WordPress Vulnerability Report

WordPress Vulnerability Report — May 22, 2024

Since last week, 153 new vulnerabilities emerged in the WordPress ecosystem including 11 in themes and 142 in plugins. 34 of the vulnerable plugins and themes remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Avatar photo
Sarah Ulmer

Published:May 22, 2024

Filed Under:WordPress Vulnerability Report

Reading Time:30 min.

In this report, 153 vulnerabilities have been publicly disclosed. Security patches for 119 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 34 plugin and themes vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.5.3 was released on May 7, 2024, as a short-cycle maintenance release. This release features 12 bug fixes on Core and 9 bug fixes for the Block editor.

The next major release will be version 6.6 planned for July 2024.

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 109 Patched / 33 Unpatched

reCAPTCHA Jetpack

Plugin:
reCAPTCHA Jetpack
Plugin Slug:
recaptcha-jetpack
Installations
700+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-3941
The vulnerability has not been patched. You should deactivate the plugin.

reCAPTCHA Jetpack

Plugin:
reCAPTCHA Jetpack
Plugin Slug:
recaptcha-jetpack
Installations
700+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3940
The vulnerability has not been patched. You should deactivate the plugin.

UnGallery

Plugin:
UnGallery
Plugin Slug:
ungallery
Installations
50+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-3582
The vulnerability has not been patched. You should deactivate the plugin.

Add Custom CSS and JS

Plugin:
Add Custom CSS and JS
Plugin Slug:
add-custom-css-and-js
Installations
10+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-3903
The vulnerability has not been patched. You should deactivate the plugin.

WP Stacker

Plugin:
WP Stacker
Plugin Slug:
wp-stacker
Installations
10+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-5003
The vulnerability has not been patched. You should deactivate the plugin.

AdFoxly – Ad Manager, AdSense Ads & Ads.txt

Plugin:
AdFoxly – Ad Manager, AdSense Ads & Ads.txt
Plugin Slug:
adfoxly
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34802
The vulnerability has not been patched. You should deactivate the plugin.

Base64 Encoder/Decoder

Plugin:
Base64 Encoder/Decoder
Plugin Slug:
base64-encoderdecoder
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3824
The vulnerability has not been patched. You should deactivate the plugin.

Base64 Encoder/Decoder

Plugin:
Base64 Encoder/Decoder
Plugin Slug:
base64-encoderdecoder
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3823
The vulnerability has not been patched. You should deactivate the plugin.

Base64 Encoder/Decoder

Plugin:
Base64 Encoder/Decoder
Plugin Slug:
base64-encoderdecoder
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-3822
The vulnerability has not been patched. You should deactivate the plugin.

Crafthemes Demo Import

Plugin:
Crafthemes Demo Import
Plugin Slug:
crafthemes-demo-import
Vulnerability:
Broken Access Control
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-34800
The vulnerability has not been patched. You should deactivate the plugin.

Dextaz Ping

Plugin:
Dextaz Ping
Plugin Slug:
dextaz-ping
Vulnerability:
Remote Code Execution (RCE)
Patched in Version:
No Fix
Severity Score:
Critical
CVE:
2024-34792
The vulnerability has not been patched. You should deactivate the plugin.

Elegant Blocks

Plugin:
Elegant Blocks
Plugin Slug:
elegant-blocks
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34769
The vulnerability has not been patched. You should deactivate the plugin.

Fast Custom Social Share by CodeBard

Plugin:
Fast Custom Social Share by CodeBard
Plugin Slug:
fast-custom-social-share-by-codebard
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34807
The vulnerability has not been patched. You should deactivate the plugin.

HL Twitter

Plugin:
HL Twitter
Plugin Slug:
hl-twitter
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3630
The vulnerability has not been patched. You should deactivate the plugin.

HL Twitter

Plugin:
HL Twitter
Plugin Slug:
hl-twitter
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3629
The vulnerability has not been patched. You should deactivate the plugin.

LetterPress

Plugin:
LetterPress
Plugin Slug:
letterpress
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3590
The vulnerability has not been patched. You should deactivate the plugin.

Newsletter Popup

Plugin:
Newsletter Popup
Plugin Slug:
newsletter-popup
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3644
The vulnerability has not been patched. You should deactivate the plugin.

Popup4Phone

Plugin:
Popup4Phone
Plugin Slug:
popup4phone
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3580
The vulnerability has not been patched. You should deactivate the plugin.

Popup4Phone

Plugin:
Popup4Phone
Plugin Slug:
popup4phone
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-3231
The vulnerability has not been patched. You should deactivate the plugin.

PopupAlly

Plugin:
PopupAlly
Plugin Slug:
popupally
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34796
The vulnerability has not been patched. You should deactivate the plugin.

Praison SEO WordPress

Plugin:
Praison SEO WordPress
Plugin Slug:
seo-wordpress
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34801
The vulnerability has not been patched. You should deactivate the plugin.

Simple Popup Manager

Plugin:
Simple Popup Manager
Plugin Slug:
simple-popup-manager
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34797
The vulnerability has not been patched. You should deactivate the plugin.

SP Project & Document Manager

Plugin:
SP Project & Document Manager
Plugin Slug:
sp-client-document-manager
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3748
The vulnerability has not been patched. You should deactivate the plugin.

SP Project & Document Manager

Plugin:
SP Project & Document Manager
Plugin Slug:
sp-client-document-manager
Vulnerability:
Directory Traversal
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-1693
The vulnerability has not been patched. You should deactivate the plugin.

Tainacan

Plugin:
Tainacan
Plugin Slug:
tainacan
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34795
The vulnerability has not been patched. You should deactivate the plugin.

Tainacan

Plugin:
Tainacan
Plugin Slug:
tainacan
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
High
CVE:
2024-34794
The vulnerability has not been patched. You should deactivate the plugin.

WP Backpack

Plugin:
WP Backpack
Plugin Slug:
wp-backpack
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-4756
The vulnerability has not been patched. You should deactivate the plugin.

WP Next Post Navi

Plugin:
WP Next Post Navi
Plugin Slug:
wp-next-post-navi
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34793
The vulnerability has not been patched. You should deactivate the plugin.

WP Prayer

Plugin:
WP Prayer
Plugin Slug:
wp-prayer
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-3405
The vulnerability has not been patched. You should deactivate the plugin.

WPB Elementor Addons

Plugin:
WPB Elementor Addons
Plugin Slug:
wpb-elementor-addons
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34791
The vulnerability has not been patched. You should deactivate the plugin.

Elementor Website Builder – More than Just a Page Builder

Plugin:
Elementor Website Builder – More than Just a Page Builder
Plugin Slug:
elementor
Installations
5,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.21.6
Severity Score:
Medium
CVE:
2024-4619
The vulnerability has been patched, so you should update to version 3.21.6.

Yoast SEO

Plugin:
Yoast SEO
Plugin Slug:
wordpress-seo
Installations
5,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
22.7
Severity Score:
Medium
CVE:
2024-4984
The vulnerability has been patched, so you should update to version 22.7.

Jetpack – WP Security, Backup, Speed, & Growth

Plugin:
Jetpack – WP Security, Backup, Speed, & Growth
Plugin Slug:
jetpack
Installations
4,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
13.4
Severity Score:
Medium
CVE:
2024-4392
The vulnerability has been patched, so you should update to version 13.4.

Rank Math SEO with AI Best SEO Tools

Plugin:
Rank Math SEO with AI Best SEO Tools
Plugin Slug:
seo-by-rank-math
Installations
2,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.0.219-beta
Severity Score:
Medium
CVE:
2024-4617
The vulnerability has been patched, so you should update to version 1.0.219-beta.

Elementor Header & Footer Builder

Plugin:
Elementor Header & Footer Builder
Plugin Slug:
header-footer-elementor
Installations
1,000,000+
Vulnerability:
Content Injection
Patched in Version:
1.6.27
Severity Score:
Medium
CVE:
2024-2619
The vulnerability has been patched, so you should update to version 1.6.27.

Elementor Header & Footer Builder

Plugin:
Elementor Header & Footer Builder
Plugin Slug:
header-footer-elementor
Installations
1,000,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.6.29
Severity Score:
Medium
CVE:
2024-4634
The vulnerability has been patched, so you should update to version 1.6.29.

Page Builder by SiteOrigin

Plugin:
Page Builder by SiteOrigin
Plugin Slug:
siteorigin-panels
Installations
700,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.29.16
Severity Score:
Medium
CVE:
2024-4361
The vulnerability has been patched, so you should update to version 2.29.16.

The Events Calendar

Plugin:
The Events Calendar
Plugin Slug:
the-events-calendar
Installations
700,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
6.4.0.1
Severity Score:
High
CVE:
2024-4180
The vulnerability has been patched, so you should update to version 6.4.0.1.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.1.6
Severity Score:
Medium
CVE:
2024-4553
The vulnerability has been patched, so you should update to version 7.1.6.

WP Shortcodes Plugin — Shortcodes Ultimate

Plugin:
WP Shortcodes Plugin — Shortcodes Ultimate
Plugin Slug:
shortcodes-ultimate
Installations
600,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
7.1.2
Severity Score:
Medium
CVE:
2024-3548
The vulnerability has been patched, so you should update to version 7.1.2.

Happy Addons for Elementor

Plugin:
Happy Addons for Elementor
Plugin Slug:
happy-elementor-addons
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.10.9
Severity Score:
Medium
CVE:
2024-4865
The vulnerability has been patched, so you should update to version 3.10.9.

Happy Addons for Elementor

Plugin:
Happy Addons for Elementor
Plugin Slug:
happy-elementor-addons
Installations
400,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.10.8
Severity Score:
Medium
CVE:
2024-4478
The vulnerability has been patched, so you should update to version 3.10.8.

Royal Elementor Addons and Templates

Plugin:
Royal Elementor Addons and Templates
Plugin Slug:
royal-elementor-addons
Installations
300,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.975
Severity Score:
Medium
CVE:
2024-3887
The vulnerability has been patched, so you should update to version 1.3.975.

Menu Icons by ThemeIsle

Plugin:
Menu Icons by ThemeIsle
Plugin Slug:
menu-icons
Installations
200,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
0.13.14
Severity Score:
Medium
CVE:
2024-4635
The vulnerability has been patched, so you should update to version 0.13.14.

GiveWP – Donation Plugin and Fundraising Platform

Plugin:
GiveWP – Donation Plugin and Fundraising Platform
Plugin Slug:
give
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.11.0
Severity Score:
Medium
CVE:
2024-3714
The vulnerability has been patched, so you should update to version 3.11.0.

HT Mega – Absolute Addons For Elementor

Plugin:
HT Mega – Absolute Addons For Elementor
Plugin Slug:
ht-mega-for-elementor
Installations
100,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.5.3
Severity Score:
Medium
CVE:
2024-4876
The vulnerability has been patched, so you should update to version 2.5.3.

HT Mega – Absolute Addons For Elementor

Plugin:
HT Mega – Absolute Addons For Elementor
Plugin Slug:
ht-mega-for-elementor
Installations
100,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.5.3
Severity Score:
Medium
CVE:
2024-4875
The vulnerability has been patched, so you should update to version 2.5.3.

iframe

Plugin:
iframe
Plugin Slug:
iframe
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
5.1
Severity Score:
Medium
CVE:
2024-34805
The vulnerability has been patched, so you should update to version 5.1.

Master Slider – Responsive Touch Slider

Plugin:
Master Slider – Responsive Touch Slider
Plugin Slug:
master-slider
Installations
90,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.9.10
Severity Score:
Medium
CVE:
2024-4470
The vulnerability has been patched, so you should update to version 3.9.10.

Import and export users and customers

Plugin:
Import and export users and customers
Plugin Slug:
import-users-from-csv-with-meta
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.26.7
Severity Score:
Medium
CVE:
2024-4656
The vulnerability has been patched, so you should update to version 1.26.7.

Sydney Toolbox

Plugin:
Sydney Toolbox
Plugin Slug:
sydney-toolbox
Installations
80,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.32
Severity Score:
Medium
CVE:
2024-4473
The vulnerability has been patched, so you should update to version 1.32.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
80,000+
Vulnerability:
Broken Access Control
Patched in Version:
2.7.1
Severity Score:
High
CVE:
2024-4223
The vulnerability has been patched, so you should update to version 2.7.1.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
80,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
2.7.1
Severity Score:
Medium
CVE:
2024-4279
The vulnerability has been patched, so you should update to version 2.7.1.

Tutor LMS – eLearning and online course solution

Plugin:
Tutor LMS – eLearning and online course solution
Plugin Slug:
tutor
Installations
80,000+
Vulnerability:
SQL Injection
Patched in Version:
2.7.1
Severity Score:
High
CVE:
2024-4318
The vulnerability has been patched, so you should update to version 2.7.1.

Visual Portfolio, Photo Gallery & Post Grid

Plugin:
Visual Portfolio, Photo Gallery & Post Grid
Plugin Slug:
visual-portfolio
Installations
70,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.3.3
Severity Score:
Medium
CVE:
2024-4363
The vulnerability has been patched, so you should update to version 3.3.3.

Exclusive Addons for Elementor

Plugin:
Exclusive Addons for Elementor
Plugin Slug:
exclusive-addons-for-elementor
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.6.9.7
Severity Score:
Medium
CVE:
2024-4618
The vulnerability has been patched, so you should update to version 2.6.9.7.

WP Table Builder – WordPress Table Plugin

Plugin:
WP Table Builder – WordPress Table Plugin
Plugin Slug:
wp-table-builder
Installations
60,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.15
Severity Score:
Medium
CVE:
2024-4700
The vulnerability has been patched, so you should update to version 1.4.15.

Order Export & Order Import for WooCommerce

Plugin:
Order Export & Order Import for WooCommerce
Plugin Slug:
order-import-export-for-woocommerce
Installations
50,000+
Vulnerability:
PHP Object Injection
Patched in Version:
2.5.0
Severity Score:
Medium
CVE:
2024-34751
The vulnerability has been patched, so you should update to version 2.5.0.

Ultimate Blocks – WordPress Blocks Plugin

Plugin:
Ultimate Blocks – WordPress Blocks Plugin
Plugin Slug:
ultimate-blocks
Installations
50,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.1.7
Severity Score:
Medium
CVE:
2024-3241
The vulnerability has been patched, so you should update to version 3.1.7.

DethemeKit For Elementor

Plugin:
DethemeKit For Elementor
Plugin Slug:
dethemekit-for-elementor
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.4
Severity Score:
Medium
CVE:
2024-4374
The vulnerability has been patched, so you should update to version 2.1.4.

DethemeKit For Elementor

Plugin:
DethemeKit For Elementor
Plugin Slug:
dethemekit-for-elementor
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.1.3
Severity Score:
Medium
CVE:
2024-34575
The vulnerability has been patched, so you should update to version 2.1.3.

Piotnet Addons For Elementor

Plugin:
Piotnet Addons For Elementor
Plugin Slug:
piotnet-addons-for-elementor
Installations
40,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.4.28
Severity Score:
Medium
CVE:
2024-4432
The vulnerability has been patched, so you should update to version 2.4.28.

Visualizer: Tables and Charts Manager for WordPress

Plugin:
Visualizer: Tables and Charts Manager for WordPress
Plugin Slug:
visualizer
Installations
30,000+
Vulnerability:
SQL Injection
Patched in Version:
3.11.0
Severity Score:
High
CVE:
2024-3750
The vulnerability has been patched, so you should update to version 3.11.0.

All-in-One Video Gallery

Plugin:
All-in-One Video Gallery
Plugin Slug:
all-in-one-video-gallery
Installations
20,000+
Vulnerability:
Local File Inclusion
Patched in Version:
3.7.0
Severity Score:
High
CVE:
2024-4670
The vulnerability has been patched, so you should update to version 3.7.0.

Envo Extra

Plugin:
Envo Extra
Plugin Slug:
envo-extra
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.8.17
Severity Score:
Medium
CVE:
2024-4385
The vulnerability has been patched, so you should update to version 1.8.17.

Post Grid Elementor Addon

Plugin:
Post Grid Elementor Addon
Plugin Slug:
post-grid-elementor-addon
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.17
Severity Score:
Medium
CVE:
2024-34789
The vulnerability has been patched, so you should update to version 2.0.17.

WPZOOM Addons for Elementor (Templates, Widgets)

Plugin:
WPZOOM Addons for Elementor (Templates, Widgets)
Plugin Slug:
wpzoom-elementor-addons
Installations
20,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.37
Severity Score:
Medium
CVE:
2024-4370
The vulnerability has been patched, so you should update to version 1.1.37.

Mega Elements – Addons for Elementor

Plugin:
Mega Elements – Addons for Elementor
Plugin Slug:
mega-elements-addons-for-elementor
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.2.2
Severity Score:
Medium
CVE:
2024-4702
The vulnerability has been patched, so you should update to version 1.2.2.

Simple Basic Contact Form

Plugin:
Simple Basic Contact Form
Plugin Slug:
simple-basic-contact-form
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
20240511
Severity Score:
Medium
CVE:
2024-4144
The vulnerability has been patched, so you should update to version 20240511.

140+ Widgets | Best Addons For Elementor – FREE

Plugin:
140+ Widgets | Best Addons For Elementor – FREE
Plugin Slug:
xpro-elementor-addons
Installations
10,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.4.3.1
Severity Score:
Medium
CVE:
2024-4440
The vulnerability has been patched, so you should update to version 1.4.3.1.

YITH WooCommerce Gift Cards

Plugin:
YITH WooCommerce Gift Cards
Plugin Slug:
yith-woocommerce-gift-cards
Installations
10,000+
Vulnerability:
Broken Access Control
Patched in Version:
4.13.0
Severity Score:
Medium
CVE:
2024-0870
The vulnerability has been patched, so you should update to version 4.13.0.

VikBooking Hotel Booking Engine & PMS

Plugin:
VikBooking Hotel Booking Engine & PMS
Plugin Slug:
vikbooking
Installations
8,000+
Vulnerability:
Insecure Direct Object References (IDOR)
Patched in Version:
1.6.8
Severity Score:
Medium
CVE:
2024-2441
The vulnerability has been patched, so you should update to version 1.6.8.

WP Compress – Image Optimizer [All-In-One]

Plugin:
WP Compress – Image Optimizer [All-In-One]
Plugin Slug:
wp-compress-image-optimizer
Installations
7,000+
Vulnerability:
Broken Access Control
Patched in Version:
6.20.02
Severity Score:
Medium
CVE:
2024-4445
The vulnerability has been patched, so you should update to version 6.20.02.

WP Compress – Image Optimizer [All-In-One]

Plugin:
WP Compress – Image Optimizer [All-In-One]
Plugin Slug:
wp-compress-image-optimizer
Installations
7,000+
Vulnerability:
Open Redirection
Patched in Version:
6.20.02
Severity Score:
Medium
CVE:
2023-6812
The vulnerability has been patched, so you should update to version 6.20.02.

JCH Optimize

Plugin:
JCH Optimize
Plugin Slug:
jch-optimize
Installations
6,000+
Vulnerability:
Path Traversal
Patched in Version:
4.2.1
Severity Score:
Medium
CVE:
2024-34808
The vulnerability has been patched, so you should update to version 4.2.1.

Move Addons for Elementor

Plugin:
Move Addons for Elementor
Plugin Slug:
move-addons
Installations
3,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.2
Severity Score:
Medium
CVE:
2024-4695
The vulnerability has been patched, so you should update to version 1.3.2.

Debug Log – Manger Tool

Plugin:
Debug Log – Manger Tool
Plugin Slug:
debug-log-config-tool
Installations
2,000+
Vulnerability:
Sensitive Data Exposure
Patched in Version:
1.5
Severity Score:
Medium
CVE:
2024-34798
The vulnerability has been patched, so you should update to version 1.5.

FundEngine – Donation and Crowdfunding Platform

Plugin:
FundEngine – Donation and Crowdfunding Platform
Plugin Slug:
wp-fundraising-donation
Installations
2,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.7.0
Severity Score:
Medium
CVE:
2024-34758
The vulnerability has been patched, so you should update to version 1.7.0.

Kognetiks Chatbot for WordPress

Plugin:
Kognetiks Chatbot for WordPress
Plugin Slug:
chatbot-chatgpt
Installations
1,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
2.0.1
Severity Score:
Critical
CVE:
2024-32700
The vulnerability has been patched, so you should update to version 2.0.1.

Copymatic – AI Content Writer & Generator

Plugin:
Copymatic – AI Content Writer & Generator
Plugin Slug:
copymatic
Installations
1,000+
Vulnerability:
Arbitrary File Upload
Patched in Version:
1.7
Severity Score:
Critical
CVE:
2024-31351
The vulnerability has been patched, so you should update to version 1.7.

Custom Post Type Attachment

Plugin:
Custom Post Type Attachment
Plugin Slug:
custom-post-type-pdf-attachment
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.4.6
Severity Score:
Medium
CVE:
2024-4546
The vulnerability has been patched, so you should update to version 3.4.6.

Fastly

Plugin:
Fastly
Plugin Slug:
fastly
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.2.26
Severity Score:
Medium
CVE:
2024-34803
The vulnerability has been patched, so you should update to version 1.2.26.

Fastly

Plugin:
Fastly
Plugin Slug:
fastly
Installations
1,000+
Vulnerability:
Broken Access Control
Patched in Version:
1.2.26
Severity Score:
Medium
CVE:
2024-34768
The vulnerability has been patched, so you should update to version 1.2.26.

Save as PDF Plugin by Pdfcrowd

Plugin:
Save as PDF Plugin by Pdfcrowd
Plugin Slug:
save-as-pdf-by-pdfcrowd
Installations
1,000+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.2.0
Severity Score:
Medium
CVE:
2023-5971
The vulnerability has been patched, so you should update to version 3.2.0.

ShiftController Employee Shift Scheduling

Plugin:
ShiftController Employee Shift Scheduling
Plugin Slug:
shiftcontroller
Installations
1,000+
Vulnerability:
PHP Object Injection
Patched in Version:
4.9.58
Severity Score:
High
CVE:
2024-4733
The vulnerability has been patched, so you should update to version 4.9.58.

Popup Builder

Plugin:
Popup Builder
Plugin Slug:
easy-notify-lite
Installations
700+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.1.30
Severity Score:
Medium
CVE:
2024-34567
The vulnerability has been patched, so you should update to version 1.1.30.

Popup – Popup More Popups

Plugin:
Popup – Popup More Popups
Plugin Slug:
popup-more
Installations
400+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.3
Severity Score:
Medium
CVE:
2024-32800
The vulnerability has been patched, so you should update to version 2.3.3.

Bulk Posts Editing For WordPress

Plugin:
Bulk Posts Editing For WordPress
Plugin Slug:
ithemeland-bulk-posts-editing-lite
Installations
200+
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
4.2.4
Severity Score:
Medium
CVE:
2024-4204
The vulnerability has been patched, so you should update to version 4.2.4.

Bulk Posts Editing For WordPress

Plugin:
Bulk Posts Editing For WordPress
Plugin Slug:
ithemeland-bulk-posts-editing-lite
Installations
200+
Vulnerability:
Broken Access Control
Patched in Version:
4.2.4
Severity Score:
Medium
CVE:
2024-4199
The vulnerability has been patched, so you should update to version 4.2.4.

month name translation benaceur

Plugin:
month name translation benaceur
Plugin Slug:
month-name-translation-benaceur
Installations
200+
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.3.8
Severity Score:
Medium
CVE:
2024-3634
The vulnerability has been patched, so you should update to version 2.3.8.

Advanced Custom Fields PRO

Plugin:
Advanced Custom Fields PRO
Plugin Slug:
advanced-custom-fields-pro
Vulnerability:
Arbitrary Code Execution
Patched in Version:
6.2.10
Severity Score:
High
CVE:
2024-34761
The vulnerability has been patched, so you should update to version 6.2.10.

Advanced Custom Fields PRO

Plugin:
Advanced Custom Fields PRO
Plugin Slug:
advanced-custom-fields-pro
Vulnerability:
Local File Inclusion
Patched in Version:
6.2.10
Severity Score:
Critical
CVE:
2024-34762
The vulnerability has been patched, so you should update to version 6.2.10.

ConvertPlus

Plugin:
ConvertPlus
Plugin Slug:
convertplug
Vulnerability:
PHP Object Injection
Patched in Version:
3.5.26.1
Severity Score:
High
CVE:
2024-4838
The vulnerability has been patched, so you should update to version 3.5.26.1.

Cost Calculator Builder Pro

Plugin:
Cost Calculator Builder Pro
Plugin Slug:
cost-calculator-builder-pro
Vulnerability:
Server Side Request Forgery (SSRF)
Patched in Version:
3.1.73
Severity Score:
Medium
CVE:
2024-4789
The vulnerability has been patched, so you should update to version 3.1.73.

ElementsKit Pro

Plugin:
ElementsKit Pro
Plugin Slug:
elementskit
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.6.2
Severity Score:
Medium
CVE:
2024-4452
The vulnerability has been patched, so you should update to version 3.6.2.

Penci Soledad Data Migrator

Plugin:
Penci Soledad Data Migrator
Plugin Slug:
penci-data-migrator
Vulnerability:
Local File Inclusion
Patched in Version:
1.3.1
Severity Score:
Critical
CVE:
2024-3551
The vulnerability has been patched, so you should update to version 1.3.1.

Swift Framework Page Builder

Plugin:
Swift Framework Page Builder
Plugin Slug:
socialdriver-framework
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2024.0.0
Severity Score:
Medium
CVE:
2024-2697
The vulnerability has been patched, so you should update to version 2024.0.0.

Tutor LMS Pro

Plugin:
Tutor LMS Pro
Plugin Slug:
tutor-pro
Vulnerability:
Broken Access Control
Patched in Version:
2.7.1
Severity Score:
High
CVE:
2024-4352
The vulnerability has been patched, so you should update to version 2.7.1.

Tutor LMS Pro

Plugin:
Tutor LMS Pro
Plugin Slug:
tutor-pro
Vulnerability:
Broken Access Control
Patched in Version:
2.7.1
Severity Score:
High
CVE:
2024-4222
The vulnerability has been patched, so you should update to version 2.7.1.

Tutor LMS Pro

Plugin:
Tutor LMS Pro
Plugin Slug:
tutor-pro
Vulnerability:
Privilege Escalation
Patched in Version:
2.7.1
Severity Score:
High
CVE:
2024-4351
The vulnerability has been patched, so you should update to version 2.7.1.

Uber Menu

Plugin:
Uber Menu
Plugin Slug:
ubermenu
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.8.3
Severity Score:
Medium
CVE:
2024-4710
The vulnerability has been patched, so you should update to version 3.8.3.

Automatic

Plugin:
Automatic
Plugin Slug:
wp-automatic
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
3.95.0
Severity Score:
Medium
CVE:
2024-4849
The vulnerability has been patched, so you should update to version 3.95.0.

WordPress Themes — 10 Patched / 1 Unpatched

ImageMagick Sharpen Resized Images

Theme:
ImageMagick Sharpen Resized Images
Theme Slug:
imagemagick-sharpen-resized-images
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
No Fix
Severity Score:
Medium
CVE:
2024-34790
The vulnerability has not been patched. You should switch themes.

Blocksy

Theme:
Blocksy
Theme Slug:
blocksy
Downloads
3,200,500
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
2.0.47
Severity Score:
Medium
CVE:
2024-4943
The vulnerability has been patched, so you should update to version 2.0.47.

ChaosTheory

Theme:
ChaosTheory
Theme Slug:
chaostheory
Downloads
441,334
Vulnerability:
Cross Site Scripting (XSS)
Patched in Version:
1.3.2
Severity Score:
Medium
CVE:
2024-34766
The vulnerability has been patched, so you should update to version 1.3.2.

Consus

Theme:
Consus
Theme Slug:
consus
Downloads
16,413
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.7
Severity Score:
Medium
CVE:
2024-34810
The vulnerability has been patched, so you should update to version 1.0.7.

EmpowerWP

Theme:
EmpowerWP
Theme Slug:
empowerwp
Downloads
219,617
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.22
Severity Score:
Medium
CVE:
2024-34809
The vulnerability has been patched, so you should update to version 1.0.22.

Ketos

Theme:
Ketos
Theme Slug:
ketos
Downloads
28,821
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.6
Severity Score:
Medium
CVE:
2024-34810
The vulnerability has been patched, so you should update to version 1.0.6.

Mindscape

Theme:
Mindscape
Theme Slug:
mindscape
Downloads
42,404
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.23
Severity Score:
Medium
CVE:
2024-34810
The vulnerability has been patched, so you should update to version 1.0.23.

Niveau

Theme:
Niveau
Theme Slug:
niveau
Downloads
16,949
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.9
Severity Score:
Medium
CVE:
2024-34810
The vulnerability has been patched, so you should update to version 1.0.9.

Oasis

Theme:
Oasis
Theme Slug:
oasis
Downloads
69,561
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.13
Severity Score:
Medium
CVE:
2024-34810
The vulnerability has been patched, so you should update to version 1.0.13.

Skyline WP

Theme:
Skyline WP
Theme Slug:
skyline-wp
Downloads
169,826
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.11
Severity Score:
Medium
CVE:
2024-34810
The vulnerability has been patched, so you should update to version 1.0.11.

Zeka

Theme:
Zeka
Theme Slug:
zeka
Downloads
20,361
Vulnerability:
Cross Site Request Forgery (CSRF)
Patched in Version:
1.0.10
Severity Score:
Medium
CVE:
2024-34810
The vulnerability has been patched, so you should update to version 1.0.10.

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles

Author:

Avatar photoSarah Ulmer

Sarah has been with SolidWP since 2015. Thanks to her deep connection to the brand, its products, and its users, Sarah was tapped as Solid’s primary Product Marketer in 2023. Sarah helps ensure that Solid’s product development team understands our users’ needs. When not at work, Sarah can be found at home with her husband, their three boys, and their dogs. Sarah enjoys long family walks, running with her lab, and watching her three boys play soccer. Sarah is originally from Texas and loves watching football games (Go Longhorns!)

Browse all of Sarah's articles