Wordfence Intelligence Weekly WordPress Vulnerability Report (November 18, 2024 to November 24, 2024)
🦸 💥 Calling all superheroes and hunters! Introducing the End of Year Holiday Extravaganza and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through December 9th, 2024:
- All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
- All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
- Minimum bounty of $5 for all valid in-scope submissions.
- All researchers earn automatic bonuses of between 5% to 180% for valid submissions
- Pending report limits are increased for all
- It’s possible to earn up to $31,200 for high impact vulnerabilities!
Last week, there were 246 vulnerabilities disclosed in 223 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 57 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 20,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- AppPresser – Mobile App Framework <= 4.4.6 – Unauthenticated Privilege Escalation via Password Reset
- WAF-RULE-770 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-772 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 159 |
| Unpatched | 87 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 196 |
| High Severity | 35 |
| Critical Severity | 15 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 133 |
| Cross-Site Request Forgery (CSRF) | 31 |
| Missing Authorization | 29 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 11 |
| Deserialization of Untrusted Data | 8 |
| Authorization Bypass Through User-Controlled Key | 7 |
| Exposure of Sensitive Information to an Unauthorized Actor | 6 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 6 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Improper Access Control | 1 |
| Improper Privilege Management | 1 |
| Protection Mechanism Failure | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 43 | |
| 24 | |
| 22 | |
| 17 | |
| 17 | |
| 15 | |
| 9 | |
| 9 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 404 Solution | 404-solution |
| Absolute Addons For Elementor | absolute-addons |
| Activity Log – Monitor & Record User Changes | aryo-activity-log |
| Advanced Event Manager | advanced-event-manager |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit-starter |
| Ahmeti Wp Güzel Sözler | ahmeti-wp-guzel-sozler |
| AI Engine – The Chatbot, AI Framework & MCP for WordPress | ai-engine |
| AI Quiz | Quiz Maker | ai-quiz |
| AI Responsive Gallery Album | ai-responsive-gallery-album |
| Ajax Search Lite – Live Search & Filter | ajax-search-lite |
| amr shortcodes | amr-shortcodes |
| Announcement & Notification Banner – Bulletin | bulletin-announcements |
| Anonymous Restricted Content | anonymous-restricted-content |
| April's Call Posts | aprils-call-posts |
| AtaraPay WooCommerce Payment Gateway | atarapay-woocommerce |
| AutoListicle: Automatically Update Numbered List Articles | autolisticle-automatically-update-numbered-list-articles |
| Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code | automation-web-platform |
| Awesome Studio | awesome-studio |
| Banner System | banner-system |
| Bard Extra | bard-extra |
| Beds24 Online Booking | beds24-online-booking |
| Blizzard Quotes | blizzard-quotes |
| Block Editor Bootstrap Blocks | block-editor-bootstrap-blocks |
| Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools | woocommerce-jetpack |
| Branda – White Label & Branding, Free Login Page Customizer | branda-white-labeling |
| BSK Forms Validation | bsk-gravity-forms-custom-validation |
| Button Block – Design Stylish, Interactive, and Multi-Functional Buttons | button-block |
| Buying Buddy IDX CRM – Real Estate MLS Plugin | buying-buddy-idx-crm |
| Chameleoni Jobs | chameleon-jobs |
| Checkout with Cash App on WooCommerce | wc-cashapp |
| Chessgame Shizzle | chessgame-shizzle |
| Classified Listing – AI-Powered Classified ads & Business Directory | classified-listing |
| Clone | wp-clone-by-wp-academy |
| Co-marquage service-public.fr | co-marquage-service-public |
| Community by PeepSo – Download from PeepSo.com | peepso-core |
| Contact Page With Google Map | contact-page-with-google-map |
| Continue Shopping From Cart | continue-shopping-from-cart-page |
| Control horas | control-horas |
| Countdown Timer for WordPress Block Editor | countdown-timer-block |
| CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout | support-x |
| Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes | security-force |
| Custom CSS, JS & PHP | custom-css |
| Custom Shortcode Sidebars | custom-shortcode-sidebars |
| de:branding | debranding |
| DeBounce Email Validator | debounce-io-email-validator |
| Dino Game – Embed Google Chrome Dinosaur Game in your website | dino-game |
| Distance Based Shipping Calculator | distance-based-shipping-calculator |
| Document & Data Automation | document-data-automation |
| Dynamic "To Top" Plugin | dynamic-to-top |
| Dynamic URL SEO | dynamic-url-seo |
| Easy Liveblogs | easy-liveblogs |
| Easy Twitter Feeds – Embed Social Media Posts with Live Updates | easy-twitter-feeds |
| EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time | wp-maximum-upload-file-size |
| Elementor Portfolio Builder | portfolio-builder-elementor |
| Elfsight Telegram Chat CC | elfsight-telegram-chat-cc |
| Email addon for CF7 | cf7-email-add-on |
| Email Subscription Popup — Newsletter & GDPR Consent | email-subscribe |
| Enter Addons – Ultimate Template Builder for Elementor | enteraddons |
| Explara Events | explara-events |
| ExpressPay Payment Module | express-pay |
| Extensions for Elementor | extensions-for-elementor |
| F4 Improvements | f4-improvements |
| Favicon My Blog | favicon-my-blog |
| Fediverse Embeds | fediverse-embeds |
| Fence URL wp-login.php | fence-url |
| Fintelligence Calculator | fintelligence-calculator |
| FireCask’s Twitter Follow Button | twitter-follow |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider | fluent-smtp |
| Footer Flyout Widget | footer-flyout-widget |
| Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More | formidable |
| Friendly Functions for Welcart | friendly-functions-for-welcart |
| GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress | gamipress |
| GD bbPress Attachments | gd-bbpress-attachments |
| GD Rating System | gd-rating-system |
| Generic Elements | generic-elements-for-elementor |
| Geolocator | geolocator |
| Getwid – Gutenberg Blocks | getwid |
| Google for WooCommerce | google-listings-and-ads |
| Google Plus Share and +1 Button | google-plus-share-and-plusone-button |
| GoQMieruca | goqmieruca |
| GoQSmile | goqsmile |
| Grey Owl Lightbox | grey-owl-lightbox |
| Grid View Gallery | grid-view-gallery |
| Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms | happyforms |
| HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents | hipaatizer |
| Hotlink2Watermark | hotlink2watermark |
| HTML5 Lyrics Karaoke Player | html5-lyrics-karaoke-player |
| HUSKY – Products Filter Professional for WooCommerce | woocommerce-products-filter |
| IceStats | icestats |
| Idealien Category Enhancements | idealien-category-enhancements |
| If-So Dynamic Content – Elementor & All Page Builders Personalization | if-so |
| Image horizontal reel scroll slideshow | image-horizontal-reel-scroll-slideshow |
| Image Optimizer, Resizer and CDN – Sirv | sirv |
| Image Widget | image-widget |
| ImbaChat | imbachat-widget |
| Include Mastodon Feed | include-mastodon-feed |
| Infinite Slider | infinite-slider |
| Innovs WPBakery Visual Composer WHMCS Elements | void-visual-whmcs-element |
| iPhone Webclip Manager | iphone-webclip-manager |
| ITERAS | iteras |
| JobBoardWP – Job Board Listings and Submissions | jobboardwp |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Kevin's Plugin | kevins-plugin |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| Lazy load videos and sticky control | lazy-load-videos-and-sticky-control |
| LeadBoxer | leadboxer |
| LeanPress | leanpress |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| LGPD Framework By Data443 | lgpd-framework |
| Library Bookshelves | library-bookshelves |
| LinkLaunder SEO | linklaunder-seo-plugin |
| Lock User Account | lock-user-account |
| LuckyWP Table of Contents | luckywp-table-of-contents |
| Mailmunch Forms for Mailchimp | mailchimp-forms-by-mailmunch |
| MailMunch – Grow your Email List | mailmunch |
| Memberlite Shortcodes | memberlite-shortcodes |
| Meteor Slides | meteor-slides |
| MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | mp3-music-player-by-sonaar |
| MP3 Sticky Player | fwdmsp |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| Multi Feed Reader | multi-feed-reader |
| My Contador lesr | my-contador-wp |
| nBlocks – Responsive Gutenberg News Blocks | nblocks |
| Office Locator | office-locator |
| Opal Woo Custom Product Variation | opal-woo-custom-product-variation |
| Open edX LMS and WordPress integrator (LITE) | edunext-openedx-integrator |
| Ortto | autopilot |
| Page Parts | page-parts |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Parallax Image | parallax-image |
| Pathomation | pathomation |
| PDF Invoices & Packing Slips Generator for WooCommerce | pdf-invoicing-for-woocommerce |
| PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) | peachpay-for-woocommerce |
| PickPlugins Product Designer for WooCommerce | product-designer |
| Popup Builder – Create highly converting, mobile friendly marketing popups. | popup-builder |
| Post By Email | post-by-email |
| Post Hits Counter | hits-counter |
| Post Ideas | post-ideas |
| Premium Packages – Sell Digital Products Securely | wpdm-premium-packages |
| Pricing table addon for elementor | pricing-table-addon-for-elementor |
| Product Table & List Builder For WooCommerce | wc-product-table-lite |
| Product Table for WooCommerce | woo-product-table |
| ProfileGrid – User Profiles, Groups and Communities | profilegrid-user-profiles-groups-and-communities |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | wedevs-project-manager |
| Protect Your Content | protect-your-content |
| PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes | revisionary |
| Pure CSS Circle Progress bar | pure-css-circle-progress-bar |
| QRMenu Restaurant QR Menu Lite | qrmenu-lite |
| Quick Learn | quick-learn |
| Quotes llama | quotes-llama |
| Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | seo-by-rank-math |
| RealtyCandy IDX Broker Extended | realtycandy-idx-broker-extended |
| RecipePress Reloaded | recipepress-reloaded |
| Request a Quote for WooCommerce – Get a Quote Button | get-a-quote-button-for-woocommerce |
| Rescue Shortcodes | rescue-shortcodes |
| Restaurant Menu – Food Ordering System – Table Reservation | menu-ordering-reservations |
| Run Contests, Raffles, and Giveaways with ContestsWP | contest-code-checker |
| salavat counter Plugin | salavat-counter |
| Save as PDF Plugin by PDFCrowd | save-as-pdf-by-pdfcrowd |
| School Management System for Wordpress | school-management |
| Shine PDF Embeder | shine-pdf |
| Shopready – Elementor addons for WooCommerce Page Builder | shopready-elementor-addon |
| Silverlight Video Player | smooth-streaming-player |
| Simple Membership | simple-membership |
| Simple Travel Map | simple-travel-map |
| SimpLy Gallery | simply-gallery-block |
| Sky Addons for Elementor | sky-elementor-addons |
| Slick Sitemap | slick-sitemap |
| Slotti Ajanvaraus | slotti-ajanvaraus |
| Social Login | oa-social-login |
| SP Blog Designer | sp-blog-designer |
| Sticky Social Icons | sticky-social-icons |
| Stratum Widgets for Elementor | stratum |
| StreamWeasels Online Status Bar | stream-status-for-twitch |
| Subaccounts for WooCommerce | subaccounts-for-woocommerce |
| SuevaFree Essential Kit | suevafree-essential-kit |
| Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform | sugar-calendar-lite |
| SVG Block | svg-block |
| System Dashboard | system-dashboard |
| Tailored Tools | tailored-tools |
| Team Rosters | team-rosters |
| The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
| Theater for WordPress | theatre |
| Theme Builder For Elementor | theme-builder-for-elementor |
| TM Islamic Helper | tm-islamic-helper |
| Tour Operator | tour-operator |
| Tribute Testimonials – WordPress Testimonial Grid/Slider | tribute-testimonial-gridslider |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor | ultimate-blocks |
| Ultimate Classified Listings – Classifieds, Directory & Marketplace | ultimate-classified-listings |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| Ultimate YouTube Video & Shorts Player With Vimeo | ultimate-youtube-video-player |
| UltraAddons for Elementor | ultraaddons-elementor-lite |
| User registration & user profile – UserPlus | userplus |
| Wc Recently viewed products | wc-recently-viewed-products |
| Weather Atlas Widget | weather-atlas |
| What Would Seth Godin Do | what-would-seth-godin-do |
| WIP Incoming Lite | wip-incoming-lite |
| Wishlist for WooCommerce: Multi Wishlists Per Customer PRO | wish-list-for-woocommerce-pro |
| WooCommerce Price Alert | price-alert-woocommerce |
| WordPress Bootscraper | wp-bootscraper |
| WordPress Brute Force Protection – Stop Brute Force Attacks | guardgiant |
| wp auto top | wp-auto-top |
| WP e-Commerce Style Email | wp-e-commerce-style-email |
| WP Mailster | wp-mailster |
| WP Travel Engine – Tour Booking Plugin – Tour Operator Software | wp-travel-engine |
| WP User Manager – User Profile Builder & Membership | wp-user-manager |
| WP-ISPConfig 3 | wp-ispconfig3 |
| WP-Orphanage Extended | wp-orphanage-extended |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click | wpb-popup-for-contact-form-7 |
| WPDash Notes | wpdash-notes |
| WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | wpfunnels |
| WPGYM - Wordpress Gym Management System | gym-management |
| Xpresslane Fast Checkout | xpresslane-integration-for-woocommerce |
| Yaad Sarig Payment Gateway For WC | yaad-sarig-payment-gateway-for-wc |
| Youneeq Recommendations | youneeq-panel |
| yPHPlista | yphplista |
| Zajax – Ajax Navigation | zajax-ajax-navigation |
| 우커머스 네이버페이 | mshop-npay |
| 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 | pgall-for-woocommerce |
| 코드엠샵 소셜톡 | mshop-naver-talktalk |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| AccessPress Staple | accesspress-staple |
| Ashe | ashe |
| Bard | bard |
| ForumEngine | forumengine |
| Gaga Lite | gaga-lite |
| Grip | grip |
| Jobify - Job Board WordPress Theme | jobify |
| One Paze | one-paze |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
WordPress Bootscraper [wp-bootscraper]
Researcher
Affected Software
Contact Page With Google Map [contact-page-with-google-map]
Researcher
Affected Software
Fediverse Embeds [fediverse-embeds]
Researcher
Affected Software
Researcher
Affected Software
Geolocator [geolocator]
Researcher
Affected Software
Opal Woo Custom Product Variation [opal-woo-custom-product-variation]
Researcher
Affected Software
Pathomation [pathomation]
Researcher
Affected Software
Quick Learn [quick-learn]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
Social Login [oa-social-login]
Researcher
Affected Software
Team Rosters [team-rosters]
Researcher
Affected Software
User registration & user profile – UserPlus [userplus]
Researcher
Affected Software
Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code [automation-web-platform]
Researcher
Affected Software
WPGYM - Wordpress Gym Management System [gym-management]
Researcher
Affected Software
Xpresslane Fast Checkout [xpresslane-integration-for-woocommerce]
Researcher
Affected Software
Absolute Addons For Elementor [absolute-addons]
Researcher
Affected Software
Banner System [banner-system]
Researcher
Affected Software
Buying Buddy IDX CRM – Real Estate MLS Plugin [buying-buddy-idx-crm]
Researcher
Affected Software
Classified Listing – AI-Powered Classified ads & Business Directory [classified-listing]
Researcher
Affected Software
Clone [wp-clone-by-wp-academy]
Researcher
Affected Software
Email addon for CF7 [cf7-email-add-on]
Researcher
Affected Software
de:branding [debranding]
Researcher
LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
8.8
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researchers
Affected Software
AccessPress Staple [accesspress-staple]
Grip [grip]
Gaga Lite [gaga-lite]
One Paze [one-paze]
Researcher
Affected Software
Researcher
Affected Software
Office Locator [office-locator]
Researcher
Affected Software
Pricing table addon for elementor [pricing-table-addon-for-elementor]
Researcher
Affected Software
QRMenu Restaurant QR Menu Lite [qrmenu-lite]
Researcher
Affected Software
School Management System for Wordpress [school-management]
Researcher
Affected Software
Shopready – Elementor addons for WooCommerce Page Builder [shopready-elementor-addon]
Researcher
Affected Software
SP Blog Designer [sp-blog-designer]
Researcher
Affected Software
Ultimate Classified Listings – Classifieds, Directory & Marketplace [ultimate-classified-listings]
Researcher
WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation
8.8
Affected Software
WP-Orphanage Extended [wp-orphanage-extended]
Researcher
Affected Software
WPGYM - Wordpress Gym Management System [gym-management]
Researcher
Affected Software
Jobify - Job Board WordPress Theme [jobify]
Researcher
Affected Software
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
ExpressPay Payment Module [express-pay]
Researcher
Affected Software
MP3 Sticky Player [fwdmsp]
Researcher
Affected Software
Post Ideas [post-ideas]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Request a Quote for WooCommerce – Get a Quote Button [get-a-quote-button-for-woocommerce]
Researcher
Affected Software
Product Table & List Builder For WooCommerce [wc-product-table-lite]
Researcher
Affected Software
WPB Popup for Contact Form 7 – Showing Contact Form 7 Popup on Button Click [wpb-popup-for-contact-form-7]
Researcher
Affected Software
Activity Log – Monitor & Record User Changes [aryo-activity-log]
Researcher
Affected Software
Grid View Gallery [grid-view-gallery]
Researcher
Affected Software
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings [seo-by-rank-math]
Researcher
Affected Software
System Dashboard [system-dashboard]
Researcher
Affected Software
AI Quiz | Quiz Maker [ai-quiz]
Researcher
Affected Software
Distance Based Shipping Calculator [distance-based-shipping-calculator]
Researcher
Affected Software
Researcher
Affected Software
ProfileGrid – User Profiles, Groups and Communities [profilegrid-user-profiles-groups-and-communities]
Researcher
Affected Software
Advanced Event Manager [advanced-event-manager]
Researcher
Affected Software
AutoListicle: Automatically Update Numbered List Articles [autolisticle-automatically-update-numbered-list-articles]
Researcher
Affected Software
Beds24 Online Booking [beds24-online-booking]
Researcher
Affected Software
Control horas [control-horas]
Researcher
Affected Software
Countdown Timer for WordPress Block Editor [countdown-timer-block]
Researcher
Affected Software
Researcher
Affected Software
Easy Liveblogs [easy-liveblogs]
Researcher
Affected Software
Elementor Portfolio Builder [portfolio-builder-elementor]
Researcher
Affected Software
Elfsight Telegram Chat CC [elfsight-telegram-chat-cc]
Researcher
Affected Software
Email Subscription Popup — Newsletter & GDPR Consent [email-subscribe]
Researcher
F4 Improvements <= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
F4 Improvements [f4-improvements]
Researcher
Affected Software
Fintelligence Calculator [fintelligence-calculator]
Researcher
Affected Software
GD Rating System [gd-rating-system]
Researcher
Affected Software
Generic Elements [generic-elements-for-elementor]
Researcher
Affected Software
Getwid – Gutenberg Blocks [getwid]
Researcher
Affected Software
Grey Owl Lightbox [grey-owl-lightbox]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Researcher
Affected Software
Include Mastodon Feed [include-mastodon-feed]
Researcher
Affected Software
Jobify - Job Board WordPress Theme [jobify]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Lazy load videos and sticky control [lazy-load-videos-and-sticky-control]
Researcher
LSX Tour Operator <= 1.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
Tour Operator [tour-operator]
Researcher
Affected Software
Memberlite Shortcodes [memberlite-shortcodes]
Researcher
Affected Software
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar [mp3-music-player-by-sonaar]
Researcher
Affected Software
Parallax Image [parallax-image]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Product Designer <= 1.0.36 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
PickPlugins Product Designer for WooCommerce [product-designer]
Researcher
Affected Software
Pure CSS Circle Progress bar [pure-css-circle-progress-bar]
Researcher
Affected Software
Quotes llama [quotes-llama]
Researcher
Affected Software
RecipePress Reloaded [recipepress-reloaded]
Researcher
Affected Software
Rescue Shortcodes [rescue-shortcodes]
Researcher
Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Save as PDF Plugin by PDFCrowd [save-as-pdf-by-pdfcrowd]
Researcher
Affected Software
Shine PDF Embeder [shine-pdf]
Researcher
Affected Software
Slick Sitemap [slick-sitemap]
Researcher
Affected Software
Slotti Ajanvaraus [slotti-ajanvaraus]
Researcher
StreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
StreamWeasels Online Status Bar [stream-status-for-twitch]
Researcher
Affected Software
SuevaFree Essential Kit [suevafree-essential-kit]
Researcher
Affected Software
Tailored Tools [tailored-tools]
Researcher
Affected Software
Tribute Testimonials – WordPress Testimonial Grid/Slider [tribute-testimonial-gridslider]
Researcher
Affected Software
FireCask’s Twitter Follow Button [twitter-follow]
Researcher
Affected Software
Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor [ultimate-blocks]
Researcher
Affected Software
Ultimate Classified Listings – Classifieds, Directory & Marketplace [ultimate-classified-listings]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
Innovs WPBakery Visual Composer WHMCS Elements [void-visual-whmcs-element]
Researcher
Affected Software
우커머스 네이버페이 [mshop-npay]
Researcher
Affected Software
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]
Researcher
Affected Software
코드엠샵 소셜톡 [mshop-naver-talktalk]
Researcher
Affected Software
404 Solution [404-solution]
Researcher
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Affected Software
AI Responsive Gallery Album [ai-responsive-gallery-album]
Researcher
Affected Software
amr shortcodes [amr-shortcodes]
Researcher
Affected Software
AtaraPay WooCommerce Payment Gateway [atarapay-woocommerce]
Researcher
Affected Software
Awesome Studio [awesome-studio]
Researcher
Affected Software
Blizzard Quotes [blizzard-quotes]
Researcher
Affected Software
Block Editor Bootstrap Blocks [block-editor-bootstrap-blocks]
Researcher
Affected Software
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools [woocommerce-jetpack]
Researcher
Affected Software
Branda – White Label & Branding, Free Login Page Customizer [branda-white-labeling]
Researcher
Affected Software
BSK Forms Validation [bsk-gravity-forms-custom-validation]
Researcher
Affected Software
Announcement & Notification Banner – Bulletin [bulletin-announcements]
Researcher
Affected Software
Chameleoni Jobs [chameleon-jobs]
Researcher
Affected Software
Checkout with Cash App on WooCommerce [wc-cashapp]
Researcher
Affected Software
Chessgame Shizzle [chessgame-shizzle]
Researcher
Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter
6.1
Affected Software
Co-marquage service-public.fr [co-marquage-service-public]
Researcher
Affected Software
Community by PeepSo – Download from PeepSo.com [peepso-core]
Researcher
Affected Software
Researcher
Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting
6.1
Affected Software
Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes [security-force]
Researcher
Affected Software
Custom CSS, JS & PHP [custom-css]
Researcher
Affected Software
DeBounce Email Validator [debounce-io-email-validator]
Researcher
Affected Software
Dynamic URL SEO [dynamic-url-seo]
Researcher
Affected Software
Researcher
Affected Software
Explara Events [explara-events]
Researcher
Affected Software
Extensions for Elementor [extensions-for-elementor]
Researcher
Affected Software
Footer Flyout Widget [footer-flyout-widget]
Researcher
Affected Software
Researcher
Affected Software
ForumEngine [forumengine]
Researcher
Affected Software
Friendly Functions for Welcart [friendly-functions-for-welcart]
Researcher
Affected Software
GD bbPress Attachments [gd-bbpress-attachments]
Researcher
Affected Software
GoQMieruca [goqmieruca]
Researcher
Affected Software
GoQSmile [goqsmile]
Researcher
Affected Software
Researcher
Affected Software
HTML5 Lyrics Karaoke Player [html5-lyrics-karaoke-player]
Researcher
Affected Software
HUSKY – Products Filter Professional for WooCommerce [woocommerce-products-filter]
Researcher
Affected Software
Infinite Slider [infinite-slider]
Researcher
Affected Software
iPhone Webclip Manager [iphone-webclip-manager]
Researcher
Affected Software
JobBoardWP – Job Board Listings and Submissions [jobboardwp]
Researcher
Affected Software
LGPD Framework By Data443 [lgpd-framework]
Researcher
Affected Software
Library Bookshelves [library-bookshelves]
Researcher
Affected Software
LinkLaunder SEO [linklaunder-seo-plugin]
Researcher
Affected Software
Mailmunch Forms for Mailchimp [mailchimp-forms-by-mailmunch]
Researcher
Affected Software
MailMunch – Grow your Email List [mailmunch]
Researcher
Affected Software
Open edX LMS and WordPress integrator (LITE) [edunext-openedx-integrator]
Researcher
Affected Software
Ortto [autopilot]
Researcher
Affected Software
Page Parts [page-parts]
Researcher
Affected Software
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) [peachpay-for-woocommerce]
Researcher
PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting
6.1
Affected Software
PDF Invoices & Packing Slips Generator for WooCommerce [pdf-invoicing-for-woocommerce]
Researcher
Affected Software
Post By Email [post-by-email]
Researcher
Affected Software
Post Hits Counter [hits-counter]
Researcher
Affected Software
Premium Packages – Sell Digital Products Securely [wpdm-premium-packages]
Researcher
Affected Software
Protect Your Content [protect-your-content]
Researcher
Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting
6.1
Affected Software
Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations]
Researcher
Affected Software
Run Contests, Raffles, and Giveaways with ContestsWP [contest-code-checker]
Researcher
Affected Software
salavat counter Plugin [salavat-counter]
Researcher
Affected Software
Subaccounts for WooCommerce [subaccounts-for-woocommerce]
Researcher
Affected Software
Sugar Calendar – Events Calendar, Event Tickets, and Events Management Platform [sugar-calendar-lite]
Researcher
Affected Software
Theater for WordPress [theatre]
Researcher
Affected Software
TM Islamic Helper [tm-islamic-helper]
Researcher
Affected Software
Wc Recently viewed products [wc-recently-viewed-products]
Researcher
Affected Software
Weather Atlas Widget [weather-atlas]
Researcher
Affected Software
WIP Incoming Lite [wip-incoming-lite]
Researcher
Affected Software
Wishlist for WooCommerce: Multi Wishlists Per Customer PRO [wish-list-for-woocommerce-pro]
Researcher
Affected Software
WooCommerce Price Alert [price-alert-woocommerce]
Researcher
Affected Software
WP e-Commerce Style Email [wp-e-commerce-style-email]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
Youneeq Recommendations [youneeq-panel]
Researcher
Affected Software
SimpLy Gallery [simply-gallery-block]
Researcher
SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
5.5
Affected Software
SVG Block [svg-block]
Researcher
Affected Software
April's Call Posts [aprils-call-posts]
Researcher
Affected Software
Continue Shopping From Cart [continue-shopping-from-cart-page]
Researcher
Affected Software
Custom Shortcode Sidebars [custom-shortcode-sidebars]
Researcher
Affected Software
Fence URL wp-login.php [fence-url]
Researcher
Idealien Category Enhancements <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
5.4
Affected Software
Idealien Category Enhancements [idealien-category-enhancements]
Researcher
Affected Software
WP-ISPConfig 3 [wp-ispconfig3]
Researcher
Affected Software
Yaad Sarig Payment Gateway For WC [yaad-sarig-payment-gateway-for-wc]
Researcher
Affected Software
Anonymous Restricted Content [anonymous-restricted-content]
Researcher
Affected Software
Google for WooCommerce [google-listings-and-ads]
Researcher
Affected Software
Jobify - Job Board WordPress Theme [jobify]
Researcher
Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure
5.3
Affected Software
Product Table for WooCommerce [woo-product-table]
Researcher
Affected Software
Simple Membership [simple-membership]
Researcher
Affected Software
Researcher
WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion
5.3
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
Researcher
Affected Software
System Dashboard [system-dashboard]
Researcher
Affected Software
Favicon My Blog [favicon-my-blog]
Researcher
Affected Software
Ajax Search Lite – Live Search & Filter [ajax-search-lite]
Researcher
Affected Software
Dynamic "To Top" Plugin [dynamic-to-top]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Image horizontal reel scroll slideshow [image-horizontal-reel-scroll-slideshow]
Researcher
Affected Software
Image Widget [image-widget]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
LuckyWP Table of Contents [luckywp-table-of-contents]
Researcher
Affected Software
Meteor Slides [meteor-slides]
Researcher
Affected Software
Researcher
Affected Software
Researcher
ProfilePress <= 4.15.14 - Authenticated (Admin+) Stored Cross-Site Scripting via "Product Files"
4.4
Affected Software
Researcher
Affected Software
Sticky Social Icons [sticky-social-icons]
Researcher
Affected Software
What Would Seth Godin Do [what-would-seth-godin-do]
Researcher
Affected Software
Ahmeti Wp Güzel Sözler [ahmeti-wp-guzel-sozler]
Researcher
Affected Software
Bard Extra [bard-extra]
Researcher
Affected Software
Researcher
Affected Software
Document & Data Automation [document-data-automation]
Researcher
Affected Software
Easy Twitter Feeds – Embed Social Media Posts with Live Updates [easy-twitter-feeds]
Researcher
Affected Software
Enter Addons – Ultimate Template Builder for Elementor [enteraddons]
Researcher
Affected Software
Google Plus Share and +1 Button [google-plus-share-and-plusone-button]
Researcher
Affected Software
Hotlink2Watermark [hotlink2watermark]
Researcher
Affected Software
Researcher
Affected Software
Jobify - Job Board WordPress Theme [jobify]
Researcher
Affected Software
Kevin's Plugin [kevins-plugin]
Researcher
Affected Software
Multi Feed Reader [multi-feed-reader]
Researcher
Affected Software
My Contador lesr [my-contador-wp]
Researcher
Affected Software
Researcher
Affected Software
RealtyCandy IDX Broker Extended [realtycandy-idx-broker-extended]
Researcher
Affected Software
Silverlight Video Player [smooth-streaming-player]
Researcher
Affected Software
Simple Travel Map [simple-travel-map]
Researcher
Affected Software
Sky Addons for Elementor [sky-elementor-addons]
Researcher
Affected Software
Stratum Widgets for Elementor [stratum]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Affected Software
Theme Builder For Elementor [theme-builder-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Ultimate YouTube Video & Shorts Player With Vimeo [ultimate-youtube-video-player]
Researcher
Affected Software
Ultimate YouTube Video & Shorts Player With Vimeo [ultimate-youtube-video-player]
Researcher
Affected Software
UltraAddons for Elementor [ultraaddons-elementor-lite]
Researcher
Affected Software
wp auto top [wp-auto-top]
Researcher
Affected Software
EasyMedia – Increase Media Upload File Size | Role-Based Upload Limit | Increase Execution Time [wp-maximum-upload-file-size]
Researcher
Affected Software
WP Travel Engine – Tour Booking Plugin – Tour Operator Software [wp-travel-engine]
Researcher
Affected Software
WP User Manager – User Profile Builder & Membership [wp-user-manager]
Researcher
Affected Software
WP User Manager – User Profile Builder & Membership [wp-user-manager]
Researcher
Affected Software
WPDash Notes [wpdash-notes]
Researcher
Affected Software
Zajax – Ajax Navigation [zajax-ajax-navigation]
Researcher
Affected Software
Lock User Account [lock-user-account]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments