In this report, 182 vulnerabilities have been publicly disclosed. Security patches for 123 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.
Additionally, there are 59 plugin and theme vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.
Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.
Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.
WordPress Core
WordPress 6.5.5 is now available! This release features three security fixes. Because this is a security release, it is recommended that you update your sites immediately. This minor release also includes 3 bug fixes in Core.
WordPress 6.6 RC3 is ready for download and testing! The target release date for WordPress 6.6 is July 16, 2024. Your help testing RC versions is vital to ensuring the final release is everything it should be: stable, powerful, and intuitive.
WordPress Plugins — 103 Patched / 56 Unpatched
- Plugin Slug:
- ultimate-social-media-icons
- Installations
- 100,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- meks-easy-ads-widget
- Installations
- 20,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- wpjam-basic
- Installations
- 5,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- ultimate-auction
- Installations
- 2,000+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- cc-bcc-for-woocommerce-order-emails
- Installations
- 1,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- nicen-localize-image
- Installations
- 1,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- stepbyteservice-openstreetmap
- Installations
- 1,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- tooltip-for-gravity-forms
- Installations
- 1,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- wpfavicon
- Installations
- 1,000+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- leaky-paywall
- Installations
- 800+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- totalsurvey
- Installations
- 600+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- taager
- Installations
- 500+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- weight-loss-tracker
- Installations
- 500+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- totalrating
- Installations
- 300+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- link-to-bible
- Installations
- 200+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- theidealweb-amelia-shortcode-extended
- Installations
- 200+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- ws-theme-addons
- Installations
- 200+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- canvas-nestjs
- Installations
- 100+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- logic-hop
- Installations
- 100+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- meal-tracker
- Installations
- 100+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- totalform
- Installations
- 70+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- ws-contact-form
- Installations
- 40+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- pagecdn
- Installations
- 30+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- triagetrak
- Installations
- 30+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- magic-conversation-for-gravity-forms
- Installations
- 10+
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- activityhub
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Livemesh Addons for Elementor
- Plugin Slug:
- addons-for-elementor
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Livemesh Addons for Elementor
- Plugin Slug:
- addons-for-elementor
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- addressya-for-woocommerce
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
alfred24 Click & Collect
- Plugin Slug:
- alfred-click-collect
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Alfred Easy Shipping
- Plugin Slug:
- alfred-easy-shipping
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
CommandBar for WP Admin
- Plugin Slug:
- commandbar-for-wp-admin
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Digital River Global Commerce
- Plugin Slug:
- digital-river-global-commerce
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Easy Custom Code (LESS/CSS/JS) – Live editing
- Plugin Slug:
- easy-custom-code
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Floating Social Buttons
- Plugin Slug:
- floating-social-buttons
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Floating Social Media Links
- Plugin Slug:
- floating-social-media-links
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Responsive Image Gallery, Gallery Album
- Plugin Slug:
- gallery-album
- Vulnerability:
- Broken Access Control
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- ideaplus
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Image Hover Effects – Caption Hover with Carousel
- Plugin Slug:
- image-hover-effects-with-carousel
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Jobs.af
- Plugin Slug:
- jobs-af
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Login Logo Editor
- Plugin Slug:
- login-logo-editor-by-oizuled
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Mine Video Player
- Plugin Slug:
- mine-video
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Get Better Reviews for WooCommerce
- Plugin Slug:
- more-better-reviews-for-woocommerce
- Vulnerability:
- Broken Access Control
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Save as PDF plugin by Pdfcrowd
- Plugin Slug:
- save-as-pdf-by-pdfcrowd
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Simple Social Share
- Plugin Slug:
- simple-social-share
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Simply Show Hooks
- Plugin Slug:
- simply-show-hooks
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- sitetweet-tweets-user-behaviors-on-your-site-on-twitter
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Plugin:
-
Elementor Addons, Widgets and Enhancements – Stax
- Plugin Slug:
- stax-addons-for-elementor
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Template Kit – Export
- Plugin Slug:
- template-kit-export
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Testimonials Widget
- Plugin Slug:
- testimonials-widget
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
UltraAddons Elementor Lite
- Plugin Slug:
- ultraaddons-elementor-lite
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
Viva Payments
- Plugin Slug:
- viva-payments-simple-checkout
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
WordPress Notification Bar
- Plugin Slug:
- wordpress-notification-bar
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
wp-code-highlightjs
- Plugin Slug:
- wp-code-highlightjs
- Vulnerability:
- Backdoor
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
WP Cookie Law Info
- Plugin Slug:
- wp-cookie-law-info
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin:
-
WP To Do
- Plugin Slug:
- wp-todo
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Plugin Slug:
- header-footer-elementor
- Installations
- 2,000,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.6.36
- Severity Score:
- Medium
- Plugin Slug:
- seo-by-rank-math
- Installations
- 2,000,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.0.219
- Severity Score:
- Medium
- Plugin Slug:
- ninja-forms
- Installations
- 800,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 3.8.5
- Severity Score:
- Medium
- Plugin Slug:
- ultimate-addons-for-gutenberg
- Installations
- 800,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 2.13.8
- Severity Score:
- Medium
- Plugin Slug:
- premium-addons-for-elementor
- Installations
- 700,000+
- Vulnerability:
- Denial of Service Attack
- Patched in Version:
- 4.10.36
- Severity Score:
- Low
- Plugin Slug:
- premium-addons-for-elementor
- Installations
- 700,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 4.10.36
- Severity Score:
- Medium
- Plugin Slug:
- the-events-calendar
- Installations
- 700,000+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 6.5.1.5
- Severity Score:
- Medium
- Plugin Slug:
- ocean-extra
- Installations
- 600,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.3.0
- Severity Score:
- Medium
- Plugin Slug:
- gutenberg
- Installations
- 300,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 18.6.1
- Severity Score:
- Medium
- Plugin Slug:
- beaver-builder-lite-version
- Installations
- 100,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.8.3
- Severity Score:
- Medium
- Plugin Slug:
- the-plus-addons-for-elementor-page-builder
- Installations
- 100,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 5.6.2
- Severity Score:
- Medium
- Plugin Slug:
- wp-nested-pages
- Installations
- 100,000+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 3.2.8
- Severity Score:
- High
- Plugin Slug:
- featured-image-from-url
- Installations
- 90,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 4.8.3
- Severity Score:
- Medium
- Plugin Slug:
- learnpress
- Installations
- 90,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 4.2.6.8.2
- Severity Score:
- Medium
- Plugin Slug:
- learnpress
- Installations
- 90,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 4.2.6.8.2
- Severity Score:
- Medium
- Plugin Slug:
- paid-memberships-pro
- Installations
- 90,000+
- Vulnerability:
- SQL Injection
- Patched in Version:
- 3.0.6
- Severity Score:
- High
- Plugin Slug:
- the-post-grid
- Installations
- 90,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 7.7.5
- Severity Score:
- Medium
- Plugin Slug:
- the-post-grid
- Installations
- 90,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 7.7.5
- Severity Score:
- Medium
- Plugin Slug:
- the-post-grid
- Installations
- 90,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 7.7.5
- Severity Score:
- Medium
- Plugin Slug:
- the-post-grid
- Installations
- 90,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 7.7.2
- Severity Score:
- Medium
- Plugin Slug:
- ameliabooking
- Installations
- 70,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 1.1.9
- Severity Score:
- Medium
- Plugin Slug:
- media-library-assistant
- Installations
- 70,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.18
- Severity Score:
- High
- Plugin Slug:
- form-maker
- Installations
- 50,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.15.26
- Severity Score:
- Medium
- Plugin Slug:
- sina-extension-for-elementor
- Installations
- 50,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.5.6
- Severity Score:
- Medium
- Plugin Slug:
- ultimate-blocks
- Installations
- 50,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.2.0
- Severity Score:
- Medium
- Plugin Slug:
- woocommerce-google-adwords-conversion-tracking-tag
- Installations
- 50,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 1.43.4
- Severity Score:
- Medium
- Plugin Slug:
- quiz-master-next
- Installations
- 40,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 9.0.2
- Severity Score:
- Medium
- Plugin Slug:
- wp-lightbox-2
- Installations
- 40,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.0.6.7
- Severity Score:
- Medium
- Plugin Slug:
- apollo13-framework-extensions
- Installations
- 30,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.9.4
- Severity Score:
- Medium
- Plugin Slug:
- cf7-widget-elementor
- Installations
- 30,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.4.1
- Severity Score:
- Medium
- Plugin Slug:
- cost-calculator-builder
- Installations
- 30,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.2.13
- Severity Score:
- Medium
- Plugin Slug:
- cost-calculator-builder
- Installations
- 30,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 3.2.13
- Severity Score:
- Medium
- Plugin Slug:
- google-maps-easy
- Installations
- 30,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.11.16
- Severity Score:
- Medium
- Plugin Slug:
- rife-elementor-extensions
- Installations
- 30,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.2.2
- Severity Score:
- Medium
- Plugin Slug:
- weforms
- Installations
- 20,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 1.6.24
- Severity Score:
- Medium
- Plugin Slug:
- wp-user-frontend
- Installations
- 20,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 4.0.8
- Severity Score:
- Medium
- Plugin Slug:
- charitable
- Installations
- 10,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.8.1.8
- Severity Score:
- Medium
- Plugin Slug:
- charitable
- Installations
- 10,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.8.1.8
- Severity Score:
- Medium
- Plugin Slug:
- gpt3-ai-content-generator
- Installations
- 10,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.8.67
- Severity Score:
- Medium
- Plugin Slug:
- lastudio-element-kit
- Installations
- 10,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 1.3.9
- Severity Score:
- High
- Plugin Slug:
- mega-elements-addons-for-elementor
- Installations
- 10,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.2.3
- Severity Score:
- Medium
- Plugin Slug:
- newsletter-optin-box
- Installations
- 10,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 3.4.3
- Severity Score:
- Medium
- Plugin Slug:
- nex-forms-express-wp-form-builder
- Installations
- 10,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 8.6.1
- Severity Score:
- Medium
- Plugin Slug:
- swift-performance-lite
- Installations
- 10,000+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.3.6.21
- Severity Score:
- Medium
- Plugin Slug:
- wc-product-customer-list
- Installations
- 10,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 3.1.7
- Severity Score:
- Medium
- Plugin Slug:
- word-balloon
- Installations
- 10,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 4.22.2
- Severity Score:
- Medium
- Plugin Slug:
- wp-event-solution
- Installations
- 10,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 4.0.0
- Severity Score:
- Medium
- Plugin Slug:
- motors-car-dealership-classified-listings
- Installations
- 9,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.4.11
- Severity Score:
- Medium
- Plugin Slug:
- tablesome
- Installations
- 9,000+
- Vulnerability:
- Sensitive Data Exposure
- Patched in Version:
- 1.0.34
- Severity Score:
- Medium
- Plugin Slug:
- wp-sentry-integration
- Installations
- 9,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 7.9.0
- Severity Score:
- Medium
- Plugin Slug:
- yith-woocommerce-affiliates
- Installations
- 8,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 3.8.1
- Severity Score:
- Medium
- Plugin Slug:
- youzify
- Installations
- 8,000+
- Vulnerability:
- SQL Injection
- Patched in Version:
- 1.2.6
- Severity Score:
- High
- Plugin Slug:
- mediavine-create
- Installations
- 7,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.9.8
- Severity Score:
- Medium
- Plugin Slug:
- profilegrid-user-profiles-groups-and-communities
- Installations
- 7,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 5.8.8
- Severity Score:
- Medium
- Plugin Slug:
- ultimate-bootstrap-elements-for-elementor
- Installations
- 6,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 1.4.3
- Severity Score:
- High
- Plugin Slug:
- wp-cafe
- Installations
- 6,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 2.2.28
- Severity Score:
- High
- Plugin Slug:
- wpzoom-addons-for-beaver-builder
- Installations
- 6,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 1.3.6
- Severity Score:
- Medium
- Plugin Slug:
- shortcode-variables
- Installations
- 5,000+
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 4.1.5
- Severity Score:
- Medium
- Plugin Slug:
- awsm-team
- Installations
- 4,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 1.3.2
- Severity Score:
- Medium
- Plugin Slug:
- bbpress-notify-nospam
- Installations
- 4,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.18.4
- Severity Score:
- High
- Plugin Slug:
- firebox
- Installations
- 4,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 2.1.16
- Severity Score:
- Medium
- Plugin Slug:
- advanced-classifieds-and-directory-pro
- Installations
- 3,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 3.2.1
- Severity Score:
- High
- Plugin Slug:
- filebird-document-library
- Installations
- 3,000+
- Vulnerability:
- Sensitive Data Exposure
- Patched in Version:
- 2.0.8.1
- Severity Score:
- Medium
- Plugin Slug:
- helloasso
- Installations
- 3,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.1.10
- Severity Score:
- Medium
- Plugin Slug:
- imgspider
- Installations
- 3,000+
- Vulnerability:
- Arbitrary File Upload
- Patched in Version:
- 2.3.11
- Severity Score:
- Critical
- Plugin Slug:
- shopbuilder
- Installations
- 3,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 2.1.13
- Severity Score:
- Medium
- Plugin Slug:
- crm-perks-forms
- Installations
- 2,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.1.6
- Severity Score:
- Medium
- Plugin Slug:
- eazydocs
- Installations
- 2,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.5.0
- Severity Score:
- Medium
- Plugin Slug:
- makecommerce
- Installations
- 2,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.5.2
- Severity Score:
- High
- Plugin Slug:
- meeting-scheduler-by-vcita
- Installations
- 2,000+
- Vulnerability:
- Local File Inclusion
- Patched in Version:
- 4.4.3
- Severity Score:
- Medium
- Plugin Slug:
- one-click-order-reorder
- Installations
- 2,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.1.10
- Severity Score:
- Medium
- Plugin Slug:
- premium-blocks-for-gutenberg
- Installations
- 2,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.1.28
- Severity Score:
- Medium
- Plugin Slug:
- yahman-add-ons
- Installations
- 2,000+
- Vulnerability:
- Backdoor
- Patched in Version:
- 0.9.29
- Severity Score:
- Medium
- Plugin Slug:
- church-admin
- Installations
- 1,000+
- Vulnerability:
- Arbitrary File Upload
- Patched in Version:
- 4.4.7
- Severity Score:
- Critical
- Plugin Slug:
- ideapush
- Installations
- 1,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 8.66
- Severity Score:
- High
- Plugin Slug:
- newspack-newsletters
- Installations
- 1,000+
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 2.13.3
- Severity Score:
- Medium
- Plugin Slug:
- post-meta-data-manager
- Installations
- 1,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.3.0
- Severity Score:
- Medium
- Plugin Slug:
- supersaas-appointment-scheduling
- Installations
- 1,000+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.1.10
- Severity Score:
- Medium
- Plugin Slug:
- zephyr-project-manager
- Installations
- 1,000+
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- 3.3.99
- Severity Score:
- High
- Plugin Slug:
- comment-reply-email
- Installations
- 500+
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.5
- Severity Score:
- High
- Plugin Slug:
- shipany
- Installations
- 100+
- Vulnerability:
- Backdoor
- Patched in Version:
- 1.1.53
- Severity Score:
- Medium
- Plugin Slug:
- integration-for-luminate-and-gravity-forms
- Installations
- 70+
- Vulnerability:
- Backdoor
- Patched in Version:
- 1.3.4
- Severity Score:
- Medium
- Plugin Slug:
- eid-easy-qualified-electonic-signature
- Installations
- 20+
- Vulnerability:
- Backdoor
- Patched in Version:
- 3.3.1
- Severity Score:
- Medium
- Plugin:
-
BLAZE Retail Widget
- Plugin Slug:
- blaze-widget
- Vulnerability:
- Backdoor
- Patched in Version:
- 2.5.4
- Severity Score:
- Medium
- Plugin:
-
Contact Form 7 Multi-Step Addon
- Plugin Slug:
- contact-form-7-multi-step-addon
- Vulnerability:
- Backdoor
- Patched in Version:
- 1.0.7
- Severity Score:
- Medium
- Plugin:
-
XPlainer – WooCommerce Product FAQ
- Plugin Slug:
- faq-for-woocommerce
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.6.4
- Severity Score:
- Medium
- Plugin:
-
JetThemeCore
- Plugin Slug:
- jet-theme-core
- Vulnerability:
- Arbitrary File Deletion
- Patched in Version:
- 2.2.1
- Severity Score:
- High
- Plugin:
-
Modern Events Calendar
- Plugin Slug:
- modern-events-calendar
- Vulnerability:
- Arbitrary File Upload
- Patched in Version:
- 7.12.0
- Severity Score:
- High
- Plugin:
-
Modern Events Calendar Lite
- Plugin Slug:
- modern-events-calendar-lite
- Vulnerability:
- Arbitrary File Upload
- Patched in Version:
- 7.12.0
- Severity Score:
- High
- Plugin:
-
Newspack Ads
- Plugin Slug:
- newspack-ads
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.47.2
- Severity Score:
- Medium
- Plugin:
-
Newspack Content Converter
- Plugin Slug:
- newspack-content-converter
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.0.0
- Severity Score:
- Medium
- Plugin:
-
Newspack Campaigns
- Plugin Slug:
- newspack-popups
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.31.2
- Severity Score:
- Medium
- Plugin:
-
PayPlus Payment Gateway
- Plugin Slug:
- payplus-payment-gateway
- Vulnerability:
- SQL Injection
- Patched in Version:
- 6.6.9
- Severity Score:
- Critical
- Plugin:
-
PayPlus Payment Gateway
- Plugin Slug:
- payplus-payment-gateway
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 6.6.9
- Severity Score:
- High
- Plugin:
-
Social Warfare
- Plugin Slug:
- social-warfare
- Vulnerability:
- Backdoor
- Patched in Version:
- 4.4.7.3
- Severity Score:
- Medium
- Plugin:
-
Ultimate Addons for Elementor
- Plugin Slug:
- ultimate-elementor
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- 1.36.32
- Severity Score:
- High
- Plugin:
-
Woffice Core
- Plugin Slug:
- woffice-core
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 5.4.9
- Severity Score:
- High
- Plugin:
-
Woffice Core
- Plugin Slug:
- woffice-core
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 5.4.9
- Severity Score:
- High
- Plugin:
-
WooCommerce Social Login
- Plugin Slug:
- woo-social-login
- Vulnerability:
- PHP Object Injection
- Patched in Version:
- 2.7.0
- Severity Score:
- Medium
- Plugin:
-
CopySafe Web Protection
- Plugin Slug:
- wp-copysafe-web
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 3.15
- Severity Score:
- Medium
- Plugin:
-
WP Directory Kit
- Plugin Slug:
- wpdirectorykit
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 1.3.6
- Severity Score:
- High
- Plugin:
-
WPQA – Builder forms Addon
- Plugin Slug:
- wpqa
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 6.1.1
- Severity Score:
- Medium
- Plugin:
-
WPQA – Builder forms Addon
- Plugin Slug:
- wpqa
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 6.1.1
- Severity Score:
- Medium
WordPress Themes — 20 Patched / 3 Unpatched
- Theme Slug:
- zbench
- Downloads
- 588,387
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Theme:
-
Boot Store
- Theme Slug:
- boot-store
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- Medium
- Theme:
-
counterpoint
- Theme Slug:
- counterpoint
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- No Fix
- Severity Score:
- High
- Theme Slug:
- ashe
- Downloads
- 1,959,473
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.234
- Severity Score:
- Medium
- Theme Slug:
- bakes-and-cakes
- Downloads
- 154,588
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.2.7
- Severity Score:
- Medium
- Theme Slug:
- bard
- Downloads
- 912,192
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.211
- Severity Score:
- Medium
- Theme Slug:
- blocksy
- Downloads
- 3,364,636
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.0.23
- Severity Score:
- Medium
- Theme Slug:
- business-one-page
- Downloads
- 211,071
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.3.0
- Severity Score:
- Medium
- Theme Slug:
- construction-landing-page
- Downloads
- 284,784
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 1.3.6
- Severity Score:
- Medium
- Theme Slug:
- hestia
- Downloads
- 4,067,479
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 3.1.3
- Severity Score:
- Medium
- Theme Slug:
- highlight
- Downloads
- 435,892
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 1.0.30
- Severity Score:
- Medium
- Theme Slug:
- lawyer-landing-page
- Downloads
- 128,839
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 1.2.5
- Severity Score:
- Medium
- Theme Slug:
- metro-magazine
- Downloads
- 260,020
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.3.8
- Severity Score:
- Medium
- Theme Slug:
- newsmatic
- Downloads
- 217,113
- Vulnerability:
- Broken Access Control
- Patched in Version:
- 1.3.3
- Severity Score:
- Medium
- Theme Slug:
- posterity
- Downloads
- 95,124
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 3.4
- Severity Score:
- Medium
- Theme Slug:
- rara-business
- Downloads
- 201,763
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 1.2.6
- Severity Score:
- Medium
- Theme Slug:
- rife-free
- Downloads
- 696,099
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.4.19
- Severity Score:
- Medium
- Theme Slug:
- trendy-news
- Downloads
- 24,718
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 1.0.16
- Severity Score:
- Medium
- Theme:
-
Basil
- Theme Slug:
- basil
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.0.5
- Severity Score:
- Medium
- Theme:
-
BookYourTravel
- Theme Slug:
- bookyourtravel
- Vulnerability:
- Privilege Escalation
- Patched in Version:
- 8.18.19
- Severity Score:
- High
- Theme:
-
Himer
- Theme Slug:
- himer
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 2.1.1
- Severity Score:
- Medium
- Theme:
-
Himer
- Theme Slug:
- himer
- Vulnerability:
- Cross Site Request Forgery (CSRF)
- Patched in Version:
- 2.1.1
- Severity Score:
- Medium
- Theme:
-
Woffice
- Theme Slug:
- woffice
- Vulnerability:
- Cross Site Scripting (XSS)
- Patched in Version:
- 5.4.9
- Severity Score:
- High
Solid Security is part of Solid Suite — The best foundation for WordPress websites.
Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!