WordPress Vulnerability Report — October 23, 2024

Since last week, 312 new vulnerabilities emerged in the WordPress ecosystem including 306 plugins and 6 themes. 181 of the vulnerable plugins and themes remain unpatched, but Solid Security Pro users are protected by virtual patching from Patchstack.

Sarah

Published:Oct 23, 2024

Filed Under:WordPress Vulnerability Report

Reading Time:54 min.

In this report, 312 vulnerabilities have been publicly disclosed. Security patches for 131 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 181 plugin and theme vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

1. WordPress Core
2. WordPress Plugins — 130 Patched / 176 Unpatched

2.1 Email Template Customizer for WooCommerce
2.2 Custom Icons for Elementor
2.3 CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 8.x
2.4 G Meta Keywords
2.5 Surfer – WordPress Plugin
2.6 Edwiser Bridge – WordPress Moodle LMS Integration
2.7 Edwiser Bridge – WordPress Moodle LMS Integration
2.8 Lightbox slider – Responsive Lightbox Gallery
2.9 WordPress Portfolio Builder – Portfolio Gallery
2.10 Pinpoint Booking System – #1 WordPress Booking Plugin
2.11 Custom Add to Cart Button Label and Link
2.12 Zoho CRM Lead Magnet
2.13 Hyperlink Group Block
2.14 Animator – Scroll Triggered Animations
2.15 DPD Baltic Shipping
2.16 Omnipress
2.17 UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode)
2.18 WP SendFox
2.19 Simple Testimonials Showcase
2.20 TAKETIN To WP Membership
2.21 Easy Addons for Elementor
2.22 UltimateAI
2.23 UltimateAI
2.24 AB Categories Search Widget
2.25 ACL Floating Cart for WooCommerce
2.26 Add Categories Post Footer
2.27 ADIF Log Search Widget
2.28 Advanced Advertising System
2.29 Affiliator
2.30 Agile Video Player Lite
2.31 Ahime Image Printer
2.32 Ahmeti Wp Timeline
2.33 AI Image Generator for Your Content & Featured Images – AI Postpix
2.34 Ajax Custom CSS/JS
2.35 ajax-extend
2.36 Ajax Rating with Custom Login
2.37 Akismet htaccess writer
2.38 All in One Slider
2.39 Analyse Uploads
2.40 Apa Banner Slider
2.41 APA Register Newsletter Form
2.42 Arkhe Blocks
2.43 Author Discussion
2.44 AVChat Video Chat
2.45 Azz Anonim Posting
2.46 Back Link Tracker
2.47 Banner Slider
2.48 Bet WC 2018 Russia
2.49 Better Author Bio
2.50 BuddyPress Better Registration
2.51 Booking.com Banner Creator
2.52 BuddyPress Greeting Message
2.53 BP Member Type Manager
2.54 Branding
2.55 Bulk images optimizer
2.56 bVerse Convert
2.57 Campus Explorer Widget
2.58 chatplusjp
2.59 CJ Change Howdy
2.60 Client Power Tools Portal
2.61 Code Generate
2.62 Cookie Scanner
2.63 Coub
2.64 Country Flags for Elementor
2.65 Crazy Call To Action Box
2.66 cSlider
2.67 CSV Product Import Export for WooCommerce
2.68 CWD 3D Image Gallery
2.69 Digital Lottery
2.70 DocumentPress
2.71 Duplicate Title Validate
2.72 Dynamic Elementor Addons
2.73 Easy Menu Manager
2.74 Easy Post Types
2.75 Easy Post Types
2.76 Easy Post Types
2.77 EKC Tournament Manager
2.78 Elemenda
2.79 Extra Privacy for Elementor
2.80 Feed Comments Number
2.81 FERMA.ru.net
2.82 Whitelist
2.83 Flat UI Button
2.84 FREE DOWNLOAD MANAGER
2.85 Free Stock Photos Foter
2.86 Gantry 4 Framework
2.87 GERRYWORKS Post by Mail
2.88 GetResponse Forms
2.89 Giveaway Boost
2.90 Google Docs RSVP
2.91 Google Map Locations
2.92 GoogleDrive folder list
2.93 TeploBot – Telegram Bot for WP
2.94 iBryl Switch User
2.95 Infinite-Scroll
2.96 INK Official
2.97 Job Board Manager for WordPress
2.98 JiangQie Free Mini Program
2.99 jLayer Parallax Slider
2.100 Kento Post View Counter
2.101 LaTeX2HTML
2.102 leenk.me
2.103 WordPress Gallery Plugin – Limb Image Gallery
2.104 WordPress Gallery Plugin – Limb Image Gallery
2.105 Linked Variation for WooCommerce
2.106 Contact Forms, Live Support, CRM, Video Messages
2.107 Maan Addons For Elementor
2.108 Local Business Addons For Elementor
2.109 El mejor Cluster
2.110 Mighty Builder
2.111 Mitm Bug Tracker
2.112 Monitor.chat
2.113 Movie Database
2.114 My Reading Library
2.115 MyTweetLinks
2.116 Nice Backgrounds
2.117 PDF-Rechnungsverwaltung
2.118 Photo Gallery Builder
2.119 photokit
2.120 Property Lot Management System
2.121 Portfolleo
2.122 Product Customizer Light
2.123 Product Website Showcase
2.124 Rate Own Post
2.125 Recently
2.126 3D Work In Progress
2.127 3D Work In Progress
2.128 WP REST API FNS
2.129 WP REST API FNS
2.130 Risk Warning Bar
2.131 RS-Members
2.132 SafetyForms
2.133 SEO Manager
2.134 SermonAudio Widgets
2.135 Shipyaari Shipping Management
2.136 Simple Code Insert Shortcode
2.137 Simple Custom Admin
2.138 Simple Load More
2.139 SiteBuilder Dynamic Components
2.140 Affiliate Platform
2.141 Social Link Groups
2.142 Social Share With Floating Bar
2.143 Sovratec Case Management
2.144 SSV Events
2.145 SSV MailChimp
2.146 Suki Sites Import
2.147 SVG Captcha
2.148 SW Contact Form
2.149 Table of Contents Plus
2.150 Tida URL Screenshot
2.151 Tito
2.152 Todo Custom Field
2.153 uCAT – Next Story
2.154 Unlimited Addon For Elementor
2.155 Adding drop down roles in registration
2.156 Verbalize WP
2.157 VKontakte Wall Post
2.158 Web Bricks Addons for Elementor
2.159 Woocommerce Custom Profile Picture
2.160 Edit WooCommerce Templates
2.161 Woo Manage Fraud Orders
2.162 Parcel Pro
2.163 WooCommerce Maintenance Mode
2.164 Woostagram Connect
2.165 WordPress Video
2.166 Category and Taxonomy Image
2.167 Category and Taxonomy Meta Fields
2.168 Category and Taxonomy Meta Fields
2.169 Category and Taxonomy Meta Fields
2.170 WP Dropbox Dropins
2.171 WordPress Image SEO
2.172 Simple User Registration
2.173 SendGrid for WordPress
2.174 WP-Spreadplugin
2.175 wpPricing Builder
2.176 Wsify Widget
2.177 Elementor Website Builder – More than Just a Page Builder
2.178 WooCommerce
2.179 All-in-One WP Migration and Backup
2.180 Jetpack – WP Security, Backup, Speed, & Growth
2.181 Secure Custom Fields
2.182 Forminator Forms – Contact Form, Payment Form & Custom Form Builder
2.183 Forminator Forms – Contact Form, Payment Form & Custom Form Builder
2.184 Royal Elementor Addons and Templates
2.185 Ad Inserter – Ad Manager & AdSense Ads
2.186 Simple Custom Post Order
2.187 Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
2.188 Responsive Lightbox & Gallery
2.189 Custom Twitter Feeds – A Tweets Widget or X Feed Widget
2.190 GiveWP – Donation Plugin and Fundraising Platform
2.191 Translate WordPress – Google Language Translator
2.192 Schema & Structured Data for WP & AMP
2.193 Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons
2.194 WP Content Copy Protection & No Right Click
2.195 SlimStat Analytics
2.196 WP ULike – All-in-One Engagement Toolkit
2.197 Exclusive Addons for Elementor
2.198 WP-Members Membership Plugin
2.199 Calculated Fields Form
2.200 Qi Blocks
2.201 Photo Gallery, Images, Slider in Rbs Image Gallery
2.202 Simple Membership
2.203 Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
2.204 Product Filter by WBW
2.205 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
2.206 Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
2.207 Themesflat Addons For Elementor
2.208 WPIDE – File Manager & Code Editor
2.209 Timetable and Event Schedule by MotoPress
2.210 ?????? ????? ??????? Persian WooCommerce SMS
2.211 VOD Infomaniak
2.212 Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider WordPress Plugin
2.213 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
2.214 Backup and Staging by WP Time Capsule
2.215 AffiliateX – Affiliate Blocks for WordPress, Amazon, eBay, AliExpress Affiliates
2.216 Mega Elements – Addons for Elementor
2.217 Multiline files upload for contact form 7
2.218 WooCommerce Bulk Edit Products, Orders, Coupons, Any WordPress Post Type (Advanced) – Smart Manager
2.219 WP Photo Album Plus
2.220 WP VR – 360 Panorama and Virtual Tour Builder For WordPress
2.221 WP VR – 360 Panorama and Virtual Tour Builder For WordPress
2.222 Add Widget After Content
2.223 Contact Form by Supsystic
2.224 Awesome Contact Form7 for Elementor
2.225 Events Addon for Elementor
2.226 Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin
2.227 Primary Addon for Elementor
2.228 Admin Management Xtended
2.229 Customer Email Verification for WooCommerce
2.230 WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
2.231 ProfileGrid – User Profiles, Groups and Communities
2.232 Kama SpamBlock
2.233 WP Popup Builder – Popup Forms and Marketing Lead Generation
2.234 Arconix Shortcodes
2.235 ElementsReady Addons for Elementor
2.236 ElementInvader Addons for Elementor
2.237 ElementInvader Addons for Elementor
2.238 WPKoi Templates for Elementor
2.239 PeproDev Ultimate Invoice
2.240 Fonto – Custom Web Fonts Manager
2.241 Parallax Image
2.242 Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App
2.243 RSS Feed Widget
2.244 Accordion Slider
2.245 Anchor Episodes Index (Spotify for Podcasters)
2.246 Smart Online Order for Clover
2.247 Smart Online Order for Clover
2.248 Flexmls® IDX Plugin
2.249 Htaccess File Editor – Easily Edit, Backup, Restore .htaccess file
2.250 Leyka
2.251 MAS Companies For WP Job Manager
2.252 My Wp Brand – Hide menu & Hide Plugin
2.253 Smart Blocks
2.254 WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin
2.255 Advanced Category and Custom Taxonomy Image
2.256 AppPresser – Mobile App Framework
2.257 Great Restaurant Menu WP
2.258 Clio Grow Form
2.259 Encyclopedia / Glossary / Wiki
2.260 HD Quiz – Save Results Light
2.261 IdeaPush
2.262 Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages
2.263 Locatoraid Store Locator
2.264 Most And Least Read Posts Widget
2.265 My Favorites
2.266 myCred Elementor
2.267 News Kit Elementor Addons
2.268 ReDi Restaurant Reservation
2.269 WordPress Social Share Buttons
2.270 StreamWeasels Twitch Integration
2.271 Sunshine Photo Cart: Free Client Photo Galleries for Photographers
2.272 Click to Chat – WP Support All-in-One Floating Widget
2.273 Click to Chat – WP Support All-in-One Floating Widget
2.274 WP Flow Plus
2.275 Photo Gallery Slideshow & Masonry Tiled Gallery
2.276 The Ultimate WordPress Toolkit – WP Extended
2.277 Zita Elementor Site Library
2.278 SendPulse Free Web Push
2.279 MAS Elementor
2.280 Time Clock – A WordPress Employee & Volunteer Time Clock Plugin
2.281 WP Sessions Time Monitoring Full Automatic
2.282 Plexx Elementor Extension
2.283 AADMY – Add Auto Date Month Year Into Posts
2.284 Rover IDX
2.285 Rover IDX
2.286 Da Reactions
2.287 Point Maker
2.288 Endless Posts Navigation
2.289 Miniorange OTP Verification with Firebase
2.290 Miniorange OTP Verification with Firebase
2.291 Miniorange OTP Verification with Firebase
2.292 WP 2FA with Telegram
2.293 WP 2FA with Telegram
2.294 WP Education – Education WordPress Plugin for Elementor
2.295 Debrandify · Remove or Replace WordPress Branding
2.296 Advanced Custom Fields PRO
2.297 Cooked Pro
2.298 Cooked Pro
2.299 Cooked Pro
2.300 EventON Pro
2.301 Nextend Social Login Pro
2.302 Social Auto Poster
2.303 Time Clock Pro
2.304 File Manager Pro
2.305 File Manager Pro
2.306 File Manager Pro

3. WordPress Themes — 1 Patched / 5 Unpatched

3.1 Digitally
3.2 disconnected
3.3 js paper
3.4 my flatonica
3.5 my wooden under construction
3.6 Mags

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.7 Beta 3 is available and ready for testing! This beta version of the WordPress software is under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it is recommended you evaluate Beta 3 on a test server and site.

WordPress Plugins — 130 Patched / 176 Unpatched

Plugin:: Email Template Customizer for WooCommerce
Plugin Slug:: email-template-customizer-for-woo
Installations: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49288

Plugin:: Custom Icons for Elementor
Plugin Slug:: custom-icons-for-elementor
Installations: 20,000+
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49676

Plugin:: CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 8.x
Plugin Slug:: woo-multi-currency
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49283

Plugin:: G Meta Keywords
Plugin Slug:: g-meta-keywords
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49301

Plugin:: Surfer – WordPress Plugin
Plugin Slug:: surferseo
Installations: 7,000+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49299

Plugin:: Edwiser Bridge – WordPress Moodle LMS Integration
Plugin Slug:: edwiser-bridge
Installations: 5,000+
Vulnerability:: Server Side Request Forgery (SSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49312

Plugin:: Edwiser Bridge – WordPress Moodle LMS Integration
Plugin Slug:: edwiser-bridge
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49311

Plugin:: Lightbox slider – Responsive Lightbox Gallery
Plugin Slug:: simple-lightbox-gallery
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49280

Plugin:: WordPress Portfolio Builder – Portfolio Gallery
Plugin Slug:: uber-grid
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49302

Plugin:: Pinpoint Booking System – #1 WordPress Booking Plugin
Plugin Slug:: booking-system
Installations: 4,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49304

Plugin:: Custom Add to Cart Button Label and Link
Plugin Slug:: woo-custom-cart-button
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49296

Plugin:: Zoho CRM Lead Magnet
Plugin Slug:: zoho-crm-forms
Installations: 4,000+
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49297

Plugin:: Hyperlink Group Block
Plugin Slug:: hyperlink-group-block
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49279

Plugin:: Animator – Scroll Triggered Animations
Plugin Slug:: scroll-triggered-animations
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49308

Plugin:: DPD Baltic Shipping
Plugin Slug:: woo-shipping-dpd-baltic
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9350

Plugin:: Omnipress
Plugin Slug:: omnipress
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49278

Plugin:: UltraAddons – Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode)
Plugin Slug:: ultraaddons-elementor-lite
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49277

Plugin:: WP SendFox
Plugin Slug:: wp-sendfox
Installations: 1,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49284

Plugin:: Simple Testimonials Showcase
Plugin Slug:: simple-testimonials-showcase
Installations: 900+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49295

Plugin:: TAKETIN To WP Membership
Plugin Slug:: taketin-to-wp-membership
Installations: 60+
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49226

Plugin:: Easy Addons for Elementor
Plugin Slug:: easy-addons-for-elementor
Installations: 10+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49631

Plugin:: UltimateAI
Plugin Slug:: Ultimate_AI
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9104

Plugin:: UltimateAI
Plugin Slug:: Ultimate_AI
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-9105

Plugin:: AB Categories Search Widget
Plugin Slug:: ab-categories-search-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49240

Plugin:: ACL Floating Cart for WooCommerce
Plugin Slug:: acl-floating-cart-for-woocommerce
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49640

Plugin:: Add Categories Post Footer
Plugin Slug:: add-categories-post-footer
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49239

Plugin:: ADIF Log Search Widget
Plugin Slug:: adif-log-search-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49238

Plugin:: Advanced Advertising System
Plugin Slug:: advanced-advertising-system
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49624

Plugin:: Affiliator
Plugin Slug:: affiliator-lite
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49326

Plugin:: Agile Video Player Lite
Plugin Slug:: agile-video-player
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49636

Plugin:: Ahime Image Printer
Plugin Slug:: ahime-image-printer
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49245

Plugin:: Ahmeti Wp Timeline
Plugin Slug:: ahmeti-wp-timeline
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49237

Plugin:: AI Image Generator for Your Content & Featured Images – AI Postpix
Plugin Slug:: ai-postpix
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49671

Plugin:: Ajax Custom CSS/JS
Plugin Slug:: ajax-awesome-css
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49230

Plugin:: ajax-extend
Plugin Slug:: ajax-extend
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49254

Plugin:: Ajax Rating with Custom Login
Plugin Slug:: ajax-rating-with-custom-login
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49246

Plugin:: Akismet htaccess writer
Plugin Slug:: akismet-htaccess-writer
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49316

Plugin:: All in One Slider
Plugin Slug:: all-in-one-slider
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49323

Plugin:: Analyse Uploads
Plugin Slug:: analyse-uploads
Vulnerability:: Arbitrary File Deletion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49253

Plugin:: Apa Banner Slider
Plugin Slug:: apa-banner-slider
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49622

Plugin:: APA Register Newsletter Form
Plugin Slug:: apa-register-newsletter-form
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49621

Plugin:: Arkhe Blocks
Plugin Slug:: arkhe-blocks
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49261

Plugin:: Author Discussion
Plugin Slug:: author-discussion
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49609

Plugin:: AVChat Video Chat
Plugin Slug:: avchat-3
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49605

Plugin:: Azz Anonim Posting
Plugin Slug:: azz-anonim-posting
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49257

Plugin:: Back Link Tracker
Plugin Slug:: back-link-tracker
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49617

Plugin:: Banner Slider
Plugin Slug:: banner-slider
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49635

Plugin:: Bet WC 2018 Russia
Plugin Slug:: bet-wc-2018-russia
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49637

Plugin:: Better Author Bio
Plugin Slug:: better-author-bio
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49229

Plugin:: BuddyPress Better Registration
Plugin Slug:: better-bp-registration
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49247

Plugin:: Booking.com Banner Creator
Plugin Slug:: bookingcom-banner-creator
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49265

Plugin:: BuddyPress Greeting Message
Plugin Slug:: bp-greeting-message
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49650

Plugin:: BP Member Type Manager
Plugin Slug:: bp-member-type-manager
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49634

Plugin:: Branding
Plugin Slug:: branding
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9452

Plugin:: Bulk images optimizer
Plugin Slug:: bulk-image-resizer
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9361

Plugin:: bVerse Convert
Plugin Slug:: bverse-convert
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49228

Plugin:: Campus Explorer Widget
Plugin Slug:: campus-explorer-widget
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49660

Plugin:: chatplusjp
Plugin Slug:: chatplusjp
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49664

Plugin:: CJ Change Howdy
Plugin Slug:: cj-change-howdy
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49223

Plugin:: Client Power Tools Portal
Plugin Slug:: client-power-tools
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49670

Plugin:: Code Generate
Plugin Slug:: code-generator
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49646

Plugin:: Cookie Scanner
Plugin Slug:: cookie-scanner
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49220

Plugin:: Coub
Plugin Slug:: coub
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49659

Plugin:: Country Flags for Elementor
Plugin Slug:: country-flags-for-elementor
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49262

Plugin:: Crazy Call To Action Box
Plugin Slug:: crazy-call-to-action-box
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49236

Plugin:: cSlider
Plugin Slug:: cslider
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49221

Plugin:: CSV Product Import Export for WooCommerce
Plugin Slug:: csv-wc-product-import-export
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49244

Plugin:: CWD 3D Image Gallery
Plugin Slug:: cwd-3d-image-gallery
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49632

Plugin:: Digital Lottery
Plugin Slug:: digital-lottery
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49242

Plugin:: DocumentPress
Plugin Slug:: documentpress-display-any-document-on-your-site
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49656

Plugin:: Duplicate Title Validate
Plugin Slug:: duplicate-title-validate
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49623

Plugin:: Dynamic Elementor Addons
Plugin Slug:: dynamic-elementor-addons
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49243

Plugin:: Easy Menu Manager
Plugin Slug:: easy-menu-manager-wpzest
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9366

Plugin:: Easy Post Types
Plugin Slug:: easy-post-types
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-10079

Plugin:: Easy Post Types
Plugin Slug:: easy-post-types
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10078

Plugin:: Easy Post Types
Plugin Slug:: easy-post-types
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10080

Plugin:: EKC Tournament Manager
Plugin Slug:: ekc-tournament-manager
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49674

Plugin:: Elemenda
Plugin Slug:: elemenda
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9373

Plugin:: Extra Privacy for Elementor
Plugin Slug:: extra-privacy-for-elementor
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49654

Plugin:: Feed Comments Number
Plugin Slug:: feed-comments-number
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49216

Plugin:: FERMA.ru.net
Plugin Slug:: ferma-ru-net-checkout
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49620

Plugin:: Whitelist
Plugin Slug:: fifthsegment-whitelist
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49643

Plugin:: Flat UI Button
Plugin Slug:: flat-ui-button
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10014

Plugin:: FREE DOWNLOAD MANAGER
Plugin Slug:: free-download-manager
Vulnerability:: Arbitrary File Deletion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49315

Plugin:: Free Stock Photos Foter
Plugin Slug:: free-stock-photos-foter
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49227

Plugin:: Gantry 4 Framework
Plugin Slug:: gantry
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9382

Plugin:: GERRYWORKS Post by Mail
Plugin Slug:: gerryworks-post-by-mail
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49608

Plugin:: GetResponse Forms
Plugin Slug:: getresponse
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-8740

Plugin:: Giveaway Boost
Plugin Slug:: giveaway-boost
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49332

Plugin:: Google Docs RSVP
Plugin Slug:: google-docs-rsvp-guestlist
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49672

Plugin:: Google Map Locations
Plugin Slug:: google-map-locations
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49606

Plugin:: GoogleDrive folder list
Plugin Slug:: googledrive-folder-list
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49335

Plugin:: TeploBot – Telegram Bot for WP
Plugin Slug:: green-wp-telegram-bot-by-teplitsa
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9627

Plugin:: iBryl Switch User
Plugin Slug:: ibryl-switch-user
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49675

Plugin:: Infinite-Scroll
Plugin Slug:: infinite-scroll
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-10040

Plugin:: INK Official
Plugin Slug:: ink-official
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49669

Plugin:: Job Board Manager for WordPress
Plugin Slug:: jemployee
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49322

Plugin:: JiangQie Free Mini Program
Plugin Slug:: jiangqie-free-mini-program
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49314

Plugin:: jLayer Parallax Slider
Plugin Slug:: jlayer-parallax-slider-wp
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49334

Plugin:: Kento Post View Counter
Plugin Slug:: kento-post-view-counter
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2016-15040

Plugin:: LaTeX2HTML
Plugin Slug:: latex2html
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49673

Plugin:: leenk.me
Plugin Slug:: leenkme
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49661

Plugin:: WordPress Gallery Plugin – Limb Image Gallery
Plugin Slug:: limb-gallery
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49260

Plugin:: WordPress Gallery Plugin – Limb Image Gallery
Plugin Slug:: limb-gallery
Vulnerability:: Arbitrary File Download
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49258

Plugin:: Linked Variation for WooCommerce
Plugin Slug:: linked-variation-for-woocommerce
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-48047

Plugin:: Contact Forms, Live Support, CRM, Video Messages
Plugin Slug:: live-support-tickets
Vulnerability:: Sensitive Data Exposure
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49235

Plugin:: Maan Addons For Elementor
Plugin Slug:: maan-elementor-addons
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49251

Plugin:: Local Business Addons For Elementor
Plugin Slug:: map-addons-for-elementor-waze-map
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49667

Plugin:: El mejor Cluster
Plugin Slug:: mejorcluster
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49232

Plugin:: Mighty Builder
Plugin Slug:: mighty-builder
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-48049

Plugin:: Mitm Bug Tracker
Plugin Slug:: mitm-bug-tracker
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49224

Plugin:: Monitor.chat
Plugin Slug:: monitor-chat
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49639

Plugin:: Movie Database
Plugin Slug:: movie-database
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-43300

Plugin:: My Reading Library
Plugin Slug:: my-reading-library
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49318

Plugin:: MyTweetLinks
Plugin Slug:: mytweetlinks
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49618

Plugin:: Nice Backgrounds
Plugin Slug:: nicebackgrounds
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49330

Plugin:: PDF-Rechnungsverwaltung
Plugin Slug:: pdf-rechnungsverwaltung
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49287

Plugin:: Photo Gallery Builder
Plugin Slug:: photo-gallery-builder
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49325

Plugin:: photokit
Plugin Slug:: photokit
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49610

Plugin:: Property Lot Management System
Plugin Slug:: plms
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49331

Plugin:: Portfolleo
Plugin Slug:: portfolleo
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49653

Plugin:: Product Customizer Light
Plugin Slug:: product-customizer-light
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9848

Plugin:: Product Website Showcase
Plugin Slug:: product-websites-showcase
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49611

Plugin:: Rate Own Post
Plugin Slug:: rate-own-post
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49616

Plugin:: Recently
Plugin Slug:: recently-viewed-most-viewed-and-sold-products-for-woocommerce
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49218

Plugin:: 3D Work In Progress
Plugin Slug:: renee-work-in-progress
Vulnerability:: Arbitrary File Deletion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49657

Plugin:: 3D Work In Progress
Plugin Slug:: renee-work-in-progress
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49652

Plugin:: WP REST API FNS
Plugin Slug:: rest-api-fns
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49329

Plugin:: WP REST API FNS
Plugin Slug:: rest-api-fns
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49328

Plugin:: Risk Warning Bar
Plugin Slug:: risk-warning-bar
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49638

Plugin:: RS-Members
Plugin Slug:: rs-members
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49219

Plugin:: SafetyForms
Plugin Slug:: safetymails-forms
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49615

Plugin:: SEO Manager
Plugin Slug:: seo-manager
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9521

Plugin:: SermonAudio Widgets
Plugin Slug:: sermonaudio-widgets
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49614

Plugin:: Shipyaari Shipping Management
Plugin Slug:: shipyaari-shipping-managment
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49626

Plugin:: Simple Code Insert Shortcode
Plugin Slug:: simple-code-insert-shortcode
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49613

Plugin:: Simple Custom Admin
Plugin Slug:: simple-custom-admin
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49647

Plugin:: Simple Load More
Plugin Slug:: simple-load-more
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49662

Plugin:: SiteBuilder Dynamic Components
Plugin Slug:: sitebuilder-dynamic-components
Vulnerability:: PHP Object Injection
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49625

Plugin:: Affiliate Platform
Plugin Slug:: smdp-affiliate-platform
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49645

Plugin:: Social Link Groups
Plugin Slug:: social-link-groups
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49619

Plugin:: Social Share With Floating Bar
Plugin Slug:: social-share-with-floating-bar
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-8790

Plugin:: Sovratec Case Management
Plugin Slug:: sovratec-case-management
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49324

Plugin:: SSV Events
Plugin Slug:: ssv-events
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49286

Plugin:: SSV MailChimp
Plugin Slug:: ssv-mailchimp
Vulnerability:: Local File Inclusion
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49285

Plugin:: Suki Sites Import
Plugin Slug:: suki-sites-import
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-8916

Plugin:: SVG Captcha
Plugin Slug:: svg-captcha
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49648

Plugin:: SW Contact Form
Plugin Slug:: sw-contact-form
Vulnerability:: SQL Injection
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49612

Plugin:: Table of Contents Plus
Plugin Slug:: table-of-contents-plus
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49250

Plugin:: Tida URL Screenshot
Plugin Slug:: tida-url-screenshot
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49641

Plugin:: Tito
Plugin Slug:: tito
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49241

Plugin:: Todo Custom Field
Plugin Slug:: todo-custom-field
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49642

Plugin:: uCAT – Next Story
Plugin Slug:: ucat-next-story
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49663

Plugin:: Unlimited Addon For Elementor
Plugin Slug:: unlimited-addon-for-elementor
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49267

Plugin:: Adding drop down roles in registration
Plugin Slug:: user-drop-down-roles-in-registration
Vulnerability:: Privilege Escalation
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49217

Plugin:: Verbalize WP
Plugin Slug:: verbalize-wp
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49668

Plugin:: VKontakte Wall Post
Plugin Slug:: vkontakte-wall-post
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49313

Plugin:: Web Bricks Addons for Elementor
Plugin Slug:: webbricks-addons
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49665

Plugin:: Woocommerce Custom Profile Picture
Plugin Slug:: woo-custom-profile-picture
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49658

Plugin:: Edit WooCommerce Templates
Plugin Slug:: woo-edit-templates
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-10049

Plugin:: Woo Manage Fraud Orders
Plugin Slug:: woo-manage-fraud-orders
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9937

Plugin:: Parcel Pro
Plugin Slug:: woo-parcel-pro
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-9383

Plugin:: WooCommerce Maintenance Mode
Plugin Slug:: woocommerce-maintenance-mode
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49651

Plugin:: Woostagram Connect
Plugin Slug:: woostagram-connect
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49327

Plugin:: WordPress Video
Plugin Slug:: wordpress-video
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49231

Plugin:: Category and Taxonomy Image
Plugin Slug:: wp-custom-taxonomy-image
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9591

Plugin:: Category and Taxonomy Meta Fields
Plugin Slug:: wp-custom-taxonomy-meta
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9588

Plugin:: Category and Taxonomy Meta Fields
Plugin Slug:: wp-custom-taxonomy-meta
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9590

Plugin:: Category and Taxonomy Meta Fields
Plugin Slug:: wp-custom-taxonomy-meta
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9589

Plugin:: WP Dropbox Dropins
Plugin Slug:: wp-dropbox-dropins
Vulnerability:: Arbitrary File Upload
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49607

Plugin:: WordPress Image SEO
Plugin Slug:: wp-image-seo
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49627

Plugin:: Simple User Registration
Plugin Slug:: wp-registration
Vulnerability:: Broken Authentication
Patched in Version:: No Fix
Severity Score:: Critical
CVE:: 2024-49604

Plugin:: SendGrid for WordPress
Plugin Slug:: wp-sendgrid-mailer
Vulnerability:: Broken Access Control
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-9364

Plugin:: WP-Spreadplugin
Plugin Slug:: wp-spreadplugin
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49266

Plugin:: wpPricing Builder
Plugin Slug:: wppricing-builder-lite-responsive-pricing-table-builder
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: Medium
CVE:: 2024-49225

Plugin:: Wsify Widget
Plugin Slug:: wsify-widget
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-48048

Plugin:: Elementor Website Builder – More than Just a Page Builder
Plugin Slug:: elementor
Installations: 10,000,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 3.24.6
Severity Score:: Medium
CVE:: 2024-6757

Plugin:: WooCommerce
Plugin Slug:: woocommerce
Installations: 8,000,000+
Vulnerability:: Content Injection
Patched in Version:: 9.1.0
Severity Score:: Medium
CVE:: 2024-9944

Plugin:: All-in-One WP Migration and Backup
Plugin Slug:: all-in-one-wp-migration
Installations: 5,000,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 7.87
Severity Score:: Medium
CVE:: 2024-8852

Plugin:: Jetpack – WP Security, Backup, Speed, & Growth
Plugin Slug:: jetpack
Installations: 4,000,000+
Vulnerability:: Broken Access Control
Patched in Version:: 13.9.1
Severity Score:: Medium
CVE:: 2024-9926

Plugin:: Secure Custom Fields
Plugin Slug:: advanced-custom-fields
Installations: 2,000,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.3.6.3
Severity Score:: Medium

Plugin:: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Plugin Slug:: forminator
Installations: 500,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.36.0
Severity Score:: Medium
CVE:: 2024-9352

Plugin:: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Plugin Slug:: forminator
Installations: 500,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.36.0
Severity Score:: Medium
CVE:: 2024-9351

Plugin:: Royal Elementor Addons and Templates
Plugin Slug:: royal-elementor-addons
Installations: 400,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.3.987
Severity Score:: Medium
CVE:: 2024-7417

Plugin:: Ad Inserter – Ad Manager & AdSense Ads
Plugin Slug:: ad-inserter
Installations: 300,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.7.38
Severity Score:: High
CVE:: 2024-49248

Plugin:: Simple Custom Post Order
Plugin Slug:: simple-custom-post-order
Installations: 300,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.5.8
Severity Score:: Medium
CVE:: 2024-49321

Plugin:: Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
Plugin Slug:: unlimited-elements-for-elementor
Installations: 300,000+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.5.122
Severity Score:: Critical
CVE:: 2024-49271

Plugin:: Responsive Lightbox & Gallery
Plugin Slug:: responsive-lightbox
Installations: 200,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.4.9
Severity Score:: Medium
CVE:: 2024-49282

Plugin:: Custom Twitter Feeds – A Tweets Widget or X Feed Widget
Plugin Slug:: custom-twitter-feeds
Installations: 100,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.2.4
Severity Score:: Medium
CVE:: 2024-49685

Plugin:: GiveWP – Donation Plugin and Fundraising Platform
Plugin Slug:: give
Installations: 100,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 3.16.4
Severity Score:: Critical
CVE:: 2024-9634

Plugin:: Translate WordPress – Google Language Translator
Plugin Slug:: google-language-translator
Installations: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.0.10
Severity Score:: Medium
CVE:: 2021-4452

Plugin:: Schema & Structured Data for WP & AMP
Plugin Slug:: schema-and-structured-data-for-wp
Installations: 100,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.36
Severity Score:: Medium
CVE:: 2024-49683

Plugin:: Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons
Plugin Slug:: woo-discount-rules
Installations: 100,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.6.6
Severity Score:: High
CVE:: 2024-8541

Plugin:: WP Content Copy Protection & No Right Click
Plugin Slug:: wp-content-copy-protector
Installations: 100,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 3.6.1
Severity Score:: Medium
CVE:: 2024-49306

Plugin:: SlimStat Analytics
Plugin Slug:: wp-slimstat
Installations: 90,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.2.7
Severity Score:: High
CVE:: 2024-9548

Plugin:: WP ULike – All-in-One Engagement Toolkit
Plugin Slug:: wp-ulike
Installations: 80,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.7.5
Severity Score:: Medium
CVE:: 2024-9649

Plugin:: Exclusive Addons for Elementor
Plugin Slug:: exclusive-addons-for-elementor
Installations: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.7.2
Severity Score:: Medium
CVE:: 2024-49292

Plugin:: WP-Members Membership Plugin
Plugin Slug:: wp-members
Installations: 60,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.4.9.6
Severity Score:: High
CVE:: 2024-9231

Plugin:: Calculated Fields Form
Plugin Slug:: calculated-fields-form
Installations: 50,000+
Vulnerability:: Content Injection
Patched in Version:: 5.2.46
Severity Score:: Medium
CVE:: 2024-9940

Plugin:: Qi Blocks
Plugin Slug:: qi-blocks
Installations: 50,000+
Vulnerability:: Local File Inclusion
Patched in Version:: 1.3.3
Severity Score:: High
CVE:: 2024-49690

Plugin:: Photo Gallery, Images, Slider in Rbs Image Gallery
Plugin Slug:: robo-gallery
Installations: 50,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.2.22
Severity Score:: Medium
CVE:: 2024-49696

Plugin:: Simple Membership
Plugin Slug:: simple-membership
Installations: 50,000+
Vulnerability:: Open Redirection
Patched in Version:: 4.5.4
Severity Score:: Medium
CVE:: 2024-49682

Plugin:: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates)
Plugin Slug:: sina-extension-for-elementor
Installations: 50,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 3.5.8
Severity Score:: Medium
CVE:: 2024-9540

Plugin:: Product Filter by WBW
Plugin Slug:: woo-product-filter
Installations: 50,000+
Vulnerability:: SQL Injection
Patched in Version:: 2.7.1
Severity Score:: High
CVE:: 2024-49691

Plugin:: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Plugin Slug:: simply-schedule-appointments
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.7.55
Severity Score:: Medium
CVE:: 2024-7877

Plugin:: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
Plugin Slug:: simply-schedule-appointments
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.7.55
Severity Score:: Medium
CVE:: 2024-7876

Plugin:: Themesflat Addons For Elementor
Plugin Slug:: themesflat-addons-for-elementor
Installations: 40,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.2
Severity Score:: Medium
CVE:: 2024-49310

Plugin:: WPIDE – File Manager & Code Editor
Plugin Slug:: wpide
Installations: 40,000+
Vulnerability:: Full Path Disclosure (FPD)
Patched in Version:: 3.5.0
Severity Score:: Medium
CVE:: 2024-9546

Plugin:: Timetable and Event Schedule by MotoPress
Plugin Slug:: mp-timetable
Installations: 30,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.3.9
Severity Score:: High
CVE:: 2020-36840

Plugin:: ?????? ????? ??????? Persian WooCommerce SMS
Plugin Slug:: persian-woocommerce-sms
Installations: 30,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 7.0.3
Severity Score:: High
CVE:: 2024-9213

Plugin:: VOD Infomaniak
Plugin Slug:: vod-infomaniak
Installations: 30,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.5.8
Severity Score:: Medium
CVE:: 2024-49274

Plugin:: Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider WordPress Plugin
Plugin Slug:: logo-slider-wp
Installations: 20,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.1.0
Severity Score:: Medium
CVE:: 2024-5429

Plugin:: Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
Plugin Slug:: publishpress-authors
Installations: 20,000+
Vulnerability:: Privilege Escalation
Patched in Version:: 4.7.2
Severity Score:: High
CVE:: 2024-9215

Plugin:: Backup and Staging by WP Time Capsule
Plugin Slug:: wp-time-capsule
Installations: 20,000+
Vulnerability:: PHP Object Injection
Patched in Version:: 1.22.22
Severity Score:: High
CVE:: 2024-49684

Plugin:: AffiliateX – Affiliate Blocks for WordPress, Amazon, eBay, AliExpress Affiliates
Plugin Slug:: affiliatex
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.9.1
Severity Score:: Medium
CVE:: 2024-49692

Plugin:: Mega Elements – Addons for Elementor
Plugin Slug:: mega-elements-addons-for-elementor
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.7
Severity Score:: Medium
CVE:: 2024-49693

Plugin:: Multiline files upload for contact form 7
Plugin Slug:: multiline-files-for-contact-form-7
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 2.9
Severity Score:: Medium
CVE:: 2024-9891

Plugin:: WooCommerce Bulk Edit Products, Orders, Coupons, Any WordPress Post Type (Advanced) – Smart Manager
Plugin Slug:: smart-manager-for-wp-e-commerce
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 8.46.0
Severity Score:: Medium
CVE:: 2024-49687

Plugin:: WP Photo Album Plus
Plugin Slug:: wp-photo-album-plus
Installations: 10,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 8.8.07.004
Severity Score:: High
CVE:: 2024-9951

Plugin:: WP VR – 360 Panorama and Virtual Tour Builder For WordPress
Plugin Slug:: wpvr
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 8.5.6
Severity Score:: Medium
CVE:: 2024-49680

Plugin:: WP VR – 360 Panorama and Virtual Tour Builder For WordPress
Plugin Slug:: wpvr
Installations: 10,000+
Vulnerability:: Broken Access Control
Patched in Version:: 8.5.5
Severity Score:: Medium
CVE:: 2024-49293

Plugin:: Add Widget After Content
Plugin Slug:: add-widget-after-content
Installations: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.5
Severity Score:: Medium
CVE:: 2024-9892

Plugin:: Contact Form by Supsystic
Plugin Slug:: contact-form-by-supsystic
Installations: 9,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.29
Severity Score:: Medium
CVE:: 2024-48046

Plugin:: Awesome Contact Form7 for Elementor
Plugin Slug:: awesome-contact-form7-for-elementor
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1
Severity Score:: Medium
CVE:: 2024-49319

Plugin:: Events Addon for Elementor
Plugin Slug:: events-addon-for-elementor
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.2.1
Severity Score:: Medium
CVE:: 2024-49264

Plugin:: Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – WordPress Plugin
Plugin Slug:: mage-eventpress
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 4.2.6
Severity Score:: Medium
CVE:: 2024-49703

Plugin:: Primary Addon for Elementor
Plugin Slug:: primary-addon-for-elementor
Installations: 8,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.9
Severity Score:: Medium
CVE:: 2024-49259

Plugin:: Admin Management Xtended
Plugin Slug:: admin-management-xtended
Installations: 7,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.4.7
Severity Score:: Medium
CVE:: 2024-49307

Plugin:: Customer Email Verification for WooCommerce
Plugin Slug:: emails-verification-for-woocommerce
Installations: 7,000+
Vulnerability:: SQL Injection
Patched in Version:: 2.9.0
Severity Score:: Critical
CVE:: 2024-49305

Plugin:: WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting
Plugin Slug:: erp
Installations: 7,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.13.3
Severity Score:: High
CVE:: 2024-47640

Plugin:: ProfileGrid – User Profiles, Groups and Communities
Plugin Slug:: profilegrid-user-profiles-groups-and-communities
Installations: 7,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 5.9.3.1
Severity Score:: Medium
CVE:: 2024-49273

Plugin:: Kama SpamBlock
Plugin Slug:: kama-spamblock
Installations: 6,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.3
Severity Score:: High
CVE:: 2024-9647

Plugin:: WP Popup Builder – Popup Forms and Marketing Lead Generation
Plugin Slug:: wp-popup-builder
Installations: 6,000+
Vulnerability:: Content Injection
Patched in Version:: 1.3.6
Severity Score:: High
CVE:: 2024-9061

Plugin:: Arconix Shortcodes
Plugin Slug:: arconix-shortcodes
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.13
Severity Score:: Medium
CVE:: 2024-9703

Plugin:: ElementsReady Addons for Elementor
Plugin Slug:: element-ready-lite
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.4.4
Severity Score:: Medium
CVE:: 2024-9444

Plugin:: ElementInvader Addons for Elementor
Plugin Slug:: elementinvader-addons-for-elementor
Installations: 5,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.3.0
Severity Score:: Medium
CVE:: 2024-9889

Plugin:: ElementInvader Addons for Elementor
Plugin Slug:: elementinvader-addons-for-elementor
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.9
Severity Score:: Medium
CVE:: 2024-9888

Plugin:: WPKoi Templates for Elementor
Plugin Slug:: wpkoi-templates-for-elementor
Installations: 5,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.1.1
Severity Score:: Medium
CVE:: 2024-49679

Plugin:: PeproDev Ultimate Invoice
Plugin Slug:: pepro-ultimate-invoice
Installations: 4,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.0.7
Severity Score:: Medium
CVE:: 2024-49298

Plugin:: Fonto – Custom Web Fonts Manager
Plugin Slug:: fonto
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.2
Severity Score:: Medium
CVE:: 2024-8920

Plugin:: Parallax Image
Plugin Slug:: parallax-image
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9
Severity Score:: Medium
CVE:: 2024-9898

Plugin:: Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App
Plugin Slug:: peepso-core
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.4.6.2
Severity Score:: Medium
CVE:: 2024-9873

Plugin:: RSS Feed Widget
Plugin Slug:: rss-feed-widget
Installations: 3,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.0
Severity Score:: Medium
CVE:: 2024-10057

Plugin:: Accordion Slider
Plugin Slug:: accordion-slider
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.9.12
Severity Score:: Medium
CVE:: 2024-9582

Plugin:: Anchor Episodes Index (Spotify for Podcasters)
Plugin Slug:: anchor-episodes-index
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1.11
Severity Score:: Medium
CVE:: 2024-10189

Plugin:: Smart Online Order for Clover
Plugin Slug:: clover-online-orders
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.8
Severity Score:: High
CVE:: 2024-8787

Plugin:: Smart Online Order for Clover
Plugin Slug:: clover-online-orders
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.5.8
Severity Score:: Medium
CVE:: 2024-9895

Plugin:: Flexmls® IDX Plugin
Plugin Slug:: flexmls-idx
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.14.23
Severity Score:: High
CVE:: 2024-8719

Plugin:: Htaccess File Editor – Easily Edit, Backup, Restore .htaccess file
Plugin Slug:: htaccess-file-editor
Installations: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.0.19
Severity Score:: Medium
CVE:: 2024-49256

Plugin:: Leyka
Plugin Slug:: leyka
Installations: 2,000+
Vulnerability:: Full Path Disclosure (FPD)
Patched in Version:: 3.31.7
Severity Score:: Medium
CVE:: 2024-49252

Plugin:: MAS Companies For WP Job Manager
Plugin Slug:: mas-wp-job-manager-company
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.14
Severity Score:: High
CVE:: 2024-9206

Plugin:: My Wp Brand – Hide menu & Hide Plugin
Plugin Slug:: my-wp-brand
Installations: 2,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.1.3
Severity Score:: Medium
CVE:: 2024-49694

Plugin:: Smart Blocks
Plugin Slug:: smart-blocks
Installations: 2,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.1
Severity Score:: Medium
CVE:: 2024-49270

Plugin:: WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin
Plugin Slug:: timetics
Installations: 2,000+
Vulnerability:: Privilege Escalation
Patched in Version:: 1.0.26
Severity Score:: Critical
CVE:: 2024-9263

Plugin:: Advanced Category and Custom Taxonomy Image
Plugin Slug:: advanced-category-and-custom-taxonomy-image
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.0
Severity Score:: Medium
CVE:: 2024-9425

Plugin:: AppPresser – Mobile App Framework
Plugin Slug:: apppresser
Installations: 1,000+
Vulnerability:: Privilege Escalation
Patched in Version:: 4.4.5
Severity Score:: High
CVE:: 2024-9305

Plugin:: Great Restaurant Menu WP
Plugin Slug:: best-restaurant-menu-by-pricelisto
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.4.3
Severity Score:: Medium
CVE:: 2024-49698

Plugin:: Clio Grow Form
Plugin Slug:: clio-grow-form
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.0.3
Severity Score:: High
CVE:: 2024-49276

Plugin:: Encyclopedia / Glossary / Wiki
Plugin Slug:: encyclopedia-lexicon-glossary-wiki-dictionary
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.7.61
Severity Score:: High
CVE:: 2024-49320

Plugin:: HD Quiz – Save Results Light
Plugin Slug:: hd-quiz-save-results-light
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 0.6
Severity Score:: Medium
CVE:: 2024-49689

Plugin:: IdeaPush
Plugin Slug:: ideapush
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 8.71
Severity Score:: Medium
CVE:: 2024-49275

Plugin:: Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages
Plugin Slug:: landing-page-cat
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 1.7.5
Severity Score:: Medium
CVE:: 2024-49686

Plugin:: Locatoraid Store Locator
Plugin Slug:: locatoraid
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.9.48
Severity Score:: High
CVE:: 2024-9652

Plugin:: Most And Least Read Posts Widget
Plugin Slug:: most-and-least-read-posts-widget
Installations: 1,000+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.5.19
Severity Score:: Medium
CVE:: 2024-49628

Plugin:: My Favorites
Plugin Slug:: my-favorites
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.4.3
Severity Score:: Medium
CVE:: 2024-49263

Plugin:: myCred Elementor
Plugin Slug:: mycred-for-elementor
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.7
Severity Score:: Medium
CVE:: 2024-49702

Plugin:: News Kit Elementor Addons
Plugin Slug:: news-kit-elementor-addons
Installations: 1,000+
Vulnerability:: Sensitive Data Exposure
Patched in Version:: 1.2.2
Severity Score:: Medium
CVE:: 2024-9541

Plugin:: ReDi Restaurant Reservation
Plugin Slug:: redi-restaurant-reservation
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 24.1015
Severity Score:: High
CVE:: 2024-9240

Plugin:: WordPress Social Share Buttons
Plugin Slug:: share-button
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.20
Severity Score:: High
CVE:: 2024-9219

Plugin:: StreamWeasels Twitch Integration
Plugin Slug:: streamweasels-twitch-integration
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.7
Severity Score:: Medium
CVE:: 2024-9897

Plugin:: Sunshine Photo Cart: Free Client Photo Galleries for Photographers
Plugin Slug:: sunshine-photo-cart
Installations: 1,000+
Vulnerability:: Broken Access Control
Patched in Version:: 3.2.10
Severity Score:: Medium
CVE:: 2024-49697

Plugin:: Click to Chat – WP Support All-in-One Floating Widget
Plugin Slug:: support-chat
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.4
Severity Score:: Medium
CVE:: 2024-10055

Plugin:: Click to Chat – WP Support All-in-One Floating Widget
Plugin Slug:: support-chat
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 2.3.4
Severity Score:: Medium
CVE:: 2024-49281

Plugin:: WP Flow Plus
Plugin Slug:: wp-imageflow2
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.2.4
Severity Score:: Medium
CVE:: 2024-49695

Plugin:: Photo Gallery Slideshow & Masonry Tiled Gallery
Plugin Slug:: wp-responsive-photo-gallery
Installations: 1,000+
Vulnerability:: SQL Injection
Patched in Version:: 1.0.4
Severity Score:: High
CVE:: 2019-25218

Plugin:: The Ultimate WordPress Toolkit – WP Extended
Plugin Slug:: wpextended
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 3.0.10
Severity Score:: High
CVE:: 2024-9347

Plugin:: Zita Elementor Site Library
Plugin Slug:: zita-site-library
Installations: 1,000+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.6.4
Severity Score:: Medium
CVE:: 2024-8921

Plugin:: SendPulse Free Web Push
Plugin Slug:: sendpulse-web-push
Installations: 900+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.7
Severity Score:: High
CVE:: 2024-9184

Plugin:: MAS Elementor
Plugin Slug:: mas-addons-for-elementor
Installations: 700+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.7
Severity Score:: Medium
CVE:: 2024-49233

Plugin:: Time Clock – A WordPress Employee & Volunteer Time Clock Plugin
Plugin Slug:: time-clock
Installations: 600+
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.2.3
Severity Score:: High
CVE:: 2024-9593

Plugin:: WP Sessions Time Monitoring Full Automatic
Plugin Slug:: activitytime
Installations: 500+
Vulnerability:: SQL Injection
Patched in Version:: 1.1.0
Severity Score:: Critical
CVE:: 2024-49681

Plugin:: Plexx Elementor Extension
Plugin Slug:: plexx-elementor-extension
Installations: 400+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.3.7
Severity Score:: Medium
CVE:: 2024-49234

Plugin:: AADMY – Add Auto Date Month Year Into Posts
Plugin Slug:: auto-date-year-month
Installations: 300+
Vulnerability:: Content Injection
Patched in Version:: 2.0.2
Severity Score:: Medium
CVE:: 2024-9837

Plugin:: Rover IDX
Plugin Slug:: rover-idx
Installations: 300+
Vulnerability:: Privilege Escalation
Patched in Version:: 3.0.0.2906
Severity Score:: High
CVE:: 2024-10002

Plugin:: Rover IDX
Plugin Slug:: rover-idx
Installations: 300+
Vulnerability:: Broken Access Control
Patched in Version:: 3.0.0.2905
Severity Score:: Medium
CVE:: 2024-10003

Plugin:: Da Reactions
Plugin Slug:: da-reactions
Installations: 200+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 5.2.0
Severity Score:: Medium
CVE:: 2024-49255

Plugin:: Point Maker
Plugin Slug:: point-maker
Installations: 200+
Vulnerability:: Local File Inclusion
Patched in Version:: 0.1.5
Severity Score:: High
CVE:: 2024-49317

Plugin:: Endless Posts Navigation
Plugin Slug:: endless-posts-navigation
Installations: 100+
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 2.2.8
Severity Score:: High
CVE:: 2024-49629

Plugin:: Miniorange OTP Verification with Firebase
Plugin Slug:: miniorange-firebase-sms-otp-verification
Installations: 100+
Vulnerability:: Broken Authentication
Patched in Version:: 3.6.1
Severity Score:: High
CVE:: 2024-9861

Plugin:: Miniorange OTP Verification with Firebase
Plugin Slug:: miniorange-firebase-sms-otp-verification
Installations: 100+
Vulnerability:: Broken Authentication
Patched in Version:: 3.6.1
Severity Score:: Critical
CVE:: 2024-9862

Plugin:: Miniorange OTP Verification with Firebase
Plugin Slug:: miniorange-firebase-sms-otp-verification
Installations: 100+
Vulnerability:: Privilege Escalation
Patched in Version:: 3.6.1
Severity Score:: Critical
CVE:: 2024-9863

Plugin:: WP 2FA with Telegram
Plugin Slug:: two-factor-login-telegram
Installations: 100+
Vulnerability:: Broken Authentication
Patched in Version:: 3.1
Severity Score:: High
CVE:: 2024-9687

Plugin:: WP 2FA with Telegram
Plugin Slug:: two-factor-login-telegram
Installations: 100+
Vulnerability:: Bypass Vulnerability
Patched in Version:: 3.1
Severity Score:: Medium
CVE:: 2024-9820

Plugin:: WP Education – Education WordPress Plugin for Elementor
Plugin Slug:: wp-education
Installations: 100+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.2.9
Severity Score:: Medium
CVE:: 2024-49630

Plugin:: Debrandify · Remove or Replace WordPress Branding
Plugin Slug:: debrandify
Installations: 60+
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.1.3
Severity Score:: Medium
CVE:: 2024-9674

Plugin:: Advanced Custom Fields PRO
Plugin Slug:: advanced-custom-fields-pro
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 6.3.9
Severity Score:: Medium

Plugin:: Cooked Pro
Plugin Slug:: cooked-pro
Vulnerability:: Arbitrary File Upload
Patched in Version:: 1.8.0
Severity Score:: Critical
CVE:: 2024-49291

Plugin:: Cooked Pro
Plugin Slug:: cooked-pro
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 1.8.0
Severity Score:: Medium
CVE:: 2024-49290

Plugin:: Cooked Pro
Plugin Slug:: cooked-pro
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: 1.8.0
Severity Score:: Medium
CVE:: 2024-49289

Plugin:: EventON Pro
Plugin Slug:: eventon-wordpress-event-calendar-plugin
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 4.7
Severity Score:: Medium
CVE:: 2023-6243

Plugin:: Nextend Social Login Pro
Plugin Slug:: nextend-social-login-pro
Vulnerability:: Broken Authentication
Patched in Version:: 3.1.15
Severity Score:: Critical
CVE:: 2024-9893

Plugin:: Social Auto Poster
Plugin Slug:: social-auto-poster
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 5.3.16
Severity Score:: Medium
CVE:: 2024-49272

Plugin:: Time Clock Pro
Plugin Slug:: time-clock-pro
Vulnerability:: Remote Code Execution (RCE)
Patched in Version:: 1.1.5
Severity Score:: High
CVE:: 2024-9593

Plugin:: File Manager Pro
Plugin Slug:: wp-file-manager-pro
Vulnerability:: Arbitrary File Upload
Patched in Version:: 8.3.10
Severity Score:: High
CVE:: 2024-8918

Plugin:: File Manager Pro
Plugin Slug:: wp-file-manager-pro
Vulnerability:: Broken Access Control
Patched in Version:: 8.3.10
Severity Score:: High
CVE:: 2024-8746

Plugin:: File Manager Pro
Plugin Slug:: wp-file-manager-pro
Vulnerability:: Cross Site Request Forgery (CSRF)
Patched in Version:: 8.3.10
Severity Score:: High
CVE:: 2024-8507

WordPress Themes — 1 Patched / 5 Unpatched

Theme:: Digitally
Theme Slug:: digitally
Downloads: 8,046
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49309

Theme:: disconnected
Theme Slug:: disconnected
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49268

Theme:: js paper
Theme Slug:: js-paper
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49678

Theme:: my flatonica
Theme Slug:: my-flatonica
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49269

Theme:: my wooden under construction
Theme Slug:: my-wooden-under-construction
Vulnerability:: Cross Site Scripting (XSS)
Patched in Version:: No Fix
Severity Score:: High
CVE:: 2024-49269

Theme:: Mags
Theme Slug:: mags
Downloads: 25,887
Vulnerability:: Local File Inclusion
Patched in Version:: 1.1.7
Severity Score:: High
CVE:: 2024-49701

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

Author:

Sarah

Sarah has been with StellarWP since 2024. As our marketing generalist, she spends her day writing content and completing projects for SolidWP, LearnDash, and The Events Calendar. In her free time, Sarah can be found playing pickleball, enjoying coffee at a local coffee shop, and spending time with her husband.

Browse all of Sarah's articles

Sign up

Placeholder text

Thanks

Oops something went wrong, please try submitting again

Solid Suite

Protect

Repair

Manage

Free Plugins

Solid Suite

Academy

Solid Academy

Guides

Livestreams

Tutorials Academy

Resources

Blog

Vulnerability Report

Support

Documentation

Table of Contents

WordPress Core

WordPress Plugins — 130 Patched / 176 Unpatched