virusword.com

Learn Wordpress

Home/Woocommerce/WordPress Vulnerability Report — May 15, 2024

WordPress Vulnerability Report — May 15, 2024

In this report, 192 vulnerabilities have been publicly disclosed. Security patches for 145 of these plugins and themes are available now, so run those updates as soon as possible. If you’re a Solid Security Pro user, the version management tool may have already warned you and updated these plugins, depending on your settings.

Additionally, there are 47 plugin vulnerabilities with no patch available yet. If you’re a Solid Security Pro user, those vulnerabilities are already protected by the Solid Security firewall. Virtual patches from Patchstack will be applied when a vulnerability is considered high or medium risk. If no patch is forthcoming from the vendor or the vulnerable software has been marked “closed” and dropped from the official WordPress repositories, you should deactivate it soon and look for alternative solutions.

window[“e516ebc3_cc22_4120_9024_74a02d8803fb”] = {“blockId”:”e516ebc3-cc22-4120-9024-74a02d8803fb”,”type”:”warning”,”content”:”

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.”,”className”:””};

Along with poor user account security, vulnerable plugins and themes are among the top reasons why WordPress websites get hacked. Unfortunately, cyberattacks are increasing in volume and sophistication. They’re also increasingly aimed at small to mid-sized businesses.

window[“255c72cf_b4e3_402c_9998_e11c0e137abc”] = {“blockId”:”255c72cf-b4e3-402c-9998-e11c0e137abc”,”className”:””,”isOpen”:true};

window[“d4016609_9a27_4a04_8b01_4cf71ac41793”] = {“blockId”:”d4016609-9a27-4a04-8b01-4cf71ac41793″,”type”:”notice”,”content”:”

Our WordPress Vulnerability Report\u00a0covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of\u00a0Low,\u00a0Medium,\u00a0High, or\u00a0Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress \u2014 and the web \u2014 more secure.”,”className”:””};

Our WordPress Vulnerability Report covers the latest emerging WordPress plugin, theme, and core vulnerabilities. Each vulnerability will have a severity rating of Low, Medium, High, or Critical. Responsible disclosure of vulnerabilities is essential to keeping the WordPress community safe. Please share this report to help spread the word and make WordPress — and the web — more secure.

WordPress Core

WordPress 6.5.3 was released on May 7, 2024, as a short-cycle maintenance release. This release features 12 bug fixes on Core and 9 bug fixes for the Block editor.

The next major release will be version 6.6 planned for July 2024.

window[“3ce27c10_4561_4878_bd60_5562a4dbf81c”] = {“blockId”:”3ce27c10-4561-4878-bd60-5562a4dbf81c”,”text”:”No new core vulnerabilities were disclosed this week.”,”className”:””};

No new core vulnerabilities were disclosed this week.

WordPress Plugins — 129 Patched / 47 Unpatched

Flo Forms – Easy Drag & Drop Form Builder

Plugin:

Flo Forms – Easy Drag & Drop Form Builder

Plugin Slug:
flo-forms

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-35174

The vulnerability has not been patched. You should deactivate the plugin.

WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder

Plugin:

WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder

Plugin Slug:
wp-post-author

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34389

The vulnerability has not been patched. You should deactivate the plugin.

WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder

Plugin:

WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder

Plugin Slug:
wp-post-author

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34387

The vulnerability has not been patched. You should deactivate the plugin.

140+ Widgets | Best Addons For Elementor – FREE

Plugin:

140+ Widgets | Best Addons For Elementor – FREE

Plugin Slug:
xpro-elementor-addons

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34570

The vulnerability has not been patched. You should deactivate the plugin.

JCH Optimize

Plugin:

JCH Optimize

Plugin Slug:
jch-optimize

Installations
6,000+

Vulnerability:
Path Traversal

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34808

The vulnerability has not been patched. You should deactivate the plugin.

Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder

Plugin:

Post Grid Master – Custom Post Types, Taxonomies & Ajax Filter Everything with Infinite Scroll, Load More, Pagination & Shortcode Builder

Plugin Slug:
ajax-filter-posts

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34390

The vulnerability has not been patched. You should deactivate the plugin.

Kognetiks Chatbot for WordPress

Plugin:

Kognetiks Chatbot for WordPress

Plugin Slug:
chatbot-chatgpt

Installations
1,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2024-32700

The vulnerability has not been patched. You should deactivate the plugin.

Netgsm

Plugin:

Netgsm

Plugin Slug:
netgsm

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-4746

The vulnerability has not been patched. You should deactivate the plugin.

Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider

Plugin:

Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider

Plugin Slug:
ultimate-store-kit

Installations
1,000+

Vulnerability:
PHP Object Injection

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-4606

The vulnerability has not been patched. You should deactivate the plugin.

WordPress Webinar Plugin – WebinarPress

Plugin:

WordPress Webinar Plugin – WebinarPress

Plugin Slug:
wp-webinarsystem

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2024-34818

The vulnerability has not been patched. You should deactivate the plugin.

gee Search Plus, improved WordPress search

Plugin:

gee Search Plus, improved WordPress search

Plugin Slug:
gsearch-plus

Installations
100+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34560

The vulnerability has not been patched. You should deactivate the plugin.

Sticky Social Link

Plugin:

Sticky Social Link

Plugin Slug:
sticky-social-link

Installations
100+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34546

The vulnerability has not been patched. You should deactivate the plugin.

DS Site Message

Plugin:

DS Site Message

Plugin Slug:
ds-site-message

Installations
10+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34439

The vulnerability has not been patched. You should deactivate the plugin.

Viet Nam Affiliate

Plugin:

Viet Nam Affiliate

Plugin Slug:
viet-nam-affiliate

Installations
10+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34417

The vulnerability has not been patched. You should deactivate the plugin.

AWSOM News Announcement

Plugin:

AWSOM News Announcement

Plugin Slug:
awsom-news-announcement

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34428

The vulnerability has not been patched. You should deactivate the plugin.

BlogLentor

Plugin:

BlogLentor

Plugin Slug:
bloglentor-for-elementor

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34421

The vulnerability has not been patched. You should deactivate the plugin.

Brozzme Scroll Top

Plugin:

Brozzme Scroll Top

Plugin Slug:
brozzme-scroll-top

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34426

The vulnerability has not been patched. You should deactivate the plugin.

canvasio3D Light

Plugin:

canvasio3D Light

Plugin Slug:
canvasio3d-light

Vulnerability:
Arbitrary File Upload

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2024-34411

The vulnerability has not been patched. You should deactivate the plugin.

Configure Login Timeout

Plugin:

Configure Login Timeout

Plugin Slug:
configure-login-timeout

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34419

The vulnerability has not been patched. You should deactivate the plugin.

Corona Virus (COVID-19) Banner & Live Data

Plugin:

Corona Virus (COVID-19) Banner & Live Data

Plugin Slug:
corona-virus-covid-19-banner

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34429

The vulnerability has not been patched. You should deactivate the plugin.

Crelly Slider

Plugin:

Crelly Slider

Plugin Slug:
crelly-slider

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-3752

The vulnerability has not been patched. You should deactivate the plugin.

Debug Info

Plugin:

Debug Info

Plugin Slug:
debug-info

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34565

The vulnerability has not been patched. You should deactivate the plugin.

EasyEvent

Plugin:

EasyEvent

Plugin Slug:
easyevent

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-3628

The vulnerability has not been patched. You should deactivate the plugin.

Enter Addons

Plugin:

Enter Addons

Plugin Slug:
enteraddons

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-3831

The vulnerability has not been patched. You should deactivate the plugin.

Fancy Elementor Flipbox

Plugin:

Fancy Elementor Flipbox

Plugin Slug:
fancy-elementor-flipbox

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34572

The vulnerability has not been patched. You should deactivate the plugin.

Fast Custom Social Share by CodeBard

Plugin:

Fast Custom Social Share by CodeBard

Plugin Slug:
fast-custom-social-share-by-codebard

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34807

The vulnerability has not been patched. You should deactivate the plugin.

Featured Content Gallery

Plugin:

Featured Content Gallery

Plugin Slug:
featured-content-gallery

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34424

The vulnerability has not been patched. You should deactivate the plugin.

Forty Four – 404 Plugin for WordPress

Plugin:

Forty Four – 404 Plugin for WordPress

Plugin Slug:
forty-four

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34423

The vulnerability has not been patched. You should deactivate the plugin.

GDPR Compliance

Plugin:

GDPR Compliance

Plugin Slug:
gdpr-compliance

Vulnerability:
Sensitive Data Exposure

Patched in Version:
No Fix

Severity Score:
High

CVE:

2024-34388

The vulnerability has not been patched. You should deactivate the plugin.

Comments Evolved for WordPress

Plugin:

Comments Evolved for WordPress

Plugin Slug:
gplus-comments

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34420

The vulnerability has not been patched. You should deactivate the plugin.

LetterPress

Plugin:

LetterPress

Plugin Slug:
letterpress

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34568

The vulnerability has not been patched. You should deactivate the plugin.

MF Gig Calendar

Plugin:

MF Gig Calendar

Plugin Slug:
mf-gig-calendar

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-3755

The vulnerability has not been patched. You should deactivate the plugin.

Pk Favicon Manager

Plugin:

Pk Favicon Manager

Plugin Slug:
phpsword-favicon-manager

Vulnerability:
Arbitrary File Upload

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2024-34416

The vulnerability has not been patched. You should deactivate the plugin.

Pootle Pagebuilder – WordPress Page builder

Plugin:

Pootle Pagebuilder – WordPress Page builder

Plugin Slug:
pootle-page-builder

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34573

The vulnerability has not been patched. You should deactivate the plugin.

Pure Chat

Plugin:

Pure Chat

Plugin Slug:
pure-chat

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-3595

The vulnerability has not been patched. You should deactivate the plugin.

QuickieBar

Plugin:

QuickieBar

Plugin Slug:
quickiebar

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34425

The vulnerability has not been patched. You should deactivate the plugin.

Social Connect

Plugin:

Social Connect

Plugin Slug:
social-connect

Vulnerability:
Privilege Escalation

Patched in Version:
No Fix

Severity Score:
Critical

CVE:

2024-4393

The vulnerability has not been patched. You should deactivate the plugin.

Swift Performance Lite

Plugin:

Swift Performance Lite

Plugin Slug:
swift-performance-lite

Vulnerability:
Broken Access Control

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-3722

The vulnerability has not been patched. You should deactivate the plugin.

Table Maker

Plugin:

Table Maker

Plugin Slug:
table-maker

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34574

The vulnerability has not been patched. You should deactivate the plugin.

TT Custom Post Type Creator

Plugin:

TT Custom Post Type Creator

Plugin Slug:
tt-custom-post-type-creator

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34430

The vulnerability has not been patched. You should deactivate the plugin.

Viet Affiliate Link

Plugin:

Viet Affiliate Link

Plugin Slug:
viet-affiliate-link

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34422

The vulnerability has not been patched. You should deactivate the plugin.

WP etracker

Plugin:

WP etracker

Plugin Slug:
wp-etracker

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
High

CVE:

2024-34431

The vulnerability has not been patched. You should deactivate the plugin.

WP Favorite Posts

Plugin:

WP Favorite Posts

Plugin Slug:
wp-favorite-posts

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34427

The vulnerability has not been patched. You should deactivate the plugin.

WPCS ( WordPress Custom Search )

Plugin:

WPCS ( WordPress Custom Search )

Plugin Slug:
wpcs-wp-custom-search

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
No Fix

Severity Score:
Medium

CVE:

2024-34418

The vulnerability has not been patched. You should deactivate the plugin.

Yoast SEO

Plugin:

Yoast SEO

Plugin Slug:
wordpress-seo

Installations
5,000,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
22.6

Severity Score:
High

CVE:

2024-4041

The vulnerability has been patched, so you should update to version 22.6.

Jetpack – WP Security, Backup, Speed, & Growth

Plugin:

Jetpack – WP Security, Backup, Speed, & Growth

Plugin Slug:
jetpack

Installations
4,000,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
13.4

Severity Score:
Medium

CVE:

2024-4392

The vulnerability has been patched, so you should update to version 13.4.

One Click Demo Import

Plugin:

One Click Demo Import

Plugin Slug:
one-click-demo-import

Installations
1,000,000+

Vulnerability:
PHP Object Injection

Patched in Version:
3.2.1

Severity Score:
Medium

CVE:

2024-34433

The vulnerability has been patched, so you should update to version 3.2.1.

Translate Multilingual sites – TranslatePress

Plugin:

Translate Multilingual sites – TranslatePress

Plugin Slug:
translatepress-multilingual

Installations
300,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
2.7.6

Severity Score:
Medium

CVE:

2024-34827

The vulnerability has been patched, so you should update to version 2.7.6.

Blocksy Companion

Plugin:

Blocksy Companion

Plugin Slug:
blocksy-companion

Installations
200,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.0.46

Severity Score:
Medium

CVE:

2024-4487

The vulnerability has been patched, so you should update to version 2.0.46.

Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

Plugin:

Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

Plugin Slug:
unlimited-elements-for-elementor

Installations
200,000+

Vulnerability:
Remote Code Execution (RCE)

Patched in Version:
1.5.103

Severity Score:
High

CVE:

2024-2662

The vulnerability has been patched, so you should update to version 1.5.103.

Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

Plugin:

Unlimited Elements For Elementor (Free Widgets, Addons, Templates)

Plugin Slug:
unlimited-elements-for-elementor

Installations
200,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.5.103

Severity Score:
High

CVE:

2024-3547

The vulnerability has been patched, so you should update to version 1.5.103.

White Label CMS

Plugin:

White Label CMS

Plugin Slug:
white-label-cms

Installations
200,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.7.4

Severity Score:
Medium

CVE:

2024-4280

The vulnerability has been patched, so you should update to version 2.7.4.

Advanced Ads – Ad Manager & AdSense

Plugin:

Advanced Ads – Ad Manager & AdSense

Plugin Slug:
advanced-ads

Installations
100,000+

Vulnerability:
PHP Object Injection

Patched in Version:
1.52.2

Severity Score:
Medium

CVE:

2024-2290

The vulnerability has been patched, so you should update to version 1.52.2.

Advanced Ads – Ad Manager & AdSense

Plugin:

Advanced Ads – Ad Manager & AdSense

Plugin Slug:
advanced-ads

Installations
100,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.52.2

Severity Score:
Medium

CVE:

2024-3952

The vulnerability has been patched, so you should update to version 1.52.2.

Beaver Builder – WordPress Page Builder

Plugin:

Beaver Builder – WordPress Page Builder

Plugin Slug:
beaver-builder-lite-version

Installations
100,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.8.1.3

Severity Score:
Medium

CVE:

2024-4430

The vulnerability has been patched, so you should update to version 2.8.1.3.

Beaver Builder – WordPress Page Builder

Plugin:

Beaver Builder – WordPress Page Builder

Plugin Slug:
beaver-builder-lite-version

Installations
100,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.8.1.2

Severity Score:
Medium

CVE:

2024-3923

The vulnerability has been patched, so you should update to version 2.8.1.2.

HT Mega – Absolute Addons For Elementor

Plugin:

HT Mega – Absolute Addons For Elementor

Plugin Slug:
ht-mega-for-elementor

Installations
100,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.5.1

Severity Score:
Medium

CVE:

2024-3990

The vulnerability has been patched, so you should update to version 2.5.1.

Pods – Custom Content Types and Fields

Plugin:

Pods – Custom Content Types and Fields

Plugin Slug:
pods

Installations
100,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.2.1.1

Severity Score:
Medium

CVE:

2024-3956

The vulnerability has been patched, so you should update to version 3.2.1.1.

WP Job Manager

Plugin:

WP Job Manager

Plugin Slug:
wp-job-manager

Installations
100,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
2.3.0

Severity Score:
Medium

CVE:

2024-34549

The vulnerability has been patched, so you should update to version 2.3.0.

XML Sitemap & Google News

Plugin:

XML Sitemap & Google News

Plugin Slug:
xml-sitemap-feed

Installations
100,000+

Vulnerability:
Local File Inclusion

Patched in Version:
5.4.9

Severity Score:
High

CVE:

2024-4441

The vulnerability has been patched, so you should update to version 5.4.9.

EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor

Plugin:

EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor

Plugin Slug:
embedpress

Installations
90,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.9.17

Severity Score:
Medium

CVE:

2024-4316

The vulnerability has been patched, so you should update to version 3.9.17.

LearnPress – WordPress LMS Plugin

Plugin:

LearnPress – WordPress LMS Plugin

Plugin Slug:
learnpress

Installations
90,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.2.6.6

Severity Score:
Medium

CVE:

2024-4277

The vulnerability has been patched, so you should update to version 4.2.6.6.

LearnPress – WordPress LMS Plugin

Plugin:

LearnPress – WordPress LMS Plugin

Plugin Slug:
learnpress

Installations
90,000+

Vulnerability:
Broken Access Control

Patched in Version:
4.2.6.6

Severity Score:
Medium

CVE:

2024-4444

The vulnerability has been patched, so you should update to version 4.2.6.6.

LearnPress – WordPress LMS Plugin

Plugin:

LearnPress – WordPress LMS Plugin

Plugin Slug:
learnpress

Installations
90,000+

Vulnerability:
SQL Injection

Patched in Version:
4.2.6.6

Severity Score:
Critical

CVE:

2024-4434

The vulnerability has been patched, so you should update to version 4.2.6.6.

LearnPress – WordPress LMS Plugin

Plugin:

LearnPress – WordPress LMS Plugin

Plugin Slug:
learnpress

Installations
90,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
4.2.6.6

Severity Score:
Critical

CVE:

2024-4397

The vulnerability has been patched, so you should update to version 4.2.6.6.

Import and export users and customers

Plugin:

Import and export users and customers

Plugin Slug:
import-users-from-csv-with-meta

Installations
80,000+

Vulnerability:
Broken Access Control

Patched in Version:
1.26.6

Severity Score:
Medium

CVE:

2024-34815

The vulnerability has been patched, so you should update to version 1.26.6.

Mesmerize Companion

Plugin:

Mesmerize Companion

Plugin Slug:
mesmerize-companion

Installations
80,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.6.149

Severity Score:
Medium

CVE:

2024-3494

The vulnerability has been patched, so you should update to version 1.6.149.

Sydney Toolbox

Plugin:

Sydney Toolbox

Plugin Slug:
sydney-toolbox

Installations
80,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.32

Severity Score:
Medium

CVE:

2024-4473

The vulnerability has been patched, so you should update to version 1.32.

AI Engine

Plugin:

AI Engine

Plugin Slug:
ai-engine

Installations
70,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
2.2.70

Severity Score:
Critical

CVE:

2024-34440

The vulnerability has been patched, so you should update to version 2.2.70.

Custom Field Suite

Plugin:

Custom Field Suite

Plugin Slug:
custom-field-suite

Installations
50,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.6.6

Severity Score:
Medium

CVE:

2024-3068

The vulnerability has been patched, so you should update to version 2.6.6.

Image Hover Effects – Elementor Addon

Plugin:

Image Hover Effects – Elementor Addon

Plugin Slug:
image-hover-effects-addon-for-elementor

Installations
50,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.4.2

Severity Score:
Medium

CVE:

2024-1166

The vulnerability has been patched, so you should update to version 1.4.2.

Ditty – Responsive News Tickers, Sliders, and Lists

Plugin:

Ditty – Responsive News Tickers, Sliders, and Lists

Plugin Slug:
ditty-news-ticker

Installations
40,000+

Vulnerability:
PHP Object Injection

Patched in Version:
3.1.39

Severity Score:
High

CVE:

2024-3954

The vulnerability has been patched, so you should update to version 3.1.39.

Timber

Plugin:

Timber

Plugin Slug:
timber-library

Installations
40,000+

Vulnerability:
Deserialization of untrusted data

Patched in Version:
1.23.1

Severity Score:
High

CVE:

2024-29800

The vulnerability has been patched, so you should update to version 1.23.1.

Visual Footer Credit Remover

Plugin:

Visual Footer Credit Remover

Plugin Slug:
visual-footer-credit-remover

Installations
40,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3

Severity Score:
Medium

CVE:

2024-2846

The vulnerability has been patched, so you should update to version 1.3.

Social Sharing Plugin – Social Warfare

Plugin:

Social Sharing Plugin – Social Warfare

Plugin Slug:
social-warfare

Installations
30,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
4.4.6

Severity Score:
Medium

CVE:

2024-34825

The vulnerability has been patched, so you should update to version 4.4.6.

Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro

Plugin:

Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro

Plugin Slug:
back-in-stock-notifier-for-woocommerce

Installations
20,000+

Vulnerability:
Broken Access Control

Patched in Version:
5.3.2

Severity Score:
Medium

CVE:

2024-4038

The vulnerability has been patched, so you should update to version 5.3.2.

Content Blocks (Custom Post Widget)

Plugin:

Content Blocks (Custom Post Widget)

Plugin Slug:
custom-post-widget

Installations
20,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.3.1

Severity Score:
Medium

CVE:

2024-34566

The vulnerability has been patched, so you should update to version 3.3.1.

ClickCease Click Fraud Protection

Plugin:

ClickCease Click Fraud Protection

Plugin Slug:
clickcease-click-fraud-protection

Installations
10,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
3.2.5

Severity Score:
Medium

CVE:

2023-6810

The vulnerability has been patched, so you should update to version 3.2.5.

Easy Affiliate Links

Plugin:

Easy Affiliate Links

Plugin Slug:
easy-affiliate-links

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
3.7.3

Severity Score:
Medium

CVE:

2024-34441

The vulnerability has been patched, so you should update to version 3.7.3.

Envo’s Elementor Templates & Widgets for WooCommerce

Plugin:

Envo’s Elementor Templates & Widgets for WooCommerce

Plugin Slug:
envo-elementor-for-woocommerce

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.4.9

Severity Score:
Medium

CVE:

2024-35167

The vulnerability has been patched, so you should update to version 1.4.9.

Graphina – Elementor Charts and Graphs

Plugin:

Graphina – Elementor Charts and Graphs

Plugin Slug:
graphina-elementor-charts-and-graphs

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.8.10

Severity Score:
Medium

CVE:

2024-4574

The vulnerability has been patched, so you should update to version 1.8.10.

HTML5 Audio Player- Best WordPress Audio Player Plugin

Plugin:

HTML5 Audio Player- Best WordPress Audio Player Plugin

Plugin Slug:
html5-audio-player

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.2.22

Severity Score:
Medium

CVE:

2024-4398

The vulnerability has been patched, so you should update to version 2.2.22.

Link Library

Plugin:

Link Library

Plugin Slug:
link-library

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
7.7

Severity Score:
Medium

CVE:

2024-4281

The vulnerability has been patched, so you should update to version 7.7.

Gallery Block (Meow Gallery)

Plugin:

Gallery Block (Meow Gallery)

Plugin Slug:
meow-gallery

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
5.1.4

Severity Score:
Medium

CVE:

2024-4386

The vulnerability has been patched, so you should update to version 5.1.4.

Hotel Booking Lite

Plugin:

Hotel Booking Lite

Plugin Slug:
motopress-hotel-booking-lite

Installations
10,000+

Vulnerability:
PHP Object Injection

Patched in Version:
4.11.2

Severity Score:
Critical

CVE:

2024-4413

The vulnerability has been patched, so you should update to version 4.11.2.

Shared Counts – Social Media Share Buttons

Plugin:

Shared Counts – Social Media Share Buttons

Plugin Slug:
shared-counts

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
1.5.0

Severity Score:
Medium

The vulnerability has been patched, so you should update to version 1.5.0.

Simple Basic Contact Form

Plugin:

Simple Basic Contact Form

Plugin Slug:
simple-basic-contact-form

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
20240511

Severity Score:
Medium

CVE:

2024-4144

The vulnerability has been patched, so you should update to version 20240511.

SportsPress – Sports Club & League Manager

Plugin:

SportsPress – Sports Club & League Manager

Plugin Slug:
sportspress

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.7.21

Severity Score:
Medium

CVE:

2024-34824

The vulnerability has been patched, so you should update to version 2.7.21.

Themify Shortcodes

Plugin:

Themify Shortcodes

Plugin Slug:
themify-shortcodes

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.1.0

Severity Score:
Medium

CVE:

2024-4567

The vulnerability has been patched, so you should update to version 2.1.0.

Thim Elementor Kit

Plugin:

Thim Elementor Kit

Plugin Slug:
thim-elementor-kit

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.1.9.1

Severity Score:
Medium

CVE:

2024-4329

The vulnerability has been patched, so you should update to version 1.1.9.1.

Thim Elementor Kit

Plugin:

Thim Elementor Kit

Plugin Slug:
thim-elementor-kit

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.1.9

Severity Score:
Medium

CVE:

2024-34415

The vulnerability has been patched, so you should update to version 1.1.9.

All-in-One Addons for Elementor – WidgetKit

Plugin:

All-in-One Addons for Elementor – WidgetKit

Plugin Slug:
widgetkit-for-elementor

Installations
10,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.5.0

Severity Score:
Medium

CVE:

2024-34548

The vulnerability has been patched, so you should update to version 2.5.0.

Orders Tracking for WooCommerce

Plugin:

Orders Tracking for WooCommerce

Plugin Slug:
woo-orders-tracking

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
1.2.11

Severity Score:
Medium

CVE:

2024-4039

The vulnerability has been patched, so you should update to version 1.2.11.

WP Latest Posts

Plugin:

WP Latest Posts

Plugin Slug:
wp-latest-posts

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
5.0.8

Severity Score:
Medium

CVE:

2024-4135

The vulnerability has been patched, so you should update to version 5.0.8.

WP Photo Album Plus

Plugin:

WP Photo Album Plus

Plugin Slug:
wp-photo-album-plus

Installations
10,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
8.7.01.002

Severity Score:
Critical

CVE:

2024-31377

The vulnerability has been patched, so you should update to version 8.7.01.002.

YITH WooCommerce Gift Cards

Plugin:

YITH WooCommerce Gift Cards

Plugin Slug:
yith-woocommerce-gift-cards

Installations
10,000+

Vulnerability:
Broken Access Control

Patched in Version:
4.13.0

Severity Score:
Medium

CVE:

2024-0870

The vulnerability has been patched, so you should update to version 4.13.0.

If-So Dynamic Content Personalization

Plugin:

If-So Dynamic Content Personalization

Plugin Slug:
if-so

Installations
8,000+

Vulnerability:
Broken Access Control

Patched in Version:
1.7.1.1

Severity Score:
Medium

CVE:

2024-34820

The vulnerability has been patched, so you should update to version 1.7.1.1.

WordPress Affiliates Plugin — SliceWP Affiliates

Plugin:

WordPress Affiliates Plugin — SliceWP Affiliates

Plugin Slug:
slicewp

Installations
8,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.1.11

Severity Score:
Medium

CVE:

2024-34413

The vulnerability has been patched, so you should update to version 1.1.11.

WP Compress – Image Optimizer [All-In-One]

Plugin:

WP Compress – Image Optimizer [All-In-One]

Plugin Slug:
wp-compress-image-optimizer

Installations
7,000+

Vulnerability:
Broken Access Control

Patched in Version:
6.20.02

Severity Score:
Medium

CVE:

2024-4445

The vulnerability has been patched, so you should update to version 6.20.02.

WP Compress – Image Optimizer [All-In-One]

Plugin:

WP Compress – Image Optimizer [All-In-One]

Plugin Slug:
wp-compress-image-optimizer

Installations
7,000+

Vulnerability:
Open Redirection

Patched in Version:
6.20.02

Severity Score:
Medium

CVE:

2023-6812

The vulnerability has been patched, so you should update to version 6.20.02.

Better Elementor Addons

Plugin:

Better Elementor Addons

Plugin Slug:
better-elementor-addons

Installations
6,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.4.5

Severity Score:
Medium

CVE:

2024-34432

The vulnerability has been patched, so you should update to version 1.4.5.

Edwiser Bridge – WordPress Moodle LMS Integration

Plugin:

Edwiser Bridge – WordPress Moodle LMS Integration

Plugin Slug:
edwiser-bridge

Installations
5,000+

Vulnerability:
Privilege Escalation

Patched in Version:
3.0.6

Severity Score:
Critical

CVE:

2024-4186

The vulnerability has been patched, so you should update to version 3.0.6.

Shopping Cart & eCommerce Store

Plugin:

Shopping Cart & eCommerce Store

Plugin Slug:
wp-easycart

Installations
5,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
5.6.5

Severity Score:
Medium

CVE:

2024-4213

The vulnerability has been patched, so you should update to version 5.6.5.

Startklar Elementor Addons

Plugin:

Startklar Elementor Addons

Plugin Slug:
startklar-elmentor-forms-extwidgets

Installations
4,000+

Vulnerability:
Arbitrary File Deletion

Patched in Version:
1.7.14

Severity Score:
High

CVE:

2024-4346

The vulnerability has been patched, so you should update to version 1.7.14.

Startklar Elementor Addons

Plugin:

Startklar Elementor Addons

Plugin Slug:
startklar-elmentor-forms-extwidgets

Installations
4,000+

Vulnerability:
Arbitrary File Upload

Patched in Version:
1.7.14

Severity Score:
Critical

CVE:

2024-4345

The vulnerability has been patched, so you should update to version 1.7.14.

Auto Affiliate Links

Plugin:

Auto Affiliate Links

Plugin Slug:
wp-auto-affiliate-links

Installations
4,000+

Vulnerability:
SQL Injection

Patched in Version:
6.4.4

Severity Score:
High

CVE:

2024-34386

The vulnerability has been patched, so you should update to version 6.4.4.

All Bootstrap Blocks

Plugin:

All Bootstrap Blocks

Plugin Slug:
all-bootstrap-blocks

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3.16

Severity Score:
Medium

CVE:

2024-35169

The vulnerability has been patched, so you should update to version 1.3.16.

Mihdan: Yandex Turbo Feed

Plugin:

Mihdan: Yandex Turbo Feed

Plugin Slug:
mihdan-yandex-turbo-feed

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.6.6

Severity Score:
Medium

CVE:

2024-4411

The vulnerability has been patched, so you should update to version 1.6.6.

Move Addons for Elementor

Plugin:

Move Addons for Elementor

Plugin Slug:
move-addons

Installations
3,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3.1

Severity Score:
Medium

CVE:

2024-34562

The vulnerability has been patched, so you should update to version 1.3.1.

iPages Flipbook For WordPress

Plugin:

iPages Flipbook For WordPress

Plugin Slug:
ipages-flipbook

Installations
2,000+

Vulnerability:
Broken Access Control

Patched in Version:
1.5.2

Severity Score:
Medium

CVE:

2024-4744

The vulnerability has been patched, so you should update to version 1.5.2.

ShopBuilder – Elementor WooCommerce Builder Addons

Plugin:

ShopBuilder – Elementor WooCommerce Builder Addons

Plugin Slug:
shopbuilder

Installations
2,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
2.1.9

Severity Score:
Medium

CVE:

2024-34812

The vulnerability has been patched, so you should update to version 2.1.9.

Zotpress

Plugin:

Zotpress

Plugin Slug:
zotpress

Installations
2,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
7.3.10

Severity Score:
Medium

CVE:

2024-34569

The vulnerability has been patched, so you should update to version 7.3.10.

Arigato Autoresponder and Newsletter

Plugin:

Arigato Autoresponder and Newsletter

Plugin Slug:
bft-autoresponder

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
2.7.2.4

Severity Score:
Medium

CVE:

2024-34823

The vulnerability has been patched, so you should update to version 2.7.2.4.

Church Admin

Plugin:

Church Admin

Plugin Slug:
church-admin

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
4.2.0

Severity Score:
Medium

CVE:

2024-34828

The vulnerability has been patched, so you should update to version 4.2.0.

Falang multilanguage for WordPress

Plugin:

Falang multilanguage for WordPress

Plugin Slug:
falang

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3.50

Severity Score:
Medium

CVE:

2024-4417

The vulnerability has been patched, so you should update to version 1.3.50.

Ghost

Plugin:

Ghost

Plugin Slug:
ghost

Installations
1,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
1.5.0

Severity Score:
High

CVE:

2024-34559

The vulnerability has been patched, so you should update to version 1.5.0.

Gold Addons for Elementor

Plugin:

Gold Addons for Elementor

Plugin Slug:
gold-addons-for-elementor

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3.0

Severity Score:
Medium

CVE:

2024-34563

The vulnerability has been patched, so you should update to version 1.3.0.

Dynamics 365 Integration

Plugin:

Dynamics 365 Integration

Plugin Slug:
integration-dynamics

Installations
1,000+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
1.3.18

Severity Score:
Medium

CVE:

2024-34550

The vulnerability has been patched, so you should update to version 1.3.18.

SKT Addons for Elementor

Plugin:

SKT Addons for Elementor

Plugin Slug:
skt-addons-for-elementor

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.9

Severity Score:
Medium

CVE:

2024-34445

The vulnerability has been patched, so you should update to version 1.9.

SKT Addons for Elementor

Plugin:

SKT Addons for Elementor

Plugin Slug:
skt-addons-for-elementor

Installations
1,000+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.9

Severity Score:
Medium

CVE:

2024-34436

The vulnerability has been patched, so you should update to version 1.9.

Squelch Tabs and Accordions Shortcodes

Plugin:

Squelch Tabs and Accordions Shortcodes

Plugin Slug:
squelch-tabs-and-accordions-shortcodes

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
0.4.8

Severity Score:
Medium

CVE:

2024-4463

The vulnerability has been patched, so you should update to version 0.4.8.

WP Discourse

Plugin:

WP Discourse

Plugin Slug:
wp-discourse

Installations
1,000+

Vulnerability:
Broken Access Control

Patched in Version:
2.5.2

Severity Score:
Medium

CVE:

2024-35168

The vulnerability has been patched, so you should update to version 2.5.2.

WPCal.io – Easy Meeting Scheduler

Plugin:

WPCal.io – Easy Meeting Scheduler

Plugin Slug:
wpcal

Installations
1,000+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
0.9.5.9

Severity Score:
Medium

CVE:

2024-34816

The vulnerability has been patched, so you should update to version 0.9.5.9.

Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.

Plugin:

Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.

Plugin Slug:
barcode-scanner-lite-pos-to-manage-products-inventory-and-orders

Installations
800+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.5.5

Severity Score:
Medium

CVE:

2024-34557

The vulnerability has been patched, so you should update to version 1.5.5.

Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.

Plugin:

Barcode Scanner and Inventory manager. POS (Point of Sale) – scan barcodes & create orders with barcode reader.

Plugin Slug:
barcode-scanner-lite-pos-to-manage-products-inventory-and-orders

Installations
800+

Vulnerability:
Sensitive Data Exposure

Patched in Version:
1.5.5

Severity Score:
Medium

CVE:

2024-34556

The vulnerability has been patched, so you should update to version 1.5.5.

Sticky banner

Plugin:

Sticky banner

Plugin Slug:
sticky-banner

Installations
600+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3.0

Severity Score:
Medium

CVE:

2024-35170

The vulnerability has been patched, so you should update to version 1.3.0.

Joli FAQ SEO – WordPress FAQ Plugin

Plugin:

Joli FAQ SEO – WordPress FAQ Plugin

Plugin Slug:
joli-faq-seo

Installations
400+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.3.3

Severity Score:
Medium

CVE:

2024-4082

The vulnerability has been patched, so you should update to version 1.3.3.

Soccer Engine – Soccer Plugin for WordPress

Plugin:

Soccer Engine – Soccer Plugin for WordPress

Plugin Slug:
soccer-engine-lite

Installations
90+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.13

Severity Score:
Medium

CVE:

2024-4312

The vulnerability has been patched, so you should update to version 1.13.

Hostel

Plugin:

Hostel

Plugin Slug:
hostel

Installations
70+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.1.5.4

Severity Score:
Medium

CVE:

2024-4314

The vulnerability has been patched, so you should update to version 1.1.5.4.

ADFO – Custom data in admin dashboard

Plugin:

ADFO – Custom data in admin dashboard

Plugin Slug:
admin-form

Installations
60+

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.9.1

Severity Score:
Medium

CVE:

2024-4103

The vulnerability has been patched, so you should update to version 1.9.1.

ADFO – Custom data in admin dashboard

Plugin:

ADFO – Custom data in admin dashboard

Plugin Slug:
admin-form

Installations
60+

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.9.1

Severity Score:
High

CVE:

2024-4104

The vulnerability has been patched, so you should update to version 1.9.1.

Z-Downloads

Plugin:

Z-Downloads

Plugin Slug:
z-downloads

Installations
60+

Vulnerability:
Arbitrary File Upload

Patched in Version:
1.11.4

Severity Score:
Critical

CVE:

2024-34555

The vulnerability has been patched, so you should update to version 1.11.4.

Aiomatic

Plugin:

Aiomatic

Plugin Slug:
aiomatic-automatic-ai-content-writer

Vulnerability:
Broken Access Control

Patched in Version:
1.9.4

Severity Score:
Medium

CVE:

2024-34435

The vulnerability has been patched, so you should update to version 1.9.4.

Breakdance

Plugin:

Breakdance

Plugin Slug:
breakdance

Vulnerability:
Remote Code Execution (RCE)

Patched in Version:
1.7.2

Severity Score:
High

CVE:

2024-4605

The vulnerability has been patched, so you should update to version 1.7.2.

Divi Builder

Plugin:

Divi Builder

Plugin Slug:
divi-builder

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.25.1

Severity Score:
Medium

CVE:

2024-4490

The vulnerability has been patched, so you should update to version 4.25.1.

Fancy Product Designer

Plugin:

Fancy Product Designer

Plugin Slug:
fancy-product-designer

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
6.1.81

Severity Score:
Medium

CVE:

2024-0904

The vulnerability has been patched, so you should update to version 6.1.81.

Porto Theme – Functionality

Plugin:

Porto Theme – Functionality

Plugin Slug:
porto-functionality

Vulnerability:
Local File Inclusion

Patched in Version:
3.1.1

Severity Score:
Medium

CVE:

2024-3808

The vulnerability has been patched, so you should update to version 3.1.1.

Spectra Pro

Plugin:

Spectra Pro

Plugin Slug:
spectra-pro

Vulnerability:
Privilege Escalation

Patched in Version:
1.1.6

Severity Score:
High

CVE:

2024-3828

The vulnerability has been patched, so you should update to version 1.1.6.

Stockholm Core

Plugin:

Stockholm Core

Plugin Slug:
stockholm-core

Vulnerability:
Local File Inclusion

Patched in Version:
2.4.2

Severity Score:
High

CVE:

2024-34554

The vulnerability has been patched, so you should update to version 2.4.2.

Stockholm Core

Plugin:

Stockholm Core

Plugin Slug:
stockholm-core

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
2.4.2

Severity Score:
High

CVE:

2024-34553

The vulnerability has been patched, so you should update to version 2.4.2.

Unyson

Plugin:

Unyson

Plugin Slug:
unyson

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
2.7.31

Severity Score:
Medium

CVE:

2024-34814

The vulnerability has been patched, so you should update to version 2.7.31.

WordPress Themes — 16 Patched

Consus

Theme:

Consus

Theme Slug:
consus

Downloads
16,364

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.7

Severity Score:
Medium

CVE:

2024-34810

The vulnerability has been patched, so you should update to version 1.0.7.

EmpowerWP

Theme:

EmpowerWP

Theme Slug:
empowerwp

Downloads
219,376

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.22

Severity Score:
Medium

CVE:

2024-34809

The vulnerability has been patched, so you should update to version 1.0.22.

Himalayas

Theme:

Himalayas

Theme Slug:
himalayas

Downloads
332,940

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.3.1

Severity Score:
Medium

CVE:

2024-34571

The vulnerability has been patched, so you should update to version 1.3.1.

Ketos

Theme:

Ketos

Theme Slug:
ketos

Downloads
28,703

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.6

Severity Score:
Medium

CVE:

2024-34810

The vulnerability has been patched, so you should update to version 1.0.6.

Mindscape

Theme:

Mindscape

Theme Slug:
mindscape

Downloads
41,737

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.23

Severity Score:
Medium

CVE:

2024-34810

The vulnerability has been patched, so you should update to version 1.0.23.

Niveau

Theme:

Niveau

Theme Slug:
niveau

Downloads
16,831

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.9

Severity Score:
Medium

CVE:

2024-34810

The vulnerability has been patched, so you should update to version 1.0.9.

Oasis

Theme:

Oasis

Theme Slug:
oasis

Downloads
69,511

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.13

Severity Score:
Medium

CVE:

2024-34810

The vulnerability has been patched, so you should update to version 1.0.13.

raindrops

Theme:

raindrops

Theme Slug:
raindrops

Downloads
716,615

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
1.700

Severity Score:
Medium

CVE:

2024-34414

The vulnerability has been patched, so you should update to version 1.700.

Skyline WP

Theme:

Skyline WP

Theme Slug:
skyline-wp

Downloads
169,635

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.11

Severity Score:
Medium

CVE:

2024-34810

The vulnerability has been patched, so you should update to version 1.0.11.

Zeka

Theme:

Zeka

Theme Slug:
zeka

Downloads
20,249

Vulnerability:
Cross Site Request Forgery (CSRF)

Patched in Version:
1.0.10

Severity Score:
Medium

CVE:

2024-34810

The vulnerability has been patched, so you should update to version 1.0.10.

Divi

Theme:

Divi

Theme Slug:
divi

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.25.1

Severity Score:
Medium

CVE:

2024-4490

The vulnerability has been patched, so you should update to version 4.25.1.

Extra

Theme:

Extra

Theme Slug:
extra

Vulnerability:
Cross Site Scripting (XSS)

Patched in Version:
4.25.1

Severity Score:
Medium

CVE:

2024-4490

The vulnerability has been patched, so you should update to version 4.25.1.

Porto

Theme:

Porto

Theme Slug:
porto

Vulnerability:
Local File Inclusion

Patched in Version:
7.1.1

Severity Score:
High

CVE:

2024-3806

The vulnerability has been patched, so you should update to version 7.1.1.

Porto

Theme:

Porto

Theme Slug:
porto

Vulnerability:
Local File Inclusion

Patched in Version:
7.1.1

Severity Score:
Medium

CVE:

2024-3807

The vulnerability has been patched, so you should update to version 7.1.1.

Stockholm

Theme:

Stockholm

Theme Slug:
stockholm

Vulnerability:
Local File Inclusion

Patched in Version:
9.7

Severity Score:
High

CVE:

2024-34552

The vulnerability has been patched, so you should update to version 9.7.

Stockholm

Theme:

Stockholm

Theme Slug:
stockholm

Vulnerability:
Local File Inclusion

Patched in Version:
9.7

Severity Score:
Critical

CVE:

2024-34551

The vulnerability has been patched, so you should update to version 9.7.

window[“27011011_8965_4393_8beb_65720bd4bc69”] = {“blockId”:”27011011-8965-4393-8beb-65720bd4bc69″,”className”:””,”heading”:”Solid Security is part of Solid Suite \u2014 The best foundation for WordPress websites.”,”text”:”Every WordPress site needs security, backups, and management tools. That\u2019s Solid Suite \u2014 an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy\u2019s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!”,”buttonText”:”Get Solid Security”,”buttonLink”:”\/pricing”,”buttonTarget”:”_self”,”buttonRel”:””};

Solid Security is part of Solid Suite — The best foundation for WordPress websites.

Every WordPress site needs security, backups, and management tools. That’s Solid Suite — an integrated bundle of three plugins: Solid Security, Solid Backups, and Solid Central. You also get access to Solid Academy’s learning resources for WordPress professionals. Build your next WordPress website on a solid foundation with Solid Suite!

Get Solid Security

The post WordPress Vulnerability Report — May 15, 2024 appeared first on SolidWP.

Source link

Explore more

Get our Wordpress Guide Get Plugins Get Connected