WordPress Vulnerability Report

WordPress Vulnerability Report — May 29, 2024

Since last week, 119 new vulnerabilities emerged in the WordPress ecosystem including 1 in themes and 118 in plugins. 32 of the vulnerable plugins remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Sarah

Published:May 29, 2024

Filed Under:WordPress Vulnerability Report

Reading Time:23 min.

In this report, 119 vulnerabilities have been publicly disclosed. Security patches for 87 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 32 plugin vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.5.3 was released on May 7, 2024, as a short-cycle maintenance release. This release features 12 bug fixes on Core and 9 bug fixes for the Block editor.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 86 Patched / 32 Unpatched

Photo Gallery by 10Web – Mobile-Friendly Image Gallery

Plugin:
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Plugin Slug:
photo-gallery
Installations
200,000+
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-35628
The vulnerability has not been patched. You should deactivate the plugin.

Business Card

Plugin:
Business Card
Plugin Slug:
business-card-by-esterox-100
Installations
10+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-4529
The vulnerability has not been patched. You should deactivate the plugin.

KKProgressbar2 Free – advanced progress bars

Plugin:
KKProgressbar2 Free – advanced progress bars
Plugin Slug:
kkprogressbar
Installations
10+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-4535
The vulnerability has not been patched. You should deactivate the plugin.

KKProgressbar2 Free – advanced progress bars

Plugin:
KKProgressbar2 Free – advanced progress bars
Plugin Slug:
kkprogressbar
Installations
10+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-4534
The vulnerability has not been patched. You should deactivate the plugin.

KKProgressbar2 Free – advanced progress bars

Plugin:
KKProgressbar2 Free – advanced progress bars
Plugin Slug:
kkprogressbar
Installations
10+
Vulnerability:
SQL Injection
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-4533
The vulnerability has not been patched. You should deactivate the plugin.

WP Stacker

Plugin:
WP Stacker
Plugin Slug:
wp-stacker
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-5003
The vulnerability has not been patched. You should deactivate the plugin.

AdFoxly – Ad Manager, AdSense Ads & Ads.txt

Plugin:
AdFoxly – Ad Manager, AdSense Ads & Ads.txt
Plugin Slug:
adfoxly
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34802
The vulnerability has not been patched. You should deactivate the plugin.

ApplyOnline – Application Form Builder and Manager

Plugin:
ApplyOnline – Application Form Builder and Manager
Plugin Slug:
apply-online
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-2036
The vulnerability has not been patched. You should deactivate the plugin.

Automatic Translator with Auto Translate

Plugin:
Automatic Translator with Auto Translate
Plugin Slug:
auto-translate
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-0632
The vulnerability has not been patched. You should deactivate the plugin.

Button contact VR

Plugin:
Button contact VR
Plugin Slug:
button-contact-vr
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-2220
The vulnerability has not been patched. You should deactivate the plugin.

Crafthemes Demo Import

Plugin:
Crafthemes Demo Import
Plugin Slug:
crafthemes-demo-import
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-34800
The vulnerability has not been patched. You should deactivate the plugin.

Dextaz Ping

Plugin:
Dextaz Ping
Plugin Slug:
dextaz-ping
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-34792
The vulnerability has not been patched. You should deactivate the plugin.

Easy Digital Downloads – Recent Purchases

Plugin:
Easy Digital Downloads – Recent Purchases
Plugin Slug:
edd-recent-purchases
Vulnerability:
Remote File Inclusion
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-35629
The vulnerability has not been patched. You should deactivate the plugin.

Elegant Addons for elementor

Plugin:
Elegant Addons for elementor
Plugin Slug:
elegant-addons-for-elementor
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3066
The vulnerability has not been patched. You should deactivate the plugin.

Flattr

Plugin:
Flattr
Plugin Slug:
flattr
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3920
The vulnerability has not been patched. You should deactivate the plugin.

LuckyWP Table of Contents

Plugin:
LuckyWP Table of Contents
Plugin Slug:
luckywp-table-of-contents
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2023-6487
The vulnerability has not been patched. You should deactivate the plugin.

LuckyWP Table of Contents

Plugin:
LuckyWP Table of Contents
Plugin Slug:
luckywp-table-of-contents
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-2953
The vulnerability has not been patched. You should deactivate the plugin.

LuckyWP Table of Contents

Plugin:
LuckyWP Table of Contents
Plugin Slug:
luckywp-table-of-contents
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-2119
The vulnerability has not been patched. You should deactivate the plugin.

Opal Estate Pro

Plugin:
Opal Estate Pro
Plugin Slug:
opal-estate-pro
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3666
The vulnerability has not been patched. You should deactivate the plugin.

PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode

Plugin:
PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode
Plugin Slug:
paypal-pay-buy-donation-and-cart-buttons-shortcode
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3065
The vulnerability has not been patched. You should deactivate the plugin.

Pet Manager

Plugin:
Pet Manager
Plugin Slug:
pet-manager
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-3917
The vulnerability has not been patched. You should deactivate the plugin.

Sailthru Triggermail

Plugin:
Sailthru Triggermail
Plugin Slug:
sailthru-triggermail
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-4290
The vulnerability has not been patched. You should deactivate the plugin.

Sailthru Triggermail

Plugin:
Sailthru Triggermail
Plugin Slug:
sailthru-triggermail
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-4289
The vulnerability has not been patched. You should deactivate the plugin.

Praison SEO WordPress

Plugin:
Praison SEO WordPress
Plugin Slug:
seo-wordpress
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34801
The vulnerability has not been patched. You should deactivate the plugin.

Simple Popup Manager

Plugin:
Simple Popup Manager
Plugin Slug:
simple-popup-manager
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34797
The vulnerability has not been patched. You should deactivate the plugin.

Toolbar Extras for Elementor & More

Plugin:
Toolbar Extras for Elementor & More
Plugin Slug:
toolbar-extras
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3611
The vulnerability has not been patched. You should deactivate the plugin.

Woocommerce – Recent Purchases

Plugin:
Woocommerce – Recent Purchases
Plugin Slug:
woo-recent-purchases
Vulnerability:
Local File Inclusion
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-35634
The vulnerability has not been patched. You should deactivate the plugin.

WP Backpack

Plugin:
WP Backpack
Plugin Slug:
wp-backpack
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-4756
The vulnerability has not been patched. You should deactivate the plugin.

WP Font Awesome Share Icons

Plugin:
WP Font Awesome Share Icons
Plugin Slug:
wp-font-awesome-share-icons
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3198
The vulnerability has not been patched. You should deactivate the plugin.

WP Next Post Navi

Plugin:
WP Next Post Navi
Plugin Slug:
wp-next-post-navi
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34793
The vulnerability has not been patched. You should deactivate the plugin.

WP Scraper

Plugin:
WP Scraper
Plugin Slug:
wp-scraper
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3663
The vulnerability has not been patched. You should deactivate the plugin.

Elementor Website Builder – More than Just a Page Builder

Plugin:
Elementor Website Builder – More than Just a Page Builder
Plugin Slug:
elementor
Installations
10,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.21.6
Severity Score:
Medium
CVE:
2024-4619
The vulnerability has been patched, so you should update to version 3.21.6.

Elementor Header & Footer Builder

Plugin:
Elementor Header & Footer Builder
Plugin Slug:
header-footer-elementor
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.26.1
Severity Score:
Medium
CVE:
2024-2618
The vulnerability has been patched, so you should update to version 1.6.26.1.

WP Fastest Cache

Plugin:
WP Fastest Cache
Plugin Slug:
wp-fastest-cache
Installations
1,000,000+
Vulnerability:
Arbitrary File Deletion
Patched in Version:
1.2.7
Severity Score:
High
CVE:
2024-4347
The vulnerability has been patched, so you should update to version 1.2.7.

Premium Addons for Elementor

Plugin:
Premium Addons for Elementor
Plugin Slug:
premium-addons-for-elementor
Installations
700,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.10.32
Severity Score:
Medium
CVE:
2024-4378
The vulnerability has been patched, so you should update to version 4.10.32.

Page Builder by SiteOrigin

Plugin:
Page Builder by SiteOrigin
Plugin Slug:
siteorigin-panels
Installations
700,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.29.16
Severity Score:
Medium
CVE:
2024-4361
The vulnerability has been patched, so you should update to version 2.29.16.

Spectra – WordPress Gutenberg Blocks

Plugin:
Spectra – WordPress Gutenberg Blocks
Plugin Slug:
ultimate-addons-for-gutenberg
Installations
700,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.13.1
Severity Score:
Medium
CVE:
2024-4366
The vulnerability has been patched, so you should update to version 2.13.1.

Spectra – WordPress Gutenberg Blocks

Plugin:
Spectra – WordPress Gutenberg Blocks
Plugin Slug:
ultimate-addons-for-gutenberg
Installations
700,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.12.9
Severity Score:
Medium
CVE:
2024-1814
The vulnerability has been patched, so you should update to version 2.12.9.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.1.6
Severity Score:
Medium
CVE:
2024-4553
The vulnerability has been patched, so you should update to version 7.1.6.

SiteOrigin Widgets Bundle

Plugin:
SiteOrigin Widgets Bundle
Plugin Slug:
so-widgets-bundle
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.61.0
Severity Score:
Medium
CVE:
2024-4362
The vulnerability has been patched, so you should update to version 1.61.0.

WP Go Maps (formerly WP Google Maps)

Plugin:
WP Go Maps (formerly WP Google Maps)
Plugin Slug:
wp-google-maps
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
9.0.37
Severity Score:
Medium
CVE:
2024-3557
The vulnerability has been patched, so you should update to version 9.0.37.

HT Mega – Absolute Addons For Elementor

Plugin:
HT Mega – Absolute Addons For Elementor
Plugin Slug:
ht-mega-for-elementor
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.5.3
Severity Score:
Medium
CVE:
2024-4876
The vulnerability has been patched, so you should update to version 2.5.3.

HT Mega – Absolute Addons For Elementor

Plugin:
HT Mega – Absolute Addons For Elementor
Plugin Slug:
ht-mega-for-elementor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.5.3
Severity Score:
Medium
CVE:
2024-4875
The vulnerability has been patched, so you should update to version 2.5.3.

Social Icons Widget & Block by WPZOOM

Plugin:
Social Icons Widget & Block by WPZOOM
Plugin Slug:
social-icons-widget-by-wpzoom
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.2.18
Severity Score:
Medium
CVE:
2024-2189
The vulnerability has been patched, so you should update to version 4.2.18.

EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor

Plugin:
EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor
Plugin Slug:
embedpress
Installations
90,000+
Vulnerability:
Broken Access Control
Patched in Version:
3.9.13
Severity Score:
Medium
CVE:
2024-1803
The vulnerability has been patched, so you should update to version 3.9.13.

LearnPress – WordPress LMS Plugin

Plugin:
LearnPress – WordPress LMS Plugin
Plugin Slug:
learnpress
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.2.6.7
Severity Score:
Medium
CVE:
2024-4971
The vulnerability has been patched, so you should update to version 4.2.6.7.

Master Slider – Responsive Touch Slider

Plugin:
Master Slider – Responsive Touch Slider
Plugin Slug:
master-slider
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.10
Severity Score:
Medium
CVE:
2024-4470
The vulnerability has been patched, so you should update to version 3.9.10.

Brizy – Page Builder

Plugin:
Brizy – Page Builder
Plugin Slug:
brizy
Installations
80,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.4.44
Severity Score:
Medium
CVE:
2024-3711
The vulnerability has been patched, so you should update to version 2.4.44.

Email Log

Plugin:
Email Log
Plugin Slug:
email-log
Installations
80,000+
Vulnerability:
Other Vulnerability Type
Patched in Version:
2.4.9
Severity Score:
High
CVE:
2024-0867
The vulnerability has been patched, so you should update to version 2.4.9.

Media Library Assistant

Plugin:
Media Library Assistant
Plugin Slug:
media-library-assistant
Installations
70,000+
Vulnerability:
SQL Injection
Patched in Version:
3.16
Severity Score:
High
CVE:
2024-3518
The vulnerability has been patched, so you should update to version 3.16.

Media Library Assistant

Plugin:
Media Library Assistant
Plugin Slug:
media-library-assistant
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.16
Severity Score:
High
CVE:
2024-3519
The vulnerability has been patched, so you should update to version 3.16.

YITH WooCommerce Ajax Search

Plugin:
YITH WooCommerce Ajax Search
Plugin Slug:
yith-woocommerce-ajax-search
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.1
Severity Score:
High
CVE:
2024-4455
The vulnerability has been patched, so you should update to version 2.4.1.

Advanced iFrame

Plugin:
Advanced iFrame
Plugin Slug:
advanced-iframe
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2024.4
Severity Score:
Medium
CVE:
2024-4365
The vulnerability has been patched, so you should update to version 2024.4.

WP Table Builder – WordPress Table Plugin

Plugin:
WP Table Builder – WordPress Table Plugin
Plugin Slug:
wp-table-builder
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.15
Severity Score:
Medium
CVE:
2024-4700
The vulnerability has been patched, so you should update to version 1.4.15.

Carousel Slider

Plugin:
Carousel Slider
Plugin Slug:
carousel-slider
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.2.11
Severity Score:
Medium
CVE:
2024-4372
The vulnerability has been patched, so you should update to version 2.2.11.

Ditty – Responsive News Tickers, Sliders, and Lists

Plugin:
Ditty – Responsive News Tickers, Sliders, and Lists
Plugin Slug:
ditty-news-ticker
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1.36
Severity Score:
Medium
CVE:
2024-3939
The vulnerability has been patched, so you should update to version 3.1.36.

FV Flowplayer Video Player

Plugin:
FV Flowplayer Video Player
Plugin Slug:
fv-wordpress-flowplayer
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.5.46.7212
Severity Score:
High
CVE:
2024-35631
The vulnerability has been patched, so you should update to version 7.5.46.7212.

Reviews and Rating – Google Reviews

Plugin:
Reviews and Rating – Google Reviews
Plugin Slug:
g-business-reviews-rating
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.3
Severity Score:
Medium
CVE:
2024-5218
The vulnerability has been patched, so you should update to version 5.3.

ND Shortcodes

Plugin:
ND Shortcodes
Plugin Slug:
nd-shortcodes
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.6
Severity Score:
Medium
CVE:
2024-5220
The vulnerability has been patched, so you should update to version 7.6.

WP DSGVO Tools (GDPR)

Plugin:
WP DSGVO Tools (GDPR)
Plugin Slug:
shapepress-dsgvo
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1.33
Severity Score:
Medium
CVE:
2024-3201
The vulnerability has been patched, so you should update to version 3.1.33.

ShareThis Share Buttons

Plugin:
ShareThis Share Buttons
Plugin Slug:
sharethis-share-buttons
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.1
Severity Score:
Medium
CVE:
2024-3648
The vulnerability has been patched, so you should update to version 2.3.1.

WPZOOM Addons for Elementor (Templates, Widgets)

Plugin:
WPZOOM Addons for Elementor (Templates, Widgets)
Plugin Slug:
wpzoom-elementor-addons
Installations
20,000+
Vulnerability:
Local File Inclusion
Patched in Version:
1.1.38
Severity Score:
Critical
CVE:
2024-5147
The vulnerability has been patched, so you should update to version 1.1.38.

LA-Studio Element Kit for Elementor

Plugin:
LA-Studio Element Kit for Elementor
Plugin Slug:
lastudio-element-kit
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.8
Severity Score:
Medium
CVE:
2024-4431
The vulnerability has been patched, so you should update to version 1.3.8.

WP Photo Album Plus

Plugin:
WP Photo Album Plus
Plugin Slug:
wp-photo-album-plus
Installations
10,000+
Vulnerability:
Content Injection
Patched in Version:
8.7.00.004
Severity Score:
Medium
CVE:
2024-4037
The vulnerability has been patched, so you should update to version 8.7.00.004.

WP TripAdvisor Review Slider

Plugin:
WP TripAdvisor Review Slider
Plugin Slug:
wp-tripadvisor-review-slider
Installations
10,000+
Vulnerability:
SQL Injection
Patched in Version:
12.7
Severity Score:
High
CVE:
2024-35630
The vulnerability has been patched, so you should update to version 12.7.

WordPress + Microsoft Office 365 / Azure AD | LOGIN

Plugin:
WordPress + Microsoft Office 365 / Azure AD | LOGIN
Plugin Slug:
wpo365-login
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
28.0
Severity Score:
Medium
CVE:
2024-4706
The vulnerability has been patched, so you should update to version 28.0.

140+ Widgets | Best Addons For Elementor – FREE

Plugin:
140+ Widgets | Best Addons For Elementor – FREE
Plugin Slug:
xpro-elementor-addons
Installations
10,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.4.3.2
Severity Score:
High
CVE:
2024-4471
The vulnerability has been patched, so you should update to version 1.4.3.2.

Videojs HTML5 Player

Plugin:
Videojs HTML5 Player
Plugin Slug:
videojs-html5-player
Installations
9,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.12
Severity Score:
Medium
CVE:
2024-5205
The vulnerability has been patched, so you should update to version 1.1.12.

Awesome Contact Form7 for Elementor

Plugin:
Awesome Contact Form7 for Elementor
Plugin Slug:
awesome-contact-form7-for-elementor
Installations
8,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.0
Severity Score:
Medium
CVE:
2024-4486
The vulnerability has been patched, so you should update to version 3.0.

Primary Addon for Elementor

Plugin:
Primary Addon for Elementor
Plugin Slug:
primary-addon-for-elementor
Installations
8,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.5.6
Severity Score:
Medium
CVE:
2024-5229
The vulnerability has been patched, so you should update to version 1.5.6.

Hash Elements

Plugin:
Hash Elements
Plugin Slug:
hash-elements
Installations
7,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.9
Severity Score:
Medium
CVE:
2024-5177
The vulnerability has been patched, so you should update to version 1.3.9.

Survey Maker – Best WordPress Survey Plugin

Plugin:
Survey Maker – Best WordPress Survey Plugin
Plugin Slug:
survey-maker
Installations
6,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.2.9
Severity Score:
Medium
CVE:
2024-4061
The vulnerability has been patched, so you should update to version 4.2.9.

Testimonial Carousel For Elementor

Plugin:
Testimonial Carousel For Elementor
Plugin Slug:
testimonials-carousel-elementor
Installations
6,000+
Vulnerability:
Broken Access Control
Patched in Version:
10.2.1
Severity Score:
Medium
CVE:
2024-4858
The vulnerability has been patched, so you should update to version 10.2.1.

WPKoi Templates for Elementor

Plugin:
WPKoi Templates for Elementor
Plugin Slug:
wpkoi-templates-for-elementor
Installations
6,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.5.11
Severity Score:
Medium
CVE:
2024-4980
The vulnerability has been patched, so you should update to version 2.5.11.

AI ChatBot for WordPress – WPBot

Plugin:
AI ChatBot for WordPress – WPBot
Plugin Slug:
chatbot
Installations
5,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.3.6
Severity Score:
Medium
CVE:
2024-0452
The vulnerability has been patched, so you should update to version 5.3.6.

WP Ultimate Post Grid

Plugin:
WP Ultimate Post Grid
Plugin Slug:
wp-ultimate-post-grid
Installations
5,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.2
Severity Score:
Medium
CVE:
2024-4043
The vulnerability has been patched, so you should update to version 3.9.2.

PopupAlly

Plugin:
PopupAlly
Plugin Slug:
popupally
Installations
4,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.2
Severity Score:
Medium
CVE:
2024-34796
The vulnerability has been patched, so you should update to version 2.1.2.

Move Addons for Elementor

Plugin:
Move Addons for Elementor
Plugin Slug:
move-addons
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.2
Severity Score:
Medium
CVE:
2024-4695
The vulnerability has been patched, so you should update to version 1.3.2.

Debug Log – Manger Tool

Plugin:
Debug Log – Manger Tool
Plugin Slug:
debug-log-config-tool
Installations
2,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
1.5
Severity Score:
Medium
CVE:
2024-34798
The vulnerability has been patched, so you should update to version 1.5.

Event post

Plugin:
Event post
Plugin Slug:
event-post
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
5.9.5
Severity Score:
Medium
CVE:
2024-1376
The vulnerability has been patched, so you should update to version 5.9.5.

Fastly

Plugin:
Fastly
Plugin Slug:
fastly
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.2.26
Severity Score:
Medium
CVE:
2024-34803
The vulnerability has been patched, so you should update to version 1.2.26.

Hash Form – Drag & Drop Form Builder

Plugin:
Hash Form – Drag & Drop Form Builder
Plugin Slug:
hash-form
Installations
1,000+
Vulnerability:
PHP Object Injection
Patched in Version:
1.1.1
Severity Score:
Medium
CVE:
2024-5085
The vulnerability has been patched, so you should update to version 1.1.1.

Hash Form – Drag & Drop Form Builder

Plugin:
Hash Form – Drag & Drop Form Builder
Plugin Slug:
hash-form
Installations
1,000+
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
1.1.1
Severity Score:
Critical
CVE:
2024-5084
The vulnerability has been patched, so you should update to version 1.1.1.

Tainacan

Plugin:
Tainacan
Plugin Slug:
tainacan
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.21.4
Severity Score:
Medium
CVE:
2024-34795
The vulnerability has been patched, so you should update to version 0.21.4.

Tainacan

Plugin:
Tainacan
Plugin Slug:
tainacan
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.21.4
Severity Score:
High
CVE:
2024-34794
The vulnerability has been patched, so you should update to version 0.21.4.

Web Directory Free

Plugin:
Web Directory Free
Plugin Slug:
web-directory-free
Installations
600+
Vulnerability:
SQL Injection
Patched in Version:
1.7.0
Severity Score:
Critical
CVE:
2024-3552
The vulnerability has been patched, so you should update to version 1.7.0.

WP-ViperGB

Plugin:
WP-ViperGB
Plugin Slug:
wp-vipergb
Installations
600+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.6.2
Severity Score:
Medium
CVE:
2024-4409
The vulnerability has been patched, so you should update to version 1.6.2.

Atarim

Plugin:
Atarim
Plugin Slug:
atarim-visual-collaboration
Vulnerability:
Other Vulnerability Type
Patched in Version:
3.30
Severity Score:
High
CVE:
2024-2038
The vulnerability has been patched, so you should update to version 3.30.

Country State City Dropdown CF7

Plugin:
Country State City Dropdown CF7
Plugin Slug:
country-state-city-auto-dropdown
Vulnerability:
SQL Injection
Patched in Version:
2.7.3
Severity Score:
Critical
CVE:
2024-3495
The vulnerability has been patched, so you should update to version 2.7.3.

ElementsKit Pro

Plugin:
ElementsKit Pro
Plugin Slug:
elementskit
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.6.2
Severity Score:
Medium
CVE:
2024-4452
The vulnerability has been patched, so you should update to version 3.6.2.

LayerSlider

Plugin:
LayerSlider
Plugin Slug:
layerslider
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.11.1
Severity Score:
Medium
CVE:
2024-4575
The vulnerability has been patched, so you should update to version 7.11.1.

Contact Form & Lead Form Elementor Builder

Plugin:
Contact Form & Lead Form Elementor Builder
Plugin Slug:
lead-form-builder
Vulnerability:
Content Injection
Patched in Version:
1.9.2
Severity Score:
Medium
CVE:
2024-4261
The vulnerability has been patched, so you should update to version 1.9.2.

Memberpress

Plugin:
Memberpress
Plugin Slug:
memberpress
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.11.30
Severity Score:
Medium
CVE:
2024-5025
The vulnerability has been patched, so you should update to version 1.11.30.

Memberpress

Plugin:
Memberpress
Plugin Slug:
memberpress
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
1.11.30
Severity Score:
Medium
CVE:
2024-5031
The vulnerability has been patched, so you should update to version 1.11.30.

Pie Register (Add on) – Social Sites Login

Plugin:
Pie Register (Add on) – Social Sites Login
Plugin Slug:
pie-register-social-site
Vulnerability:
Broken Authentication
Patched in Version:
1.7.8
Severity Score:
Critical
CVE:
2024-4544
The vulnerability has been patched, so you should update to version 1.7.8.

NextScripts

Plugin:
NextScripts
Plugin Slug:
social-networks-auto-poster-facebook-twitter-g
Vulnerability:
Sensitive Data Exposure
Patched in Version:
4.4.4
Severity Score:
High
CVE:
2024-2088
The vulnerability has been patched, so you should update to version 4.4.4.

NextScripts

Plugin:
NextScripts
Plugin Slug:
social-networks-auto-poster-facebook-twitter-g
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
4.4.4
Severity Score:
Medium
CVE:
2024-1446
The vulnerability has been patched, so you should update to version 4.4.4.

NextScripts

Plugin:
NextScripts
Plugin Slug:
social-networks-auto-poster-facebook-twitter-g
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
4.4.4
Severity Score:
High
CVE:
2024-1762
The vulnerability has been patched, so you should update to version 4.4.4.

Uber Menu

Plugin:
Uber Menu
Plugin Slug:
ubermenu
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.8.3
Severity Score:
Medium
CVE:
2024-4710
The vulnerability has been patched, so you should update to version 3.8.3.

Userpro

Plugin:
Userpro
Plugin Slug:
userpro
Vulnerability:
Privilege Escalation
Patched in Version:
5.1.9
Severity Score:
Critical
CVE:
2024-35700
The vulnerability has been patched, so you should update to version 5.1.9.

WordPress Themes — 1 Patched / 0 Unpatched

Blocksy

Theme:
Blocksy
Theme Slug:
blocksy
Downloads
3,232,407
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.47
Severity Score:
Medium
CVE:
2024-4943
The vulnerability has been patched, so you should update to version 2.0.47.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Sarah

Sarah has been with StellarWP since 2024. As our marketing generalist, she spends her day writing content and completing projects for SolidWP, LearnDash, and The Events Calendar. In her free time, Sarah can be found playing pickleball, enjoying coffee at a local coffee shop, and spending time with her husband.

Browse all of Sarah's articles

Author:

Sarah

Sarah has been with StellarWP since 2024. As our marketing generalist, she spends her day writing content and completing projects for SolidWP, LearnDash, and The Events Calendar. In her free time, Sarah can be found playing pickleball, enjoying coffee at a local coffee shop, and spending time with her husband.

Browse all of Sarah's articles