WordPress Vulnerability Report

WordPress Vulnerability Report — August 28, 2024

Since last week, 122 new vulnerabilities emerged in the WordPress ecosystem including 118 plugins and 4 themes. 49 of the vulnerable plugins and themes remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Sarah

Published:Aug 28, 2024

Filed Under:WordPress Vulnerability Report

Reading Time:23 min.

In this report, 122 vulnerabilities have been publicly disclosed. Security patches for 73 of these plugins are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 49 plugin and theme vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.6.1 is available! This minor release features 7 bug fixes in Core and 9 bug fixes for the Block Editor. You can review a summary of the maintenance updates in this release by reading the Release Candidate announcement.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 72 Patched / 46 Unpatched

TI WooCommerce Wishlist

Plugin:
TI WooCommerce Wishlist
Plugin Slug:
ti-woocommerce-wishlist
Installations
100,000+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-43917
The vulnerability has not been patched. You should deactivate the plugin.

YARPP – Yet Another Related Posts Plugin

Plugin:
YARPP – Yet Another Related Posts Plugin
Plugin Slug:
yet-another-related-posts-plugin
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43919
The vulnerability has not been patched. You should deactivate the plugin.

WP Table Builder – WordPress Table Plugin

Plugin:
WP Table Builder – WordPress Table Plugin
Plugin Slug:
wp-table-builder
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3282
The vulnerability has not been patched. You should deactivate the plugin.

DSGVO All in one for WP

Plugin:
DSGVO All in one for WP
Plugin Slug:
dsgvo-all-in-one-for-wp
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43964
The vulnerability has not been patched. You should deactivate the plugin.

Maintenance & Coming Soon Redirect Animation

Plugin:
Maintenance & Coming Soon Redirect Animation
Plugin Slug:
maintenance-coming-soon-redirect-animation
Installations
5,000+
Vulnerability:
Bypass Vulnerability
Patched in Version:
No Fix
Severity Score:
Low
CVE:
2024-43944
The vulnerability has not been patched. You should deactivate the plugin.

Super Testimonials

Plugin:
Super Testimonials
Plugin Slug:
super-testimonial
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-43959
The vulnerability has not been patched. You should deactivate the plugin.

SKT Blocks – Gutenberg based Page Builder

Plugin:
SKT Blocks – Gutenberg based Page Builder
Plugin Slug:
skt-blocks
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43946
The vulnerability has not been patched. You should deactivate the plugin.

Classic Addons – WPBakery Page Builder

Plugin:
Classic Addons – WPBakery Page Builder
Plugin Slug:
classic-addons-wpbakery-page-builder-addons
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43953
The vulnerability has not been patched. You should deactivate the plugin.

SendGrid for WordPress

Plugin:
SendGrid for WordPress
Plugin Slug:
wp-sendgrid-mailer
Installations
1,000+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-43965
The vulnerability has not been patched. You should deactivate the plugin.

Skitter Slideshow

Plugin:
Skitter Slideshow
Plugin Slug:
wp-skitter-slideshow
Installations
500+
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2022-1751
The vulnerability has not been patched. You should deactivate the plugin.

AdRotate

Plugin:
AdRotate
Plugin Slug:
adrotate1
Vulnerability:
Arbitrary File Upload
Patched in Version:
No Fix
Severity Score:
High
CVE:
2022-1206
The vulnerability has not been patched. You should deactivate the plugin.

Animated Number Counters

Plugin:
Animated Number Counters
Plugin Slug:
animated-number-counters
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43957
The vulnerability has not been patched. You should deactivate the plugin.

App Builder

Plugin:
App Builder
Plugin Slug:
app-builder
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-7651
The vulnerability has not been patched. You should deactivate the plugin.

azurecurve Toggle Show/Hide

Plugin:
azurecurve Toggle Show/Hide
Plugin Slug:
azurecurve-toggle-showhide
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43961
The vulnerability has not been patched. You should deactivate the plugin.

Blog Introduction

Plugin:
Blog Introduction
Plugin Slug:
blogintroduction-wordpress-plugin
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-7862
The vulnerability has not been patched. You should deactivate the plugin.

Brickscore

Plugin:
Brickscore
Plugin Slug:
brickscore
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-43950
The vulnerability has not been patched. You should deactivate the plugin.

Smart Online Order for Clover

Plugin:
Smart Online Order for Clover
Plugin Slug:
clover-online-orders
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-7032
The vulnerability has not been patched. You should deactivate the plugin.

Droip

Plugin:
Droip
Plugin Slug:
droip
Vulnerability:
Arbitrary File Deletion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-43955
The vulnerability has not been patched. You should deactivate the plugin.

Droip

Plugin:
Droip
Plugin Slug:
droip
Vulnerability:
Settings Change
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43954
The vulnerability has not been patched. You should deactivate the plugin.

GHActivity

Plugin:
GHActivity
Plugin Slug:
ghactivity
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43949
The vulnerability has not been patched. You should deactivate the plugin.

Gixaw Chat

Plugin:
Gixaw Chat
Plugin Slug:
gixaw-chat
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-7816
The vulnerability has not been patched. You should deactivate the plugin.

Hide My Site

Plugin:
Hide My Site
Plugin Slug:
hide-my-site
Vulnerability:
Sensitive Data Exposure
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-5880
The vulnerability has not been patched. You should deactivate the plugin.

ILC Thickbox

Plugin:
ILC Thickbox
Plugin Slug:
ilc-thickbox
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-7820
The vulnerability has not been patched. You should deactivate the plugin.

LatePoint

Plugin:
LatePoint
Plugin Slug:
latepoint
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43945
The vulnerability has not been patched. You should deactivate the plugin.

LWS Affiliation

Plugin:
LWS Affiliation
Plugin Slug:
lws-affiliation
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43962
The vulnerability has not been patched. You should deactivate the plugin.

Memberpress

Plugin:
Memberpress
Plugin Slug:
memberpress
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43956
The vulnerability has not been patched. You should deactivate the plugin.

Misiek Paypal

Plugin:
Misiek Paypal
Plugin Slug:
misiek-paypal
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-7861
The vulnerability has not been patched. You should deactivate the plugin.

Misiek Photo Album

Plugin:
Misiek Photo Album
Plugin Slug:
misiek-photo-album
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-7818
The vulnerability has not been patched. You should deactivate the plugin.

Misiek Photo Album

Plugin:
Misiek Photo Album
Plugin Slug:
misiek-photo-album
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-7817
The vulnerability has not been patched. You should deactivate the plugin.

Music Request Manager

Plugin:
Music Request Manager
Plugin Slug:
music-request-manager
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-6018
The vulnerability has not been patched. You should deactivate the plugin.

Music Request Manager

Plugin:
Music Request Manager
Plugin Slug:
music-request-manager
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-6019
The vulnerability has not been patched. You should deactivate the plugin.

Music Request Manager

Plugin:
Music Request Manager
Plugin Slug:
music-request-manager
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-6017
The vulnerability has not been patched. You should deactivate the plugin.

OTA Sync Booking Engine Widget

Plugin:
OTA Sync Booking Engine Widget
Plugin Slug:
ota-sync-booking-engine-widget
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-7647
The vulnerability has not been patched. You should deactivate the plugin.

Propovoice Pro

Plugin:
Propovoice Pro
Plugin Slug:
propovoice-pro
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-43941
The vulnerability has not been patched. You should deactivate the plugin.

Responsive Video

Plugin:
Responsive Video
Plugin Slug:
responsive-video
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-7629
The vulnerability has not been patched. You should deactivate the plugin.

RT Easy Builder – Advanced addons for Elementor

Plugin:
RT Easy Builder – Advanced addons for Elementor
Plugin Slug:
rt-easy-builder-advanced-addons-for-elementor
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-2254
The vulnerability has not been patched. You should deactivate the plugin.

Simple Headline Rotator

Plugin:
Simple Headline Rotator
Plugin Slug:
simple-headline-rotator
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-7860
The vulnerability has not been patched. You should deactivate the plugin.

Snapshot Backup

Plugin:
Snapshot Backup
Plugin Slug:
snapshot-backup
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-7689
The vulnerability has not been patched. You should deactivate the plugin.

Web and WooCommerce Addons for WPBakery Builder

Plugin:
Web and WooCommerce Addons for WPBakery Builder
Plugin Slug:
vc-addons-by-bit14
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43960
The vulnerability has not been patched. You should deactivate the plugin.

Woo Inquiry

Plugin:
Woo Inquiry
Plugin Slug:
woo-inquiry
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-7854
The vulnerability has not been patched. You should deactivate the plugin.

WordSurvey

Plugin:
WordSurvey
Plugin Slug:
wordsurvey
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-6767
The vulnerability has not been patched. You should deactivate the plugin.

WP Testimonial Widget

Plugin:
WP Testimonial Widget
Plugin Slug:
wp-testimonial-widget
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43967
The vulnerability has not been patched. You should deactivate the plugin.

WP Testimonial Widget

Plugin:
WP Testimonial Widget
Plugin Slug:
wp-testimonial-widget
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-43966
The vulnerability has not been patched. You should deactivate the plugin.

WP Testimonial Widget

Plugin:
WP Testimonial Widget
Plugin Slug:
wp-testimonial-widget
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-7390
The vulnerability has not been patched. You should deactivate the plugin.

Z Y N I T H

Plugin:
Z Y N I T H
Plugin Slug:
zynith-seo
Vulnerability:
Settings Change
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43940
The vulnerability has not been patched. You should deactivate the plugin.

Z Y N I T H

Plugin:
Z Y N I T H
Plugin Slug:
zynith-seo
Vulnerability:
Settings Change
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43939
The vulnerability has not been patched. You should deactivate the plugin.

LiteSpeed Cache

Plugin:
LiteSpeed Cache
Plugin Slug:
litespeed-cache
Installations
5,000,000+
Vulnerability:
Privilege Escalation
Patched in Version:
6.4
Severity Score:
Critical
CVE:
2024-28000
The vulnerability has been patched, so you should update to version 6.4.

Jeg Elementor Kit

Plugin:
Jeg Elementor Kit
Plugin Slug:
jeg-elementor-kit
Installations
200,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.6.8
Severity Score:
Medium
CVE:
2024-6804
The vulnerability has been patched, so you should update to version 2.6.8.

Responsive Lightbox & Gallery

Plugin:
Responsive Lightbox & Gallery
Plugin Slug:
responsive-lightbox
Installations
200,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.4.8
Severity Score:
Medium
CVE:
2024-43924
The vulnerability has been patched, so you should update to version 2.4.8.

Responsive Lightbox & Gallery

Plugin:
Responsive Lightbox & Gallery
Plugin Slug:
responsive-lightbox
Installations
200,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.8
Severity Score:
Medium
CVE:
2024-6870
The vulnerability has been patched, so you should update to version 2.4.8.

Orbit Fox by ThemeIsle

Plugin:
Orbit Fox by ThemeIsle
Plugin Slug:
themeisle-companion
Installations
200,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.10.37
Severity Score:
Medium
CVE:
2024-7778
The vulnerability has been patched, so you should update to version 2.10.37.

Beaver Builder – WordPress Page Builder

Plugin:
Beaver Builder – WordPress Page Builder
Plugin Slug:
beaver-builder-lite-version
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.8.3.4
Severity Score:
High
CVE:
2024-43926
The vulnerability has been patched, so you should update to version 2.8.3.4.

Custom Permalinks

Plugin:
Custom Permalinks
Plugin Slug:
custom-permalinks
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.7.0
Severity Score:
Medium
CVE:
2023-0926
The vulnerability has been patched, so you should update to version 2.7.0.

Email Address Encoder

Plugin:
Email Address Encoder
Plugin Slug:
email-address-encoder
Installations
100,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.24
Severity Score:
Medium
CVE:
2024-43927
The vulnerability has been patched, so you should update to version 1.0.24.

EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor

Plugin:
EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor
Plugin Slug:
embedpress
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.0.9
Severity Score:
Medium
CVE:
2024-43936
The vulnerability has been patched, so you should update to version 4.0.9.

Gallery Plugin for WordPress – Envira Photo Gallery

Plugin:
Gallery Plugin for WordPress – Envira Photo Gallery
Plugin Slug:
envira-gallery-lite
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.8.15
Severity Score:
Medium
CVE:
2024-43925
The vulnerability has been patched, so you should update to version 1.8.15.

GiveWP – Donation Plugin and Fundraising Platform

Plugin:
GiveWP – Donation Plugin and Fundraising Platform
Plugin Slug:
give
Installations
100,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
3.14.2
Severity Score:
Medium
CVE:
2024-5941
The vulnerability has been patched, so you should update to version 3.14.2.

GiveWP – Donation Plugin and Fundraising Platform

Plugin:
GiveWP – Donation Plugin and Fundraising Platform
Plugin Slug:
give
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.14.0
Severity Score:
Medium
CVE:
2024-5940
The vulnerability has been patched, so you should update to version 3.14.0.

GiveWP – Donation Plugin and Fundraising Platform

Plugin:
GiveWP – Donation Plugin and Fundraising Platform
Plugin Slug:
give
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.14.0
Severity Score:
Medium
CVE:
2024-5939
The vulnerability has been patched, so you should update to version 3.14.0.

WordPress Button Plugin MaxButtons

Plugin:
WordPress Button Plugin MaxButtons
Plugin Slug:
maxbuttons
Installations
100,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
9.8.0
Severity Score:
Medium
CVE:
2024-6499
The vulnerability has been patched, so you should update to version 9.8.0.

String locator

Plugin:
String locator
Plugin Slug:
string-locator
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.6.6
Severity Score:
High
CVE:
2023-6987
The vulnerability has been patched, so you should update to version 2.6.6.

Ninja Tables – Easiest Data Table Builder

Plugin:
Ninja Tables – Easiest Data Table Builder
Plugin Slug:
ninja-tables
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.0.13
Severity Score:
Medium
CVE:
2024-7304
The vulnerability has been patched, so you should update to version 5.0.13.

AI Engine

Plugin:
AI Engine
Plugin Slug:
ai-engine
Installations
70,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
2.5.1
Severity Score:
Critical
CVE:
2024-6451
The vulnerability has been patched, so you should update to version 2.5.1.

Visual CSS Style Editor

Plugin:
Visual CSS Style Editor
Plugin Slug:
yellow-pencil-visual-theme-customizer
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.6.4
Severity Score:
High
CVE:
2024-43963
The vulnerability has been patched, so you should update to version 7.6.4.

Piotnet Addons For Elementor

Plugin:
Piotnet Addons For Elementor
Plugin Slug:
piotnet-addons-for-elementor
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.31
Severity Score:
Medium
CVE:
2024-5502
The vulnerability has been patched, so you should update to version 2.4.31.

Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker

Plugin:
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Plugin Slug:
quiz-master-next
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
9.1.1
Severity Score:
Medium
CVE:
2024-6879
The vulnerability has been patched, so you should update to version 9.1.1.

WP Last Modified Info

Plugin:
WP Last Modified Info
Plugin Slug:
wp-last-modified-info
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.9.1
Severity Score:
Medium
CVE:
2024-6864
The vulnerability has been patched, so you should update to version 1.9.1.

Image Hotspot by DevVN

Plugin:
Image Hotspot by DevVN
Plugin Slug:
devvn-image-hotspot
Installations
30,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.2.6
Severity Score:
High
CVE:
2024-7656
The vulnerability has been patched, so you should update to version 1.2.6.

Simple Job Board

Plugin:
Simple Job Board
Plugin Slug:
simple-job-board
Installations
20,000+
Vulnerability:
PHP Object Injection
Patched in Version:
2.12.4
Severity Score:
High
CVE:
2024-7351
The vulnerability has been patched, so you should update to version 2.12.4.

140+ Widgets | Xpro Addons For Elementor – FREE

Plugin:
140+ Widgets | Xpro Addons For Elementor – FREE
Plugin Slug:
xpro-elementor-addons
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.4.4
Severity Score:
Medium
CVE:
2024-7791
The vulnerability has been patched, so you should update to version 1.4.4.4.

Generate Images – Magic Post Thumbnail

Plugin:
Generate Images – Magic Post Thumbnail
Plugin Slug:
magic-post-thumbnail
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.2.10
Severity Score:
High
CVE:
2024-43921
The vulnerability has been patched, so you should update to version 5.2.10.

WooCommerce Google Feed Manager

Plugin:
WooCommerce Google Feed Manager
Plugin Slug:
wp-product-feed-manager
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.9.0
Severity Score:
Medium
The vulnerability has been patched, so you should update to version 2.9.0.

WooCommerce Google Feed Manager

Plugin:
WooCommerce Google Feed Manager
Plugin Slug:
wp-product-feed-manager
Installations
10,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
2.9.0
Severity Score:
High
CVE:
2024-7258
The vulnerability has been patched, so you should update to version 2.9.0.

BP Profile Search

Plugin:
BP Profile Search
Plugin Slug:
bp-profile-search
Installations
8,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
5.8
Severity Score:
High
CVE:
2024-7850
The vulnerability has been patched, so you should update to version 5.8.

Themify Builder

Plugin:
Themify Builder
Plugin Slug:
themify-builder
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
7.6.2
Severity Score:
Medium
CVE:
2024-7836
The vulnerability has been patched, so you should update to version 7.6.2.

GEO my WP

Plugin:
GEO my WP
Plugin Slug:
geo-my-wp
Installations
5,000+
Vulnerability:
Local File Inclusion
Patched in Version:
4.5.0.2
Severity Score:
High
CVE:
2024-6330
The vulnerability has been patched, so you should update to version 4.5.0.2.

Shopping Cart & eCommerce Store

Plugin:
Shopping Cart & eCommerce Store
Plugin Slug:
wp-easycart
Installations
5,000+
Vulnerability:
SQL Injection
Patched in Version:
5.7.3
Severity Score:
High
CVE:
2024-7827
The vulnerability has been patched, so you should update to version 5.7.3.

WPMobile.App — Android and iOS Mobile Application

Plugin:
WPMobile.App — Android and iOS Mobile Application
Plugin Slug:
wpappninja
Installations
5,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
11.49
Severity Score:
Medium
CVE:
2024-43933
The vulnerability has been patched, so you should update to version 11.49.

WP Crowdfunding

Plugin:
WP Crowdfunding
Plugin Slug:
wp-crowdfunding
Installations
4,000+
Vulnerability:
Settings Change
Patched in Version:
2.1.11
Severity Score:
Medium
CVE:
2024-43937
The vulnerability has been patched, so you should update to version 2.1.11.

Collapsing Archives

Plugin:
Collapsing Archives
Plugin Slug:
collapsing-archives
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0.6
Severity Score:
Medium
CVE:
2024-43934
The vulnerability has been patched, so you should update to version 3.0.6.

Name Directory

Plugin:
Name Directory
Plugin Slug:
name-directory
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.29.1
Severity Score:
Medium
CVE:
2024-43938
The vulnerability has been patched, so you should update to version 1.29.1.

LH Add Media From Url

Plugin:
LH Add Media From Url
Plugin Slug:
lh-add-media-from-url
Installations
2,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.30
Severity Score:
High
CVE:
2024-7090
The vulnerability has been patched, so you should update to version 1.30.

Event Espresso – Event Registration & Ticketing Sales

Plugin:
Event Espresso – Event Registration & Ticketing Sales
Plugin Slug:
event-espresso-decaf
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.0.22.decaf
Severity Score:
Medium
CVE:
2024-6883
The vulnerability has been patched, so you should update to version 5.0.22.decaf.

ImageRecycle pdf & image compression

Plugin:
ImageRecycle pdf & image compression
Plugin Slug:
imagerecycle-pdf-image-compression
Installations
1,000+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
3.1.15
Severity Score:
Medium
CVE:
2024-8120
The vulnerability has been patched, so you should update to version 3.1.15.

ImageRecycle pdf & image compression

Plugin:
ImageRecycle pdf & image compression
Plugin Slug:
imagerecycle-pdf-image-compression
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.1.15
Severity Score:
Medium
CVE:
2024-6631
The vulnerability has been patched, so you should update to version 3.1.15.

Image Optimizer, Resizer and CDN – Sirv

Plugin:
Image Optimizer, Resizer and CDN – Sirv
Plugin Slug:
sirv
Installations
1,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
7.2.8
Severity Score:
Critical
The vulnerability has been patched, so you should update to version 7.2.8.

Zephyr Project Manager

Plugin:
Zephyr Project Manager
Plugin Slug:
zephyr-project-manager
Installations
1,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
3.3.103
Severity Score:
Medium
CVE:
2024-43916
The vulnerability has been patched, so you should update to version 3.3.103.

Zephyr Project Manager

Plugin:
Zephyr Project Manager
Plugin Slug:
zephyr-project-manager
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.103
Severity Score:
Medium
CVE:
2024-43915
The vulnerability has been patched, so you should update to version 3.3.103.

Favicon Generator (CLOSED)

Plugin:
Favicon Generator (CLOSED)
Plugin Slug:
favicon-generator
Installations
300+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.1
Severity Score:
Critical
CVE:
2024-7568
The vulnerability has been patched, so you should update to version 2.1.

Chatbot with ChatGPT WordPress

Plugin:
Chatbot with ChatGPT WordPress
Plugin Slug:
smartsearchwp
Installations
40+
Vulnerability:
SQL Injection
Patched in Version:
2.4.5
Severity Score:
Critical
CVE:
2024-6847
The vulnerability has been patched, so you should update to version 2.4.5.

Chatbot with ChatGPT WordPress

Plugin:
Chatbot with ChatGPT WordPress
Plugin Slug:
smartsearchwp
Installations
40+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.5
Severity Score:
High
CVE:
2024-6843
The vulnerability has been patched, so you should update to version 2.4.5.

Greenshift Query and Meta Addon

Plugin:
Greenshift Query and Meta Addon
Plugin Slug:
greenshiftquery
Vulnerability:
SQL Injection
Patched in Version:
3.9.2
Severity Score:
High
CVE:
2024-43942
The vulnerability has been patched, so you should update to version 3.9.2.

Greenshift Woocommerce Addon

Plugin:
Greenshift Woocommerce Addon
Plugin Slug:
greenshiftwoo
Vulnerability:
SQL Injection
Patched in Version:
1.9.8
Severity Score:
High
CVE:
2024-43943
The vulnerability has been patched, so you should update to version 1.9.8.

Oxygen Builder

Plugin:
Oxygen Builder
Plugin Slug:
oxygenbuilder
Vulnerability:
Broken Access Control
Patched in Version:
4.9
Severity Score:
Medium
CVE:
2024-6688
The vulnerability has been patched, so you should update to version 4.9.

Multilingual CMS

Plugin:
Multilingual CMS
Plugin Slug:
sitepress-multilingual-cms
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
4.6.13
Severity Score:
Critical
CVE:
2024-6386
The vulnerability has been patched, so you should update to version 4.6.13.

WBW Product Table PRO

Plugin:
WBW Product Table PRO
Plugin Slug:
woo-producttables-pro
Vulnerability:
SQL Injection
Patched in Version:
1.9.5
Severity Score:
Critical
CVE:
2024-43918
The vulnerability has been patched, so you should update to version 1.9.5.

WP Armour Extended

Plugin:
WP Armour Extended
Plugin Slug:
wp-armour-extended
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.32
Severity Score:
High
CVE:
2024-43948
The vulnerability has been patched, so you should update to version 1.32.

WP Armour Extended

Plugin:
WP Armour Extended
Plugin Slug:
wp-armour-extended
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.32
Severity Score:
Medium
CVE:
2024-43947
The vulnerability has been patched, so you should update to version 1.32.

File Manager Pro

Plugin:
File Manager Pro
Plugin Slug:
wp-file-manager-pro
Vulnerability:
Arbitrary File Upload
Patched in Version:
8.3.8
Severity Score:
Critical
CVE:
2024-7559
The vulnerability has been patched, so you should update to version 8.3.8.

JobSearch

Plugin:
JobSearch
Plugin Slug:
wp-jobsearch
Vulnerability:
PHP Object Injection
Patched in Version:
2.5.4
Severity Score:
Critical
CVE:
2024-43931
The vulnerability has been patched, so you should update to version 2.5.4.

JobSearch

Plugin:
JobSearch
Plugin Slug:
wp-jobsearch
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
2.5.4
Severity Score:
Medium
CVE:
2024-43930
The vulnerability has been patched, so you should update to version 2.5.4.

JobSearch

Plugin:
JobSearch
Plugin Slug:
wp-jobsearch
Vulnerability:
Broken Access Control
Patched in Version:
2.5.6
Severity Score:
Medium
CVE:
2024-43929
The vulnerability has been patched, so you should update to version 2.5.6.

JobSearch

Plugin:
JobSearch
Plugin Slug:
wp-jobsearch
Vulnerability:
Broken Access Control
Patched in Version:
2.5.6
Severity Score:
Medium
CVE:
2024-43928
The vulnerability has been patched, so you should update to version 2.5.6.

WordPress Themes — 1 Patched / 3 Unpatched

Esotera

Theme:
Esotera
Theme Slug:
esotera
Downloads
59,465
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43952
The vulnerability has not been patched. You should switch themes.

IntoTheDark

Theme:
IntoTheDark
Theme Slug:
intothedark
Downloads
1,994
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-43958
The vulnerability has not been patched. You should switch themes.

Tempera

Theme:
Tempera
Theme Slug:
tempera
Downloads
703,425
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-43951
The vulnerability has not been patched. You should switch themes.

Phlox PRO

Theme:
Phlox PRO
Theme Slug:
phlox-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.16.5
Severity Score:
High
CVE:
2024-6339
The vulnerability has been patched, so you should update to version 5.16.5.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Sarah

Sarah has been with StellarWP since 2024. As our marketing generalist, she spends her day writing content and completing projects for SolidWP, LearnDash, and The Events Calendar. In her free time, Sarah can be found playing pickleball, enjoying coffee at a local coffee shop, and spending time with her husband.

Browse all of Sarah's articles

Author:

Sarah

Sarah has been with StellarWP since 2024. As our marketing generalist, she spends her day writing content and completing projects for SolidWP, LearnDash, and The Events Calendar. In her free time, Sarah can be found playing pickleball, enjoying coffee at a local coffee shop, and spending time with her husband.

Browse all of Sarah's articles