Wordfence Intelligence Weekly WordPress Vulnerability Report (February 19, 2024 to February 25, 2024)
🎉 Did you know we’re running a Bug Bounty Extravaganza again?
Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!
Last week, there were 88 vulnerabilities disclosed in 61 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 37 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.
Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.
Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 14,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
New Firewall Rules Deployed Last Week
The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:
- Addon Library <= 1.3.76 – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
- Bricks <= 1.9.6 – Unauthenticated Remote Code Execution via queryEditor – Extended Protection
Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.
Total Unpatched & Patched Vulnerabilities Last Week
| Patch Status | Number of Vulnerabilities |
|---|---|
| Patched | 71 |
| Unpatched | 17 |
Total Vulnerabilities by CVSS Severity Last Week
| Severity Rating | Number of Vulnerabilities |
|---|---|
| Low Severity | 1 |
| Medium Severity | 73 |
| High Severity | 12 |
| Critical Severity | 2 |
Total Vulnerabilities by CWE Type Last Week
| Vulnerability Type by CWE | Number of Vulnerabilities |
|---|---|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 39 |
| Missing Authorization | 15 |
| Cross-Site Request Forgery (CSRF) | 14 |
| Improper Access Control | 6 |
| Exposure of Sensitive Information to an Unauthorized Actor | 3 |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 3 |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 2 |
| Deserialization of Untrusted Data | 1 |
| Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1 |
| Improper Privilege Management | 1 |
| Plaintext Storage of a Password | 1 |
| Server-Side Request Forgery (SSRF) | 1 |
| Unrestricted Upload of File with Dangerous Type | 1 |
Researchers That Contributed to WordPress Security Last Week
| Researcher Name | Number of Vulnerabilities |
|---|---|
| 10 | |
| 10 | |
| 8 | |
| 6 | |
| 6 | |
| 4 | |
| 4 | |
| 4 | |
| 3 | |
| 3 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 2 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 | |
| 1 |
Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.
WordPress Plugins with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery | interactive-3d-flipbook-powered-physics-engine |
| Academy LMS – WordPress LMS Plugin for Complete eLearning Solution | academy |
| Addon Library | addon-library |
| Admin side data storage for Contact Form 7 | admin-side-data-storage-for-contact-form-7 |
| Advanced Social Feeds Widget & Shortcode | advanced-facebook-twitter-widget |
| Archivist – Custom Archive Templates | archivist-custom-archive-templates |
| Backup Bolt | backup-bolt |
| BackWPup – WordPress Backup & Restore Plugin | backwpup |
| Beaver Builder – WordPress Page Builder | beaver-builder-lite-version |
| Brizy – Page Builder | brizy |
| CatalogX – Product Catalog Mode For WooCommerce | woocommerce-catalog-enquiry |
| Change Table Prefix | change-table-prefix |
| Colibri Page Builder | colibri-page-builder |
| Coming Soon Maintenance Mode | coming-soon-maintenance-mode |
| Contact Form builder with drag & drop for WordPress – Kali Forms | kali-forms |
| Cost of Goods: Product Cost & Profit Calculator for WooCommerce | cost-of-goods-for-woocommerce |
| Custom Order Statuses for WooCommerce | custom-order-statuses-for-woocommerce |
| Database Reset | wordpress-database-reset |
| Digits: WordPress Mobile Number Signup and Login | digits |
| Elementor Addon Elements | addon-elements-for-elementor-page-builder |
| Enhanced Text Widget | enhanced-text-widget |
| Enjoy Social Feed plugin for WordPress website | enjoy-instagram-instagram-responsive-images-gallery-and-carousel |
| Error Log Viewer by BestWebSoft | error-log-viewer |
| Event Tickets and Registration | event-tickets |
| Fancy Product Designer | fancy-product-designer |
| Featured Image from URL (FIFU) | featured-image-from-url |
| File Manager Pro | wp-file-manager-pro |
| FormFacade – WordPress plugin for Google Forms | formfacade |
| Heureka | heureka |
| Innovs HR – Complete Human Resource Management System for Your Business | innovs-hr-manager |
| Jobs for WordPress | job-postings |
| KODO Qiniu | kodo-qiniu |
| Link Library | link-library |
| Maintenance Page | maintenance-page |
| Oliver POS – A WooCommerce Point of Sale (POS) | oliver-pos |
| Page Builder: Pagelayer – Drag and Drop website builder | pagelayer |
| Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | wp-user-avatar |
| Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products – Restrict Content, Protect WooCommerce Category, and more | password-protected |
| PeproDev Ultimate Invoice | pepro-ultimate-invoice |
| Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio | play-ht |
| Plugin Groups | plugin-groups |
| RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | custom-registration-form-builder-with-submission-manager |
| Relevanssi – A Better Search | relevanssi |
| Scalable Vector Graphics (SVG) | scalable-vector-graphics-svg |
| Schema & Structured Data for WP & AMP | schema-and-structured-data-for-wp |
| Simple Job Board | simple-job-board |
| Social Sharing Plugin – Sassy Social Share | sassy-social-share |
| SuperFaktura WooCommerce | woocommerce-superfaktura |
| Tabs Shortcode and Widget | tabs-shortcode-and-widget |
| Tutor LMS – eLearning and online course solution | tutor |
| Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | ultimate-member |
| User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds | userfeedback-lite |
| Widget for Social Page Feeds | facebook-pagelike-widget |
| WooCommerce Google Sheet Connector | wc-gsheetconnector |
| WordPress User Registration Forms by Formidable Forms | formidable-registration |
| WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce | wp-event-manager |
| WP Shortcodes Plugin — Shortcodes Ultimate | shortcodes-ultimate |
| wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin | wpdatatables |
| WPify Woo Czech | wpify-woo |
| YARPP – Yet Another Related Posts Plugin | yet-another-related-posts-plugin |
| YML for Yandex Market | yml-for-yandex-market |
WordPress Themes with Reported Vulnerabilities Last Week
| Software Name | Software Slug |
|---|---|
| Colibri WP | colibri-wp |
Vulnerability Details
Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.
CVE-ID
CVE-2024-1071
CVE-2024-1071
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
CVE-ID
CVE-2024-0365
CVE-2024-0365
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Fancy Product Designer
Fancy Product Designer
Researcher
CVE-ID
CVE-2024-1505
CVE-2024-1505
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
Researcher
Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
8.8
CVE-ID
CVE-2024-1710
CVE-2024-1710
Patch Status
Unpatched
Unpatched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
Addon Library
Addon Library
Researcher
CVE-ID
CVE-2024-1311
CVE-2024-1311
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
Brizy – Page Builder
Brizy – Page Builder
Researcher
CVE-ID
CVE-2024-0203
CVE-2024-0203
Patch Status
Patched
Patched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Digits: WordPress Mobile Number Signup and Login
Digits: WordPress Mobile Number Signup and Login
Researcher
CVE-ID
CVE-2024-1358
CVE-2024-1358
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Elementor Addon Elements
Elementor Addon Elements
Researcher
CVE-ID
CVE-2024-1290
CVE-2024-1290
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
WordPress User Registration Forms by Formidable Forms
WordPress User Registration Forms by Formidable Forms
Researcher
CVE-ID
CVE-2024-1772
CVE-2024-1772
Patch Status
Unpatched
Unpatched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Researcher
CVE-ID
CVE-2024-1217
CVE-2024-1217
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Contact Form builder with drag & drop for WordPress – Kali Forms
Contact Form builder with drag & drop for WordPress – Kali Forms
Researcher
PeproDev Ultimate Invoice <= 1.9.7 - Unauthenticated Sensitive Information Exposure via init_plugin
7.5
CVE-ID
CVE-2024-25933
CVE-2024-25933
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
PeproDev Ultimate Invoice
PeproDev Ultimate Invoice
Researcher
CVE-ID
CVE-2024-0702
CVE-2024-0702
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Oliver POS – A WooCommerce Point of Sale (POS)
Oliver POS – A WooCommerce Point of Sale (POS)
Researcher
CVE-ID
CVE-2024-1776
CVE-2024-1776
Patch Status
Unpatched
Unpatched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Admin side data storage for Contact Form 7
Admin side data storage for Contact Form 7
Researcher
CVE-ID
CVE-2024-25932
CVE-2024-25932
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Change Table Prefix
Change Table Prefix
Researcher
CVE-ID
CVE-2024-1559
CVE-2024-1559
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Link Library
Link Library
Researcher
CVE-ID
CVE-2024-1519
CVE-2024-1519
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
CVE-ID
CVE-2024-1108
CVE-2024-1108
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Plugin Groups
Plugin Groups
Researcher
CVE-ID
CVE-2024-1081
CVE-2024-1081
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Researcher
CVE-ID
CVE-2024-0896
CVE-2024-0896
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Beaver Builder – WordPress Page Builder
Beaver Builder – WordPress Page Builder
Researchers
CVE-ID
CVE-2024-0897
CVE-2024-0897
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Beaver Builder – WordPress Page Builder
Beaver Builder – WordPress Page Builder
Researcher
CVE-ID
CVE-2024-1291
CVE-2024-1291
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
Brizy – Page Builder
Brizy – Page Builder
Researcher
CVE-ID
CVE-2024-1296
CVE-2024-1296
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
Brizy – Page Builder
Brizy – Page Builder
Researcher
CVE-ID
CVE-2024-1293
CVE-2024-1293
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
Brizy – Page Builder
Brizy – Page Builder
Researcher
CVE-ID
CVE-2024-1393
CVE-2024-1393
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Elementor Addon Elements
Elementor Addon Elements
Researcher
CVE-ID
CVE-2024-1392
CVE-2024-1392
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Elementor Addon Elements
Elementor Addon Elements
Researcher
CVE-ID
CVE-2024-1391
CVE-2024-1391
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Elementor Addon Elements
Elementor Addon Elements
Researcher
CVE-ID
CVE-2024-1422
CVE-2024-1422
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Elementor Addon Elements
Elementor Addon Elements
Researcher
CVE-ID
CVE-2024-1496
CVE-2024-1496
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Featured Image from URL (FIFU)
Featured Image from URL (FIFU)
Researcher
CVE-ID
CVE-2024-25934
CVE-2024-25934
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
FormFacade – WordPress plugin for Google Forms
FormFacade – WordPress plugin for Google Forms
Researcher
CVE-ID
CVE-2024-0820
CVE-2024-0820
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Jobs for WordPress
Jobs for WordPress
Researcher
CVE-ID
CVE-2024-1409
CVE-2024-1409
Patch Status
Patched
Patched
Published
Feb 22, 2024
Feb 22, 2024
CVE-ID
CVE-2024-1408
CVE-2024-1408
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
CVE-ID
CVE-2024-1570
CVE-2024-1570
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
CVE-ID
CVE-2024-1806
CVE-2024-1806
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
CVE-ID
CVE-2024-1448
CVE-2024-1448
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Social Sharing Plugin – Sassy Social Share
Social Sharing Plugin – Sassy Social Share
Researcher
Scalable Vector Graphics (SVG) <= 3.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
6.4
CVE-ID
CVE-2023-7085
CVE-2023-7085
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Scalable Vector Graphics (SVG)
Scalable Vector Graphics (SVG)
Researcher
Schema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site Scripting
6.4
CVE-ID
CVE-2024-1586
CVE-2024-1586
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Schema & Structured Data for WP & AMP
Schema & Structured Data for WP & AMP
Researcher
CVE-ID
CVE-2024-0719
CVE-2024-0719
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Tabs Shortcode and Widget
Tabs Shortcode and Widget
Researcher
CVE-ID
CVE-2024-1510
CVE-2024-1510
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
WP Shortcodes Plugin — Shortcodes Ultimate
WP Shortcodes Plugin — Shortcodes Ultimate
Researcher
CVE-ID
CVE-2024-1810
CVE-2024-1810
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
Archivist – Custom Archive Templates
Archivist – Custom Archive Templates
Researcher
CVE-ID
CVE-2024-0821
CVE-2024-0821
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Cost of Goods: Product Cost & Profit Calculator for WooCommerce
Cost of Goods: Product Cost & Profit Calculator for WooCommerce
Researcher
CVE-ID
CVE-2023-7015
CVE-2023-7015
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
File Manager Pro
File Manager Pro
Researcher
CVE-ID
CVE-2024-0976
CVE-2024-0976
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce
Researcher
CVE-ID
CVE-2024-0591
CVE-2024-0591
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Researcher
CVE-ID
CVE-2024-1365
CVE-2024-1365
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
YML for Yandex Market
YML for Yandex Market
Researcher
Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting
5.4
CVE-ID
CVE-2024-1038
CVE-2024-1038
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Beaver Builder – WordPress Page Builder
Beaver Builder – WordPress Page Builder
Researcher
Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
5.4
CVE-ID
CVE-2024-0871
CVE-2024-0871
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Beaver Builder – WordPress Page Builder
Beaver Builder – WordPress Page Builder
Researchers
CVE-ID
CVE-2024-25930
CVE-2024-25930
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Custom Order Statuses for WooCommerce
Custom Order Statuses for WooCommerce
Researcher
CVE-ID
CVE-2024-0828
CVE-2024-0828
Patch Status
Unpatched
Unpatched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Researcher
SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
5.4
CVE-ID
CVE-2024-1758
CVE-2024-1758
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
SuperFaktura WooCommerce
SuperFaktura WooCommerce
Researcher
CVE-ID
CVE-2024-1128
CVE-2024-1128
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Tutor LMS – eLearning and online course solution
Tutor LMS – eLearning and online course solution
Researcher
CVE-ID
CVE-2024-0903
CVE-2024-0903
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
Researcher
CVE-ID
CVE-2024-1779
CVE-2024-1779
Patch Status
Unpatched
Unpatched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Admin side data storage for Contact Form 7
Admin side data storage for Contact Form 7
Researcher
CVE-ID
CVE-2023-7236
CVE-2023-7236
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Backup Bolt
Backup Bolt
Researcher
CVE-ID
CVE-2024-1475
CVE-2024-1475
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Coming Soon Maintenance Mode
Coming Soon Maintenance Mode
Researcher
CVE-ID
CVE-2024-0779
CVE-2024-0779
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Enjoy Social Feed plugin for WordPress website
Enjoy Social Feed plugin for WordPress website
Researcher
CVE-ID
CVE-2023-6821
CVE-2023-6821
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Error Log Viewer by BestWebSoft
Error Log Viewer by BestWebSoft
Researcher
CVE-ID
CVE-2024-1370
CVE-2024-1370
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Maintenance Page
Maintenance Page
Researcher
CVE-ID
CVE-2024-1462
CVE-2024-1462
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Maintenance Page
Maintenance Page
Researcher
Relevanssi – A Better Search <= 4.22.0 - Missing Authorization to Unauthenticated Query Log Export
5.3
CVE-ID
CVE-2024-1380
CVE-2024-1380
Patch Status
Patched
Patched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Relevanssi – A Better Search
Relevanssi – A Better Search
Researcher
CVE-ID
CVE-2024-0593
CVE-2024-0593
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Simple Job Board
Simple Job Board
Researcher
CVE-ID
CVE-2024-1562
CVE-2024-1562
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
WooCommerce Google Sheet Connector
WooCommerce Google Sheet Connector
Researcher
CVE-ID
CVE-2024-1492
CVE-2024-1492
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
WPify Woo Czech
WPify Woo Czech
Researcher
CVE-ID
CVE-2024-1501
CVE-2024-1501
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Database Reset
Database Reset
Researcher
CVE-ID
CVE-2024-1590
CVE-2024-1590
Patch Status
Patched
Patched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Page Builder: Pagelayer – Drag and Drop website builder
Page Builder: Pagelayer – Drag and Drop website builder
Researcher
CVE-ID
CVE-2024-0951
CVE-2024-0951
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Advanced Social Feeds Widget & Shortcode
Advanced Social Feeds Widget & Shortcode
Researcher
CVE-ID
CVE-2024-0559
CVE-2024-0559
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Enhanced Text Widget
Enhanced Text Widget
Researcher
CVE-ID
CVE-2024-0656
CVE-2024-0656
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Widget for Social Page Feeds <= 6.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-ID
CVE-2024-0973
CVE-2024-0973
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Widget for Social Page Feeds
Widget for Social Page Feeds
Researcher
CVE-ID
CVE-2024-0602
CVE-2024-0602
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
YARPP – Yet Another Related Posts Plugin
YARPP – Yet Another Related Posts Plugin
Researcher
CVE-ID
CVE-2024-1777
CVE-2024-1777
Patch Status
Unpatched
Unpatched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Admin side data storage for Contact Form 7
Admin side data storage for Contact Form 7
Researcher
CVE-ID
CVE-2024-1778
CVE-2024-1778
Patch Status
Unpatched
Unpatched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Admin side data storage for Contact Form 7
Admin side data storage for Contact Form 7
Researcher
CVE-ID
CVE-2024-1165
CVE-2024-1165
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
Brizy – Page Builder
Brizy – Page Builder
Researcher
CVE-ID
CVE-2024-1362
CVE-2024-1362
Patch Status
Patched
Patched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Colibri Page Builder
Colibri Page Builder
Researcher
CVE-ID
CVE-2024-1361
CVE-2024-1361
Patch Status
Patched
Patched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Colibri Page Builder
Colibri Page Builder
Researcher
CVE-ID
CVE-2024-1360
CVE-2024-1360
Patch Status
Patched
Patched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Colibri WP
Colibri WP
Researcher
Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
4.3
CVE-ID
CVE-2024-1218
CVE-2024-1218
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Contact Form builder with drag & drop for WordPress – Kali Forms
Contact Form builder with drag & drop for WordPress – Kali Forms
Researcher
Enjoy Social Feed plugin for WordPress website <= 6.2.2 - Missing Authorization to Database Reset
4.3
CVE-ID
CVE-2024-0780
CVE-2024-0780
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Enjoy Social Feed plugin for WordPress website
Enjoy Social Feed plugin for WordPress website
Researcher
CVE-ID
CVE-2024-1053
CVE-2024-1053
Patch Status
Patched
Patched
Published
Feb 21, 2024
Feb 21, 2024
Affected Software
Event Tickets and Registration
Event Tickets and Registration
Researcher
CVE-ID
CVE-2024-0858
CVE-2024-0858
Patch Status
Unpatched
Unpatched
Published
Feb 20, 2024
Feb 20, 2024
Researcher
CVE-ID
CVE-2024-0827
CVE-2024-0827
Patch Status
Unpatched
Unpatched
Published
Feb 22, 2024
Feb 22, 2024
Affected Software
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
Researcher
CVE-ID
CVE-2024-25929
CVE-2024-25929
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
CatalogX – Product Catalog Mode For WooCommerce
CatalogX – Product Catalog Mode For WooCommerce
Researcher
CVE-ID
CVE-2024-25935
CVE-2024-25935
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
Researcher
Schema & Structured Data for WP & AMP <= 1.26 - Missing Authorization to reCaptcha Key Modification
4.3
CVE-ID
CVE-2024-1288
CVE-2024-1288
Patch Status
Patched
Patched
Published
Feb 19, 2024
Feb 19, 2024
Affected Software
Schema & Structured Data for WP & AMP
Schema & Structured Data for WP & AMP
Researcher
CVE-ID
CVE-2024-1133
CVE-2024-1133
Patch Status
Patched
Patched
Published
Feb 20, 2024
Feb 20, 2024
Affected Software
Tutor LMS – eLearning and online course solution
Tutor LMS – eLearning and online course solution
Researcher
CVE-ID
CVE-2023-5775
CVE-2023-5775
Patch Status
Patched
Patched
Published
Feb 23, 2024
Feb 23, 2024
Affected Software
BackWPup – WordPress Backup & Restore Plugin
BackWPup – WordPress Backup & Restore Plugin
Researcher
As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.
This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.
Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.
Comments