Last week there were 67 vulnerabilities found in 60 WordPress Plugins
Type of vulnerability:
Cross-site scripting, SQL Injection, Unauthorized Actions, Cross-site Request Forgery, etc.
Contact Us to find more Be sure to mention the name of the plugin or theme you want to know about.
Vulnerable Plugins
Affected Software: Simple Inventory Management – just scan barcodes to manage products and orders. For WooCommerce
CVE ID: CVE-2023-52221
CVSS Score: 9.8 (Critical)
Patch Status: Patched
Customer Reviews for WooCommerce <= 5.38.9 – Authenticated (Author+) Arbitrary File Upload
Affected Software: Customer Reviews for WooCommerce
CVE ID: CVE-2023-6979
CVSS Score: 9.8 (Critical)
Patch Status: Patched
AI Engine: ChatGPT Chatbot <= 1.9.98 – Unauthenticated Arbitrary File Upload via rest_upload
Affected Software: AI Engine: Chatbots, Generators, Assistants, GPT 4 and more!
CVE ID: CVE-2023-51409
CVSS Score: 9.8 (Critical)
Patch Status: Patched
Affected Software: Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce
CVE ID: CVE-2023-52215
CVSS Score: 9.8 (Critical)
Patch Status: Patched
Affected Software: POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications
CVE ID: CVE-2023-6875
CVSS Score: 9.8 (Critical)
Patch Status: Patched
WP Testimonials <= 1.4.4 – Authenticated (Contributor+) SQL Injection
Affected Software: WP Testimonials
CVE ID: CVE Unknown
CVSS Score: 8.8 (High)
Patch Status: Patched
WP Register Profile With Shortcode <= 3.5.9 – Cross-Site Request Forgery to User Password Reset
Affected Software: WP Register Profile With Shortcode
CVE ID: CVE-2023-5448
CVSS Score: 8.8 (High)
Patch Status: Patched
Profile Builder Pro <= 3.10.0 – Cross-Site Request Forgery
Affected Software: Profile Builder Pro
CVE ID: CVE-2024-22140
CVSS Score: 8.8 (High)
Patch Status: Patched
Download Monitor <= 4.9.4 – Authenticated (Admin+) SQL Injection
Affected Software: Download Monitor
CVE ID: CVE Unknown
CVSS Score: 7.2 (High)
Patch Status: Patched
Affected Software: Order Export & Order Import for WooCommerce
CVE ID: CVE-2024-22135
CVSS Score: 7.2 (High)
Patch Status: Patched
PDF Invoices & Packing Slips for WooCommerce <= 3.7.5 – Authenticated (Shop Manager+) SQL Injection
Affected Software: PDF Invoices & Packing Slips for WooCommerce
CVE ID: CVE-2024-22147
CVSS Score: 7.2 (High)
Patch Status: Patched
Index Now <= 2.6.3 – Cross-Site Request Forgery via reset_form
Affected Software: Index Now
CVE ID: CVE-2024-0428
CVSS Score: 7.1 (High)
Patch Status: Patched
Affected Software/s: EventON, EventON Pro
CVE ID: CVE-2023-6158
CVSS Score: 6.5 (Medium)
Patch Status: Patched
Affected Software: List category posts
CVE ID: CVE-2023-6994
CVSS Score: 6.5 (Medium)
Patch Status: Patched
Affected Software/s: EventON, EventON Pro
CVE ID: CVE-2023-6244
CVSS Score: 6.5 (Medium)
Patch Status: Patched
Affected Software: Profile Builder Pro
CVE ID: CVE-2024-22141
CVSS Score: 6.5 (Medium)
Patch Status: Patched
Word Replacer Pro <= 1.0 – Missing Authorization
Affected Software: Word Replacer Pro
CVE ID: CVE-2023-52229
CVSS Score: 6.5 (Medium)
Patch Status: Unpatched
GD Rating System <= 3.5.0 – Unauthenticated Stored Cross-Site Scripting via IP
Affected Software: GD Rating System
CVE ID: CVE Unknown
CVSS Score: 6.5 (Medium)
Patch Status: Patched
Affected Software/s: EventON, EventON Pro
CVE ID: CVE-2023-6242
CVSS Score: 6.5 (Medium)
Patch Status: Patched
Formidable Forms <= 6.7 – HTML Injection
Affected Software: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
CVE ID: CVE-2023-6830
CVSS Score: 6.5 (Medium)
Patch Status: Patched
Happy Elementor Addons <= 3.10.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
Affected Software: Happy Addons for Elementor
CVE ID: CVE Unknown
CVSS Score: 6.4 (Medium)
Patch Status: Patched
Voting Record <= 2.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting
Affected Software: Voting Record
CVE ID: CVE-2023-7084
CVSS Score: 6.4 (Medium)
Patch Status: Unpatched
Affected Software: OneClick Chat to Order
CVE ID: CVE Unknown
CVSS Score: 6.4 (Medium)
Patch Status: Patched
Beds24 Online Booking <= 2.0.23 – Authenticated (Contributor+) Stored Cross-Site Scripting
Affected Software: Beds24 Online Booking
CVE ID: CVE-2023-52228
CVSS Score: 6.4 (Medium)
Patch Status: Unpatched
TNC PDF viewer <= 2.8.0 – Authenticated (Contributor+) Stored Cross-Site Scripting
Affected Software: TNC PDF viewer
CVE ID: CVE Unknown
CVSS Score: 6.4 (Medium)
Patch Status: Patched
Affected Software: Constant Contact Forms by MailMunch
CVE ID: CVE-2024-22137
CVSS Score: 6.4 (Medium)
Patch Status: Unpatched
Affected Software: Plugin for Google Reviews
CVE ID: CVE-2023-6884
CVSS Score: 6.4 (Medium)
Patch Status: Patched
WP SMS <= 6.5.1 – Authenticated (Contributor+) Stored Cross-Site Scripting
Affected Software: WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc
CVE ID: CVE Unknown
CVSS Score: 6.4 (Medium)
Patch Status: Patched
Affected Software: Email Encoder – Protect Email Addresses and Phone Numbers
CVE ID: CVE-2023-7070
CVSS Score: 6.4 (Medium)
Patch Status: Patched
Affected Software: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
CVE ID: CVE-2023-7071
CVSS Score: 6.4 (Medium)
Patch Status: Patched
Football pool <= 2.11.3 – Authenticated (Contributor+) Stored Cross-Site Scripting
Affected Software: Football Pool
CVE ID: CVE Unknown
CVSS Score: 6.4 (Medium)
Patch Status: Patched
ARMember <= 4.0.22 – Cross-Site Request Forgery
Affected Software: ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
CVE ID: CVE-2023-52200
CVSS Score: 6.3 (Medium)
Patch Status: Patched
WooCommerce < 8.4.0 – Reflected Cross-Site Scripting
Affected Software: WooCommerce
CVE ID: CVE Unknown
CVSS Score: 6.1 (Medium)
Patch Status: Patched
Profile Builder Pro <= 3.10.0 – Reflected Cross-Site Scripting
Affected Software: Profile Builder Pro
CVE ID: CVE-2024-22142
CVSS Score: 6.1 (Medium)
Patch Status: Patched
Shortcodes Finder <= 1.5.4 – Reflected Cross-Site Scripting
Affected Software: Shortcodes Finder
CVE ID: CVE-2024-21750
CVSS Score: 6.1 (Medium)
Patch Status: Unpatched
Advanced Woo Search <= 2.96 – Reflected Cross-Site Scripting
Affected Software: Advanced Woo Search
CVE ID: CVE-2024-0251
CVSS Score: 6.1 (Medium)
Patch Status: Patched
Voting Record <= 2.0 – Cross-Site Request Forgery to Settings Update and Cross-Site Scripting
Affected Software: Voting Record
CVE ID: CVE-2023-7083
CVSS Score: 6.1 (Medium)
Patch Status: Unpatched
Auto Affiliate Links <= 6.4.2.7 – Cross-Site Request Forgery
Affected Software: Auto Affiliate Links
CVE ID: CVE Unknown
CVSS Score: 5.8 (Medium)
Patch Status: Patched
Metform Elementor Contact Form Builder <= 3.8.1 – Cross-Site Request Forgery
Affected Software: Metform Elementor Contact Form Builder
CVE ID: CVE-2023-6788
CVSS Score: 5.4 (Medium)
Patch Status: Patched
Affected Software: Schema & Structured Data for WP & AMP
CVE ID: CVE-2024-22146
CVSS Score: 5.4 (Medium)
Patch Status: Patched
RabbitLoader <= 2.19.13 – Missing Authorization via multiple AJAX actions
Affected Software: RabbitLoader
CVE ID: CVE-2024-21751
CVSS Score: 5.4 (Medium)
Patch Status: Patched
Affected Software: MailerLite – WooCommerce integration
CVE ID: CVE-2023-52223
CVSS Score: 5.4 (Medium)
Patch Status: Patched
Affected Software: Contact Form 7 Extension For Mailchimp
CVE ID: CVE-2024-22134
CVSS Score: 5.4 (Medium)
Patch Status: Unpatched
Paid Memberships Pro <= 2.12.6 – Information Exposure in Debug Logs
Affected Software: Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
CVE ID: CVE Unknown
CVSS Score: 5.3 (Medium)
Patch Status: Patched
Seraphinite Accelerator <= 2.20.45 – Unauthenticated Sensitive Information Exposure via Log File
Affected Software: Seraphinite Accelerator
CVE ID: CVE-2024-22138
CVSS Score: 5.3 (Medium)
Patch Status: Unpatched
WordPress Manutenção <= 1.0.6 – IP Spoofing to Maintenance Mode Bypass
Affected Software: WordPress Manutenção
CVE ID: CVE-2024-22139
CVSS Score: 5.3 (Medium)
Patch Status: Unpatched
The Events Calendar <= 6.2.8.2 – Unauthenticated Sensitive Information Exposure
Affected Software: The Events Calendar
CVE ID: CVE-2023-6557
CVSS Score: 5.3 (Medium)
Patch Status: Patched
ElementsKit Lite <= 3.0.3 – Unauthenticated Sensitive Information Exposure
Affected Software: ElementsKit Elementor addons
CVE ID: CVE-2023-6582
CVSS Score: 5.3 (Medium)
Patch Status: Patched
Newsletter <= 8.0.6 – Cross-Site Request Forgery
Affected Software: Newsletter – Send awesome emails from WordPress
CVE ID: CVE Unknown
CVSS Score: 4.7 (Medium)
Patch Status: Patched
Contest Gallery <= 21.2.8.4 – Cross-Site Request Forgery
Affected Software: Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin for WordPress
CVE ID: CVE Unknown
CVSS Score: 4.7 (Medium)
Patch Status: Patched
Formidable Forms <= 6.7 – Authenticated (Administrator+) Stored Cross-Site Scripting
Affected Software: Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
CVE ID: CVE-2023-6842
CVSS Score: 4.4 (Medium)
Patch Status: Patched
Woocommerce Vietnam Checkout <= 2.0.8 – Authenticated (Admin+) Stored Cross-Site Scripting
Affected Software: Woocommerce Vietnam Checkout
CVE ID: CVE Unknown
CVSS Score: 4.4 (Medium)
Patch Status: Patched
Affected Software: WordPress Button Plugin MaxButtons
CVE ID: CVE-2023-6594
CVSS Score: 4.4 (Medium)
Patch Status: Patched
Swift SMTP <= 5.0.6 – Cross-Site Request Forgery
Affected Software: Swift SMTP (formerly Welcome Email Editor)
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Patch Status: Patched
LiveChat Elementor <= 1.0.13 – Cross-Site Request Forgery
Affected Software: WordPress Live Chat Plugin for Elementor – LiveChat
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Patch Status: Patched
Affected Software: Gallery Plugin for WordPress – Envira Photo Gallery
CVE ID: CVE-2023-6742
CVSS Score: 4.3 (Medium)
Patch Status: Patched
InstaWP Connect <= 0.1.0.8 – Cross-Site Request Forgery via create_file_db_manager
Affected Software: InstaWP Connect – 1-click WP Staging & Migration
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Patch Status: Patched
Seraphinite Alternative Slugs Manager <= 1.3 – Cross-Site Request Forgery
Affected Software: Seraphinite Alternative Slugs Manager
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Patch Status: Patched
MailerLite – WooCommerce integration <= 2.0.8 – Missing Authorization via Multiple Functions
Affected Software: MailerLite – WooCommerce integration
CVE ID: CVE-2023-52227
CVSS Score: 4.3 (Medium)
Patch Status: Patched
LiveChat WooCommerce <= 2.2.16 – Cross-Site Request Forgery
Affected Software: WordPress Live Chat Plugin for WooCommerce – LiveChat
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Patch Status: Patched
Advanced Flamingo <= 1.0 – Cross-Site Request Forgery
Affected Software: Advanced Flamingo
CVE ID: CVE-2023-52226
CVSS Score: 4.3 (Medium)
Patch Status: Unpatched
WP Spell Check <= 9.17 – Cross-Site Request Forgery
Affected Software: WP Spell Check
CVE ID: CVE-2024-22143
CVSS Score: 4.3 (Medium)
Patch Status: Patched
Contact Form 7 – Dynamic Text Extension <= 4.1.0 – Insecure Direct Object Reference
Affected Software: Contact Form 7 – Dynamic Text Extension
CVE ID: CVE-2023-6630
CVSS Score: 4.3 (Medium)
Patch Status: Patched
Contact Form 7 Connector <= 1.2.2 – Cross-Site Request Forgery
Affected Software: Contact Form 7 Connector
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Patch Status: Patched
Products & Order Export for WooCommerce <= 2.0.7 – Missing Authorization
Affected Software: Products, Order & Customers Export for WooCommerce
CVE ID: CVE Unknown
CVSS Score: 4.3 (Medium)
Patch Status: Patched
Droit Elementor Addons <= 3.1.5 – Cross-Site Request Forgery
Affected Software: Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder
CVE ID: CVE-2024-22136
CVSS Score: 4.3 (Medium)
Patch Status: Unpatched
WPS Hide Login <= 1.9.11 – Hidden Login Page Location Disclosure
Affected Software: WPS Hide Login
CVE ID: CVE-2023-49748
CVSS Score: 3.7 (Low)
Patch Status: Unpatched
Image by pikisuperstar on Freepik