WordPress Vulnerability Report – July 27, 2023

Since last week, 329 total vulnerabilities emerged in public disclosure. They may affect over 9 million WordPress sites. There are 209 plugin vulnerabilities and 18 theme vulnerabilities with security patches, so run those updates! Additionally, there are 66 plugin vulnerabilities and 36 theme vulnerabilities with no patch available yet.

Dan Knauss

Updated:Sep 28, 2023

Published:Jul 27, 2023

Filed Under:WordPress Vulnerability Report

Reading Time:114 min.

1. WordPress Core Vulnerabilities — Patched
2. WordPress Plugin Vulnerabilities — Patched

2.1 Essential Addons For Elementor
2.2 Ninja Forms
2.3 Ninja Forms
2.4 Ninja Forms
2.5 The Events Calendar
2.6 The Events Calendar
2.7 Popup Maker
2.8 NextGEN Gallery
2.9 WP Activity Log
2.10 404 to 301
2.11 Elementor Addon Elements
2.12 CAPTCHA 4WP
2.13 WP AutoTerms: Privacy Policy Generator (GDPR & CCPA), Terms & Conditions Generator, Cookie Notice Banner
2.14 Blocksy Companion
2.15 Meta Tag Manager
2.16 Pods
2.17 TI WooCommerce Wishlist
2.18 Asset CleanUp: Page Speed Booster
2.19 AnyWhere Elementor
2.20 EmbedPress
2.21 Event Tickets
2.22 Easy Watermark
2.23 Simple Author Box
2.24 WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to fix Insecure Content
2.25 Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
2.26 Preloader Plus – WordPress Loading Screen Plugin
2.27 Spotlight Social Media Feeds
2.28 Weglot Translate – Translate your WordPress website and go multilingual
2.29 Better Notifications for WP
2.30 Stop User Enumeration
2.31 Mail Bank – #1 Mail SMTP Plugin for WordPress
2.32 Gutenberg Block Editor Toolkit
2.33 Divi Contact Form 7
2.34 Cost Calculator Builder
2.35 Image Photo Gallery Final Tiles Grid
2.36 Hide Admin Bar Based on User Roles
2.37 Divi Carousel Lite
2.38 WP Google Review Slider
2.39 DiviTorque – Divi Theme, Divi Builder and Extra Theme
2.40 Contact Form 7 Skins
2.41 Greenshift – animation and page builder blocks
2.42 New User Approve
2.43 HP Everywhere
2.44 PHP Everywhere
2.45 PHP Everywhere
2.46 Redirect 404 Error Page to Homepage or Custom Page with Logs
2.47 Gallery Blocks with Lightbox
2.48 Disable Emojis & Disable Embeds for WordPress Performance & SpeedUp
2.49 Media Library Categories
2.50 WP to Twitter
2.51 Product Feed Manager
2.52 DeMomentSomTres WordPress Export Posts With Images
2.53 Enjoy Social Feed plugin for WordPress website
2.54 eRoom – Zoom Meetings & Webinar
2.55 MasterStudy LMS
2.56 Notification
2.57 PowerPack Lite for Beaver Builder
2.58 Seo Optimized Images
2.59 WP News and Scrolling Widgets
2.60 Stop WP Emails Going to Spam
2.61 WooCommerce Tiered Price Table
2.62 WP Review Slider
2.63 WP Mail Log
2.64 WP VR
2.65 ACF Frontend – Add and edit posts, pages, users and more all from the frontend
2.66 HuCommerce | Magyar WooCommerce kiegészítések
2.67 Post to Google My Business (Google Business Profile)
2.68 PublishPress Planner: Organize and Schedule Your WordPress Content
2.69 Salon booking system
2.70 Easy Photography Portfolio
2.71 Quiz Cat
2.72 WooCommerce Google Ads Dynamic Remarketing
2.73 WP Travel
2.74 WpStream – Live Streaming, Video on Demand, Pay Per View
2.75 ACF-VC Integrator
2.76 AnyComment
2.77 WordPress Tag Cloud Plugin – Tag Groups
2.78 Search Console
2.79 Discussion Board
2.80 Photo Engine
2.81 Image Carousel For Divi
2.82 Market Exporter
2.83 Multiple Page Generator Plugin – MPG
2.84 Share This Image
2.85 Client Invoicing by Sprout Invoices
2.86 Integration for WooCommerce and Zoho CRM
2.87 Spanish Market Enhancements for WooCommerce
2.88 Pay For Post with WooCommerce
2.89 360 Javascript Viewer
2.90 Activity Log For MainWP
2.91 WooCommerce Attribute Stock – Share Stock Between Products (Lite Version)
2.92 Message Filter for Contact Form 7
2.93 Church Admin
2.94 TempTool [Show Current Template Info]
2.95 XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin]
2.96 WordPress Team Members – GS Plugins
2.97 Remove Duplicate Posts
2.98 WP Required Taxonomies – Categories and Tags Mandatory
2.99 SV Proven Expert
2.100 SV Tracking Manager
2.101 UltraAddons Elementor Lite (Header & Footer Builder, Menu Builder, Cart Icon, Shortcode)
2.102 WooBuddy
2.103 Live Sales Notification for Woocommerce – Woomotiv
2.104 Integration for WooCommerce and QuickBooks
2.105 wpShopGermany IT-RECHT KANZLEI
2.106 WordPress Gallery Plugin – Limb Image Gallery
2.107 GraphComment Comment system
2.108 Terms & Conditions Per Product
2.109 Chamber Dashboard Business Directory
2.110 Embed Docs – Elementor Files Addon,Elementor Docs Addon,Embed PDF, Word, PowerPoint and Excel Files in Gutenberg & Elementor
2.111 Embed Video Thumbnail
2.112 WordPress Form Builder Plugin – Gutenberg Forms
2.113 FormsCRM
2.114 WZ Followed Posts – Display what visitors are reading
2.115 Member Profile Forms / Custom Registration / Post From Profile in BuddyPress / BuddyBoss
2.116 WPEventPartners Demo Import
2.117 Advanced WC Analytics – Google Analytics Dashboard for WooCommerce
2.118 Display WP Admin Pages in the Frontend – WP Frontend Admin
2.119 Product Filter Widget for Elementor
2.120 what3words Address Field
2.121 Advanced Custom Fields Frontend Forms – ACF Forms – ACF Post Form – ACF Registration Form – ACF Content Form – ACF Profile Form
2.122 BuddyForms Ultimate Member
2.123 Gift Message for WooCommerce
2.124 Ultimate LinkedIn Integration
2.125 Shipping for Nova Poshta
2.126 Spice Blocks
2.127 WooCommerce Country Catalogs – Product Country Restrictions
2.128 2MB Autocode
2.129 Checkbox
2.130 WordPress Image Compression and Optimizer Plugin – CheetahO
2.131 Multicollab – Google Doc-Style Editorial Commenting for WordPress
2.132 Content Blocks Builder
2.133 WordPress Job Board and Recruitment Plugin – JobWP
2.134 Joli FAQ SEO – WordPress FAQ Plugin
2.135 RSS Control
2.136 Simple Tour Guide
2.137 Coming Soon Pages for WordPress – Coming Soon Booster
2.138 WP SPID Italia
2.139 AI Tools – Chatbot, ChatGPT, Content Generator, Image Generator, Artificial Intelligence GPT
2.140 Coming Soon Master
2.141 EthereumICO
2.142 Files Download Delay
2.143 Bulk Landing Page Creator for WordPress – LPagery
2.144 Mobile App Editor – WordPress to Android App Builder
2.145 Search Field for Gravity Forms
2.146 Stellar Places
2.147 Subaccounts for WooCommerce
2.148 WN Flipbox Pro
2.149 Bing Custom Search for WordPress
2.150 WP Tools Divi Blog Carousel
2.151 Display Data on your site! Create Dynamic Content Templates from any form of data. Works with ACF, Pods, BuddyPress/ BuddyBoss
2.152 Contact Form By Mega Forms – Drag and Drop Form Builder
2.153 Ultimate Custom ScrollBar
2.154 WPGutenBlog Demo Import
2.155 SV100 Companion
2.156 Blocks Product Editor for WooCommerce
2.157 Variable Inspector
2.158 Stripe Express
2.159 BuddyForms Form Elements for WooCommerce
2.160 Order Redirects for WooCommerce
2.161 Simple blueprint installer
2.162 BuddyForms Moderation ( Former: Review Logic )
2.163 Import Holded for WooCommerce or Easy Digital Downloads
2.164 Order Picking For WooCommerce
2.165 ShortcodeHub – MultiPurpose Shortcode Builder
2.166 WPEForm Lite – Drag and Drop Live Form Builder for Contact, Payment & Quiz Forms
2.167 CO2ok: carbon offsetting for e-commerce
2.168 SV Forms
2.169 SV Posts
2.170 Video Analytics for Cloudflare Stream
2.171 WP Table Pixie
2.172 CF7 ReCaptcha Mine
2.173 Convoworks WP
2.174 Custom Welcome Guide
2.175 DeMomentSomTres Gravity Forms Improvements
2.176 Fast Custom Social Share by CodeBard
2.177 Contact form builder for Gutenberg – Formello
2.178 Menukaart – Restaurant Menu & Online Ordering with WooCommerce
2.179 SV Columns Manager
2.180 Divi Testimonial Plus
2.181 WP Signals
2.182 BuddyForms Anonymous Author
2.183 BuddyForms Attach Post with Group
2.184 BuddyForms Hierarchical Posts
2.185 BuddyForms Posts 2 Posts
2.186 BuddyForms Remote
2.187 Caldera Forms
2.188 Simple Freemius Shop
2.189 Convert Pro
2.190 DeMomentSomTres Subscribe
2.191 DEV.LAND
2.192 DokoBuilder : DIY Product Bundle for WooCommerce
2.193 Expandable Paywall
2.194 External Media Upload
2.195 Frontend Admin – Add and edit posts, pages, users and more all from the frontend
2.196 Gallery Bank
2.197 Map Plugin alternative to Google Maps using MapQuest, with directions
2.198 Information for help
2.199 Google Maps Plugin by Intergeo
2.200 Oxygen Builder
2.201 Popups
2.202 Remove WP Update Nags
2.203 SV Media Library
2.204 BuddyPress Groups Integration for WooCommerce
2.205 WP Cloud Server
2.206 WP Native Articles – Instant Articles Plugin for WordPress
2.207 Schema Pro
2.208 WP Scrive by Webbstart
2.209 WPCasa Mail Alert

3. WordPress Plugin Vulnerabilities — Unpatched

3.1 WPS Limit Login
3.2 Custom Field Template
3.3 Social Share Icons & Social Share Buttons
3.4 WP-CopyProtect [Protect your blog posts]
3.5 Elastic Email Sender
3.6 GTmetrix for WordPress
3.7 Molongui
3.8 Pinpoint Booking System
3.9 Borderless
3.10 Art Decoration Shortcode
3.11 Banner Management For WooCommerce
3.12 Fraud Prevention For Woocommerce
3.13 Google Map Shortcode
3.14 MultiParcels Shipping For WooCommerce
3.15 Server Info
3.16 Language
3.17 WP Emoji One
3.18 WP Quick Post Duplicator
3.19 Booster Elementor Addons
3.20 Instant CSS
3.21 CodeBard's Patron Button and Widgets for Patreon
3.22 Simple Googlebot Visit
3.23 QR code MeCard/vCard generator
3.24 WRC Pricing Tables
3.25 Audio Player with Playlist Ultimate
3.26 Client Portal : SuiteDash Direct Login
3.27 Go Fetch Jobs (for WP Job Manager)
3.28 Mobile Address Bar Changer
3.29 Perelink Pro
3.30 Post List With Featured Image
3.31 Post Affiliate Pro
3.32 Remove Duplicate Posts
3.33 Donations Made Easy – Smart Donations
3.34 Taboola
3.35 Exifography
3.36 Onepage Builder – Easiest Landing Page Builder For WordPress
3.37 eaSYNC
3.38 Post Connector
3.39 Smarty for WordPress
3.40 Gestion-Pymes
3.41 Woocommerce Delivery Date Premium
3.42 bbResolutions
3.43 BlogPost – BlogPost Widgets – Amazing Blog Layouts
3.44 CF7 Constant Contact Fields Mapping
3.45 WP Clone Menu
3.46 DancePress (TRWA)
3.47 DeMomentSomTres Immediate Send
3.48 Disabler
3.49 WordPress Easy Call Now Button by elixirs.io
3.50 Extend Filter Products By Price Widget
3.51 Easy Responsive Pricing Tables
3.52 Jupiter X Core
3.53 WP Logger
3.54 LWS Affiliation
3.55 Menu Item Scheduler
3.56 Protect Uploads with Login – Protect Your Uploads
3.57 Quasar form
3.58 Role Based Bulk Quantity Pricing
3.59 Page Builder for Gutenberg – StarterBlocks
3.60 Subscribe to Category
3.61 tagDiv Composer
3.62 Ultra Elementor Addons
3.63 WordPress Auto SEO Plugin – Upfiv SEO Wizard
3.64 User Email Verification for WooCommerce
3.65 WP-FlyBox
3.66 WooCommerce Sync for Google Sheet

4. WordPress Theme Vulnerabilities

4.1 Bootstrap Blog
4.2 Ona
4.3 Yuki
4.4 Techism
4.5 Chic Lifestyle
4.6 Lifestyle Magazine
4.7 SalesZone
4.8 Travel Tour
4.9 Brand
4.10 WP Sierra
4.11 Eighteen tags
4.12 Hasium
4.13 Broadcast Lite
4.14 Salzburg Blog
4.15 Everse
4.16 Speculor
4.17 Meridia
4.18 Aquarella Lite
4.19 Consultpress Lite
4.20 Topcat Lite
4.21 Shuban
4.22 Purus
4.23 Elation
4.24 GutenBook
4.25 Chained
4.26 Elasta
4.27 Purosa
4.28 LearnMore
4.29 WPCake
4.30 Nokke
4.31 Arendelle
4.32 PixiGo
4.33 WP Moose
4.34 G Blog
4.35 NicheBase
4.36 Cuisine Palace
4.37 Amela
4.38 Agncy
4.39 Travel Agency Booking
4.40 Bootstrap Fitness
4.41 Bootstrap Coach
4.42 Blockst
4.43 Relax Spa
4.44 Villar
4.45 BlogHub
4.46 Viralike
4.47 NewsHit
4.48 Simplifii
4.49 Roven Blog
4.50 Krste
4.51 Unakit
4.52 Temp Mail X
4.53 Rovenstart
4.54 Bani

Additionally, there are 66 plugin vulnerabilities and 36 theme vulnerabilities with no patch available yet. If you use an unpatched plugin or theme, check their vendors’ intentions and progress on a security release. Suppose no patch is forthcoming or the vulnerable software has been marked “closed” and dropped from the official WordPress theme and plugin repositories. In that case, you should consider deactivation and removal in favor of alternative solutions.

Such an unusually high number of vulnerability reports is due to outdated versions of many plugins and themes that may use a common third-party dependency, Freemius’ WordPress SDK 2.5.9. Please see the Freemius WordPress SDK 2.5.9 Security Disclosure for more details.

New Today: Patchstack lists multiple high-severity vulnerabilities in the Ninja Forms plugin, potentially affecting 900k active WordPress sites. These vulnerabilities include a POST-based reflected XSS and broken access control on the form submissions export feature. Please update to version 3.6.26.

WordPress Core Vulnerabilities — Patched

WordPress core is very secure when it’s properly configured and maintained. Vulnerable plugins not updated by site owners are the most common vector for attacks on WordPress websites. Our weekly WordPress Vulnerability Report, powered by Patchstack, covers new vulnerabilities that have emerged in plugins, themes, and/or WordPress core since last week’s report. Our goal is to spread awareness of emerging security threats and help you decide what to do if you find vulnerable software on your website. For a deeper analysis of recent trends in WordPress vulnerabilities and threat vectors, see our 2022 Annual Vulnerability Report.

These reports are published every Wednesday and include all active vulnerabilities tracked by Patchstack as of Monday since the previous report. This leaves a 48-hour window for the newest emerging vulnerabilities to be patched before full public disclosure. iThemes Security Pro users have access to vulnerability alerts emerging within this window.

WordPress Plugin Vulnerabilities — Patched

In this section, you’ll find the most recently disclosed WordPress plugin vulnerabilities fixed with a new release from their authors and maintainers. Please apply the updates if you are affected!

These vulnerabilities have been disclosed and scored for their severity, thanks to our friends at Patchstack. Each plugin listing includes the type of vulnerability with its CVE number and CVSS severity rating with links to more technical details. You’ll also see the number of active sites using the plugin and the plugin version release that patches the vulnerability. We start with the most popular plugins, representing the largest target for attackers.

Plugin:: Essential Addons for Elementor
Plugin Slug:: essential-addons-for-elementor-lite
Installations:: 1,000,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 5.8.2
Severity Score:: Medium
CVE:: 2023-3779

Plugin:: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Plugin Slug:: ninja-forms
Installations:: 900,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.6.26
Severity Score:: High
CVE:: 2023-37979

Plugin:: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Plugin Slug:: ninja-forms
Installations:: 900,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.6.26
Severity Score:: High
CVE:: 2023-38393

Plugin:: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Plugin Slug:: ninja-forms
Installations:: 900,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.6.26
Severity Score:: High
CVE:: 2023-38386

Plugin:: The Events Calendar
Plugin Slug:: the-events-calendar
Installations:: 800,000+
Vulnerability:: Broken Access Control
Patched in Version:: 6.1.3
Severity Score:: Medium
CVE:: 2023-35777

Plugin:: The Events Calendar
Plugin Slug:: the-events-calendar
Installations:: 800,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.1.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Popup Maker – Popup for opt-ins, lead gen, & more
Plugin Slug:: popup-maker
Installations:: 700,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.10.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WordPress Gallery Plugin – NextGEN Gallery
Plugin Slug:: nextgen-gallery
Installations:: 600,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4.7
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Activity Log
Plugin Slug:: wp-security-audit-log
Installations:: 200,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.4.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: 404 to 301 – Redirect, Log and Notify 404 Errors
Plugin Slug:: 404-to-301
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Elementor Addon Elements
Plugin Slug:: addon-elements-for-elementor-page-builder
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.12
Severity Score:: High
CVE:: 2023-33999

Plugin:: CAPTCHA 4WP
Plugin Slug:: advanced-nocaptcha-recaptcha
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 7.0.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP AutoTerms: Privacy Policy Generator (GDPR & CCPA), Terms & Conditions Generator, Cookie Notice Banner
Plugin Slug:: auto-terms-of-service-and-privacy-policy
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Blocksy Companion
Plugin Slug:: blocksy-companion
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.47
Severity Score:: High
CVE:: 2023-33999

Plugin:: Meta Tag Manager
Plugin Slug:: meta-tag-manager
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Pods – Custom Content Types and Fields
Plugin Slug:: pods
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.8.23
Severity Score:: High
CVE:: 2023-33999

Plugin:: TI WooCommerce Wishlist
Plugin Slug:: ti-woocommerce-wishlist
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Asset CleanUp: Page Speed Booster
Plugin Slug:: wp-asset-clean-up
Installations:: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.5.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: AnyWhere Elementor
Plugin Slug:: anywhere-elementor
Installations:: 90,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor
Plugin Slug:: embedpress
Installations:: 80,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Event Tickets and Registration
Plugin Slug:: event-tickets
Installations:: 70,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.6.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Easy Watermark
Plugin Slug:: easy-watermark
Installations:: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.7
Severity Score:: High
CVE:: 2023-33999

Plugin:: Simple Author Box
Plugin Slug:: simple-author-box
Installations:: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect to Force HTTPS, SSL Score
Plugin Slug:: wp-letsencrypt-ssl
Installations:: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.3.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor
Plugin Slug:: gutentor
Installations:: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Preloader Plus – WordPress Loading Screen Plugin
Plugin Slug:: preloader-plus
Installations:: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Spotlight Social Feeds [Block, Shortcode, and Widget]
Plugin Slug:: spotlight-social-photo-feeds
Installations:: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Weglot Translate – Translate your WordPress website and go multilingual
Plugin Slug:: weglot
Installations:: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Customize WordPress Emails and Alerts – Better Notifications for WP
Plugin Slug:: bnfw
Installations:: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7
Severity Score:: High
CVE:: 2023-33999

Plugin:: Stop User Enumeration
Plugin Slug:: stop-user-enumeration
Installations:: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Mail Bank – #1 Mail SMTP Plugin for WordPress
Plugin Slug:: wp-mail-bank
Installations:: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.13
Severity Score:: High
CVE:: 2023-33999

Plugin:: Gutenberg Block Editor Toolkit – EditorsKit
Plugin Slug:: block-options
Installations:: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.17
Severity Score:: High
CVE:: 2023-33999

Plugin:: Contact Form 7 Module For Divi Builder
Plugin Slug:: cf7-styler-for-divi
Installations:: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Cost Calculator Builder
Plugin Slug:: cost-calculator-builder
Installations:: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Image Photo Gallery Final Tiles Grid
Plugin Slug:: final-tiles-grid-gallery-lite
Installations:: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.5.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: Hide Admin Bar Based on User Roles
Plugin Slug:: hide-admin-bar-based-on-user-roles
Installations:: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: Divi Carousel Lite
Plugin Slug:: wow-carousel-for-divi-lite
Installations:: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.12
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Google Review Slider
Plugin Slug:: wp-google-places-review-slider
Installations:: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 12.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Divi Torque Lite
Plugin Slug:: addons-for-divi
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.6.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: CF7 Skins for Contact Form 7
Plugin Slug:: contact-form-7-skins
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Greenshift – animation and page builder blocks
Plugin Slug:: greenshift-animation-and-page-builder-blocks
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.8.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: New User Approve
Plugin Slug:: new-user-approve
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.5.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: PHP Everywhere
Plugin Slug:: php-everywhere
Installations:: 20,000+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 3.0.0
Severity Score:: Critical
CVE:: 2022-24664

Plugin:: PHP Everywhere
Plugin Slug:: php-everywhere
Installations:: 20,000+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 3.0.0
Severity Score:: Critical
CVE:: 2022-24665

Plugin:: PHP Everywhere
Plugin Slug:: php-everywhere
Installations:: 20,000+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 3.0.0
Severity Score:: Critical
CVE:: 2022-24663

Plugin:: Redirect 404 Error Page to Homepage or Custom Page with Logs
Plugin Slug:: redirect-404-error-page-to-homepage-or-custom-page
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery
Plugin Slug:: simply-gallery-block
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: Reduce HTTP Requests, Disable Emojis & Disable Embeds, Speedup WooCommerce
Plugin Slug:: wp-disable
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Media Library Categories
Plugin Slug:: wp-media-library-categories
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.1
Severity Score:: Medium
CVE:: 2023-36382

Plugin:: WP to Twitter
Plugin Slug:: wp-to-twitter
Installations:: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.3.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Product Feed Manager – WooCommerce to Google Shopping, Social Catalogs, and 170+ Popular Marketplaces
Plugin Slug:: best-woocommerce-feed
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: DeMomentSomTres WordPress Export Posts With Images
Plugin Slug:: demomentsomtres-wp-export
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 20200610
Severity Score:: High
CVE:: 2023-33999

Plugin:: Enjoy Social Feed plugin for WordPress website
Plugin Slug:: enjoy-instagram-instagram-responsive-images-gallery-and-carousel
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.2.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: eRoom – Zoom Meetings & Webinars
Plugin Slug:: eroom-zoom-meetings-webinar
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: MasterStudy LMS WordPress Plugin – for Online Courses and Education
Plugin Slug:: masterstudy-lms-learning-management-system
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.8.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Notification – Custom Notifications and Alerts for WordPress
Plugin Slug:: notification
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.1.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: PowerPack Lite for Beaver Builder
Plugin Slug:: powerpack-addon-for-beaver-builder
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.9.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Seo Optimized Images
Plugin Slug:: seo-optimized-images
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP News and Scrolling Widgets
Plugin Slug:: sp-news-and-widget
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Stop WP Emails Going to Spam
Plugin Slug:: stop-wp-emails-going-to-spam
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Tiered Pricing Table for WooCommerce
Plugin Slug:: tier-pricing-table
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.5.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Review Slider
Plugin Slug:: wp-facebook-reviews
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Mail Log
Plugin Slug:: wp-mail-log
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP VR – 360 Panorama and Virtual Tour Builder For WordPress
Plugin Slug:: wpvr
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Frontend Admin by DynamiApps
Plugin Slug:: acf-frontend-form-element
Installations:: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.8.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: HuCommerce | Magyar WooCommerce kiegészítések
Plugin Slug:: surbma-magyar-woocommerce
Installations:: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2022.0.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Post to Google My Business (Google Business Profile)
Plugin Slug:: post-to-google-my-business
Installations:: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1.14
Severity Score:: High
CVE:: 2023-33999

Plugin:: PublishPress Planner: Organize and Schedule Your WordPress Content
Plugin Slug:: publishpress
Installations:: 7,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: Salon booking system
Plugin Slug:: salon-booking-system
Installations:: 7,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 8.4.9
Severity Score:: High
CVE:: 2023-33999

Plugin:: Easy Photography Portfolio
Plugin Slug:: photography-portfolio
Installations:: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.9
Severity Score:: High
CVE:: 2023-33999

Plugin:: Quiz Cat – WordPress Quiz Plugin
Plugin Slug:: quiz-cat
Installations:: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WooCommerce Google Ads Dynamic Remarketing
Plugin Slug:: woocommerce-google-dynamic-retargeting-tag
Installations:: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.17
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Travel – Best Travel Booking WordPress Plugin, Tour Management Engine
Plugin Slug:: wp-travel
Installations:: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.2.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WpStream – Live Streaming, Video on Demand, Pay Per View
Plugin Slug:: wpstream
Installations:: 5,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.5.5
Severity Score:: Medium
CVE:: 2023-38512

Plugin:: ACF-VC Integrator
Plugin Slug:: acf-vc-integrator
Installations:: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: AnyComment
Plugin Slug:: anycomment
Installations:: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.0.99
Severity Score:: High
CVE:: 2023-33999

Plugin:: Tag Groups is the Advanced Way to Display Your Taxonomy Terms
Plugin Slug:: tag-groups
Installations:: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Search Console
Plugin Slug:: search-console
Installations:: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Discussion Board – WordPress Forum Plugin
Plugin Slug:: wp-discussion-board
Installations:: 3,000+
Vulnerability:: Content Injection
Patched in Version:: 2.4.9
Severity Score:: Medium
CVE:: 2023-39161

Plugin:: Photo Engine (Media Organizer & Lightroom)
Plugin Slug:: wplr-sync
Installations:: 3,000+
Vulnerability:: Insecure Direct Object References (IDOR)
Patched in Version:: 6.2.6
Severity Score:: Medium
CVE:: 2023-38513

Plugin:: Image Carousel For Divi
Plugin Slug:: image-carousel-for-divi
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Market Exporter
Plugin Slug:: market-exporter
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.19
Severity Score:: High
CVE:: 2023-33999

Plugin:: Multiple Page Generator Plugin – MPG
Plugin Slug:: multiple-pages-generator-by-porthas
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Share This Image
Plugin Slug:: share-this-image
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.81
Severity Score:: High
CVE:: 2023-33999

Plugin:: Client Invoicing by Sprout Invoices – Easy Estimates and Invoices for WordPress
Plugin Slug:: sprout-invoices
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 19.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Integration for WooCommerce and Zoho CRM, Books, Invoice, Inventory, Bigin
Plugin Slug:: woo-zoho
Installations:: 2,000+
Vulnerability:: Open Redirection
Patched in Version:: 1.3.7
Severity Score:: Medium
CVE:: 2023-38481

Plugin:: Spanish Market Enhancements for WooCommerce
Plugin Slug:: woocommerce-es
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Pay For Post with WooCommerce
Plugin Slug:: woocommerce-pay-per-post
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1.11
Severity Score:: High
CVE:: 2023-33999

Plugin:: 360 Javascript Viewer
Plugin Slug:: 360deg-javascript-viewer
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Activity Log For MainWP
Plugin Slug:: activity-log-mainwp
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WooCommerce Attribute Stock – Share Stock Between Products (Lite Version)
Plugin Slug:: attribute-stock-for-woocommerce
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Message Filter for Contact Form 7
Plugin Slug:: cf7-message-filter
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Church Admin
Plugin Slug:: church-admin
Installations:: 1,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: 3.8.0
Severity Score:: Medium
CVE:: 2023-38515

Plugin:: TempTool [Show Current Template Info]
Plugin Slug:: current-template-name
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.10
Severity Score:: High
CVE:: 2023-33999

Plugin:: XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin]
Plugin Slug:: faq-for-woocommerce
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More
Plugin Slug:: gs-team-members
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Remove Duplicate Posts
Plugin Slug:: remove-duplicate-posts
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Required Taxonomies – Categories and Tags Mandatory
Plugin Slug:: required-taxonomies
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: SV Proven Expert
Plugin Slug:: sv-provenexpert
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.00
Severity Score:: High
CVE:: 2023-33999

Plugin:: SV Tracking Manager
Plugin Slug:: sv-tracking-manager
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.00
Severity Score:: High
CVE:: 2023-33999

Plugin:: UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode)
Plugin Slug:: ultraaddons-elementor-lite
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages
Plugin Slug:: wc4bp
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4.16
Severity Score:: High
CVE:: 2023-33999

Plugin:: Live Sales Notification for Woocommerce – Woomotiv
Plugin Slug:: woomotiv
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: Integration for WooCommerce and QuickBooks
Plugin Slug:: wp-woocommerce-quickbooks
Installations:: 1,000+
Vulnerability:: Open Redirection
Patched in Version:: 1.2.4
Severity Score:: Medium
CVE:: 2023-38478

Plugin:: wpShopGermany IT-RECHT KANZLEI
Plugin Slug:: wpshopgermany-it-recht-kanzlei
Installations:: 900+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8
Severity Score:: Medium
CVE:: 2023-37993

Plugin:: Limb Gallery | Create Beautiful Image & Video Galleries
Plugin Slug:: limb-gallery
Installations:: 800+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: GraphComment Comment system
Plugin Slug:: graphcomment-comment-system
Installations:: 700+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: Terms & Conditions Per Product
Plugin Slug:: terms-and-conditions-per-product
Installations:: 700+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Chamber Dashboard Business Directory
Plugin Slug:: chamber-dashboard-business-directory
Installations:: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.3.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Embed Docs – Elementor Files Addon,Elementor Docs Addon,Embed PDF, Word, PowerPoint and Excel Files in Gutenberg & Elementor
Plugin Slug:: embed-docs
Installations:: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Embed Video Thumbnail
Plugin Slug:: embed-video-thumbnail
Installations:: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Gutenberg Forms – WordPress Form Builder Plugin
Plugin Slug:: forms-gutenberg
Installations:: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: FormsCRM
Plugin Slug:: formscrm
Installations:: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: WZ Followed Posts – Display what visitors are reading
Plugin Slug:: where-did-they-go-from-here
Installations:: 600+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Member Profile Forms / Custom Registration / Post From Profile in BuddyPress / BuddyBoss
Plugin Slug:: buddyforms-members
Installations:: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.12
Severity Score:: High
CVE:: 2023-33999

Plugin:: WPEventPartners Demo Import
Plugin Slug:: wep-demo-import
Installations:: 500+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: WooCommerce Google Analytics Integration By Advanced WC Analytics
Plugin Slug:: advance-wc-analytics
Installations:: 400+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Frontend Admin – Display WP Admin Pages in the Frontend
Plugin Slug:: display-admin-page-on-frontend
Installations:: 400+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.21.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Product Filter Widget for Elementor
Plugin Slug:: product-filter-widget-for-elementor
Installations:: 400+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: what3words Address Field
Plugin Slug:: 3-word-address-validation-field
Installations:: 300+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 4.0.1
Severity Score:: Medium
CVE:: 2021-4428

Plugin:: Advanced Custom Fields Frontend Forms – ACF Forms – ACF Post Form – ACF Registration Form – ACF Content Form – ACF Profile Form
Plugin Slug:: buddyforms-acf
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Ultimate Member
Plugin Slug:: buddyforms-ultimate-member
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: Gift Message for WooCommerce
Plugin Slug:: gift-message-for-woocommerce
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: Ultimate LinkedIn Integration
Plugin Slug:: linkedin-login
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Shipping for Nova Poshta
Plugin Slug:: nova-poshta-ttn
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Spice Blocks
Plugin Slug:: spice-blocks
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: WooCommerce Country Catalogs – Product Country Restrictions
Plugin Slug:: woo-country-restrictions-advanced
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.14.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: 2MB Autocode
Plugin Slug:: 2mb-autocode
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Checkbox
Plugin Slug:: checkbox
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.8.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: WordPress Image Compression and Optimizer Plugin – CheetahO
Plugin Slug:: cheetaho-image-optimizer
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.3.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Multicollab – Google Docs-Style Editorial Collaboration in WordPress
Plugin Slug:: commenting-feature
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Content Blocks Builder
Plugin Slug:: content-blocks-builder
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.17
Severity Score:: High
CVE:: 2023-33999

Plugin:: WordPress Job Board and Recruitment Plugin – JobWP
Plugin Slug:: jobwp
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Joli FAQ SEO – WordPress FAQ Plugin
Plugin Slug:: joli-faq-seo
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: RSS Control
Plugin Slug:: rss-control
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: Simple Tour Guide
Plugin Slug:: simple-tour-guide
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Coming Soon Pages for WordPress – Coming Soon Booster
Plugin Slug:: wp-coming-soon-booster
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.7
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP SPID Italia
Plugin Slug:: wp-spid-italia
Installations:: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: AI Tools – Chatbot, ChatGPT, Content Generator, Image Generator, Artificial Intelligence GPT
Plugin Slug:: artificial-intelligence-auto-content-generator
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Coming Soon Master
Plugin Slug:: coming-soon-master
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: EthereumICO
Plugin Slug:: ethereumico
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.4.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: Files Download Delay
Plugin Slug:: files-download-delay
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.9
Severity Score:: High
CVE:: 2023-33999

Plugin:: Bulk Landing Page Creator for WordPress – LPagery
Plugin Slug:: lpagery
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Mobile App Editor – WordPress to Android App Builder
Plugin Slug:: mobile-app-editor
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Search Field for Gravity Forms
Plugin Slug:: search-field-for-gravity-forms
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Stellar Places
Plugin Slug:: stellar-places
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Subaccounts for WooCommerce
Plugin Slug:: subaccounts-for-woocommerce
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WN Flipbox Pro
Plugin Slug:: wn-flipbox-pro
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Bing Custom Search for WordPress
Plugin Slug:: wp-bing-search
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.6.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Tools Divi Blog Carousel
Plugin Slug:: wp-tools-divi-blog-carousel
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Display Data on your site! Create Dynamic Content Templates from any form of data. Works with ACF, Pods, BuddyPress/ BuddyBoss
Plugin Slug:: buddyforms-hook-fields
Installations:: 90+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Contact Form By Mega Forms – Drag and Drop Form Builder
Plugin Slug:: mega-forms
Installations:: 90+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Ultimate Custom ScrollBar
Plugin Slug:: ultimate-custom-scrollbar
Installations:: 90+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: WPGutenBlog Demo Import
Plugin Slug:: layouts-importer
Installations:: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: SV100 Companion
Plugin Slug:: sv100-companion
Installations:: 80+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.00
Severity Score:: High
CVE:: 2023-33999

Plugin:: Blocks Product Editor for WooCommerce
Plugin Slug:: blocks-product-editor-for-woocommerce
Installations:: 70+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Variable Inspector
Plugin Slug:: variable-inspector
Installations:: 70+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.4.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Stripe Express
Plugin Slug:: wp-stripe-express
Installations:: 60+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.12.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Form Elements for WooCommerce
Plugin Slug:: buddyforms-woocommerce-form-elements
Installations:: 50+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Order Redirects for WooCommerce
Plugin Slug:: order-redirects-for-woocommerce
Installations:: 40+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.8.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Simple blueprint installer
Plugin Slug:: simple-blueprint-installer
Installations:: 40+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Moderation ( Former: Review Logic )
Plugin Slug:: buddyforms-review
Installations:: 30+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: Connect WooCommerce Holded
Plugin Slug:: import-holded-products-woocommerce
Installations:: 30+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Order Picking For WooCommerce
Plugin Slug:: order-picking-for-woocommerce
Installations:: 30+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: ShortcodeHub – MultiPurpose Shortcode Builder
Plugin Slug:: shortcodehub
Installations:: 30+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WPEForm Lite – Drag and Drop Live Form Builder for Contact, Payment & Quiz Forms
Plugin Slug:: wpeform-lite
Installations:: 30+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: ClimateClick: Climate Action for all
Plugin Slug:: co2ok-for-woocommerce
Installations:: 20+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: SV Forms
Plugin Slug:: sv-forms
Installations:: 20+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.02
Severity Score:: High
CVE:: 2023-33999

Plugin:: SV Posts
Plugin Slug:: sv-posts
Installations:: 20+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.00
Severity Score:: High
CVE:: 2023-33999

Plugin:: Video Analytics for Cloudflare Stream
Plugin Slug:: video-analytics-for-cloudflare-stream
Installations:: 20+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Table Pixie
Plugin Slug:: wp-table-pixie
Installations:: 20+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: CF7 ReCaptcha Mine
Plugin Slug:: cf7-recaptcha-mine
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Convoworks WP
Plugin Slug:: convoworks-wp
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.22.15
Severity Score:: High
CVE:: 2023-33999

Plugin:: Custom Welcome Guide
Plugin Slug:: custom-welcome-guide
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.9
Severity Score:: High
CVE:: 2023-33999

Plugin:: DeMomentSomTres Gravity Forms Improvements
Plugin Slug:: demomentsomtres-gravity-forms-improvements
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 201805021810
Severity Score:: High
CVE:: 2023-33999

Plugin:: Fast Custom Social Share by CodeBard
Plugin Slug:: fast-custom-social-share-by-codebard
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Contact form builder for Gutenberg – Formello
Plugin Slug:: formello
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Menukaart – Restaurant Menu & Online Ordering with WooCommerce
Plugin Slug:: menukaart
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: SV Columns Manager
Plugin Slug:: sv-columns-manager
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.00
Severity Score:: High
CVE:: 2023-33999

Plugin:: Divi Testimonial Plus
Plugin Slug:: website-testimonials
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.1.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Signals
Plugin Slug:: wp-signals
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Anonymous Author
Plugin Slug:: buddyforms-anonymous-author
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Attach Post with Group
Plugin Slug:: buddyforms-attach-posts-to-groups-extension
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Hierarchical Posts
Plugin Slug:: buddyforms-hierarchical-posts
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Posts 2 Posts
Plugin Slug:: buddyforms-posts-to-posts-integration
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyForms Remote
Plugin Slug:: buddyforms-remote
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: Caldera Forms
Plugin Slug:: caldera-forms
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.5.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Simple Freemius Shop
Plugin Slug:: checkout-freemius-rewamped
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Convert Pro
Plugin Slug:: convertpro
Vulnerability:: Broken Access Control
Patched in Version:: 1.7.6
Severity Score:: High
CVE:: 2023-36684

Plugin:: DeMomentSomTres Subscribe
Plugin Slug:: demomentsomtres-mailchimp-subscribe
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.201903272301
Severity Score:: High
CVE:: 2023-33999

Plugin:: DEV.LAND
Plugin Slug:: dev-land
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.5
Severity Score:: High
CVE:: 2023-33999

Plugin:: DokoBuilder : DIY Product Bundle for WooCommerce
Plugin Slug:: doko-box-builder
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: Expandable Paywall
Plugin Slug:: expandable-paywall
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.17
Severity Score:: High
CVE:: 2023-33999

Plugin:: External Media Upload
Plugin Slug:: external-media-upload
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: Frontend Admin – Add and edit posts, pages, users and more all from the frontend
Plugin Slug:: frontend-admin
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.8.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Gallery Bank
Plugin Slug:: gallery-bank
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.0.19
Severity Score:: High
CVE:: 2023-33999

Plugin:: Map Plugin alternative to Google Maps using MapQuest, with directions
Plugin Slug:: get-directions
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.16.2
Severity Score:: High
CVE:: 2023-33999

Plugin:: Information for help
Plugin Slug:: information-for-help
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 0.0.3
Severity Score:: High
CVE:: 2023-33999

Plugin:: Google Maps Plugin by Intergeo
Plugin Slug:: intergeo-maps
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.6
Severity Score:: High
CVE:: 2023-33999

Plugin:: Oxygen Builder
Plugin Slug:: oxygen
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.4
Severity Score:: Medium
CVE:: 2022-46841

Plugin:: Popups
Plugin Slug:: popups
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8
Severity Score:: High
CVE:: 2023-33999

Plugin:: Remove WP Update Nags
Plugin Slug:: remove-wp-update-nags
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: SV Media Library
Plugin Slug:: sv-media-library
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.00
Severity Score:: High
CVE:: 2023-33999

Plugin:: BuddyPress Groups Integration for WooCommerce
Plugin Slug:: wc4bp-groups
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.1
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Cloud Server
Plugin Slug:: wp-cloud-server
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Native Articles – Instant Articles Plugin for WordPress
Plugin Slug:: wp-native-articles
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.0
Severity Score:: High
CVE:: 2023-33999

Plugin:: Schema Pro
Plugin Slug:: wp-schema-pro
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.7.8
Severity Score:: Medium
CVE:: 2023-36682

Plugin:: WP Scrive by Webbstart
Plugin Slug:: wp-scrive
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.4
Severity Score:: High
CVE:: 2023-33999

Plugin:: WPCasa Mail Alert
Plugin Slug:: wpcasa-mail-alert
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.3.0
Severity Score:: High
CVE:: 2023-33999

WordPress Plugin Vulnerabilities — Unpatched

This section contains plugin vulnerabilities with no known fix. Until a patch is available, you are advised to deactivate the plugin, at minimum, immediately. If there is a high risk of active exploits or the plugin remains unpatched for weeks, you are advised to delete the plugin. You should also delete persistently unpatched plugins the WordPress.org repository has locked and marked “Closed” so they can no longer be downloaded and installed.

Plugin:: WPS Limit Login
Plugin Slug:: wps-limit-login
Installations:: 60,000+
Vulnerability:: Race Condition
Patched in Version:: No Fix
Severity Score:: Low
CVE:: 2023-39160

Plugin:: Custom Field Template
Plugin Slug:: custom-field-template
Installations:: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-38392

Plugin:: Social Share Icons & Social Share Buttons
Plugin Slug:: ultimate-social-media-plus
Installations:: 30,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38514

Plugin:: WP-CopyProtect [Protect your blog posts]
Plugin Slug:: wp-copyprotect
Installations:: 20,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-25025

Plugin:: Elastic Email Sender
Plugin Slug:: elastic-email-sender
Installations:: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38387

Plugin:: GTmetrix for WordPress
Plugin Slug:: gtmetrix-for-wordpress
Installations:: 10,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-37996

Plugin:: Author Box for Authors, Co-Authors, Multiple Authors and Guest Authors – Molongui
Plugin Slug:: molongui-authorship
Installations:: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-39164

Plugin:: Pinpoint Booking System – #1 WordPress Booking Plugin
Plugin Slug:: booking-system
Installations:: 5,000+
Vulnerability:: Content Spoofing
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38520

Plugin:: Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg
Plugin Slug:: borderless
Installations:: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38518

Plugin:: Art Decoration Shortcode
Plugin Slug:: art-decoration-shortcode
Installations:: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-37994

Plugin:: Banner Management For WooCommerce
Plugin Slug:: banner-management-for-woocommerce
Installations:: 4,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-39158

Plugin:: Fraud Prevention For Woocommerce
Plugin Slug:: woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers
Installations:: 4,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-39159

Plugin:: Google Map Shortcode
Plugin Slug:: google-map-shortcode
Installations:: 3,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38396

Plugin:: MultiParcels Shipping For WooCommerce
Plugin Slug:: multiparcels-shipping-for-woocommerce
Installations:: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High

Plugin:: Server Info
Plugin Slug:: server-info
Installations:: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: WordPress Language
Plugin Slug:: wordpress-language
Installations:: 3,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38383

Plugin:: WP Emoji One
Plugin Slug:: wp-emoji-one
Installations:: 3,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-37991

Plugin:: WP Quick Post Duplicator
Plugin Slug:: wp-quick-post-duplicator
Installations:: 3,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-31214

Plugin:: Booster Elementor Addons
Plugin Slug:: booster-for-elementor
Installations:: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38480

Plugin:: Instant CSS
Plugin Slug:: instant-css
Installations:: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38483

Plugin:: CodeBard's Patron Button and Widgets for Patreon
Plugin Slug:: patron-button-and-widgets-by-codebard
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-30491

Plugin:: Simple Googlebot Visit
Plugin Slug:: simple-googlebot-visit
Installations:: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38479

Plugin:: QR code MeCard/vCard generator
Plugin Slug:: wp-qrcode-me-v-card
Installations:: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38477

Plugin:: WRC Pricing Tables
Plugin Slug:: wrc-pricing-tables
Installations:: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38517

Plugin:: Audio Player with Playlist Ultimate
Plugin Slug:: audio-player-with-playlist-ultimate
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38516

Plugin:: Client Portal : SuiteDash Direct Login
Plugin Slug:: client-portal-suitedash-login
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38476

Plugin:: Go Fetch Jobs (for WP Job Manager)
Plugin Slug:: go-fetch-jobs-wp-job-manager
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Mobile Address Bar Changer
Plugin Slug:: mobile-address-bar-changer
Installations:: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38390

Plugin:: Perelink Pro
Plugin Slug:: perelink
Installations:: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-37990

Plugin:: Post List With Featured Image
Plugin Slug:: post-list-with-featured-image
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-37997

Plugin:: Post Affiliate Pro
Plugin Slug:: postaffiliatepro
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38482

Plugin:: Remove Duplicate Posts
Plugin Slug:: remove-duplicate-posts
Installations:: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-29237

Plugin:: Donations Made Easy – Smart Donations
Plugin Slug:: smart-donations
Installations:: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38475

Plugin:: Taboola
Plugin Slug:: taboola
Installations:: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38398

Plugin:: Exifography
Plugin Slug:: thesography
Installations:: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38521

Plugin:: Onepage Builder – Easiest Landing Page Builder For WordPress
Plugin Slug:: tx-onepager
Installations:: 1,000+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38391

Plugin:: Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC
Plugin Slug:: easync-booking
Installations:: 300+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-38384

Plugin:: Post Connector
Plugin Slug:: post-connector
Installations:: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-28931

Plugin:: Smarty for WordPress
Plugin Slug:: smarty-for-wordpress
Installations:: 100+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-37992

Plugin:: Gestion-Pymes
Plugin Slug:: gestion-pymes
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38397

Plugin:: Woocommerce Delivery Date Premium
Plugin Slug:: woocommerce-delivery-date
Installations:: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: bbResolutions
Plugin Slug:: bbresolutions
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: BlogPost – BlogPost Widgets – Amazing Blog Layouts
Plugin Slug:: blogpost-widgets
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: CF7 Constant Contact Fields Mapping
Plugin Slug:: cf7-constant-contact-fields-mapping
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: WP Clone Menu
Plugin Slug:: clone-menu
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38395

Plugin:: DancePress (TRWA)
Plugin Slug:: dancepress-trwa
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: DeMomentSomTres Immediate Send
Plugin Slug:: demomentsomtres-mailchimp-immediate-send
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Disabler
Plugin Slug:: disabler
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-37998

Plugin:: WordPress Easy Call Now Button by elixirs.io
Plugin Slug:: easy-call-now-button
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Extend Filter Products By Price Widget
Plugin Slug:: extend-filter-products-by-price-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Easy Responsive Pricing Tables
Plugin Slug:: fullworks-pricing-tables
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: JupiterX Core
Plugin Slug:: jupiterx-core
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-3813

Plugin:: WP Logger
Plugin Slug:: lite-wp-logger
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: LWS Affiliation
Plugin Slug:: lws-affiliation
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2023-32297

Plugin:: Menu Item Scheduler
Plugin Slug:: menu-item-scheduler
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Protect Uploads with Login – Protect Your Uploads
Plugin Slug:: protect-uploads-with-login-page
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Quasar form
Plugin Slug:: quasar-form
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-35910

Plugin:: Role Based Bulk Quantity Pricing
Plugin Slug:: role-based-bulk-quantity-pricing
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Page Builder for Gutenberg – StarterBlocks
Plugin Slug:: starterblocks
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: Subscribe to Category
Plugin Slug:: subscribe-to-category
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2023-32590

Plugin:: tagDiv Composer
Plugin Slug:: td-composer
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-39166

Plugin:: Ultra Elementor Addons
Plugin Slug:: ultra-elementor-addons
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: WordPress Auto SEO Plugin – Upfiv SEO Wizard
Plugin Slug:: upfiv-complete-all-in-one-seo-wizard
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Plugin:: User Email Verification for WooCommerce
Plugin Slug:: woo-confirmation-email
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-39162

Plugin:: WP-FlyBox
Plugin Slug:: wp-flybox
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2023-38381

Plugin:: WordPress WooCommerce Sync for Google Sheet
Plugin Slug:: wp-woo-commerce-sync-for-g-sheet
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

WordPress Theme Vulnerabilities

In this section, you’ll find the latest WordPress theme vulnerabilities to be disclosed. You’ll see the same information we provided above for vulnerable plugins, and the same advice applies. If a security update exists, install it immediately. If a vulnerability remains unpatched in a theme you are actively using, you must find an alternative theme. Deactivate and delete persistently unpatched themes and those marked “Closed” in the WordPress.org theme repository. If you have a vulnerable theme installed that you are not actively using, delete it.

Theme:: Bootstrap Blog
Theme Slug:: bootstrap-blog
Downloads:: 87,177
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 10.2.3
Severity Score:: High
CVE:: 2023-33999

Theme:: Ona
Theme Slug:: ona
Downloads:: 86,847
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.18.3
Severity Score:: High
CVE:: 2023-33999

Theme:: Yuki
Theme Slug:: yuki
Downloads:: 74,316
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Techism
Theme Slug:: techism
Downloads:: 58,069
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Chic Lifestyle
Theme Slug:: chic-lifestyle
Downloads:: 57,532
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 10.0.8
Severity Score:: High
CVE:: 2023-33999

Theme:: Lifestyle Magazine
Theme Slug:: lifestyle-magazine
Downloads:: 49,638
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 10.2.1
Severity Score:: High
CVE:: 2023-33999

Theme:: SalesZone
Theme Slug:: saleszone
Downloads:: 45,813
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Travel Tour
Theme Slug:: travel-tour
Downloads:: 39,431
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.0
Severity Score:: High
CVE:: 2023-33999

Theme:: Brand
Theme Slug:: brand
Downloads:: 32,911
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: WP Sierra
Theme Slug:: wp-sierra
Downloads:: 31,861
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Eighteen tags
Theme Slug:: eighteen-tags
Downloads:: 26,056
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Hasium
Theme Slug:: hasium
Downloads:: 23,338
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Broadcast Lite
Theme Slug:: broadcast-lite
Downloads:: 21,268
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.8
Severity Score:: High
CVE:: 2023-33999

Theme:: Salzburg Blog
Theme Slug:: salzburg-blog
Downloads:: 21,114
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Everse
Theme Slug:: everse
Downloads:: 19,143
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.12
Severity Score:: High
CVE:: 2023-33999

Theme:: Speculor
Theme Slug:: speculor
Downloads:: 17,306
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Meridia
Theme Slug:: meridia
Downloads:: 16,976
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.8
Severity Score:: High
CVE:: 2023-33999

Theme:: Aquarella Lite
Theme Slug:: aquarella-lite
Downloads:: 16,673
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: ConsultPress Lite
Theme Slug:: consultpress-lite
Downloads:: 15,868
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Topcat Lite
Theme Slug:: topcat-lite
Downloads:: 15,747
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Shuban
Theme Slug:: shuban
Downloads:: 13,783
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Purus
Theme Slug:: purus
Downloads:: 13,561
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Elation
Theme Slug:: elation
Downloads:: 13,250
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: GutenBook
Theme Slug:: gutenbook
Downloads:: 13,216
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Chained
Theme Slug:: chained
Downloads:: 12,157
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Elasta
Theme Slug:: elasta
Downloads:: 11,744
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.9
Severity Score:: High
CVE:: 2023-33999

Theme:: Purosa
Theme Slug:: purosa
Downloads:: 11,224
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.3
Severity Score:: High
CVE:: 2023-33999

Theme:: LearnMore
Theme Slug:: learnmore
Downloads:: 9,915
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: WPCake
Theme Slug:: wpcake
Downloads:: 8,708
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Nokke
Theme Slug:: nokke
Downloads:: 8,472
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.4
Severity Score:: High
CVE:: 2023-33999

Theme:: Arendelle
Theme Slug:: arendelle
Downloads:: 8,463
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.13
Severity Score:: High
CVE:: 2023-33999

Theme:: PixiGo
Theme Slug:: pixigo
Downloads:: 7,670
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: WP Moose
Theme Slug:: wp-moose
Downloads:: 7,516
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: G Blog
Theme Slug:: g-blog
Downloads:: 6,993
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: NicheBase
Theme Slug:: nichebase
Downloads:: 6,985
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.3
Severity Score:: High
CVE:: 2023-33999

Theme:: Cuisine Palace
Theme Slug:: cuisine-palace
Downloads:: 6,091
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Amela
Theme Slug:: amela
Downloads:: 6,063
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.14
Severity Score:: High
CVE:: 2023-33999

Theme:: Agncy
Theme Slug:: agncy
Downloads:: 6,032
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Travel Agency Booking
Theme Slug:: travel-agency-booking
Downloads:: 5,703
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Bootstrap Fitness
Theme Slug:: bootstrap-fitness
Downloads:: 5,569
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.6
Severity Score:: High
CVE:: 2023-33999

Theme:: Bootstrap Coach
Theme Slug:: bootstrap-coach
Downloads:: 5,146
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.2
Severity Score:: High
CVE:: 2023-33999

Theme:: Blockst
Theme Slug:: blockst
Downloads:: 3,309
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.9
Severity Score:: High
CVE:: 2023-33999

Theme:: Relax Spa
Theme Slug:: relax-spa
Downloads:: 2,572
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.1
Severity Score:: High
CVE:: 2023-33999

Theme:: Villar
Theme Slug:: villar
Downloads:: 3,995
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: BlogHub
Theme Slug:: bloghub
Downloads:: 3,575
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Viralike
Theme Slug:: viralike
Downloads:: 3,245
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: NewsHit
Theme Slug:: newshit
Downloads:: 3,073
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Simplifii
Theme Slug:: simplifii
Downloads:: 2,700
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Roven Blog
Theme Slug:: roven-blog
Downloads:: 2,598
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Krste
Theme Slug:: krste
Downloads:: 2,526
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Unakit
Theme Slug:: unakit
Downloads:: 2,259
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Temp Mail X
Theme Slug:: temp-mail-x
Downloads:: 2,215
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Rovenstart
Theme Slug:: rovenstart
Downloads:: 1,845
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Theme:: Bani
Theme Slug:: bani
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2023-33999

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Dan Knauss

Dan Knauss has worked for and written about agencies and product companies in the WordPress space since 2015. He’s been involved in WordPress and open source web development since their beginning.

Browse all of Dan's articles

Follow Dan:

Sign up

Placeholder text

Thanks

Oops something went wrong, please try submitting again

Table of Contents

WordPress Core Vulnerabilities — Patched

WordPress Plugin Vulnerabilities — Patched