Wordfence Intelligence Weekly WordPress Vulnerability Report (December 9, 2024 to December 15, 2024)
💥 Time to wrap up this year and kick-off the new year with a bang! We’re wrapping up the year with our End of Year Holiday Extravaganza, High-Risk Bonus Blitz Challenge, and Superhero Challenge for the Wordfence Bug Bounty Program. Through January 6th, 2025:
- All in-scope vulnerability types for WordPress plugins/themes with >= 1,000 active installations are in-scope for ALL researchers
- All plugins and themes with 50-999 active installs hosted in the WordPress.org repository and updated within the last 2 years are in-scope for all researchers!
- All plugins and themes hosted in the WordPress.org repository with any install count are in scope for our preset list of high threat vulnerabilities.
- $150 bonus awarded when a researcher submits at least 15 valid high threat vulnerabilities, and then a $50 bonus awarded for every 5 submitted thereafter.
- Minimum bounty of $5 for all valid in-scope submissions.
- All researchers earn automatic bonuses of between 5% to 180% for valid submissions
- Pending report limits are increased for all
- It’s possible to earn up to $31,200 for high impact vulnerabilities!
Last week, there were 381 vulnerabilities disclosed in 355 WordPress Plugins and 8 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 73 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 21,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- s2Member (Pro) <= 241114 – Unauthenticated Remote Code Execution
- WAF-RULE-783 – Data redacted while we work with the vendor on a patch.
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 225 |
| Unpatched | 156 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 2 |
| Medium Severity | 303 |
| High Severity | 49 |
| Critical Severity | 27 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 161 |
| Cross-Site Request Forgery (CSRF) | 72 |
| Missing Authorization | 61 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 32 |
| Exposure of Sensitive Information to an Unauthorized Actor | 8 |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 8 |
| Improper Control of Generation of Code ('Code Injection') | 8 |
| Authorization Bypass Through User-Controlled Key | 6 |
| Unrestricted Upload of File with Dangerous Type | 5 |
| Deserialization of Untrusted Data | 4 |
| Improper Privilege Management | 4 |
| Improper Access Control | 3 |
| Improper Authentication | 2 |
| Server-Side Request Forgery (SSRF) | 2 |
| Authentication Bypass Using an Alternate Path or Channel | 1 |
| Exposure of Private Personal Information to an Unauthorized Actor | 1 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 |
| Path Traversal: '/../filedir' | 1 |
| Uncontrolled Resource Consumption | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 66 | |
| 33 | |
| 24 | |
| 19 | |
| 18 | |
| 15 | |
| 14 | |
| 11 | |
| 11 | |
| 9 | |
| 8 | |
| 7 | |
| 7 | |
| 7 | |
| 7 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 6 | |
| 4 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 360 Javascript Viewer | 360deg-javascript-viewer |
| 3D Avatar User Profile | 3d-avatar-user-profile |
| Accept Stripe Payments Using Contact Form 7 | accept-stripe-payments-using-contact-form-7 |
| Active Products Tables for WooCommerce. Use constructor to create tables | profit-products-tables-for-woocommerce |
| Add image to Post | add-image-to-post |
| Add infos to The Events Calendar | add-infos-to-the-events-calendar |
| addWeather | myweather |
| Admin Customization | wpp-customization |
| Advanced Blog Post Block | advanced-blog-post-block |
| Advanced Fancybox | advanced-fancybox |
| Advanced Menu Manager Pro – Built for Content-heavy WordPress Sites to Add, Filter, Lock, and Edit Menus Easily | advance-menu-manager |
| Advanced What should we write next about | advanced-what-should-we-write-about-next |
| AHAthat Plugin | ahathat |
| AI Post Generator | AutoWriter | ai-post-generator |
| AIcomments – комментарии и отзывы ChatGPT | aicomments |
| AIKCT Engine Chatbot | ai-seo-translator |
| Amazon Product Price | amazon-product-price |
| Analytics Cat – Google Analytics Made Easy | analytics-cat |
| Aphorismus | aphorismus |
| AppMaps | appmaps |
| Appsplate | appsplate |
| AR for WordPress | ar-for-wordpress |
| Arabic Webfonts | arabic-webfonts |
| Arena.IM – Live Blogging for real-time events | arena-liveblog-and-chat-tool |
| AutoWP – AI Content Writer & Rewriter | autowp-ai-content-writer-rewriter |
| Awesome FAQ – Modern Accordion, Tabs, Responsive & Super Fast FAQ Builder | faq-and-answers |
| Awesome Support – WordPress HelpDesk & Support Plugin | awesome-support |
| Axeptio – Cookie Banner – GDPR Consent & Compliance with a friendly touch | axeptio-sdk-integration |
| Banner System | banner-system |
| Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) | barcode-scanner-lite-pos-to-manage-products-inventory-and-orders |
| Beaver Builder Page Builder – Drag and Drop Website Builder | beaver-builder-lite-version |
| Bet sport Free | bet-sport-free |
| Better WP Login Page | better-wp-login-page |
| bodi0`s Easy cache | bodi0s-easy-cache |
| Bold Page Builder | bold-page-builder |
| Booking System Trafft | booking-system-trafft |
| Bootstrap Buttons | bootstrap-buttons |
| BP Email Assign Templates | bp-email-assign-templates |
| Buk for WordPress | buk-appointments |
| Bukza | bukza |
| Caldera SMTP Mailer | caldera-smtp-mailer |
| Car Dealer (Dealership) and Vehicle sales | cardealer |
| CarDealerPress | cardealerpress |
| Catch Popup | catch-popup |
| Category of Posts | list-one-category-of-posts |
| CE21 Suite | ce21-suite |
| Check Pincode For WooCommerce | check-pincode-for-woocommerce |
| Child Theme Creator by Orbisius | orbisius-child-theme-creator |
| CK and SyntaxHighlighter | ck-and-syntaxhighlighter |
| CleverNode Related Content | clevernode-related-content |
| CM Answers – Discussion Forum Plugin for WordPress Q&A | cm-answers |
| Code Generator Pro | code-generator-pro |
| Cognito Forms | cognito-forms |
| Comments On Feed | comments-on-feed |
| Companion Portfolio – Responsive Portfolio Plugin | companion-portfolio |
| Connatix Video Embed | connatix-video-embed |
| Connect Contact Form 7 to Constant Contact V3 | connect-contact-form-7-to-constant-contact-v3 |
| Contact Form, Survey & Form Builder – MightyForms | mightyforms |
| Cookie Banner for GDPR / CCPA – WPLP Cookie Consent | gdpr-cookie-consent |
| CoSchool LMS – A complete Learning Management System to Create and Sell Your Courses Online | coschool |
| Country Blocker | country-blocker |
| Coupon Affiliates – Affiliate Plugin for WooCommerce | woo-coupon-usage |
| Crafthemes Demo Import | crafthemes-demo-import |
| Cricket Live Score | cricket-score |
| CRUDLab Google Plus Button | crudlab-google-plus |
| Cryptocurrency Price Widget | cryptocurrency-price-widget |
| CSV to HTML | csv-to-html |
| Currency Converter Widget ⚡ PRO | currency-converter-widget-pro |
| Custom Skins Contact Form 7 | custom-skins-contact-form-7 |
| de:branding | debranding |
| dejure.org Vernetzungsfunktion | dejureorg-vernetzungsfunktion |
| Device Detector | device-detector |
| Display Future Posts | display-future-posts |
| Dr Affiliate | dr-affiliate |
| DTC Documents | dtc-documents |
| DX Dark Site | devrix-dark-site |
| Easy Site Importer | easy-site-importer |
| EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder | eazydocs |
| ECT Product Carousel | ect-product-carousel |
| ECT Social Share | ect-social-share |
| EduAdmin Booking | eduadmin-booking |
| EELV Newsletter | eelv-newsletter |
| ElementInvader Addons for Elementor | elementinvader-addons-for-elementor |
| Email Reminders | email-reminders |
| Essential Real Estate | essential-real-estate |
| eTemplates | etemplates |
| Eveeno | eveeno |
| Events Addon for Elementor | events-addon-for-elementor |
| Evernote Sync | evernote-sync |
| Falcon – WordPress Optimizations & Tweaks | falcon |
| Fancy Roller Scroller | fancy-roller-scroller |
| Feedpress Generator – External RSS Frontend Customizer | feedpress-generator |
| Filestack WP Upload | filestack-upload |
| Firebase OTP Authentication | authentication-via-otp-using-firebase |
| Flaming Forms | flaming-forms |
| Flash News / Post (Responsive) | flashnews-fading-effect-pearlbells |
| Floating Video Player | floating-player |
| FloristPress for Woo – Customize your eCommerce store for your Florist | bakkbone-florist-companion |
| Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | fluentform |
| FooGallery Premium | foogallery-premium |
| FormFacade – Embed Google Forms in your website | formfacade |
| ForumWP – Forum & Discussion Board | forumwp |
| Frontend Admin by DynamiApps | acf-frontend-form-element |
| FULL – Cliente | full-customer |
| Ganohrs Toggle Shortcode | ganohrs-toggle-shortcode |
| Gaxx Keywords | gaxx-keywords |
| GEO my WP | geo-my-wp |
| Geocache Stat Bar Widget | geocache-stat-bar-widget |
| GeoDataSource Country Region DropDown | geodatasource-country-region-dropdown |
| GeoFlickr | geoflickr |
| Geoportail Shortcode | geoportail-shortcode |
| Get Post Content Shortcode | get-post-content-shortcode |
| GitSync | git-sync |
| glomex oEmbed | glomex-oembed |
| Go Animate | goanimate |
| Gou Manage My Account Menu – User Roles | gou-wc-account-tabs |
| Greenshift – animation and page builder blocks | greenshift-animation-and-page-builder-blocks |
| Grid Plus – Unlimited grid layout | grid-plus |
| GS Books Showcase – Display Books in Grid, Slider & More | Library for WordPress | gs-books-showcase |
| GS Portfolio – WordPress Portfolio Plugin with Filterable Portfolio Grid and Portfolio Slider | gs-portfolio |
| Gutenberg Blocks and Page Layouts – Attire Blocks | attire-blocks |
| Gutensee | gutensee |
| Hack-Info | hack-info |
| Hash Form – Drag & Drop Form Builder | hash-form |
| Hello Event Widgets For Elementor | hello-event-widgets-for-elementor |
| Hello In All Languages | hello-in-all-languages |
| Hive Support | AI-Powered Help Desk, Live Chat and Chatbot | hive-support |
| Horizontal scroll image slideshow | horizontal-scroll-image-slideshow |
| HostFact bestelformulier integratie | hostfact-bestelformulier-integratie |
| HQ Rental Software | hq-rental-software |
| Hunk Companion | hunk-companion |
| Hurrakify | hurrakify |
| I Plant A Tree | i-plant-a-tree |
| ICDSoft Reseller Store | icdsoft-reseller-store |
| iChart – Easy Charts and Graphs | ichart |
| IDer Login for WordPress | ider-login |
| ImageRecycle pdf & image compression | imagerecycle-pdf-image-compression |
| ImmoToolBox Connect | immotoolbox-connect |
| Import Eventbrite Events | import-eventbrite-events |
| IMS Countdown | ims-countdown |
| Increase Sociability | increase-sociability |
| Insertify – Ad,HTML,CSS,JS,PHP,PDF,Header & Footer | insertify |
| Instant Appointment | instant-appointment |
| Integrate Firebase | integrate-firebase |
| J&T Express Malaysia | jt-express |
| jCarousel for WordPress | jcarousel-for-wordpress |
| Jet Footer Code | jet-footer-code |
| Job Board Manager | job-board-manager |
| KH Easy User Settings | kh-easy-user-settings |
| Koalendar – Easy Appointment Scheduling & Booking Plugin | koalendar-free-booking-widget |
| Kredeum NFTs, the easiest way to sell your NFTs directly on your WordPress site | kredeum-nfts |
| Ksher | ksher-payment |
| Kundgenerator | kundgenerator |
| kvCORE IDX | kvcore-idx |
| LabelGrid Tools | label-grid-tools |
| Last Viewed Posts by WPBeginner | last-viewed-posts |
| LaunchPage.app Importer | launchpage-app-importer |
| LDD Directory Lite | ldd-directory-lite |
| Leader | leader |
| LeaderBoard Plugin | leaderboard-lite |
| LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | learnpress |
| Library Bookshelves | library-bookshelves |
| Library Management System | library-management-system |
| Like in Vk.com | like-on-vkontakte |
| Link Invoice Payment for WooCommerce | invoice-payment-for-woocommerce |
| LionScripts: Site Maintenance & Noindex Nofollow Plugin | maintenance-and-noindex-nofollow |
| ListApp Mobile Manager | listapp-mobile-manager |
| MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites | mainwp-child |
| Mandrill WP – Email Form Under Post | email-form-under-post |
| Mark New Posts | mark-new-posts |
| MDC Comment Toolbar | mdc-comment-toolbar |
| Media Downloader | media-downloader |
| Members – Membership & User Role Editor Plugin | members |
| Metrika | metrika |
| Mimoos | devoluciones-packback |
| Minify HTML | minify-html-markup |
| Minterpress | minterpress |
| Mollie for Contact Form 7 | cf7-mollie |
| MStore API – Create Native Android & iOS Apps On The Cloud | mstore-api |
| Multiple Admin Emails | multiple-admin-emails |
| My IDX Home Search | my-idx-home-search |
| My WP Customize Admin/Frontend | my-wp |
| MyParcel | woocommerce-myparcel |
| Nabz Image Gallery | nabz-image-gallery |
| Navayan CSV Export | navayan-csv-export |
| New User Approve | new-user-approve |
| News Ticker for Elementor | news-ticker-for-elementor |
| Newsletter Subscriptions | newsletter-subscriptions |
| NewsmanApp | newsmanapp |
| Nias course | دوره ساز نیاس | nias-course |
| NiceJob | nicejob |
| Ninja Forms – The Contact Form Builder That Grows With You | ninja-forms |
| Notibar – Notification Bar for WordPress | notibar |
| NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar | notificationx |
| OAuth Single Sign On – SSO (OAuth Client) | miniorange-login-with-eve-online-google-facebook |
| Online Booking & Scheduling Calendar for WordPress by vcita | meeting-scheduler-by-vcita |
| ONLYOFFICE DocSpace | onlyoffice-docspace |
| Onlywire Multi Autosubmitter | onlywire-multi-autosubmitter |
| Opt-In Downloads | halfdata-optin-downloads |
| Order Delivery & Pickup Location Date Time ( Free Version ) | order-delivery-pickup-location-date-time-free-version |
| Out of the Block: OpenStreetMap | ootb-openstreetmap |
| Password for WP | password-for-wp |
| Payment Gateway Per Product for WooCommerce | woocommerce-product-payments |
| PDF Generator for Posts & Pages – Export Any Post Type to PDF | post-to-pdf |
| PeproDev WooCommerce Receipt Uploader | pepro-bacs-receipt-upload-for-woocommerce |
| Perfect Font Awesome Integration | perfect-font-awesome-integration |
| phZoom Plugin for WordPress | phzoom |
| PickPlugins Mail Picker — Email Marketing & Newsletters | mail-picker |
| PixProof – Easy Photo Proofing for Photographers | pixproof |
| Planaday API | planaday-api |
| Plezi | plezi |
| Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls | poll-maker |
| Poll, Poll Forms – WordPress Poll plugin by Poll Builder | poll-builder |
| Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder | popup-maker |
| Popup Surveys & Polls for WordPress (Mare.io) | popup-surveys |
| Post Carousel & Slider | post-types-carousel-slider |
| Posti Shipping | posti-shipping |
| Posts and Products Views for WooCommerce | posts-and-products-views |
| Posts Date Ranges | posts-date-ranges |
| PowerBI Embed Reports | embed-power-bi-reports |
| PowerFormBuilder – Contact Form Database Manager for WordPress | power-forms-builder |
| Primary Addon for Elementor | primary-addon-for-elementor |
| Primer MyData for Woocommerce | primer-mydata |
| Print Science Designer | print-science-designer |
| Product Carousel Slider & Grid Ultimate for WooCommerce | woo-product-carousel-slider-and-grid-ultimate |
| Projectopia – Project Management Tool | projectopia-core |
| Property Hive Mortgage Calculator | property-hive-mortgage-calculator |
| Property Hive Stamp Duty Calculator | property-hive-stamp-duty-calculator |
| Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart | push-monkey-desktop-push-notifications |
| QC SEO Help for llms.txt, AI Analytics, AI Content Writer, FAQ Generator, Subtitle to Article | seo-help |
| Quietly Insights | quietly-insights |
| Quran multilanguage Text & Audio | quran-text-multilanguage |
| Quran Phrases About Most People Shortcodes | quran-phrases-about-most-people-shortcodes |
| Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player | radio-player |
| Radius Blocks – WordPress Gutenberg Blocks | radius-blocks |
| RapidLoad AI – Optimize Web Vitals Automatically | unusedcss |
| Rate My Post – Star Rating Plugin by FeedbackWP | rate-my-post |
| Responsive Filterable Portfolio Gallery – Media Grid & Video Portfolio | responsive-filterable-portfolio |
| Responsive Google Maps | by imbaa | responsive-google-maps |
| Restaurant & Cafe Addon for Elementor | restaurant-cafe-addon-for-elementor |
| Restrict – membership, site, content and user access restrictions for WordPress | restricted-content |
| Revi.io – Customer and Product Reviews | revi-io-customer-and-product-reviews |
| Role Includer | role-includer |
| Sailthru Triggermail | sailthru-triggermail |
| Saksh Escrow System | saksh-escrow-system |
| Schema App Structured Data | schema-app-structured-data-for-schemaorg |
| SeedProd Pro | seedprod-coming-soon-pro-5 |
| Seraphinite Bulk Discounts for WooCommerce | seraphinite-discount-for-woocommerce |
| Service | service |
| Share Buttons – Social Media | rich-web-share-button |
| Shortcodes for Elementor | shortcode-elementor |
| Sign In With Google | sign-in-with-google |
| Simple Booking – Widget | simple-booking-widget |
| Simple Link Directory – AI Powered | simple-link-directory |
| Simple Locator | simple-locator |
| Simple Payment | simple-payment |
| Simple Presenter | simple-presenter |
| Simple Restrict | simple-restrict |
| SIP Calculator | sip-calculator |
| SiteOrigin Widgets Bundle | so-widgets-bundle |
| Smaily for WP | smaily-for-wp |
| Smart PopUp Blaster | smart-popup-blaster |
| SmartAgenda – Prise de rendez-vous en ligne | smart-agenda-prise-de-rendez-vous-en-ligne |
| SMSify | smsify |
| Snippet Shortcodes | shortcode-variables |
| Social Media Sharing | social-media-sharing |
| Social Media Shortcodes | social-media-shortcodes |
| SOPA Blackout | sopa-blackout |
| Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate | spreadr-for-woocomerce |
| SQL Chart Builder | sql-chart-builder |
| STAGGS – Product Configurator Toolkit | staggs |
| States Map US | ymc-states-map |
| Super Backup & Clone - Migrate for WordPress | indeed-wp-superbackup |
| Surbma | SalesAutopilot Shortcode | surbma-salesautopilot-shortcode |
| SVG Shortcode | svg-shortcode |
| Table Addons for Elementor – Responsive Table Builder | advanced-data-table-for-elementor |
| Tabs Maker | tabs-maker |
| TagGator | taggator |
| TCBD Popover | tcbd-popover |
| Termin-Kalender | termin-kalender |
| The Permalinker | the-permalinker |
| Themify Store Locator | themify-store-locator |
| This is a Subversion repository; use the 'svnadmin' tool to examine | critical-site-intel-stats |
| Tickera – Sell Tickets & Manage Events | tickera-event-ticketing-system |
| Timetics – Appointment Booking Calendar & Scheduling System | timetics |
| Tithe.ly Giving Button | wp-tithely |
| Torod – The smart shipping and delivery portal for e-shops and retailers | torod |
| TSB Occasion Editor | tsb-occasion-editor |
| turboSMTP | turbosmtp |
| Ui Slider Filter By Price | ui-slider-filter-by-price |
| Ultimate Endpoints With Rest Api | custom-wp-rest-api |
| UNIVERSAM | universam-demo |
| Unlimited Elements For Elementor | unlimited-elements-for-elementor |
| Utech World Time | utech-world-time-for-wp |
| Vayu Blocks – Website Builder for the Gutenberg Block Editor | vayu-blocks |
| vBSSO-lite | vbsso-lite |
| Video & Photo Gallery for Ultimate Member | gallery-for-ultimate-member |
| Vimeography: Vimeo Video Gallery WordPress Plugin | vimeography |
| Visual Recent Posts | visual-recent-posts |
| Visualmodo Elements | visualmodo-elements |
| VPSUForm – Drag & Drop Contact Form Builder with Email Automation | v-form |
| Waymark | waymark |
| Web Stories | web-stories |
| Web3 Crypto Payments by DePay for WooCommerce | depay-payments-for-woocommerce |
| Website Toolbox Forum | website-toolbox-forums |
| WooCommerce - PDF Vouchers | woocommerce-pdf-vouchers |
| WooCommerce Basic Ordernumbers | woocommerce-basic-ordernumbers |
| Woocommerce Blocks – Woolook | woolook |
| WooCommerce Cart Count Shortcode | woo-cart-count-shortcode |
| WordPress Filter | wordpress-filter |
| WordPress HelpDesk & Support Ticket System Plugin – Octrace Support | octrace-support |
| WordPress Post Grid Layouts with Pagination – Sogrid | sogrid |
| Wovax IDX | wovax-idx |
| WP Ad Guru – Banner ad, Responsive popup, Popup maker, Ad rotator & More | wp-ad-guru |
| WP Controller | wp-management-controller |
| WP Cookies Enabler | wp-cookies-enabler |
| WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses | wp-courses |
| WP Crowdfunding | wp-crowdfunding |
| WP Currency Exchange Rates | wp-currency-exchange-rates |
| WP Email Log – PostBox | postbox-email-logs |
| WP Enabled SVG | wp-enable-svg |
| WP Fiddle | wp-fiddle |
| WP Flipkart Importer | wp-flipkart-importer |
| WP GeoNames | wp-geonames |
| WP Job Portal – AI-Powered Recruitment System for Company or Job Board website | wp-job-portal |
| WP Log Action | wp-log-action |
| Wp Login with Ajax | wp-login-with-ajax |
| WP Mailster | wp-mailster |
| WP Mega Menu | wp-megamenu |
| Wp NssUser Register | wp-nssuser-register |
| Wp photo text slider 50 | wp-photo-text-slider-50 |
| WP Pipes | wp-pipes |
| WP Quick Shop | wp-quick-shop |
| WP Service Payment Form With Authorize.net | wp-service-payment-form-with-authorizenet |
| WP Simple Pay Lite Manager | stripe-manager |
| WP-Ban-User | wp-ban-user |
| WP-CRM System – Manage Clients and Projects | wp-crm-system |
| WP-HideThat | wp-hide-that |
| WP-NERD Toolkit | wp-nerd-toolkit |
| WP-Revive Adserver | wp-revive-adserver |
| WPBookit | wpbookit |
| WPC Order Notes for WooCommerce | woo-order-notes |
| WPCargo Track & Trace | wpcargo |
| WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More | wpforms-lite |
| WPMobile.App | wpappninja |
| WP微信机器人 | wp-weixin-robot |
| Wr Age Verification | wr-age-verification |
| XML Multilanguage Sitemap Generator | xml-multilanguage-sitemap-generator |
| XPD Reduce Image Filesize | xpd-reduce-image-filesize |
| YDS Support Ticket System | yds-support-ticket-system |
| Yoo Bar – Notification, Announcement & Promo Bar for WordPress | yoo-bar |
| Youtube Video Grid | Youmax | youmax-channel-embeds-for-youtube-businesses |
| Zita Site Builder – Elementor, WordPress & Gutenberg Website Builder | ai-site-builder |
| افزونه پیامک ووکامرس Persian WooCommerce SMS | persian-woocommerce-sms |
| 畅言评论系统 | changyan |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Avada | Website Builder For WordPress & WooCommerce | Avada |
| Bicycleshop | bicycleshop |
| Brandy | brandy |
| hmd | hmd |
| Plain Post | plain-post |
| TravelTour | traveltour |
| Woffice CRM | woffice |
| Woodmart | woodmart |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
Affected Software
Axeptio – Cookie Banner – GDPR Consent & Compliance with a friendly touch [axeptio-sdk-integration]
Researcher
Affected Software
CE21 Suite [ce21-suite]
Researcher
Affected Software
Code Generator Pro [code-generator-pro]
Researcher
Affected Software
Researcher
Affected Software
This is a Subversion repository; use the 'svnadmin' tool to examine [critical-site-intel-stats]
Researcher
Affected Software
eTemplates [etemplates]
Researcher
Affected Software
Firebase OTP Authentication [authentication-via-otp-using-firebase]
Researcher
Affected Software
ForumWP – Forum & Discussion Board [forumwp]
Researcher
Affected Software
Hunk Companion [hunk-companion]
Researcher
Affected Software
LaunchPage.app Importer [launchpage-app-importer]
Researcher
Affected Software
ListApp Mobile Manager [listapp-mobile-manager]
Researcher
Affected Software
PickPlugins Mail Picker — Email Marketing & Newsletters [mail-picker]
Researcher
Affected Software
Nabz Image Gallery [nabz-image-gallery]
Researcher
Affected Software
Navayan CSV Export [navayan-csv-export]
Researcher
Affected Software
Projectopia – Project Management Tool [projectopia-core]
Researcher
Affected Software
Share Buttons – Social Media [rich-web-share-button]
Researcher
Affected Software
Sign In With Google [sign-in-with-google]
Researcher
Affected Software
Researcher
Affected Software
Super Backup & Clone - Migrate for WordPress [indeed-wp-superbackup]
Researcher
Affected Software
Researcher
Affected Software
vBSSO-lite [vbsso-lite]
Researcher
Affected Software
Woffice CRM [woffice]
Researcher
Affected Software
WooCommerce - PDF Vouchers [woocommerce-pdf-vouchers]
Researcher
Affected Software
Woocommerce Blocks – Woolook [woolook]
Researcher
Affected Software
WP Cookies Enabler [wp-cookies-enabler]
Researcher
Affected Software
Wp NssUser Register [wp-nssuser-register]
Researcher
Affected Software
Zita Site Builder – Elementor, WordPress & Gutenberg Website Builder [ai-site-builder]
Researcher
Affected Software
Advanced What should we write next about [advanced-what-should-we-write-about-next]
Researcher
Affected Software
de:branding [debranding]
Researcher
Affected Software
Dr Affiliate [dr-affiliate]
Researcher
Affected Software
Researcher
Affected Software
EduAdmin Booking [eduadmin-booking]
Researcher
Affected Software
Flash News / Post (Responsive) [flashnews-fading-effect-pearlbells]
Researcher
Affected Software
FULL – Cliente [full-customer]
Researcher
Affected Software
HQ Rental Software [hq-rental-software]
Researcher
Affected Software
Researcher
Affected Software
KH Easy User Settings [kh-easy-user-settings]
Researcher
Affected Software
Mimoos [devoluciones-packback]
Researcher
Minterpress <= 1.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
8.8
Affected Software
Minterpress [minterpress]
Researcher
Affected Software
Opt-In Downloads [halfdata-optin-downloads]
Researcher
Affected Software
PowerFormBuilder – Contact Form Database Manager for WordPress [power-forms-builder]
Researcher
Affected Software
Product Carousel Slider & Grid Ultimate for WooCommerce [woo-product-carousel-slider-and-grid-ultimate]
Researcher
Affected Software
Quietly Insights [quietly-insights]
Researcher
Affected Software
Saksh Escrow System [saksh-escrow-system]
Researcher
Affected Software
Service [service]
Researcher
Affected Software
Researcher
Affected Software
Video & Photo Gallery for Ultimate Member [gallery-for-ultimate-member]
Researcher
Affected Software
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Researchers
Affected Software
OAuth Single Sign On – SSO (OAuth Client) [miniorange-login-with-eve-online-google-facebook]
Researcher
Affected Software
Print Science Designer [print-science-designer]
Researcher
Affected Software
FooGallery Premium [foogallery-premium]
Researcher
Affected Software
Appsplate [appsplate]
Researcher
Affected Software
Instant Appointment [instant-appointment]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
WPBookit [wpbookit]
Researcher
Affected Software
Wr Age Verification [wr-age-verification]
Researcher
Affected Software
Active Products Tables for WooCommerce. Use constructor to create tables [profit-products-tables-for-woocommerce]
Researcher
Affected Software
Grid Plus – Unlimited grid layout [grid-plus]
Researcher
Affected Software
Researcher
Affected Software
Crafthemes Demo Import [crafthemes-demo-import]
Researcher
Affected Software
Frontend Admin by DynamiApps [acf-frontend-form-element]
Researcher
Affected Software
Mollie for Contact Form 7 [cf7-mollie]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
SeedProd Pro [seedprod-coming-soon-pro-5]
Researcher
Affected Software
Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate [spreadr-for-woocomerce]
Researcher
Affected Software
WP Mega Menu [wp-megamenu]
Researcher
Affected Software
WP Simple Pay Lite Manager [stripe-manager]
Researcher
Affected Software
Gaxx Keywords [gaxx-keywords]
Researcher
Affected Software
RapidLoad AI – Optimize Web Vitals Automatically [unusedcss]
Researcher
Affected Software
Coupon Affiliates – Affiliate Plugin for WooCommerce [woo-coupon-usage]
Researcher
Affected Software
Hive Support | AI-Powered Help Desk, Live Chat and Chatbot [hive-support]
Researcher
Affected Software
Library Management System [library-management-system]
Researcher
Affected Software
Researcher
Affected Software
Responsive Filterable Portfolio Gallery – Media Grid & Video Portfolio [responsive-filterable-portfolio]
Researcher
Affected Software
Simple Link Directory – AI Powered [simple-link-directory]
Researcher
Affected Software
Spreadr Woocommerce Plugin – Amazon Importer for Dropshipping and Affiliate [spreadr-for-woocomerce]
Researcher
Affected Software
SQL Chart Builder [sql-chart-builder]
Researcher
Affected Software
Researcher
Affected Software
TSB Occasion Editor [tsb-occasion-editor]
Researcher
Affected Software
WP-CRM System – Manage Clients and Projects [wp-crm-system]
Researcher
Affected Software
WPMobile.App [wpappninja]
Researcher
Affected Software
Wr Age Verification [wr-age-verification]
Researcher
Affected Software
YDS Support Ticket System [yds-support-ticket-system]
Researcher
Add infos to the events calendar <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Add infos to The Events Calendar [add-infos-to-the-events-calendar]
Researcher
Affected Software
Advanced Blog Post Block [advanced-blog-post-block]
Researcher
Affected Software
Table Addons for Elementor – Responsive Table Builder [advanced-data-table-for-elementor]
Researcher
Affected Software
Arena.IM – Live Blogging for real-time events [arena-liveblog-and-chat-tool]
Researcher
Affected Software
Arena.IM – Live Blogging for real-time events [arena-liveblog-and-chat-tool]
Researcher
Affected Software
Beaver Builder Page Builder – Drag and Drop Website Builder [beaver-builder-lite-version]
Researcher
Affected Software
Bicycleshop [bicycleshop]
Researcher
Affected Software
Booking System Trafft [booking-system-trafft]
Researcher
Affected Software
Brandy [brandy]
Researcher
Affected Software
Buk for WordPress [buk-appointments]
Researcher
Affected Software
Catch Popup [catch-popup]
Researcher
Cognito Forms <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
Affected Software
Cognito Forms [cognito-forms]
Researcher
Affected Software
Companion Portfolio – Responsive Portfolio Plugin [companion-portfolio]
Researcher
Affected Software
Connatix Video Embed [connatix-video-embed]
Researcher
Affected Software
Cricket Live Score [cricket-score]
Researcher
Currency Converter Widget ⚡ PRO <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Currency Converter Widget ⚡ PRO [currency-converter-widget-pro]
Researcher
Email Reminders <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
6.4
Affected Software
Email Reminders [email-reminders]
Researcher
Affected Software
Eveeno [eveeno]
Researcher
Affected Software
Events Addon for Elementor [events-addon-for-elementor]
Researcher
Affected Software
Researcher
Affected Software
Ganohrs Toggle Shortcode [ganohrs-toggle-shortcode]
Researcher
Affected Software
GeoDataSource Country Region DropDown [geodatasource-country-region-dropdown]
Researcher
Affected Software
glomex oEmbed [glomex-oembed]
Researcher
Affected Software
Gutenberg Blocks and Page Layouts – Attire Blocks [attire-blocks]
Researcher
Affected Software
Hello Event Widgets For Elementor [hello-event-widgets-for-elementor]
Researcher
Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Horizontal scroll image slideshow [horizontal-scroll-image-slideshow]
Researcher
Affected Software
HostFact bestelformulier integratie [hostfact-bestelformulier-integratie]
Researcher
Affected Software
iChart – Easy Charts and Graphs [ichart]
Researcher
Affected Software
IDer Login for WordPress [ider-login]
Researcher
Affected Software
IMS Countdown [ims-countdown]
Researcher
Affected Software
Integrate Firebase [integrate-firebase]
Researcher
Affected Software
Koalendar – Easy Appointment Scheduling & Booking Plugin [koalendar-free-booking-widget]
Researcher
Affected Software
Researcher
Affected Software
My IDX Home Search [my-idx-home-search]
Researcher
Affected Software
My IDX Home Search [my-idx-home-search]
Researcher
Affected Software
NewsmanApp [newsmanapp]
Researcher
Affected Software
Nias course | دوره ساز نیاس [nias-course]
Researcher
Affected Software
ONLYOFFICE DocSpace [onlyoffice-docspace]
Researcher
Affected Software
Out of the Block: OpenStreetMap [ootb-openstreetmap]
Researcher
Perfect Font Awesome Integration <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Perfect Font Awesome Integration [perfect-font-awesome-integration]
Researcher
Affected Software
Plain Post [plain-post]
Researcher
Affected Software
Poll, Poll Forms – WordPress Poll plugin by Poll Builder [poll-builder]
Researcher
Affected Software
Post Carousel & Slider [post-types-carousel-slider]
Researcher
Affected Software
Researcher
Affected Software
Posts and Products Views for WooCommerce [posts-and-products-views]
Researcher
Affected Software
PowerBI Embed Reports [embed-power-bi-reports]
Researcher
Affected Software
Primary Addon for Elementor [primary-addon-for-elementor]
Researcher
Affected Software
Property Hive Mortgage Calculator [property-hive-mortgage-calculator]
Researcher
Affected Software
Property Hive Stamp Duty Calculator [property-hive-stamp-duty-calculator]
Researcher
Affected Software
Quran Phrases About Most People Shortcodes [quran-phrases-about-most-people-shortcodes]
Researcher
Affected Software
Radius Blocks – WordPress Gutenberg Blocks [radius-blocks]
Researcher
Affected Software
Responsive Google Maps | by imbaa [responsive-google-maps]
Researcher
Affected Software
Restaurant & Cafe Addon for Elementor [restaurant-cafe-addon-for-elementor]
Researcher
Affected Software
Sailthru Triggermail [sailthru-triggermail]
Researcher
Affected Software
Simple Locator [simple-locator]
Researcher
Affected Software
Smaily for WP [smaily-for-wp]
Researcher
Affected Software
SmartAgenda – Prise de rendez-vous en ligne [smart-agenda-prise-de-rendez-vous-en-ligne]
Researcher
Affected Software
Smart PopUp Blaster [smart-popup-blaster]
Researcher
Affected Software
Social Media Shortcodes [social-media-shortcodes]
Researcher
Affected Software
States Map US [ymc-states-map]
Researcher
Surbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
Surbma | SalesAutopilot Shortcode [surbma-salesautopilot-shortcode]
Researcher
Affected Software
Tabs Maker [tabs-maker]
Researcher
Affected Software
TCBD Popover [tcbd-popover]
Researcher
Affected Software
The Permalinker [the-permalinker]
Researcher
Affected Software
Tithe.ly Giving Button [wp-tithely]
Researcher
Affected Software
Researcher
Affected Software
Unlimited Elements For Elementor [unlimited-elements-for-elementor]
Researcher
Affected Software
Utech World Time [utech-world-time-for-wp]
Researcher
Affected Software
Visualmodo Elements [visualmodo-elements]
Researcher
Affected Software
Web Stories [web-stories]
Researcher
WooCommerce Cart Count Shortcode <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
Affected Software
WooCommerce Cart Count Shortcode [woo-cart-count-shortcode]
Researcher
Affected Software
GS Books Showcase – Display Books in Grid, Slider & More | Library for WordPress [gs-books-showcase]
Researcher
Affected Software
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researchers
Affected Software
WP Enabled SVG [wp-enable-svg]
Researcher
Affected Software
WP GeoNames [wp-geonames]
Researcher
Affected Software
Wp photo text slider 50 [wp-photo-text-slider-50]
Researcher
Affected Software
WP-Revive Adserver [wp-revive-adserver]
Researcher
Affected Software
Notibar – Notification Bar for WordPress [notibar]
Researcher
Affected Software
3D Avatar User Profile [3d-avatar-user-profile]
Researcher
Affected Software
addWeather [myweather]
Researcher
Affected Software
Admin Customization [wpp-customization]
Researcher
Affected Software
Advanced Fancybox [advanced-fancybox]
Researcher
Affected Software
AHAthat Plugin [ahathat]
Researcher
AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting
6.1
Affected Software
Researcher
Affected Software
Amazon Product Price [amazon-product-price]
Researcher
Affected Software
Analytics Cat – Google Analytics Made Easy [analytics-cat]
Researcher
Affected Software
Aphorismus [aphorismus]
Researcher
Affected Software
Barcode Scanner (+Mobile App) – Inventory manager, Order fulfillment system, POS (Point of Sale) [barcode-scanner-lite-pos-to-manage-products-inventory-and-orders]
Researcher
Affected Software
Bootstrap Buttons [bootstrap-buttons]
Researcher
Affected Software
BP Email Assign Templates [bp-email-assign-templates]
Researcher
Affected Software
CarDealerPress [cardealerpress]
Researcher
Affected Software
Category of Posts [list-one-category-of-posts]
Researcher
Affected Software
Check Pincode For WooCommerce [check-pincode-for-woocommerce]
Researcher
Affected Software
CK and SyntaxHighlighter [ck-and-syntaxhighlighter]
Researcher
Affected Software
CleverNode Related Content [clevernode-related-content]
Researcher
Affected Software
Comments On Feed [comments-on-feed]
Researcher
Affected Software
Connect Contact Form 7 to Constant Contact V3 [connect-contact-form-7-to-constant-contact-v3]
Researcher
Affected Software
Country Blocker [country-blocker]
Researcher
Affected Software
CRUDLab Google Plus Button [crudlab-google-plus]
Researcher
Affected Software
CSV to HTML [csv-to-html]
Researcher
dejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
6.1
Affected Software
dejure.org Vernetzungsfunktion [dejureorg-vernetzungsfunktion]
Researcher
Affected Software
Device Detector [device-detector]
Researcher
Affected Software
Display Future Posts [display-future-posts]
Researcher
Affected Software
DTC Documents [dtc-documents]
Researcher
Affected Software
DX Dark Site [devrix-dark-site]
Researcher
Affected Software
ECT Product Carousel [ect-product-carousel]
Researcher
Affected Software
ECT Social Share [ect-social-share]
Researcher
Affected Software
EELV Newsletter [eelv-newsletter]
Researcher
Affected Software
Evernote Sync [evernote-sync]
Researcher
Affected Software
Fancy Roller Scroller [fancy-roller-scroller]
Researcher
Affected Software
Feedpress Generator – External RSS Frontend Customizer [feedpress-generator]
Researcher
Affected Software
Filestack WP Upload [filestack-upload]
Researcher
Affected Software
Flaming Forms [flaming-forms]
Researcher
Affected Software
FormFacade – Embed Google Forms in your website [formfacade]
Researcher
Affected Software
GeoFlickr [geoflickr]
Researcher
Affected Software
Geoportail Shortcode [geoportail-shortcode]
Researcher
Affected Software
Go Animate [goanimate]
Researcher
Affected Software
Hello In All Languages [hello-in-all-languages]
Researcher
Affected Software
hmd [hmd]
Researcher
Affected Software
I Plant A Tree [i-plant-a-tree]
Researcher
Affected Software
ICDSoft Reseller Store [icdsoft-reseller-store]
Researcher
Affected Software
ImageRecycle pdf & image compression [imagerecycle-pdf-image-compression]
Researcher
Affected Software
ImmoToolBox Connect [immotoolbox-connect]
Researcher
Affected Software
Import Eventbrite Events [import-eventbrite-events]
Researcher
Affected Software
Increase Sociability [increase-sociability]
Researcher
Affected Software
Link Invoice Payment for WooCommerce [invoice-payment-for-woocommerce]
Researcher
Affected Software
J&T Express Malaysia [jt-express]
Researcher
Affected Software
Jet Footer Code [jet-footer-code]
Researcher
Affected Software
Kundgenerator [kundgenerator]
Researcher
Affected Software
kvCORE IDX [kvcore-idx]
Researcher
Affected Software
LabelGrid Tools [label-grid-tools]
Researcher
Affected Software
LDD Directory Lite [ldd-directory-lite]
Researcher
Affected Software
LeaderBoard Plugin [leaderboard-lite]
Researcher
Affected Software
Library Bookshelves [library-bookshelves]
Researcher
Affected Software
Like in Vk.com [like-on-vkontakte]
Researcher
Affected Software
LionScripts: Site Maintenance & Noindex Nofollow Plugin [maintenance-and-noindex-nofollow]
Researcher
Affected Software
Mandrill WP – Email Form Under Post [email-form-under-post]
Researcher
Affected Software
MDC Comment Toolbar [mdc-comment-toolbar]
Researcher
Affected Software
Media Downloader [media-downloader]
Researcher
Affected Software
Multiple Admin Emails [multiple-admin-emails]
Researcher
Affected Software
Newsletter Subscriptions [newsletter-subscriptions]
Researcher
Affected Software
Onlywire Multi Autosubmitter [onlywire-multi-autosubmitter]
Researcher
Affected Software
Password for WP [password-for-wp]
Researcher
Affected Software
PeproDev WooCommerce Receipt Uploader [pepro-bacs-receipt-upload-for-woocommerce]
Researcher
Affected Software
افزونه پیامک ووکامرس Persian WooCommerce SMS [persian-woocommerce-sms]
Researcher
Affected Software
phZoom Plugin for WordPress [phzoom]
Researcher
Affected Software
Planaday API [planaday-api]
Researcher
Affected Software
Posts Date Ranges [posts-date-ranges]
Researcher
Affected Software
Primer MyData for Woocommerce [primer-mydata]
Researcher
Affected Software
Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart [push-monkey-desktop-push-notifications]
Researcher
Affected Software
Quran multilanguage Text & Audio [quran-text-multilanguage]
Researcher
Affected Software
Revi.io – Customer and Product Reviews [revi-io-customer-and-product-reviews]
Researcher
Affected Software
Role Includer [role-includer]
Researcher
Affected Software
Schema App Structured Data [schema-app-structured-data-for-schemaorg]
Researcher
Affected Software
Seraphinite Bulk Discounts for WooCommerce [seraphinite-discount-for-woocommerce]
Researcher
Affected Software
Simple Booking – Widget [simple-booking-widget]
Researcher
Affected Software
Simple Payment [simple-payment]
Researcher
Affected Software
Simple Presenter [simple-presenter]
Researcher
Affected Software
SIP Calculator [sip-calculator]
Researcher
Affected Software
SMSify [smsify]
Researcher
Affected Software
Social Media Sharing [social-media-sharing]
Researcher
Affected Software
SOPA Blackout [sopa-blackout]
Researcher
Affected Software
Researcher
Affected Software
TravelTour [traveltour]
Researcher
Affected Software
Ui Slider Filter By Price [ui-slider-filter-by-price]
Researcher
Affected Software
Ultimate Endpoints With Rest Api [custom-wp-rest-api]
Researcher
Affected Software
Researcher
Affected Software
Video & Photo Gallery for Ultimate Member [gallery-for-ultimate-member]
Researcher
Affected Software
Visual Recent Posts [visual-recent-posts]
Researcher
Affected Software
Website Toolbox Forum [website-toolbox-forums]
Researcher
Affected Software
WordPress Filter [wordpress-filter]
Researcher
Affected Software
WordPress HelpDesk & Support Ticket System Plugin – Octrace Support [octrace-support]
Researcher
Affected Software
Researcher
Affected Software
WP Controller [wp-management-controller]
Researcher
Affected Software
WP Currency Exchange Rates [wp-currency-exchange-rates]
Researcher
Affected Software
WP Flipkart Importer [wp-flipkart-importer]
Researcher
Affected Software
WP Log Action [wp-log-action]
Researcher
Affected Software
Wp Login with Ajax [wp-login-with-ajax]
Researcher
Affected Software
WP Quick Shop [wp-quick-shop]
Researcher
Affected Software
WP Service Payment Form With Authorize.net [wp-service-payment-form-with-authorizenet]
Researcher
Affected Software
WP-Ban-User [wp-ban-user]
Researcher
Affected Software
WP-HideThat [wp-hide-that]
Researcher
Affected Software
WPC Order Notes for WooCommerce [woo-order-notes]
Researcher
Affected Software
XPD Reduce Image Filesize [xpd-reduce-image-filesize]
Researcher
Affected Software
Car Dealer (Dealership) and Vehicle sales [cardealer]
Researcher
Affected Software
Contact Form, Survey & Form Builder – MightyForms [mightyforms]
Researcher
Affected Software
GEO my WP [geo-my-wp]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Popup Surveys & Polls for WordPress (Mare.io) [popup-surveys]
Researcher
Affected Software
SVG Shortcode [svg-shortcode]
Researcher
Affected Software
Accept Stripe Payments Using Contact Form 7 [accept-stripe-payments-using-contact-form-7]
Researcher
Affected Software
Banner System [banner-system]
Researcher
Affected Software
Payment Gateway Per Product for WooCommerce [woocommerce-product-payments]
Researcher
Affected Software
Gou Manage My Account Menu – User Roles [gou-wc-account-tabs]
Researcher
Affected Software
Job Board Manager [job-board-manager]
Researcher
Affected Software
Ksher [ksher-payment]
Researcher
Affected Software
Last Viewed Posts by WPBeginner [last-viewed-posts]
Researcher
Affected Software
Researcher
Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
5.3
Affected Software
Researcher
Affected Software
Minify HTML [minify-html-markup]
Researcher
Affected Software
Order Delivery & Pickup Location Date Time ( Free Version ) [order-delivery-pickup-location-date-time-free-version]
Researcher
Affected Software
Researcher
Rate My Post – Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts
5.3
Affected Software
Rate My Post – Star Rating Plugin by FeedbackWP [rate-my-post]
Researcher
Affected Software
Restrict – membership, site, content and user access restrictions for WordPress [restricted-content]
Researcher
Affected Software
Simple Restrict [simple-restrict]
Researcher
Affected Software
Tickera – Sell Tickets & Manage Events [tickera-event-ticketing-system]
Researchers
Affected Software
Web3 Crypto Payments by DePay for WooCommerce [depay-payments-for-woocommerce]
Researcher
Affected Software
Researcher
Affected Software
WP-NERD Toolkit [wp-nerd-toolkit]
Researcher
Affected Software
XML Multilanguage Sitemap Generator [xml-multilanguage-sitemap-generator]
Researcher
Affected Software
SeedProd Pro [seedprod-coming-soon-pro-5]
Researcher
Affected Software
SeedProd Pro [seedprod-coming-soon-pro-5]
Researcher
Affected Software
Researcher
Affected Software
Researcher
Affected Software
Researchers
Affected Software
Researcher
Affected Software
360 Javascript Viewer [360deg-javascript-viewer]
Researcher
Affected Software
Better WP Login Page [better-wp-login-page]
Researcher
Affected Software
bodi0`s Easy cache [bodi0s-easy-cache]
Researcher
Affected Software
Cryptocurrency Price Widget [cryptocurrency-price-widget]
Researcher
Affected Software
Geocache Stat Bar Widget [geocache-stat-bar-widget]
Researcher
Affected Software
Researcher
Affected Software
Add image to Post [add-image-to-post]
Researcher
Advance Menu Manager <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
4.3
Affected Software
Researcher
Affected Software
AI Post Generator | AutoWriter [ai-post-generator]
Researcher
Affected Software
AIcomments – комментарии и отзывы ChatGPT [aicomments]
Researcher
Affected Software
AIKCT Engine Chatbot [ai-seo-translator]
Researcher
Affected Software
Arabic Webfonts [arabic-webfonts]
Researcher
Affected Software
Arena.IM – Live Blogging for real-time events [arena-liveblog-and-chat-tool]
Researcher
Affected Software
AutoWP – AI Content Writer & Rewriter [autowp-ai-content-writer-rewriter]
Researcher
Affected Software
Researcher
Affected Software
Awesome Support – WordPress HelpDesk & Support Plugin [awesome-support]
Researcher
Affected Software
Bet sport Free [bet-sport-free]
Researcher
Affected Software
Caldera SMTP Mailer [caldera-smtp-mailer]
Researcher
Affected Software
Child Theme Creator by Orbisius [orbisius-child-theme-creator]
Researcher
Affected Software
Researcher
Affected Software
Cookie Banner for GDPR / CCPA – WPLP Cookie Consent [gdpr-cookie-consent]
Researcher
Affected Software
Custom Skins Contact Form 7 [custom-skins-contact-form-7]
Researcher
Easy Site Importer <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
4.3
Affected Software
Easy Site Importer [easy-site-importer]
Researcher
Affected Software
ElementInvader Addons for Elementor [elementinvader-addons-for-elementor]
Researcher
Affected Software
Essential Real Estate [essential-real-estate]
Researcher
Affected Software
Researcher
Affected Software
Get Post Content Shortcode [get-post-content-shortcode]
Researcher
Affected Software
Greenshift – animation and page builder blocks [greenshift-animation-and-page-builder-blocks]
Researcher
Affected Software
Hash Form – Drag & Drop Form Builder [hash-form]
Researcher
Affected Software
Hive Support | AI-Powered Help Desk, Live Chat and Chatbot [hive-support]
Researcher
Affected Software
Leader [leader]
Researcher
Affected Software
Mark New Posts [mark-new-posts]
Researcher
Affected Software
New User Approve [new-user-approve]
Researcher
Affected Software
News Ticker for Elementor [news-ticker-for-elementor]
Researcher
Affected Software
Notibar – Notification Bar for WordPress [notibar]
Researcher
Affected Software
Online Booking & Scheduling Calendar for WordPress by vcita [meeting-scheduler-by-vcita]
Researcher
Affected Software
WP Email Log – PostBox [postbox-email-logs]
Researcher
Affected Software
Posti Shipping [posti-shipping]
Researcher
Affected Software
Shortcodes for Elementor [shortcode-elementor]
Researcher
Affected Software
SiteOrigin Widgets Bundle [so-widgets-bundle]
Researcher
Affected Software
Snippet Shortcodes [shortcode-variables]
Researcher
Affected Software
Termin-Kalender [termin-kalender]
Researcher
Affected Software
Themify Store Locator [themify-store-locator]
Researcher
Affected Software
WooCommerce Basic Ordernumbers [woocommerce-basic-ordernumbers]
Researcher
Affected Software
WP Crowdfunding [wp-crowdfunding]
Researcher
Affected Software
WP Mailster [wp-mailster]
Researcher
Affected Software
Researcher
Affected Software
WPCargo Track & Trace [wpcargo]
Researcher
Affected Software
Youtube Video Grid | Youmax [youmax-channel-embeds-for-youtube-businesses]
Researcher
Affected Software
畅言评论系统 [changyan]
Researcher
Affected Software
AR for WordPress [ar-for-wordpress]
Researcher
Affected Software
Bold Page Builder [bold-page-builder]
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments