Wordfence Intelligence Weekly WordPress Vulnerability Report (December 2, 2024 to December 8, 2024)
💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025:
- All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
- All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
- All plugins and themes hosted in the WordPress.org repository with any install count are in scope for our preset list of high threat vulnerabilities.
- $150 bonus awarded when a researcher submits at least 15 valid high threat vulnerabilities, and then a $50 bonus awarded for every 5 submitted thereafter.
- Minimum bounty of $5 for all valid in-scope submissions.
- All researchers earn automatic bonuses of between 5% to 180% for valid submissions
- Pending report limits are increased for all
- It’s possible to earn up to $31,200 for high impact vulnerabilities!
Last week, there were 228 vulnerabilities disclosed in 209 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 73 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 20,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- WAF-RULE-774 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-775 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-776 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-777 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-778 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-779 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-780 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-781 – Data redacted while we work with the vendor on a patch.
- WAF-RULE-782 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 157 |
| Unpatched | 71 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Medium Severity | 185 |
| High Severity | 35 |
| Critical Severity | 8 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 118 |
| Missing Authorization | 38 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 20 |
| Cross-Site Request Forgery (CSRF) | 13 |
| Authorization Bypass Through User-Controlled Key | 8 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 6 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 5 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Improper Control of Generation of Code ('Code Injection') | 4 |
| Exposure of Sensitive Information to an Unauthorized Actor | 3 |
| Deserialization of Untrusted Data | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Improper Access Control | 1 |
| Improper Authentication | 1 |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
| URL Redirection to Untrusted Site ('Open Redirect') | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 23 | |
| 19 | |
| 13 | |
| 12 | |
| 12 | |
| 11 | |
| 8 | |
| 7 | |
| 6 | |
| 5 | |
| 5 | |
| 5 | |
| 5 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| ABCBiz Addons for Elementor | abcbiz-addons |
| Accessibility by AllAccessible | allaccessible |
| Accordion Slider | accordion-slider |
| Accounting for WooCommerce | accounting-for-woocommerce |
| Additional Custom Order Status for WooCommerce | order-status-for-woocommerce |
| Advanced Control Manager for WordPress by ItalyStrap | advanced-control-manager |
| Advanced Element Bucket Addons for Elementor | cs-element-bucket |
| Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution | file-manager-advanced |
| AI Quiz | Quiz Maker | ai-quiz |
| AIO Contact | aio-contact |
| All Bootstrap Blocks | all-bootstrap-blocks |
| Analytify – Google Analytics Dashboard For WordPress (GA4 analytics tracking) | wp-analytify |
| ARforms | arforms |
| Arkhe Blocks | arkhe-blocks |
| ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup | armember-membership |
| Authors List | authors-list |
| AWeber Forms by Optin Cat | aweber-wp |
| Awesome Shortcodes | awesome-shortcodes |
| B Testimonial – Customer Testimonials in Custom Layouts | b-testimonial |
| Beautiful taxonomy filters | beautiful-taxonomy-filters |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Blaze Online eParcel for WooCommerce | blaze-online-eparcel-for-woocommerce |
| Block Controller | block-controller |
| BMLT Tabbed Map | bmlt-tabbed-map |
| Board Document Manager from CHUHPL | board-document-manager-from-chuhpl |
| Bold Page Builder | bold-page-builder |
| Borderless – Addons and Templates for Elementor | borderless |
| BP Profile Shortcodes Extra | bp-profile-shortcodes-extra |
| Broadcast | threewp-broadcast |
| Broken Link Checker | broken-link-checker |
| Campaign Monitor Forms by Optin Cat | campaign-monitor-wp |
| Captivate Sync | captivatesync-trade |
| CardGate Payments for WooCommerce | cardgate |
| Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | wp-carousel-free |
| Charity Addon for Elementor | charity-addon-for-elementor |
| Church Admin | church-admin |
| Classic Addons – WPBakery Page Builder | classic-addons-wpbakery-page-builder-addons |
| Clickbank WordPress Plugin (Storefront) | clickbank-storefront |
| Clients | clients |
| CLUEVO LMS, E-Learning Platform | cluevo-lms |
| CMSMasters Elementor Addon | cmsmasters-elementor-addon |
| Colibri Page Builder | colibri-page-builder |
| Comfino Payment Gateway | comfino-payment-gateway |
| Connexion Logs | logs-de-connexion |
| Contact Form Builder by vcita | contact-form-with-a-meeting-scheduler-by-vcita |
| Contact Form, Survey & Form Builder – MightyForms | mightyforms |
| Contact Form, Survey, Quiz & Popup Form Builder – ARForms | arforms-form-builder |
| Cookielay | cookielay |
| Country Blocker | country-blocker |
| DELUCKS SEO | delucks-seo |
| Depicter — Popup & Slider Builder | depicter |
| Designer – Elementor Addons | designer |
| Dollie AI – Connect | dollie |
| Dynific Addons for Elementor (formerly AnyWhere Elementor) | anywhere-elementor |
| Easy Blocks pro | easy-blocks-pro |
| Easy Code Snippets | easy-code-snippets |
| Easy Replace | easy-replace |
| Easy Social Feed Premium | easy-facebook-likebox-premium |
| Echoza | echoza |
| eewee admin custom | eewee-admincustom |
| Eleblog – Elementor Blog And Magazine Addons | ele-blog |
| Element Pack – Widgets, Templates & Addons for Elementor | bdthemes-element-pack-lite |
| ElementsReady Addons for Elementor | element-ready-lite |
| Elite Notification – Sales Popup, Social Proof, FOMO Notification for WooCommerce | elite-notification |
| Email Address Obfuscation | email-address-obfuscation |
| Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More | envira-gallery-lite |
| Event Tickets with Ticket Scanner | event-tickets-with-ticket-scanner |
| Exhibit to WP Gallery | exhibit-to-wp-gallery |
| Eyewear prescription form | eyewear-prescription-form |
| FancyBox for WordPress | fancybox-for-wordpress |
| FAQs | faqs |
| FAT Services Booking | fat-services-booking |
| Feedpress Generator – External RSS Frontend Customizer | feedpress-generator |
| FileBird – WordPress Media Library Folders & File Manager | filebird |
| FileOrganizer – WordPress File Manager | fileorganizer |
| Firelight Lightbox | easy-fancybox |
| float block | float-block |
| FloristPress for Woo – Customize your eCommerce store for your Florist | bakkbone-florist-companion |
| Flower Delivery by Florist One | flower-delivery-by-florist-one |
| Folder Gallery | folder-gallery |
| Form Data Collector | form-data-collector |
| Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | form-maker |
| ForumWP – Forum & Discussion Board | forumwp |
| Friends | friends |
| Futurio Extra | futurio-extra |
| FV Flowplayer Video Player | fv-wordpress-flowplayer |
| Gallery | multi-gallery |
| Getwid – Gutenberg Blocks | getwid |
| GiveWP – Donation Plugin and Fundraising Platform | give |
| Gold Addons for Elementor | gold-addons-for-elementor |
| Goodlayers Core | goodlayers-core |
| GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets | gs-pinterest-portfolio |
| Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor | gutentor |
| IdeaPush | ideapush |
| If Menu – Visibility control for Menus | if-menu |
| Import Export For WooCommerce | import-export-for-woocommerce |
| Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free | funnelforms-free |
| Intro Tour Tutorial DeepPresentation | dp-intro-tours |
| jAlbum Bridge | jalbum-bridge |
| Jetpack – WP Security, Backup, Speed, & Growth | jetpack |
| KiviCare – Clinic & Patient Management System (EHR) | kivicare-clinic-management-system |
| Knowledge Base documentation & wiki plugin – BasePress Docs | basepress |
| LA-Studio Element Kit for Elementor | lastudio-element-kit |
| Library Management System | library-management-system |
| Limit Login Attempts (Spam Protection) | wp-limit-failed-login-attempts |
| Listdom: AI-powered Business Directory with Classifieds Ads Listings | listdom |
| Login Widget With Shortcode | login-sidebar-widget |
| Login with OTP | otp-login |
| Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) | magical-addons-for-elementor |
| Maspik – Ultimate Spam Protection | contact-forms-anti-spam |
| Message Filter for Contact Form 7 | cf7-message-filter |
| Mini Program API | wp-mini-program |
| Minimum and Maximum Quantity for WooCommerce | min-and-max-quantity-for-woocommerce |
| Mollie for Contact Form 7 | cf7-mollie |
| My auctions allegro | my-auctions-allegro-free-edition |
| Namaste! LMS | namaste-lms |
| News Kit Addons For Elementor | news-kit-elementor-addons |
| NEX-Forms – Ultimate Forms Plugin for WordPress | nex-forms-express-wp-form-builder |
| Next-Cart Store to WooCommerce Migration | nextcart-woocommerce-migration |
| Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder | the-plus-addons-for-block-editor |
| Ni CRM Lead | ni-crm-lead |
| Ni WooCommerce Bulk Product Editor | ni-woocommerce-product-editor |
| Ni WooCommerce Order Export | ni-woocommerce-order-export |
| NPS computy | nps-computy |
| Online Booking & Scheduling Calendar for WordPress by vcita | meeting-scheduler-by-vcita |
| ONLYOFFICE Docs | onlyoffice |
| Paloma Widget | postman-widget |
| PDF Builder for WooCommerce. Create invoices,packing slips and more | woo-pdf-invoice-builder |
| Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | nextgen-gallery |
| Pie Forms — Drag & Drop Form Builder | pie-forms-for-wp |
| Pie Register - Social Sites Login (Add on) | pie-register-social-site |
| Pie Register Premium | pie-register-premium |
| Pinpoint Booking System – Version 2 | booking-system |
| Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred | mycred |
| Pojo Forms | pojo-forms |
| Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls | poll-maker |
| Post Grid Gutenberg Blocks – PostX | ultimate-post |
| Posti Shipping | posti-shipping |
| PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) | powerpack-lite-for-elementor |
| Prodigy Commerce | prodigy-commerce |
| Product Labels For Woocommerce (Sale Badges) | aco-product-labels-for-woocommerce |
| Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker | wedevs-project-manager |
| Pulsating Chat Button | amin-chat-button |
| Quick License Manager – WooCommerce Plugin | quick-license-manager |
| Related Posts By PickPlugins | related-post |
| Responsive Lightbox & Gallery | responsive-lightbox |
| Responsive Videos | responsive-youtube-videos |
| Revy | revy |
| RRAddons for Elementor | rrdevs-for-elementor |
| s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions | s2member |
| Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more | scratch-win-giveaways-for-website-facebook |
| SearchIQ – The Search Solution | searchiq |
| SG Helper | sg-helper |
| Shipping by Weight for WooCommerce | dn-shipping-by-weight |
| Shiptimize for WooCommerce | shiptimize-for-woocommerce |
| Shortcodes Blocks Creator Ultimate | ultimate-shortcodes-creator |
| Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal | simple-e-commerce-shopping-cart |
| Simple Notification | simple-notification |
| Simple Redirection | eelv-redirection |
| Simple User Registration | wp-registration |
| Smart PopUp Blaster | smart-popup-blaster |
| Smoove connector for Elementor forms | smoove-elementor |
| SMS for Lead Capture Forms | clicksend-lead-capture-form |
| Spectra Gutenberg Blocks – Website Builder for the Block Editor | ultimate-addons-for-gutenberg |
| Splash Sync | splash-connector |
| Sprout Invoices – Client Invoicing & Estimates | sprout-invoices |
| Stars Testimonials — Responsive Reviews & Star Ratings | stars-testimonials-with-slider-and-masonry-grid |
| SV100 Companion | sv100-companion |
| Swift Performance Lite | swift-performance-lite |
| TAX SERVICE Electronic HDM | virtual-hdm-for-taxservice-am |
| The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce | the-plus-addons-for-elementor-page-builder |
| Themesflat Addons For Elementor | themesflat-addons-for-elementor |
| TI WooCommerce Wishlist | ti-woocommerce-wishlist |
| Tutor LMS Elementor Addons | tutor-lms-elementor-addons |
| TWChat – Send or receive messages from users | twchat |
| TwentyTwenty | twentytwenty |
| Ultimate Coming Soon Page, Maintenance Mode & Under Construction – Gutenberg Block Builder & Landing Page | ultimate-coming-soon |
| Unlock Addons for Elementor | unlock-addons-for-elementor |
| Verowa Connect | verowa-connect |
| Video Gallery – YouTube Gallery, Vimeo, Video Portfolio, Image Portfolio and Image Gallery | gallery-videos |
| Visual Portfolio, Photo Gallery & Post Grid | visual-portfolio |
| WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder | wdesignkit |
| WIP WooCarousel Lite | wip-woocarousel-lite |
| WordPress Auction Plugin | wp-auctions |
| Wot Elementor Widgets | wot-elementor-widgets |
| WP eCards – Branded Digital Greeting Cards | wp-ecards-invites |
| WP GeoNames | wp-geonames |
| WP Hide & Security Enhancer | wp-hide-security-enhancer |
| WP Job Manager – Company Profiles | wp-job-manager-companies |
| WP Mailster | wp-mailster |
| WP Media Optimizer (.webp) | wp-media-optimizer-webp |
| WP Private Content Plus | wp-private-content-plus |
| WP System | wp-system |
| WP Travel – Ultimate Travel Booking System, Tour Management Engine | wp-travel |
| WP Umbrella: Update Backup Restore & Monitoring | wp-health |
| wp-publications | wp-publications |
| WP-SVG | wp-svg |
| WPBITS Addons For Elementor Page Builder | wpbits-addons-for-elementor |
| WPC Smart Quick View for WooCommerce | woo-smart-quick-view |
| WPCasa – Real Estate for WordPress | wpcasa |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| XLTab – Accordions and Tabs for Elementor Page Builder | xl-tab |
| Xpro Addons — 140+ Widgets for Elementor | xpro-elementor-addons |
| Z-Downloads | z-downloads |
| Zion Builder – Website Builder for Speed & Creativity | zionbuilder |
| Zooom | zooom |
| افزونه پیامک ووکامرس Persian WooCommerce SMS | persian-woocommerce-sms |
| 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 | pgall-for-woocommerce |
| 코드엠샵 소셜톡 | mshop-naver-talktalk |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Blocksy | blocksy |
| Flixita | flixita |
| NewsMash | newsmash |
| NewsMunch | newsmunch |
| Pubnews | pubnews |
| Soledad | soledad |
| Sweet Date | sweetdate |
| Tydskrif | tydskrif |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Import Export For WooCommerce [import-export-for-woocommerce]
Researcher
Affected Software
Eyewear prescription form [eyewear-prescription-form]
Researcher
Affected Software
Pie Register Premium [pie-register-premium]
Researcher
Affected Software
SV100 Companion [sv100-companion]
Researcher
Affected Software
Sweet Date [sweetdate]
Researcher
WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
9.8
Affected Software
WP Umbrella: Update Backup Restore & Monitoring [wp-health]
Researcher
Affected Software
Simple User Registration [wp-registration]
Researcher
Affected Software
Accessibility by AllAccessible [allaccessible]
Researcher
Affected Software
AI Quiz | Quiz Maker [ai-quiz]
Researcher
Affected Software
All Bootstrap Blocks [all-bootstrap-blocks]
Researcher
Affected Software
Designer – Elementor Addons [designer]
Researcher
Affected Software
eewee admin custom [eewee-admincustom]
Researcher
Affected Software
Stars Testimonials — Responsive Reviews & Star Ratings [stars-testimonials-with-slider-and-masonry-grid]
Researcher
Affected Software
Researcher
Affected Software
Gallery [multi-gallery]
Researcher
Affected Software
Pubnews [pubnews]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
FAT Services Booking [fat-services-booking]
Researcher
Affected Software
Login with OTP [otp-login]
Researcher
Affected Software
Pie Register - Social Sites Login (Add on) [pie-register-social-site]
Researcher
Affected Software
Researcher
Affected Software
Swift Performance Lite [swift-performance-lite]
Researcher
Affected Software
Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution [file-manager-advanced]
Researcher
Affected Software
Beautiful taxonomy filters [beautiful-taxonomy-filters]
Researcher
Affected Software
Classic Addons – WPBakery Page Builder [classic-addons-wpbakery-page-builder-addons]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
Limit Login Attempts (Spam Protection) [wp-limit-failed-login-attempts]
Researcher
Affected Software
TAX SERVICE Electronic HDM [virtual-hdm-for-taxservice-am]
Researcher
Affected Software
TI WooCommerce Wishlist [ti-woocommerce-wishlist]
Researcher
Affected Software
Verowa Connect [verowa-connect]
Researcher
Affected Software
WordPress Auction Plugin [wp-auctions]
Researcher
Affected Software
WP Hide & Security Enhancer [wp-hide-security-enhancer]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Authors List <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax
7.3
Affected Software
Authors List [authors-list]
Researcher
Affected Software
AIO Contact [aio-contact]
Researcher
Affected Software
FileOrganizer – WordPress File Manager [fileorganizer]
Researcher
Affected Software
Researcher
YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection
7.2
Affected Software
Researcher
Affected Software
Easy Blocks pro [easy-blocks-pro]
Researcher
Affected Software
Library Management System [library-management-system]
Researcher
Affected Software
AIO Contact [aio-contact]
Researcher
Affected Software
Contact Form, Survey, Quiz & Popup Form Builder – ARForms [arforms-form-builder]
Researcher
BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter
6.5
Affected Software
BP Profile Shortcodes Extra [bp-profile-shortcodes-extra]
Researcher
Affected Software
DELUCKS SEO [delucks-seo]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
KiviCare – Clinic & Patient Management System (EHR) [kivicare-clinic-management-system]
Researcher
Affected Software
Ni CRM Lead [ni-crm-lead]
Researcher
Affected Software
Pinpoint Booking System – Version 2 [booking-system]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker [wedevs-project-manager]
Researcher
Affected Software
Researcher
Affected Software
Xpro Addons — 140+ Widgets for Elementor [xpro-elementor-addons]
Researcher
Affected Software
ABCBiz Addons for Elementor [abcbiz-addons]
Researcher
Affected Software
Advanced Element Bucket Addons for Elementor [cs-element-bucket]
Researcher
Affected Software
Arkhe Blocks [arkhe-blocks]
Researcher
Affected Software
B Testimonial – Customer Testimonials in Custom Layouts [b-testimonial]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
BMLT Tabbed Map [bmlt-tabbed-map]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
Captivate Sync <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
6.4
Affected Software
Captivate Sync [captivatesync-trade]
Researcher
Affected Software
CMSMasters Elementor Addon [cmsmasters-elementor-addon]
Researcher
Affected Software
Contact Form Builder by vcita [contact-form-with-a-meeting-scheduler-by-vcita]
Researcher
Affected Software
Contact Form, Survey & Form Builder – MightyForms [mightyforms]
Researcher
Affected Software
Cookielay [cookielay]
Researcher
Affected Software
Easy Replace [easy-replace]
Researcher
Affected Software
Element Pack – Widgets, Templates & Addons for Elementor [bdthemes-element-pack-lite]
Researcher
Affected Software
ElementsReady Addons for Elementor [element-ready-lite]
Researcher
Affected Software
Email Address Obfuscation [email-address-obfuscation]
Researcher
Affected Software
FAT Services Booking [fat-services-booking]
Researcher
Flower Delivery by Florist One <= 3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Flower Delivery by Florist One [flower-delivery-by-florist-one]
Researcher
Affected Software
Futurio Extra [futurio-extra]
Researcher
Affected Software
Researcher
jAlbum Bridge <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter
6.4
Affected Software
jAlbum Bridge [jalbum-bridge]
Researcher
Affected Software
Researcher
Magical Addons For Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) [magical-addons-for-elementor]
Researcher
Affected Software
Mini Program API [wp-mini-program]
Researcher
Affected Software
Responsive Lightbox & Gallery [responsive-lightbox]
WPC Smart Quick View for WooCommerce [woo-smart-quick-view]
Accordion Slider [accordion-slider]
FV Flowplayer Video Player [fv-wordpress-flowplayer]
Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More [envira-gallery-lite]
Colibri Page Builder [colibri-page-builder]
Visual Portfolio, Photo Gallery & Post Grid [visual-portfolio]
Getwid – Gutenberg Blocks [getwid]
Firelight Lightbox [easy-fancybox]
FancyBox for WordPress [fancybox-for-wordpress]
Researcher
Affected Software
Researcher
Affected Software
News Kit Addons For Elementor [news-kit-elementor-addons]
Researcher
Affected Software
NewsMash [newsmash]
Researcher
Affected Software
NewsMunch [newsmunch]
Researcher
Affected Software
ONLYOFFICE Docs [onlyoffice]
Researcher
Affected Software
Post Grid Gutenberg Blocks – PostX [ultimate-post]
Researcher
Affected Software
Responsive Videos [responsive-youtube-videos]
Researcher
Affected Software
RRAddons for Elementor [rrdevs-for-elementor]
Researcher
Affected Software
Scratch & Win – Giveaways and Contests. Boost subscribers, traffic, repeat visits, referrals, sales and more [scratch-win-giveaways-for-website-facebook]
Researcher
SearchIQ – The Search Solution <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
SearchIQ – The Search Solution [searchiq]
Researcher
Affected Software
Depicter — Popup & Slider Builder [depicter]
Researcher
Affected Software
Smart PopUp Blaster [smart-popup-blaster]
Researcher
Affected Software
Spectra Gutenberg Blocks – Website Builder for the Block Editor [ultimate-addons-for-gutenberg]
Researcher
Affected Software
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce [the-plus-addons-for-elementor-page-builder]
Researcher
Themesflat Addons For Elementor <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Themesflat Addons For Elementor [themesflat-addons-for-elementor]
Researcher
Affected Software
TwentyTwenty [twentytwenty]
Researcher
Affected Software
Unlock Addons for Elementor [unlock-addons-for-elementor]
Researcher
Affected Software
WIP WooCarousel Lite [wip-woocarousel-lite]
Researcher
Affected Software
Zion Builder – Website Builder for Speed & Creativity [zionbuilder]
Researcher
Affected Software
GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets [gs-pinterest-portfolio]
Researcher
Affected Software
Wot Elementor Widgets [wot-elementor-widgets]
Researcher
Affected Software
WP eCards – Branded Digital Greeting Cards [wp-ecards-invites]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
WP-SVG [wp-svg]
Researcher
Affected Software
WPBITS Addons For Elementor Page Builder [wpbits-addons-for-elementor]
Researcher
Affected Software
코드엠샵 소셜톡 [mshop-naver-talktalk]
Researcher
Affected Software
Researcher
Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce <= 1.5 - Missing Authorization
6.3
Affected Software
Elite Notification – Sales Popup, Social Proof, FOMO Notification for WooCommerce [elite-notification]
Researcher
Affected Software
Pinpoint Booking System – Version 2 [booking-system]
Researcher
Affected Software
Pojo Forms [pojo-forms]
Researcher
Affected Software
Accounting for WooCommerce [accounting-for-woocommerce]
Researcher
Affected Software
Additional Custom Order Status for WooCommerce [order-status-for-woocommerce]
Researcher
Affected Software
Advanced Control Manager for WordPress by ItalyStrap [advanced-control-manager]
Researcher
Affected Software
Awesome Shortcodes [awesome-shortcodes]
Researcher
Affected Software
Blaze Online eParcel for WooCommerce [blaze-online-eparcel-for-woocommerce]
Researcher
Affected Software
Block Controller [block-controller]
Researcher
Affected Software
Board Document Manager from CHUHPL [board-document-manager-from-chuhpl]
Researcher
Affected Software
Campaign Monitor Forms by Optin Cat [campaign-monitor-wp]
Researcher
Affected Software
CardGate Payments for WooCommerce [cardgate]
Researcher
Affected Software
Clickbank WordPress Plugin (Storefront) [clickbank-storefront]
Researcher
Affected Software
Comfino Payment Gateway [comfino-payment-gateway]
Researcher
Affected Software
Country Blocker [country-blocker]
Researcher
Affected Software
Pie Forms — Drag & Drop Form Builder [pie-forms-for-wp]
Researcher
Affected Software
Easy Code Snippets [easy-code-snippets]
Researcher
Affected Software
Exhibit to WP Gallery [exhibit-to-wp-gallery]
Researcher
Feedpress Generator – External RSS Frontend Customizer <= 1.2.1 - Reflected Cross-Site Scripting
6.1
Affected Software
Feedpress Generator – External RSS Frontend Customizer [feedpress-generator]
Researcher
Affected Software
Folder Gallery [folder-gallery]
Researcher
Affected Software
Form Data Collector [form-data-collector]
Researcher
Affected Software
ForumWP – Forum & Discussion Board [forumwp]
Researcher
Affected Software
ForumWP – Forum & Discussion Board [forumwp]
Researcher
Affected Software
Researcher
Affected Software
Goodlayers Core [goodlayers-core]
Researcher
Affected Software
Intro Tour Tutorial DeepPresentation [dp-intro-tours]
Researcher
Affected Software
Researcher
Affected Software
Login Widget With Shortcode [login-sidebar-widget]
Researcher
Affected Software
Mollie for Contact Form 7 [cf7-mollie]
Researcher
Affected Software
My auctions allegro [my-auctions-allegro-free-edition]
Researcher
Affected Software
Next-Cart Store to WooCommerce Migration [nextcart-woocommerce-migration]
Researcher
Affected Software
Ni WooCommerce Bulk Product Editor [ni-woocommerce-product-editor]
Researcher
Affected Software
Ni WooCommerce Order Export [ni-woocommerce-order-export]
Researcher
Affected Software
NPS computy [nps-computy]
Researcher
Affected Software
Paloma Widget [postman-widget]
Researcher
Affected Software
PDF Builder for WooCommerce. Create invoices,packing slips and more [woo-pdf-invoice-builder]
Researcher
Affected Software
Pie Register Premium [pie-register-premium]
Researcher
Affected Software
Posti Shipping [posti-shipping]
Researcher
Affected Software
Pulsating Chat Button [amin-chat-button]
Researcher
Affected Software
Quick License Manager – WooCommerce Plugin [quick-license-manager]
Researcher
Affected Software
Shiptimize for WooCommerce [shiptimize-for-woocommerce]
Researcher
Affected Software
Shortcodes Blocks Creator Ultimate [ultimate-shortcodes-creator]
Researcher
Affected Software
Shortcodes Blocks Creator Ultimate [ultimate-shortcodes-creator]
Researcher
Affected Software
Shortcodes Blocks Creator Ultimate [ultimate-shortcodes-creator]
Researcher
Affected Software
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal [simple-e-commerce-shopping-cart]
Researcher
Affected Software
Smoove connector for Elementor forms [smoove-elementor]
Researcher
Affected Software
Splash Sync [splash-connector]
Researcher
Affected Software
Researcher
Affected Software
Tydskrif [tydskrif]
Researcher
Affected Software
WP GeoNames [wp-geonames]
Researcher
Affected Software
WP Job Manager – Company Profiles [wp-job-manager-companies]
Researcher
Affected Software
WP Media Optimizer (.webp) [wp-media-optimizer-webp]
Researcher
Affected Software
افزونه پیامک ووکامرس Persian WooCommerce SMS [persian-woocommerce-sms]
Researcher
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 <= 5.2.2 - Reflected Cross-Site Scripting via add_query_arg Function
6.1
Affected Software
워드프레스 결제 심플페이 – 우커머스 결제 플러그인 [pgall-for-woocommerce]
Researcher
Affected Software
Borderless – Addons and Templates for Elementor [borderless]
Researcher
Affected Software
Broken Link Checker [broken-link-checker]
Researcher
SG Helper <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
5.5
Affected Software
SG Helper [sg-helper]
Researcher
Affected Software
WordPress Auction Plugin [wp-auctions]
Researcher
Affected Software
Event Tickets with Ticket Scanner [event-tickets-with-ticket-scanner]
Researcher
Affected Software
FloristPress for Woo – Customize your eCommerce store for your Florist [bakkbone-florist-companion]
Researcher
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita [meeting-scheduler-by-vcita]
Researcher
Affected Software
Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal [simple-e-commerce-shopping-cart]
Researcher
Affected Software
Simple Notification [simple-notification]
Researcher
Affected Software
Church Admin [church-admin]
Researcher
Affected Software
Sprout Invoices – Client Invoicing & Estimates [sprout-invoices]
Researcher
Affected Software
Connexion Logs [logs-de-connexion]
Researcher
Affected Software
If Menu – Visibility control for Menus [if-menu]
Researcher
Affected Software
Minimum and Maximum Quantity for WooCommerce [min-and-max-quantity-for-woocommerce]
Researcher
Affected Software
Related Posts By PickPlugins [related-post]
Researcher
Affected Software
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
WP Private Content Plus [wp-private-content-plus]
Researcher
Affected Software
WPCasa – Real Estate for WordPress [wpcasa]
Researcher
Affected Software
AWeber Forms by Optin Cat [aweber-wp]
Researcher
Affected Software
Connexion Logs [logs-de-connexion]
Researcher
Affected Software
NEX-Forms – Ultimate Forms Plugin for WordPress [nex-forms-express-wp-form-builder]
Researcher
Affected Software
Product Labels For Woocommerce (Sale Badges) [aco-product-labels-for-woocommerce]
Researcher
Affected Software
float block [float-block]
Researcher
Affected Software
Researcher
Affected Software
wp-publications [wp-publications]
Researchers
Affected Software
Researcher
Affected Software
Z-Downloads [z-downloads]
Researcher
Affected Software
Researcher
Affected Software
Dynific Addons for Elementor (formerly AnyWhere Elementor) [anywhere-elementor]
Researcher
Affected Software
Charity Addon for Elementor [charity-addon-for-elementor]
Researcher
Affected Software
CLUEVO LMS, E-Learning Platform [cluevo-lms]
Researcher
Affected Software
Shipping by Weight for WooCommerce [dn-shipping-by-weight]
Researcher
Affected Software
Dollie AI – Connect [dollie]
Researcher
Affected Software
Eleblog – Elementor Blog And Magazine Addons [ele-blog]
Researcher
Affected Software
Researcher
Affected Software
FloristPress for Woo – Customize your eCommerce store for your Florist [bakkbone-florist-companion]
Researcher
Affected Software
Gold Addons for Elementor [gold-addons-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
LA-Studio Element Kit for Elementor [lastudio-element-kit]
Researcher
Affected Software
Maspik – Ultimate Spam Protection [contact-forms-anti-spam]
Researcher
Affected Software
Message Filter for Contact Form 7 [cf7-message-filter]
Researcher
Affected Software
Message Filter for Contact Form 7 [cf7-message-filter]
Researcher
Affected Software
Message Filter for Contact Form 7 [cf7-message-filter]
Researcher
Affected Software
Namaste! LMS [namaste-lms]
Researcher
Affected Software
Researcher
Affected Software
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) [powerpack-lite-for-elementor]
Researcher
Affected Software
Prodigy Commerce [prodigy-commerce]
Researcher
Affected Software
Prodigy Commerce [prodigy-commerce]
Researcher
Affected Software
Simple Redirection [eelv-redirection]
Researcher
Affected Software
SMS for Lead Capture Forms [clicksend-lead-capture-form]
Researcher
Affected Software
Tutor LMS Elementor Addons [tutor-lms-elementor-addons]
Researcher
Affected Software
Researcher
Affected Software
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments