Wordfence Intelligence Weekly WordPress Vulnerability Report (October 28, 2024 to November 3, 2024)
🦸 👻 Calling all superheroes and haunters! Introducing the Cybersecurity Month Spooktacular Haunt and the WordPress Superhero Challenge for the Wordfence Bug Bounty Program! Through November 11th, 2024:
- All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
- Top-tier researchers earn automatic bonuses of between 10% to 120% for valid submissions
- Pending report limits are increased for all
- It’s possible to earn up to $31,200 for high impact vulnerabilities!
Last week, there were 239 vulnerabilities disclosed in 229 WordPress Plugins and no WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 52 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 19,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-759 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 113 |
| Unpatched | 126 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 211 |
| High Severity | 17 |
| Critical Severity | 11 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 130 |
| Cross-Site Request Forgery (CSRF) | 44 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 21 |
| Unrestricted Upload of File with Dangerous Type | 12 |
| Missing Authorization | 7 |
| Exposure of Sensitive Information to an Unauthorized Actor | 4 |
| Authentication Bypass Using an Alternate Path or Channel | 2 |
| Authorization Bypass Through User-Controlled Key | 2 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 2 |
| Improper Control of Generation of Code ('Code Injection') | 2 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Incorrect Privilege Assignment | 2 |
| Deserialization of Untrusted Data | 1 |
| External Control of File Name or Path | 1 |
| Files or Directories Accessible to External Parties | 1 |
| Improper Access Control | 1 |
| Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | 1 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 1 |
| Insertion of Sensitive Information into Log File | 1 |
| Missing Authentication for Critical Function | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 74 | |
| 21 | |
| 14 | |
| 10 | |
| 8 | |
| 8 | |
| 8 | |
| 6 | |
| 6 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| (dp) AddThis | dp-addthis |
| 3D Presentation | 3d-presentation |
| Aajoda Testimonials | aajoda-testimonials |
| Accordion title for Elementor | accordion-title-for-elementor |
| Addressbook | addressbook |
| Admin SMS Alert | admin-sms-alert |
| Administrator Z | administrator-z |
| Advanced Control Manager for WordPress by ItalyStrap | advanced-control-manager |
| Advanced Cron Manager – debug & control | advanced-cron-manager |
| Advanced PDF Generator | advanced-pdf-generator |
| affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display | affiliate-toolkit-starter |
| AI Puffer – Chat. Create. Automate. (formerly AI Power) | gpt3-ai-content-generator |
| All Post Contact Form | allpost-contactform |
| Alley Elementor Widget | alley-elementor-widget |
| Alphabetical List | alphabetical-list |
| AmaDiscount Plugin | amadiscount |
| amazing neo icon font for elementor | amazing-neo-icon-font-for-elementor |
| Amazon Associate Filter | amazon-associate-filter |
| AMP Img Shortcode | amp-img-shortcode |
| Ancient World Linked Data for WordPress | ancient-world-linked-data-for-wordpress |
| APK Downloader | apk-downloader |
| ApplyOnline – Application Form Builder and Manager | apply-online |
| Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress | bookingpress-appointment-booking |
| Appointmind | appointmind |
| AR for WooCommerce | ar-for-woocommerce |
| Arconix Shortcodes | arconix-shortcodes |
| aThemes Addons for Elementor | athemes-addons-for-elementor-lite |
| Audio Comparison Lite | audio-comparison-lite |
| Awesome Progress Bar | awesome-progess-bar |
| Awesome Shortcodes For Genesis | awesome-shortcodes-for-genesis |
| AwesomePress | awesomepress |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Beds24 Online Booking | beds24-online-booking |
| BetterLinks – URL Shortener, Link Tracking, Analytics & Affiliate Link Manager | betterlinks |
| Bigmart Elements | bigmart-elements |
| Black Widgets For Elementor | black-widgets |
| Blrt WP Embed | blrt-wp-embed |
| Bonway Static Block Editor | bonway-static-block-editor |
| bpmn.io | bpmnio |
| Bricksable for Bricks Builder | bricksable |
| BTEV | bluetrait-event-viewer |
| Build 5 Star Reviews on Google Reviews, Yelp, Facebook… easily and risk-free | RRatingg | 5-stars-rating-funnel |
| Bulk Change Role | bulk-role-change |
| Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | wp-carousel-free |
| Classy Addons for Elementor | classy-addons-for-elementor |
| Clever Addons for Elementor | cafe-lite |
| Clyp | clyp |
| CM Table Of Contents – Clear navigation for better content discovery | cm-table-of-content |
| Code Explorer | code-explorer |
| Countdown, Coming Soon, Maintenance – Countdown & Clock | countdown-builder |
| Cresta Addons for Elementor | cresta-addons-for-elementor |
| Crypto | crypto |
| Custom Admin Menu | custom-admin-menu |
| Custom Author URL | author-slug |
| Custom post type templates for Elementor | custom-post-type-templates-for-elementor |
| DataMentor – Best DataTables Plugin for Elementor | datamentor |
| Definitive Addons for Elementor | definitive-addons-for-elementor |
| Delisho – Recipe Widgets and Blocks | dr-widgets-blocks |
| Display Terms Shortcode | display-terms-shortcode |
| Ditty – Responsive News Tickers, Sliders, and Lists | ditty-news-ticker |
| Domain Sharding | domain-sharding |
| Download Monitor | download-monitor |
| Download-Mirror-Counter | wp-download-mirror-counter |
| DS.DownloadList | dsdownloadlist |
| Dynamic Widgets | dynamic-widgets |
| e-shopsカート2 | e-shops-cart2 |
| Easy Accordion Block | easy-accordion-block |
| Easy Gallery | simple-gallery-odihost |
| Easy Property Listings | easy-property-listings |
| Easy SVG Upload | easy-svg-upload |
| Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons | bdthemes-element-pack-lite |
| Elementary Addons | elementary-addons |
| Elo Rating Shortcode | elo-rating-shortcode |
| Emoji Shortcode | emoji-shortcode |
| Enable Shortcodes inside Widgets,Comments and Experts | enable-shortcodes-inside-widgetscomments-and-experts |
| EndomondoWP | endomondowp |
| EventPrime – Events Calendar, Bookings and Tickets | eventprime-event-calendar-management |
| Events Manager Pro – extended | events-manager-pro-extended |
| Exclusive Addons for Elementor | exclusive-addons-for-elementor |
| Extender All In One For Elementor | extender-all-in-one-for-elementor |
| EzyOnlineBookings Online Booking System Widget | ezyonlinebookings-online-booking-system |
| Featured Posts Scroll | featured-posts-scroll |
| FileOrganizer – WordPress File Manager | fileorganizer |
| Flash Show And Hide Box | flash-show-and-hide-box |
| Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More | formidable |
| Forminator Forms – Contact Form, Payment Form & Custom Form Builder | forminator |
| Forumax – AI Powered Advanced Community Forum Plugin | bbp-core |
| FraudLabs Pro SMS Verification | fraudlabs-pro-sms-verification |
| GDReseller | gdreseller |
| Genoo | genoo |
| GEO my WP | geo-my-wp |
| GEO Plugin by Squirrly SEO | squirrly-seo |
| Get Quote For Woocommerce – Request A Quote For Woocommerce | get-a-quote-for-woocommerce |
| Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) | gift-voucher |
| Gmap Point List | gmap-point-list |
| Gmw Premium Settings | gmw-premium-settings |
| Golf Tracker | golf-tracker |
| Group Chat & Video Chat by AtomChat | atomchat |
| Header Footer Composer for Elementor | header-footer-composer |
| Hoo Addons for Elementor | hoo-addons-for-elementor |
| Hover Video Preview | hover-video-preview |
| HT Builder – WordPress Theme Builder for Elementor | ht-builder |
| HT Politic – For Political WordPress Themes / Website | wp-politic |
| ID-SK Toolkit | idsk-toolkit |
| Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation | zero-bs-crm |
| Jetpackcrm Ext Woo Connect | jetpackcrm-ext-woo-connect |
| Jigoshop – Store Exporter | jigoshop-exporter |
| Job Postings | job-postings |
| JS Help Desk – AI-Powered Support & Ticketing System | js-support-ticket |
| Kadence Blocks — Page Builder Toolkit for Gutenberg Editor | kadence-blocks |
| Kata Plus – Addons for Elementor – Widgets, Extensions and Templates | kata-plus |
| Kento Ads Rotator | kento-ads-rotator |
| Knowledge Base | knowledgebase |
| LH QR Codes | lh-qr-codes |
| LiteSpeed Cache | litespeed-cache |
| Lodgix.com Vacation Rental Website Builder | lodgixcom-vacation-rental-listing-management-booking-plugin |
| Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) | magical-addons-for-elementor |
| MailPoet – Newsletters, Email Marketing, and Automation | mailpoet |
| Manage User Columns | manage-user-columns |
| Market 360 Viewer | market-360-viewer |
| Marketing Automation by AZEXO | marketing-automation-by-azexo |
| Marquee Elementor with Posts | marquee-elementor |
| MasterBip para Elementor | masterbip-for-elementor |
| Masteriyo LMS – LMS Course Builder, Quizzes & Certificates | learning-management-system |
| MDR Webmaster Tools | mdr-webmaster-tools |
| Media Library Assistant | media-library-assistant |
| Media Library Tools – AI-Powered Rename, Clean & CSV Import/Export | media-library-tools |
| Media Modal | media-modal |
| Meta Store Elements | meta-store-elements |
| ML Responsive Audio player with playlist Shortcode | mlr-audio |
| Mobilize | mobilize |
| Move Addons for Elementor | move-addons |
| MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO | multiple-pages-generator-by-porthas |
| Multi Purpose Mail Form | multi-purpose-mail-form |
| MyCurator Content Curation | mycurator |
| MyOrderDesk | myorderdesk |
| Naver Blog | naver-blog-api |
| Newsletters | newsletters-lite |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| NMR Strava activities | nmr-strava-activities |
| Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | otter-blocks |
| Paytium: Mollie payment forms & donations | paytium |
| Planning Center Online Giving | planning-center-online-giving |
| Platform.ly Official | platformly |
| Plug your WooCommerce into the largest catalog of customized print products from Helloprint | helloprint |
| Plugin Name: GMO Social Connection | gmo-social-connection |
| Popup Box – Create Countdown, Coupon, Video, Contact Form Popups | ays-popup-box |
| Porsline | porsline |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Post Status Notifier | post-status-notifier |
| Post Status Notifier Lite | post-status-notifier-lite |
| Premium Addons for Elementor – Powerful Elementor Templates & Widgets | premium-addons-for-elementor |
| Pricer Ninja: Create and add responsive Pricing Tables to your website on-the-fly | pricer-ninja-pricing-tables |
| Pricing Table WordPress Plugin – Easy Pricing Tables | easy-pricing-tables |
| Quran Shortcode | quran-shortcode |
| Random Featured Post | random-featured-post-plugin |
| ReCaptcha Integration for WordPress | wp-recaptcha-integration |
| Reftagger Shortcode | reftagger-shortcode |
| Responsive Flickr Gallery | responsive-flickr-gallery |
| Responsive Gallery Grid | responsive-gallery-grid |
| Restaurant & Cafe Addon for Elementor | restaurant-cafe-addon-for-elementor |
| RLM Elementor Widgets Pack | rlm-elementor-widgets-pack |
| RSVP ME | rsvp-me |
| RSVPMaker for Toastmasters | rsvpmaker-for-toastmasters |
| Sales Page Addon – Elementor & Beaver Builder | sales-page-addon |
| Selar.co Widget | selar-co-widget |
| Seo Free | seo-free |
| SEUR Oficial | seur |
| SH Slideshow | sh-slideshow |
| Show Visitor IP Address | show-visitor-ip-address |
| Sided | sided |
| Simple Business Manager | simple-business-manager |
| Simple Goods | simple-goods |
| Simple Job Manager | simple-job-manager |
| Simple Page Specific Sidebars | page-specific-sidebars |
| SIP Reviews Shortcode for WooCommerce | sip-reviews-shortcode-woocommerce |
| Skip To | skip-to |
| SKSDEV Toolkit | sksdev-toolkit |
| Slicko | slicko-for-elementor |
| Smart Mockups | smart-mockups |
| SmartLink Dynamic URLs | smartlink-dinamic-urls |
| SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery | sms-alert |
| Social Media Share Buttons & Social Sharing Icons | ultimate-social-media-icons |
| Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor | sastra-essential-addons-for-elementor |
| Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder | stacks-mobile-app-builder |
| Stars SMTP Mailer | stars-smtp-mailer |
| Step by Step | step-by-step |
| Sticky Social Bar | sticky-social-bar |
| StreamWeasels Kick Integration | streamweasels-kick-integration |
| StreamWeasels YouTube Integration | streamweasels-youtube-integration |
| Subscribe to Comments | subscribe-to-comments |
| Super Addons for Elementor | super-addons-for-elementor |
| T(-) Countdown | t-countdown |
| Taskbuilder – Project Management & Task Management Tool With Kanban Board | taskbuilder |
| Themedy Toolbox | themedy-toolbox |
| ThemeFuse Maintenance Mode | themefuse-maintenance-mode |
| ThemeShark Templates & Widgets for Elementor | themeshark-elementor |
| TradeMe widgets | trademe-widget |
| Training – Courses | training |
| Twitter @Anywhere Plus | twitter-anywhere-plus |
| Ultimate TinyMCE | ultimate-tinymce |
| UPDATE NOTIFICATIONS | update-notifications |
| W3P SEO | wp-perfect-plugin |
| W3SPEEDSTER | w3speedster-wp |
| Webriti Custom Login | webriti-custom-login-page |
| Website price calculator | price-calculator-to-your-website |
| WeChat Subscribers Lite 微信公众订阅号插件 | wechat-subscribers-lite |
| While Loading | while-it-is-loading |
| Widget or Sidebar Shortcode | widget-or-sidebar-per-shortcode |
| WM Zoom | wm-zoom |
| Woo Manage Fraud Orders | woo-manage-fraud-orders |
| Woocommerce Product Design | woo-product-design |
| Woocommerce Quote Calculator | woo-quote-calculator-order |
| WordPress Business Plugin | business |
| World Prayer Time | world-prayer-time |
| WP Baidu Map | wp-baidu-map |
| WP Course Manager | wp-course-manager |
| WP donimedia carousel | wp-donimedia-carousel |
| WP EASY RECIPE | wp-easy-recipe |
| WP EIS | wp-eis |
| WP Feature Box | wp-feature-box |
| WP Hotel Booking | wp-hotel-booking |
| WP Pocket URLs | wp-pocket-urls |
| WP Simple Anchors Links | wp-simple-anchors-links |
| WP Team – WordPress Team Member Plugin | ht-team-member |
| WPAdverts – Classifieds Plugin | wpadverts |
| WPC Smart Messages for WooCommerce | wpc-smart-messages |
| WPGlobus Translate Options | wpglobus-translate-options |
| Курс валют UAH | ukrainian-currency |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
AI Puffer – Chat. Create. Automate. (formerly AI Power) [gpt3-ai-content-generator]
Researcher
Affected Software
All Post Contact Form [allpost-contactform]
Researcher
Affected Software
AR for WooCommerce [ar-for-woocommerce]
Researcher
Affected Software
Crypto [crypto]
Researcher
Affected Software
Crypto [crypto]
Researcher
Affected Software
Multi Purpose Mail Form [multi-purpose-mail-form]
Researcher
Affected Software
Researcher
Affected Software
RSVPMaker for Toastmasters [rsvpmaker-for-toastmasters]
Researcher
Affected Software
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder [stacks-mobile-app-builder]
Researcher
Affected Software
Woocommerce Product Design [woo-product-design]
Researcher
Affected Software
W3SPEEDSTER [w3speedster-wp]
Researcher
Bulk Change Role <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
8.8
Affected Software
Bulk Change Role [bulk-role-change]
Researcher
Affected Software
Crypto [crypto]
Researcher
Affected Software
Marketing Automation by AZEXO [marketing-automation-by-azexo]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Stars SMTP Mailer [stars-smtp-mailer]
Researcher
Affected Software
Training – Courses [training]
Researcher
Affected Software
WP donimedia carousel [wp-donimedia-carousel]
Researcher
Affected Software
WP Hotel Booking [wp-hotel-booking]
Researcher
Affected Software
WPC Smart Messages for WooCommerce [wpc-smart-messages]
Researcher
Affected Software
DS.DownloadList [dsdownloadlist]
Researcher
Affected Software
LiteSpeed Cache [litespeed-cache]
Researcher
Affected Software
FileOrganizer – WordPress File Manager [fileorganizer]
Researcher
Affected Software
Woocommerce Product Design [woo-product-design]
Researcher
Affected Software
Enable Shortcodes inside Widgets,Comments and Experts [enable-shortcodes-inside-widgetscomments-and-experts]
Researcher
Researcher
Affected Software
Media Library Assistant [media-library-assistant]
Researcher
Affected Software
WPAdverts – Classifieds Plugin [wpadverts]
Researcher
Affected Software
Build 5 Star Reviews on Google Reviews, Yelp, Facebook… easily and risk-free | RRatingg [5-stars-rating-funnel]
Researcher
Affected Software
Administrator Z [administrator-z]
Researcher
Affected Software
AmaDiscount Plugin [amadiscount]
Researcher
Affected Software
Blrt WP Embed [blrt-wp-embed]
Researcher
Affected Software
Download-Mirror-Counter [wp-download-mirror-counter]
Researcher
Affected Software
Easy Gallery [simple-gallery-odihost]
Researcher
Affected Software
Golf Tracker [golf-tracker]
Researcher
Lodgix.com Vacation Rental Website Builder <= 3.9.73 - Authenticated (Contributor+) SQL Injection
6.5
Affected Software
Lodgix.com Vacation Rental Website Builder [lodgixcom-vacation-rental-listing-management-booking-plugin]
Researcher
Affected Software
Market 360 Viewer [market-360-viewer]
Researcher
Affected Software
Porsline [porsline]
Researcher
Affected Software
Quran Shortcode [quran-shortcode]
Researcher
Affected Software
RSVP ME [rsvp-me]
Researcher
Affected Software
Simple Job Manager [simple-job-manager]
Researcher
Affected Software
SIP Reviews Shortcode for WooCommerce [sip-reviews-shortcode-woocommerce]
Researchers
Affected Software
Website price calculator [price-calculator-to-your-website]
Researcher
Affected Software
Woocommerce Quote Calculator [woo-quote-calculator-order]
Researcher
Affected Software
WP EIS [wp-eis]
Researcher
Affected Software
(dp) AddThis [dp-addthis]
Researcher
Affected Software
3D Presentation [3d-presentation]
Researcher
Affected Software
Aajoda Testimonials [aajoda-testimonials]
Researcher
Affected Software
Accordion title for Elementor [accordion-title-for-elementor]
Researcher
Affected Software
Advanced Control Manager for WordPress by ItalyStrap [advanced-control-manager]
Researcher
Affected Software
affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display [affiliate-toolkit-starter]
Researcher
Affected Software
Alley Elementor Widget [alley-elementor-widget]
Researcher
Affected Software
amazing neo icon font for elementor [amazing-neo-icon-font-for-elementor]
Researcher
Affected Software
AMP Img Shortcode [amp-img-shortcode]
Researcher
Affected Software
Ancient World Linked Data for WordPress [ancient-world-linked-data-for-wordpress]
Researcher
Affected Software
Arconix Shortcodes [arconix-shortcodes]
Researcher
aThemes Addons for Elementor <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
aThemes Addons for Elementor [athemes-addons-for-elementor-lite]
Researcher
AtomChat <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode
6.4
Affected Software
Group Chat & Video Chat by AtomChat [atomchat]
Researcher
Affected Software
Audio Comparison Lite [audio-comparison-lite]
Researcher
Affected Software
Awesome Progress Bar [awesome-progess-bar]
Researcher
Affected Software
AwesomePress [awesomepress]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Bigmart Elements [bigmart-elements]
Researcher
Affected Software
Black Widgets For Elementor [black-widgets]
Researcher
Affected Software
Black Widgets For Elementor [black-widgets]
Researcher
Affected Software
Bonway Static Block Editor [bonway-static-block-editor]
Researcher
Affected Software
WordPress Business Plugin [business]
Researcher
Affected Software
Classy Addons for Elementor [classy-addons-for-elementor]
Researcher
Affected Software
Clever Addons for Elementor [cafe-lite]
Researcher
Affected Software
Cresta Addons for Elementor [cresta-addons-for-elementor]
Researcher
Affected Software
Custom Admin Menu [custom-admin-menu]
Researcher
Affected Software
Custom post type templates for Elementor [custom-post-type-templates-for-elementor]
Researcher
Affected Software
DataMentor – Best DataTables Plugin for Elementor [datamentor]
Researcher
Definitive Addons for Elementor <= 1.5.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Definitive Addons for Elementor [definitive-addons-for-elementor]
Researcher
Affected Software
Delisho – Recipe Widgets and Blocks [dr-widgets-blocks]
Researcher
Affected Software
Display Terms Shortcode [display-terms-shortcode]
Researcher
Affected Software
Ditty – Responsive News Tickers, Sliders, and Lists [ditty-news-ticker]
Researcher
Easy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
6.4
Affected Software
Easy SVG Upload [easy-svg-upload]
Researcher
Affected Software
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
Elementary Addons [elementary-addons]
Researcher
Affected Software
Elo Rating Shortcode [elo-rating-shortcode]
Researcher
Affected Software
Emoji Shortcode [emoji-shortcode]
Researcher
Affected Software
EndomondoWP [endomondowp]
Researcher
Affected Software
Extender All In One For Elementor [extender-all-in-one-for-elementor]
Researcher
Affected Software
EzyOnlineBookings Online Booking System Widget [ezyonlinebookings-online-booking-system]
Researcher
Affected Software
GDReseller [gdreseller]
Researcher
Affected Software
Researcher
Affected Software
Gmap Point List [gmap-point-list]
Researcher
Affected Software
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor [kadence-blocks]
Researcher
Affected Software
Header Footer Composer for Elementor [header-footer-composer]
Researcher
Affected Software
Hoo Addons for Elementor [hoo-addons-for-elementor]
Researcher
Affected Software
Hover Video Preview [hover-video-preview]
Researcher
Affected Software
HT Builder – WordPress Theme Builder for Elementor [ht-builder]
Researcher
Affected Software
Researcher
Affected Software
WP Team – WordPress Team Member Plugin [ht-team-member]
Researcher
Affected Software
ID-SK Toolkit [idsk-toolkit]
Researcher
Affected Software
Job Postings [job-postings]
Researcher
Affected Software
Researcher
Affected Software
Kento Ads Rotator [kento-ads-rotator]
Researcher
Affected Software
Knowledge Base [knowledgebase]
Researcher
Affected Software
LH QR Codes [lh-qr-codes]
Researcher
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) [magical-addons-for-elementor]
Researcher
Marquee Elementor with Posts <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Marquee Elementor with Posts [marquee-elementor]
Researcher
Affected Software
MasterBip para Elementor [masterbip-for-elementor]
Researcher
Affected Software
Masteriyo LMS – LMS Course Builder, Quizzes & Certificates [learning-management-system]
Researcher
Affected Software
Media Library Tools – AI-Powered Rename, Clean & CSV Import/Export [media-library-tools]
Researcher
Affected Software
Media Modal [media-modal]
Researcher
Affected Software
Meta Store Elements [meta-store-elements]
Researcher
Affected Software
Researcher
Affected Software
MyOrderDesk [myorderdesk]
Researcher
Affected Software
Newsletters [newsletters-lite]
Researcher
Affected Software
NMR Strava activities [nmr-strava-activities]
Researcher
Affected Software
Researcher
Affected Software
Planning Center Online Giving [planning-center-online-giving]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Premium Addons for Elementor – Powerful Elementor Templates & Widgets [premium-addons-for-elementor]
Researcher
Affected Software
Pricer Ninja: Create and add responsive Pricing Tables to your website on-the-fly [pricer-ninja-pricing-tables]
Researcher
Affected Software
Reftagger Shortcode [reftagger-shortcode]
Researcher
Affected Software
Restaurant & Cafe Addon for Elementor [restaurant-cafe-addon-for-elementor]
Researcher
Affected Software
RLM Elementor Widgets Pack [rlm-elementor-widgets-pack]
Researcher
Affected Software
Sales Page Addon – Elementor & Beaver Builder [sales-page-addon]
Researcher
Affected Software
Spexo Addons for Elementor – Elementor Widgets, Mega Menu, Popup Builder, Template Kits and Starter Templates for Elementor [sastra-essential-addons-for-elementor]
Researcher
Affected Software
Selar.co Widget [selar-co-widget]
Researcher
Affected Software
Show Visitor IP Address [show-visitor-ip-address]
Researcher
Affected Software
Simple Business Manager [simple-business-manager]
Researcher
Affected Software
Simple Goods [simple-goods]
Researcher
SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting
6.4
Affected Software
SIP Reviews Shortcode for WooCommerce [sip-reviews-shortcode-woocommerce]
Researchers
Affected Software
SKSDEV Toolkit [sksdev-toolkit]
Researcher
Affected Software
Smart Mockups [smart-mockups]
Researcher
Affected Software
Researcher
Affected Software
Step by Step [step-by-step]
Researcher
Affected Software
StreamWeasels YouTube Integration [streamweasels-youtube-integration]
Researcher
Affected Software
Super Addons for Elementor [super-addons-for-elementor]
Researcher
Affected Software
StreamWeasels Kick Integration [streamweasels-kick-integration]
Researcher
T(-) Countdown <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
Affected Software
T(-) Countdown [t-countdown]
Researcher
Affected Software
Themedy Toolbox [themedy-toolbox]
Researcher
Affected Software
ThemeShark Templates & Widgets for Elementor [themeshark-elementor]
Researcher
Affected Software
TradeMe widgets [trademe-widget]
Researcher
Affected Software
Ultimate TinyMCE [ultimate-tinymce]
Researcher
Affected Software
Widget or Sidebar Shortcode [widget-or-sidebar-per-shortcode]
Researcher
Affected Software
WP Baidu Map [wp-baidu-map]
Researcher
Affected Software
WP EASY RECIPE [wp-easy-recipe]
Researcher
Affected Software
WP Feature Box [wp-feature-box]
Researcher
Affected Software
WP Pocket URLs [wp-pocket-urls]
Researcher
Affected Software
WP Simple Anchors Links [wp-simple-anchors-links]
Researcher
Affected Software
Курс валют UAH [ukrainian-currency]
Researcher
Affected Software
Addressbook [addressbook]
Researcher
Affected Software
Admin SMS Alert [admin-sms-alert]
Researcher
Affected Software
Advanced PDF Generator [advanced-pdf-generator]
Researcher
Affected Software
Amazon Associate Filter [amazon-associate-filter]
Researcher
Affected Software
APK Downloader [apk-downloader]
Researcher
Affected Software
Appointmind [appointmind]
Researcher
Affected Software
Awesome Shortcodes For Genesis [awesome-shortcodes-for-genesis]
Researcher
Affected Software
Researcher
Affected Software
Custom Author URL [author-slug]
Researcher
Affected Software
Domain Sharding [domain-sharding]
Researcher
Affected Software
e-shopsカート2 [e-shops-cart2]
Researcher
Events Manager Pro – extended <= 0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
6.1
Affected Software
Events Manager Pro – extended [events-manager-pro-extended]
Researcher
Affected Software
Featured Posts Scroll [featured-posts-scroll]
Researcher
Affected Software
Flash Show And Hide Box [flash-show-and-hide-box]
Researcher
FraudLabs Pro SMS Verification <= 1.10.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
FraudLabs Pro SMS Verification [fraudlabs-pro-sms-verification]
Researcher
Affected Software
Plugin Name: GMO Social Connection [gmo-social-connection]
Researcher
Affected Software
Jigoshop – Store Exporter [jigoshop-exporter]
Researcher
Affected Software
MDR Webmaster Tools [mdr-webmaster-tools]
Researcher
Affected Software
Naver Blog [naver-blog-api]
Researcher
Affected Software
Platform.ly Official [platformly]
Researcher
Affected Software
Post Status Notifier [post-status-notifier]
Post Status Notifier Lite [post-status-notifier-lite]
Researcher
Affected Software
Pricing Table WordPress Plugin – Easy Pricing Tables [easy-pricing-tables]
Researcher
Affected Software
Random Featured Post [random-featured-post-plugin]
Researcher
Affected Software
ReCaptcha Integration for WordPress [wp-recaptcha-integration]
Researcher
Affected Software
Responsive Flickr Gallery [responsive-flickr-gallery]
Researcher
Affected Software
SEUR Oficial [seur]
Researcher
Affected Software
SH Slideshow [sh-slideshow]
Researcher
Simple Page Specific Sidebars <= 2.14.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
Simple Page Specific Sidebars [page-specific-sidebars]
Researcher
Affected Software
SmartLink Dynamic URLs [smartlink-dinamic-urls]
Researcher
Affected Software
Sticky Social Bar [sticky-social-bar]
Researcher
Affected Software
Subscribe to Comments [subscribe-to-comments]
Researcher
Affected Software
ThemeFuse Maintenance Mode [themefuse-maintenance-mode]
Researcher
Affected Software
Twitter @Anywhere Plus [twitter-anywhere-plus]
Researcher
Affected Software
UPDATE NOTIFICATIONS [update-notifications]
Researcher
Affected Software
Webriti Custom Login [webriti-custom-login-page]
Researcher
Affected Software
WeChat Subscribers Lite 微信公众订阅号插件 [wechat-subscribers-lite]
Researcher
Affected Software
While Loading [while-it-is-loading]
Researcher
Affected Software
World Prayer Time [world-prayer-time]
Researcher
Affected Software
WP Course Manager [wp-course-manager]
Researcher
Affected Software
WPGlobus Translate Options [wpglobus-translate-options]
Researcher
Affected Software
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons [bdthemes-element-pack-lite]
Researcher
Affected Software
MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO [multiple-pages-generator-by-porthas]
Researcher
Affected Software
ApplyOnline – Application Form Builder and Manager [apply-online]
Researcher
Affected Software
Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress [bookingpress-appointment-booking]
Researcher
Affected Software
Researcher
Affected Software
Get Quote For Woocommerce – Request A Quote For Woocommerce [get-a-quote-for-woocommerce]
Researcher
Affected Software
Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builder [stacks-mobile-app-builder]
Researcher
Affected Software
Woo Manage Fraud Orders [woo-manage-fraud-orders]
Researcher
Affected Software
Researcher
Affected Software
Code Explorer [code-explorer]
Researcher
Affected Software
Researcher
Affected Software
Advanced Cron Manager – debug & control [advanced-cron-manager]
Researcher
Affected Software
Beds24 Online Booking [beds24-online-booking]
Researcher
Bricksable for Bricks Builder <= 1.6.59 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
Affected Software
Bricksable for Bricks Builder [bricksable]
Researcher
Affected Software
Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel [wp-carousel-free]
Researcher
Affected Software
Countdown, Coming Soon, Maintenance – Countdown & Clock [countdown-builder]
Researcher
Affected Software
Easy Property Listings [easy-property-listings]
Researcher
Affected Software
Researcher
Affected Software
JS Help Desk – AI-Powered Support & Ticketing System [js-support-ticket]
Researcher
Affected Software
Researcher
Affected Software
MyCurator Content Curation [mycurator]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups [ays-popup-box]
Researcher
Affected Software
Responsive Gallery Grid [responsive-gallery-grid]
Researcher
Affected Software
GEO Plugin by Squirrly SEO [squirrly-seo]
Researcher
Affected Software
Social Media Share Buttons & Social Sharing Icons [ultimate-social-media-icons]
Researcher
Affected Software
Alphabetical List [alphabetical-list]
Researcher
Affected Software
BTEV [bluetrait-event-viewer]
Researcher
Affected Software
CM Table Of Contents – Clear navigation for better content discovery [cm-table-of-content]
Researcher
Affected Software
CM Table Of Contents – Clear navigation for better content discovery [cm-table-of-content]
Researcher
Affected Software
Download Monitor [download-monitor]
Researcher
Affected Software
Dynamic Widgets [dynamic-widgets]
Researcher
Affected Software
Easy Accordion Block [easy-accordion-block]
Researcher
Affected Software
EventPrime – Events Calendar, Bookings and Tickets [eventprime-event-calendar-management]
Researcher
Affected Software
Exclusive Addons for Elementor [exclusive-addons-for-elementor]
Researcher
Affected Software
kallyas [kallyas]
Researcher
Affected Software
Manage User Columns [manage-user-columns]
Researcher
Affected Software
Move Addons for Elementor [move-addons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPC Smart Messages for WooCommerce [wpc-smart-messages]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments