WP Ghost) – Security & Firewall | hide-my-wp |
| WP Githuber MD – WordPress Markdown Editor | wp-githuber-md |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP Log Viewer | wp-log-viewer |
| WP Quick Setup | wp-quick-setup |
| wp-login customizer | wp-login-customizer |
| WP-Strava | wp-strava |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPvivid — Backup, Migration & Staging | wpvivid-backuprestore |
| Writer Helper | writer-helper |
| xili-tidy-tags | xili-tidy-tags |
| Yotpo: Product & Photo Reviews for WooCommerce | yotpo-social-reviews-for-woocommerce |
| ZIJ KART | zij-kart |
| 胖鼠采集(Fat Rat Collect) | fat-rat-collect |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Airin Blog | airin-blog |
| Gameplan - Event and Gym Fitness WordPress Theme | gameplan |
| reconstruction | reconstruction |
| Xin | xin |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
CSV to HTML [csv-to-html]
Researcher
Affected Software
Ads Booster by Ads Pro [free-wp-booster-by-ads-pro]
Researcher
Affected Software
Advanced Personalization [personalization-by-flowcraft]
Researcher
Affected Software
Airin Blog [airin-blog]
Researcher
Affected Software
AJAX Random Posts [ajax-random-posts]
Researcher
Affected Software
Backup and Staging by WP Time Capsule [wp-time-capsule]
Researcher
Affected Software
Boat Rental Plugin for WordPress [boat-rental-system]
Researcher
Affected Software
Chartify – WordPress Chart Plugin [chart-builder]
Researcher
Affected Software
Datasets Manager by Arttia Creative [datasets-manager-by-arttia-creative]
Researcher
Affected Software
Devexhub Gallery [devexhub-gallery]
Researcher
Affected Software
Do That Task [do-that-task]
Researcher
Affected Software
Easy CSV Importer BETA [easy-csv-importer]
Researcher
Affected Software
Researcher
Affected Software
kineticPay for WooCommerce [kineticpay-for-woocommerce]
Researcher
Affected Software
Lis Video Gallery [lis-video-gallery]
Researcher
Affected Software
Matix Popup Builder [medma-matix]
Researcher
Affected Software
MultiManager WP – Manage All Your WordPress Sites Easily [multimanager-wp]
Researcher
Affected Software
My Geo Posts Free [my-geo-posts-free]
Researcher
Affected Software
NIX Anti-Spam Light [nix-anti-spam-light]
Researcher
Affected Software
Picsmize [picsmize]
Researcher
Affected Software
Really Simple Security Pro multisite [really-simple-ssl-pro-multisite]
Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) [really-simple-ssl]
Really Simple Security Pro [really-simple-ssl-pro]
Researcher
Affected Software
Referrer Detector [referrer-detector]
Researcher
Affected Software
Relais 2FA [relais-2fa]
Researcher
Affected Software
WDES Responsive Mobile Menu [wdes-responsive-mobile-menu]
Researcher
Affected Software
WooCommerce Upload Files [woocommerce-upload-files]
Researcher
Affected Software
WordPress User Extra Fields [wp-user-extra-fields]
Researcher
Affected Software
Xin [xin]
Researcher
Affected Software
ZIJ KART [zij-kart]
Researcher
Affected Software
Global Gateway e4 | Payeezy Gateway | [globe-gateway-e4]
Researcher
Affected Software
Smart Popup by Supsystic [popup-by-supsystic]
Researcher
Affected Software
B-Banner Slider [b-banner-slider]
Researcher
Affected Software
WordPress BasePress Migration Tools [basepress-migration-tools]
Researcher
Affected Software
CF7 Reply Manager [cf7-reply-manager]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Convert Docx2post [convert-docx2post]
Researcher
Affected Software
Event Tickets with Ticket Scanner [event-tickets-with-ticket-scanner]
Researcher
Exclusive Content Password Protect <= 1.1.0 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
Affected Software
Exclusive Content Password Protect [exclusive-content-password-protect]
Researcher
Affected Software
GPX Viewer [gpx-viewer]
Researcher
Affected Software
Hacklog DownloadManager [hacklog-downloadmanager]
Researcher
Affected Software
Hive Support | AI-Powered Help Desk, Live Chat and Chatbot [hive-support]
Researcher
Affected Software
Researcher
Affected Software
WPvivid — Backup, Migration & Staging [wpvivid-backuprestore]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Push Notifications for WordPress by PushAssist [push-notification-for-wp-by-pushassist]
Researcher
Affected Software
Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder [real3d-flipbook-lite]
Researcher
Affected Software
Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation [ai-content-generator]
Researcher
Affected Software
SK WP Settings Backup [sk-wp-settings-backup]
Researcher
Affected Software
User Management [user-management]
Researcher
Affected Software
WordPress User Extra Fields [wp-user-extra-fields]
Researcher
Affected Software
WP Quick Setup [wp-quick-setup]
Researcher
WP Video Robot <= 1.20.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
8.8
Affected Software
WordPress Video Robot - The Ultimate Video Importer [wp-video-robot]
Researcher
Affected Software
Writer Helper [writer-helper]
Researcher
Affected Software
Advanced Order Export For WooCommerce [woo-order-export-lite]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Blogger 301 Redirect [blogger-301-redirect]
Researcher
Affected Software
DigiPass [digipass]
Researcher
Affected Software
External Database Based Actions [external-database-based-actions]
Researcher
Affected Software
LUNA RADIO PLAYER [lu-radioplayer]
Researcher
Affected Software
Researcher
PDF Generator Addon for Elementor Page Builder <= 2.0.0 - Unauthenticated Arbitrary File Download
7.5
Affected Software
PDF Generator for WordPress Elementor [pdf-generator-addon-for-elementor-page-builder]
Researcher
Affected Software
WordPress Video Robot - The Ultimate Video Importer [wp-video-robot]
Researcher
Patch Status
Unpatched
Unpatched
Published
Nov 12, 2024
Nov 12, 2024
Affected Software
Twigify [twigify]
AP Twig Bridge [ap-twig-bridge]
Content Template Engine [content-template-engine]
Researcher
Affected Software
Uix Slideshow [uix-slideshow]
Researcher
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
CDI – Collect and Deliver Interface for Woocommerce [collect-and-deliver-interface-for-woocommerce]
Researcher
Affected Software
SAML IDP (Identity Provider) – Login with Website Users [miniorange-wp-as-saml-idp]
Researcher
Affected Software
Podlove Podcast Publisher [podlove-podcasting-plugin-for-wordpress]
Researcher
Affected Software
Team Members – Multi Language Supported Team Plugin [team-showcase-supreme]
Researcher
Affected Software
Researcher
Affected Software
WordPress GDPR [wordpress-gdpr]
Researcher
Affected Software
WP Activity Log [wp-security-audit-log]
Researcher
Affected Software
Styler for Ninja Forms [styler-for-ninja-forms-lite]
Researcher
Affected Software
WordPress GDPR [wordpress-gdpr]
Researcher
Aqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
Aqua SVG Sprite [aqua-svg-sprite]
Researcher
Affected Software
ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators [convertcalculator]
Researcher
Affected Software
Researcher
Drozd – Addons for Elementor <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Drozd – Addons for Elementor [drozd-addons-for-elementor]
Researcher
Affected Software
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme [exclusive-divi]
Researcher
Affected Software
Happy Addons for Elementor [happy-elementor-addons]
Researcher
Affected Software
JetWidgets For Elementor [jetwidgets-for-elementor]
Researcher
Affected Software
Job Manager by JobScore [job-manager-by-jobscore]
Researcher
Affected Software
Linear [linear]
Researcher
Affected Software
LUNA RADIO PLAYER [lu-radioplayer]
Researcher
Affected Software
Mapster WP Maps [mapster-wp-maps]
Researcher
Affected Software
Researcher
Affected Software
NiceJob [nicejob]
Researcher
PJW Mime Config <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
PJW Mime Config [pjw-mime-config]
Researcher
Affected Software
Print PDF Generator and Publisher [nopeamedia]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Royal Addons for Elementor – Addons and Templates Kit for Elementor [royal-elementor-addons]
Researcher
Affected Software
Simple Pricing Table [simple-pricing-table]
Researcher
Affected Software
Slickstream: Engagement and Conversions [slick-engagement]
Researcher
Affected Software
Social Proof (Testimonial) Slider [social-proof-testimonials-slider]
Researcher
Affected Software
Steel [steel]
Researcher
Affected Software
SVG Case Study [case-study]
Researcher
Affected Software
SVGPlus [svgplus]
Researcher
Affected Software
Themify Builder [themify-builder]
Researcher
Affected Software
WP AdCenter – Ad Manager & Adsense Ads [wpadcenter]
Researcher
Affected Software
WP Githuber MD – WordPress Markdown Editor [wp-githuber-md]
Researcher
Affected Software
Researcher
Affected Software
Drop Shadow Boxes [drop-shadow-boxes]
Researcher
Affected Software
Advanced Form Integration — Connect Forms to 200+ Apps [advanced-form-integration]
Researcher
Affected Software
AJAX Login and Registration modal popup + inline form [ajax-login-and-registration-modal-popup]
Researcher
Affected Software
Researcher
Affected Software
AWcode Toolkit [awcode-toolkit]
Researcher
Affected Software
Bounce Handler MailPoet 3 [bounce-handler-mailpoet]
Researcher
Affected Software
Constant Contact Forms by MailMunch [constant-contact-forms-by-mailmunch]
Researcher
Affected Software
Business Essentials for Contact Form 7 [cf7-redirect-thank-you-page]
Researcher
Affected Software
DK White Label [dk-white-label]
Researcher
Affected Software
DPortfolio [dportfolio]
Researcher
Affected Software
胖鼠采集(Fat Rat Collect) [fat-rat-collect]
Researcher
Affected Software
Gallery Manager [fancy-gallery]
Researcher
Affected Software
Researcher
Affected Software
Hebrew Dates [hebrewdates]
Researcher
Affected Software
WP Ghost (Hide My WP Ghost) – Security & Firewall [hide-my-wp]
Researcher
Affected Software
Kognetiks Chatbot for WordPress [chatbot-chatgpt]
Researcher
Affected Software
LearnPress – Backup & Migration Tool [learnpress-import-export]
Researcher
Affected Software
PeproDev WooCommerce Receipt Uploader [pepro-bacs-receipt-upload-for-woocommerce]
Researcher
Affected Software
Product Delivery Date for WooCommerce – Lite [product-delivery-date-for-woocommerce-lite]
Researcher
Affected Software
Radio Buttons and Swatches for WooCommerce [variations-radio-buttons-for-woocommerce]
Researcher
Affected Software
Razorpay Payment Button Plugin [razorpay-payment-button]
Researcher
Affected Software
Razorpay Payment Button Elementor Plugin [razorpay-payment-button-elementor]
Researcher
Affected Software
reconstruction [reconstruction]
Researcher
Affected Software
Shipping with Venipak for WooCommerce [wc-venipak-shipping]
Researcher
Affected Software
SimpleForm – Contact form made simple [simpleform]
Researcher
Affected Software
SimpleForm Contact Form Submissions [simpleform-contact-form-submissions]
Researcher
Affected Software
SKT Donation – Charity and Fundraising Plugin [skt-donation]
Researcher
Affected Software
Researcher
Affected Software
wp-login customizer [wp-login-customizer]
Researcher
Affected Software
xili-tidy-tags [xili-tidy-tags]
Researcher
Affected Software
Yotpo: Product & Photo Reviews for WooCommerce [yotpo-social-reviews-for-woocommerce]
Researcher
Affected Software
Essential Addons for Elementor – Popular Elementor Templates & Widgets [essential-addons-for-elementor-lite]
Researcher
Affected Software
Admin and Site Enhancements (ASE) [admin-site-enhancements]
Researcher
Affected Software
WP Log Viewer [wp-log-viewer]
Researchers
Affected Software
404 Error Monitor [404-error-monitor]
Researcher
Affected Software
404 Solution [404-solution]
Researcher
Affected Software
Ai Auto Tool Content Writing Assistant All in One [ai-auto-tool]
Researcher
Affected Software
Floating Buttons for WooCommerce [shop-assistant-for-woocommerce-jarvis]
Researcher
Affected Software
Hash Elements [hash-elements]
Researcher
Affected Software
Hide Links [hide-links]
Researcher
Affected Software
Kognetiks Chatbot for WordPress [chatbot-chatgpt]
Researcher
Affected Software
Kognetiks Chatbot for WordPress [chatbot-chatgpt]
Researcher
Affected Software
Pie Register Premium [pie-register-premium]
Researcher
Affected Software
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups [ays-popup-box]
Researcher
Affected Software
CYAN Backup [cyan-backup]
Researcher
Affected Software
EKC Tournament Manager [ekc-tournament-manager]
Researcher
Affected Software
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
Full Screen (Page) Background Image Slideshow [full-screen-page-background-image-slideshow]
Researcher
Affected Software
jwp-a11y [jwp-a11y]
Researcher
Affected Software
Photo Gallery by 10Web – Mobile-Friendly Image Gallery [photo-gallery]
Researcher
Affected Software
Real WP Shop Lite Ajax eCommerce Shopping Cart [real-wp-shop-lite]
Researcher
Affected Software
Reservit Hotel [reservit-hotel]
Researcher
Affected Software
Simple Side Tab [simple-side-tab]
Researcher
Affected Software
Booking Calendar [booking]
Researcher
Affected Software
3DPrint Lite [3dprint-lite]
Researcher
Boostify Header Footer Builder for Elementor <= 1.3.6 - Authenticated (Contributor+) Post Disclosure
4.3
Affected Software
Boostify Header Footer Builder for Elementor [boostify-header-footer-builder]
Researcher
Affected Software
BuddyPress Builder for Elementor – BuddyBuilder [stax-buddy-builder]
Researcher
Affected Software
Buy one click WooCommerce [buy-one-click-woocommerce]
Researcher
Affected Software
Buy one click WooCommerce [buy-one-click-woocommerce]
Researcher
Affected Software
Buy one click WooCommerce [buy-one-click-woocommerce]
Researcher
Affected Software
Customer Reviews for WooCommerce [customer-reviews-woocommerce]
Researcher
Affected Software
Disable Admin Notices – Hide Dashboard Notifications [disable-admin-notices]
Researcher
Affected Software
EKC Tournament Manager [ekc-tournament-manager]
Researcher
Affected Software
EKC Tournament Manager [ekc-tournament-manager]
Researcher
Affected Software
EleForms – All In One Form Integration including DB for Elementor [all-contact-form-integration-for-elementor]
Researcher
Affected Software
Futurio Extra [futurio-extra]
Researcher
Affected Software
Kognetiks Chatbot for WordPress [chatbot-chatgpt]
Researcher
Affected Software
Kognetiks Chatbot for WordPress [chatbot-chatgpt]
Researcher
Affected Software
Music Player for Elementor – Audio Player & Podcast Player [music-player-for-elementor]
Researchers
Affected Software
Popularis Extra [popularis-extra]
Researcher
Affected Software
Simple Local Avatars [simple-local-avatars]
Researcher
Affected Software
Tutor LMS Elementor Addons [tutor-lms-elementor-addons]
Researcher
Affected Software
W3SPEEDSTER [w3speedster-wp]
Researcher
Affected Software
WP Chat App [wp-whatsapp]
Researcher
Affected Software
Easy Popup Lightbox Maker [easy-popup-lightbox-maker]
Researcher
Affected Software
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments