Wordfence Intelligence Weekly WordPress Vulnerability Report (December 18, 2023 to December 31, 2023)

Wordfence just launched its bug bounty program. For the first 6 months, all awarded bounties receive a 10% bonus. View the announcement to learn more now!

Over the last two weeks, there were 263 vulnerabilities disclosed in 217 WordPress Plugins and 3 WordPress themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 42 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 12,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Two Weeks

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Directory Traversal via HTTP Headers

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status
Number of Vulnerabilities

Unpatched
43

Patched
220

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating
Number of Vulnerabilities

Low Severity
1

Medium Severity
212

High Severity
30

Critical Severity
20

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE
Number of Vulnerabilities

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
77

Missing Authorization
51

Cross-Site Request Forgery (CSRF)
47

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
30

Unrestricted Upload of File with Dangerous Type
9

Deserialization of Untrusted Data
7

Information Exposure Through Log Files
7

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
5

Information Exposure
4

Protection Mechanism Failure
3

Authorization Bypass Through User-Controlled Key
3

Server-Side Request Forgery (SSRF)
2

URL Redirection to Untrusted Site (‘Open Redirect’)
2

Storage of Sensitive Data in a Mechanism without Access Control
2

Weak Password Recovery Mechanism for Forgotten Password
2

Improper Input Validation
2

Improper Privilege Management
1

Reliance on IP Address for Authentication
1

External Control of File Name or Path
1

Information Exposure Through Debug Information
1

Use of Less Trusted Source
1

Improper Authentication
1

Improper Authorization
1

Improper Access Control
1

Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’)
1

Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)
1

Researchers That Contributed to WordPress Security Last Week

Researcher Name
Number of Vulnerabilities

Rafie Muhammad
61

Brandon James Roldan (tomorrowisnew)
24

Muhammad Daffa
23

Ngô Thiên An (ancorn_)
16

LVT-tholv2k
14

emad
11

Abdi Pranata
10

Joshua Chan
10

Nguyen Xuan Chien
9

Abu Hurayra (HurayraIIT)
9

Mika
6

Skalucy
6

Dave Jong
6

thiennv
5

resecured.io
5

Revan Arifio
5

Huynh Tien Si
3

wpdabh
3

Le Ngoc Anh
3

Dmitrii Ignatyev
3

DoYeon Park (p6rkdoye0n)
3

Hiroho Shimada
2

Kyle Sanchez
2

Hung -mov Nguyen
2

Webbernaut
2

Nguyen Anh Tien
2

Jeongwoo-Lee(Roronoa)
2

Elliot
1

István Márton
(Wordfence Vulnerability Researcher)
1

Taihei Shimamine
1

Rein Daelman (trein)
1

Robert DeVore
1

Marc-Alexandre Montpas
1

Vladislav Pokrovsky (ΞX.MI)
1

Yuchen Ji
1

Fariq Fadillah Gusti Insani (fariqfgi)
1

Yudistira Arya
1

Lucio Sá
1

Francesco Carlucci
1

Benmalek Aymen (centaurus)
1

Nex Team
1

Françoa Taffarel
1

 

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through this form. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name
Software Slug

404 Solution
404-solution

AI Power: Complete AI Pack – Powered by GPT-4
gpt3-ai-content-generator

AMP for WP – Accelerated Mobile Pages
accelerated-mobile-pages

ARI Stream Quiz – WordPress Quizzes Builder
ari-stream-quiz

ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
armember-membership

Accredible Certificates & Open Badges
accredible-certificates

Active Products Tables for WooCommerce. Professional products tables for WooCommerce store
profit-products-tables-for-woocommerce

Add Any Extension to Pages
add-any-extension-to-pages

Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
advanced-access-manager

Advanced Category Template
advanced-category-template

Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms
advanced-form-integration

Affiliates Manager
affiliates-manager

All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs – My Sticky Elements
mystickyelements

Apollo13 Framework Extensions
apollo13-framework-extensions

Appointment & Event Booking Calendar Plugin – Webba Booking
webba-booking-lite

Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
simply-schedule-appointments

Author Box, Guest Author and Co-Authors for Your Posts – Molongui
molongui-authorship

Auto Amazon Links – Amazon Associates Affiliate Plugin
amazon-auto-links

Awesome Support – WordPress HelpDesk & Support Plugin
awesome-support

BERTHA AI. Your AI co-pilot for WordPress and Chrome
bertha-ai-free

Back Button Widget
back-button-widget

Backup Migration
backup-backup

Beaver Builder – WordPress Page Builder
beaver-builder-lite-version

Block IPs for Gravity Forms
gf-block-ips

Booking Calendar | Appointment Booking | BookIt
bookit

Booking Manager
booking-manager

Booking for Appointments and Events Calendar – Amelia
ameliabooking

BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin
bookingpress-appointment-booking

Booster Elite for WooCommerce
booster-elite-for-woocommerce

Branda – White Label WordPress, Custom Login Page Customizer
branda-white-labeling

Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
brave-popup-builder

BuddyPress
buddypress

Build App Online
build-app-online

BulkGate SMS Plugin for WooCommerce
woosms-sms-module-for-woocommerce

Business Directory Plugin – Easy Listing Directories for WordPress
business-directory-plugin

CBX Bookmark & Favorite
cbxwpbookmark

CRM Perks Forms – WordPress Form Builder
crm-perks-forms

CSS & JavaScript Toolbox
css-javascript-toolbox

CURCY – Multi Currency for WooCommerce
UNKNOWN-CVE-2023-50831-1

Calculated Fields Form
calculated-fields-form

Checkout Mestres WP
checkout-mestres-wp

Clockwork SMS Notfications
mediaburst-email-to-sms

Clone
wp-clone-by-wp-academy

Colibri Page Builder
colibri-page-builder

Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce
enhanced-e-commerce-for-woocommerce-store

Crowdsignal Dashboard – Polls, Surveys & more
polldaddy

Currency Converter Widget – Exchange Rates
currency-converter-widget

Custom 404 Pro
custom-404-pro

Custom Post Carousels with Owl
dd-post-carousel

Custom Twitter Feeds – A Tweets Widget or X Feed Widget
custom-twitter-feeds

Customer Reviews for WooCommerce
customer-reviews-woocommerce

Customize My Account for WooCommerce
customize-my-account-for-woocommerce

Dan’s Embedder for Google Calendar
dans-gcal

Database Cleaner: Clean, Optimize & Repair
database-cleaner

Defender Security – Malware Scanner, Login Security & Firewall
defender-security

Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan
antihacker

Doofinder WP & WooCommerce Search
doofinder-for-woocommerce

Duplicator – WordPress Migration & Backup Plugin
duplicator

Dynamic Content for Elementor
dynamic-content-for-elementor

E2Pdf – Export To Pdf Tool for WordPress
e2pdf

Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy)
easy-digital-downloads

Easy PayPal & Stripe Buy Now Button
wp-ecommerce-paypal

Easy Video Player
easy-video-player

Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress
plugins-on-steroids

Enable Media Replace
enable-media-replace

EnvíaloSimple: Email Marketing y Newsletters
envialosimple-email-marketing-y-newsletters-gratis

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
essential-blocks

Event Monster – Event Management, Tickets Booking, Upcoming Event
event-monster

Events Shortcodes For The Events Calendar
template-events-calendar

Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
everest-backup

Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
everest-forms

Export Media URLs
export-media-urls

FOX – Currency Switcher Professional for WooCommerce
woocommerce-currency-switcher

FastDup – Fastest WordPress Migration & Duplicator
fastdup

Floating Button
floating-button

Fluent Support – WordPress Helpdesk and Customer Support Ticket Plugin
fluent-support

Form plugin for WordPress – Zoho Forms
zoho-forms

Frontend Admin by DynamiApps
acf-frontend-form-element

Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits
funnel-builder

FunnelKit Checkout
woofunnels-aero-checkout

GEO my WordPress
geo-my-wp

GeoDirectory – WordPress Business Directory Plugin, or Classified Directory
geodirectory

Google Photos Gallery with Shortcodes
google-picasa-albums-viewer

HT Mega – Absolute Addons For Elementor
ht-mega-for-elementor

HTML Forms
html-forms

HUSKY – Products Filter for WooCommerce Professional
woocommerce-products-filter

Happy Addons for Elementor
happy-elementor-addons

HashBar – WordPress Notification Bar
hashbar-wp-notification-bar

Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building
icegram

If-So Dynamic Content Personalization
if-so

Image Optimizer, Resizer and CDN – Sirv
sirv

Image Source Control Lite – Show Image Credits and Captions
image-source-control-isc

Impreza – WordPress Website and WooCommerce Builder
impreza

Inline Image Upload for BBPress
image-upload-for-bbpress

Insert or Embed Articulate Content into WordPress
insert-or-embed-articulate-content-into-wordpress

Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Gallery, and Manage Your Google Drive Files Into Your WordPress Site
integrate-google-drive

JS Help Desk – Best Help Desk & Support Plugin
js-support-ticket

JSM file_get_contents() Shortcode
wp-file-get-contents

JVM Gutenberg Rich Text Icons
jvm-rich-text-icons

Job Manager & Career – Manage job board listings, and recruitments
job-manager-career

LA-Studio Element Kit for Elementor
lastudio-element-kit

Limit Login Attempts Reloaded
limit-login-attempts-reloaded

Loan Repayment Calculator and Application Form
quick-interest-slider

Local Delivery Drivers for WooCommerce
local-delivery-drivers-for-woocommerce

Login Lockdown – Protect Login Form
login-lockdown

Login as User or Customer
login-as-customer-or-user

Logo Slider – Logo Showcase, Logo Carousel, Logo Gallery and Client Logo Presentation
gs-logo-slider

MC4WP: Mailchimp for WordPress
mailchimp-for-wp

MF Gig Calendar
mf-gig-calendar

MStore API
mstore-api

Mail logging – WP Mail Catcher
wp-mail-catcher

Malware Scanner
miniorange-malware-protection

Media File Renamer: Rename Files (Manual, Auto & AI)
media-file-renamer

Menu Image, Icons made easy
menu-image

Metform Elementor Contact Form Builder
metform

Most And Least Read Posts Widget
most-and-least-read-posts-widget

Multi Step Form
multi-step-form

MultiVendorX Marketplace – WooCommetrce MultiVendor Marketplace Solution
dc-woocommerce-multi-vendor

My Agile Privacy – The only GDPR solution for WordPress that you can truly trust
myagileprivacy

NEX-Forms – Ultimate Form Builder – Contact forms and much more
nex-forms-express-wp-form-builder

New User Approve
new-user-approve

NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images
nitropack

Page Generator
page-generator

Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
paid-member-subscriptions

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions
paid-memberships-pro

Pay with Vipps for WooCommerce
woo-vipps

Photo Gallery by 10Web – Mobile-Friendly Image Gallery
photo-gallery

Piotnet Forms
piotnetforms

Poll Maker – Best WordPress Poll Plugin
poll-maker

Pre* Party Resource Hints
pre-party-browser-hints

Product Catalog Simple
post-type-x

Product Code for WooCommerce
product-code-for-woocommerce

Product Feed Manager – WooCommerce to Google Shopping, Social Catalogs, and 170+ Popular Marketplaces
best-woocommerce-feed

Product Filter by WBW
woo-product-filter

Product Table by WBW
woo-product-tables

Product Vendors
woocommerce-product-vendors

ProfileGrid – User Profiles, Memberships, Groups and Communities
profilegrid-user-profiles-groups-and-communities

Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress
quiz-master-next

Rate my Post – WP Rating System
rate-my-post

Recipe Maker For Your Food Blog from Zip Recipes
zip-recipes

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit
wp-marketing-automations

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
custom-registration-form-builder-with-submission-manager

Rencontre – Dating Site
rencontre

Republish Old Posts
republish-old-posts

Restaurant Reservations
nd-restaurant-reservations

Rise Blocks – A Complete Gutenberg Page Builder
rise-blocks

Schema & Structured Data for WP & AMP
schema-and-structured-data-for-wp

Send Users Email
send-users-email

Sensei LMS – Online Courses, Quizzes, & Learning
sensei-lms

Seos Contact Form
seos-contact-form

Simple Counter
abwp-simple-counter

Simple Job Board
simple-job-board

Simple Membership
simple-membership

Simple Staff List
simple-staff-list

Slider by Soliloquy – Responsive Image Slider for WordPress
soliloquy-lite

Spam protection, Anti-Spam, FireWall by CleanTalk
cleantalk-spam-protect

Split Test For Elementor
split-test-for-elementor

Squirrly SEO – Advanced Pack
squirrly-seo-pack

Sticky Chat Widget: WhatsApp, Messenger, Click to chat, SMS, Email, Messages, Call Button, Contact form and more Chat buttons
sticky-chat-widget

Stock Ticker
stock-ticker

Store Locator WordPress
agile-store-locator

Strong Testimonials
strong-testimonials

Stylish Price List – Price Table Builder & QR Code Restaurant Menu
stylish-price-list

SureFeedback Client Site
projecthuddle-child-site

TerraClassifieds – Simple Classifieds Plugin
terraclassifieds

Theme per user
theme-per-user

Themify Icons
themify-icons

Thrive Automator
thrive-automator

Ultimate Addons for Beaver Builder
bb-ultimate-addon

Ultimate Addons for WPBakery
Ultimate_VC_Addons

Ultimate Dashboard – Custom WordPress Dashboard
ultimate-dashboard

Uncanny Automator – Automate everything with the #1 no-code automation and integration plugin
uncanny-automator

User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
userfeedback-lite

Verge3D Publishing and E-Commerce
verge3d

WP Adminify – WordPress Dashboard Customization | Custom Login | Admin Columns | Dashboard Widget | Media Library Folders
adminify

WP Affiliate Disclosure
wp-affiliate-disclosure

WP Chat App
wp-whatsapp

WP Crowdfunding
wp-crowdfunding

WP Edit Username
wp-edit-username

WP Frontend Profile
wp-front-end-profile

WP Go Maps (formerly WP Google Maps)
wp-google-maps

WP Job Portal – A Complete Job Board
wp-job-portal

WP MLM SOFTWARE PLUGIN
wp-mlm

WP Mail Log
wp-mail-log

WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce
wp-optin-wheel

WP Remote Site Search
wp-remote-site-search

WP Review Slider
wp-facebook-reviews

WP Shortcodes Plugin — Shortcodes Ultimate
shortcodes-ultimate

WP Simple Booking Calendar
wp-simple-booking-calendar

WP Stripe Checkout
wp-stripe-checkout

WP Tabs – Responsive Tabs Plugin for WordPress
wp-expand-tabs-free

WP User Profile Avatar
wp-user-profile-avatar

WPC Product Bundles for WooCommerce
woo-product-bundle

WPCS – WordPress Currency Switcher Professional
currency-switcher

WS Form LITE – Drag & Drop Contact Form Builder for WordPress
ws-form

Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
webinar-ignition

Welcart e-Commerce
usc-e-shop

White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard
white-label

WooCommerce Easy Duplicate Product
woo-easy-duplicate-product

WooCommerce Menu Extension
woocommerce-menu-extension

WooCommerce PDF Invoice Builder, Create invoices, packing slips and more
woo-pdf-invoice-builder

WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels
print-invoices-packing-slip-labels-for-woocommerce

WooCommerce Per Product Shipping
woocommerce-shipping-per-product

WooCommerce Ship to Multiple Addresses
woocommerce-shipping-multiple-addresses

WooCommerce Stripe Payment Gateway
woocommerce-gateway-stripe

WooCommerce Warranty Requests
woocommerce-warranty

WooPayments – Fully Integrated Solution Built and Supported by Woo
woocommerce-payments

Woocommerce Shipping Canada Post
woocommerce-shipping-canada-post

WordPress Infinite Scroll – Ajax Load More
ajax-load-more

WordPress.com Editing Toolkit
full-site-editing

YITH WooCommerce Product Add-Ons
yith-woocommerce-product-add-ons

ZeroBounce Email Verification & Validation
zerobounce

eCommerce Product Catalog Plugin for WordPress
ecommerce-product-catalog

iframe
iframe

iframe Shortcode
iframe-shortcode

uncode-core
uncode-core

weForms – Easy Drag & Drop Contact Form Builder For WordPress
weforms

WordPress Themes with Reported Vulnerabilities Last Week

Software Name
Software Slug

BuddyBoss Theme
buddyboss-theme

Divi
Divi

TheGem
thegem

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

BERTHA AI Plugin <= 1.11.10.7 – Unauthenticated Arbitrary File Upload

WebinarIgnition <= 3.05.0 – Missing Authorization to Unauthenticated Privilege Escalation

Piotnet Forms Plugin <= 1.0.25 – Unauthenticated Arbitrary File Upload

WP Clone <= 2.4.2 – Sensitive Information Exposure

Rencontre – Dating Site <= 3.10.1 – Unauthenticated Arbitrary File Upload

Login as User or Customer (User Switching) <= 3.8 – Authentication Bypass

Build App Online <= 1.0.19 – Account Takeover via Weak Password Reset Mechanism

Frontend Admin by DynamiApps Plugin <= 3.18.3 – Unauthenticated Arbitrary File Upload

JS Help Desk <= 2.8.1 – Unauthenticated SQL Injection via email and trackingid

Checkout Mestres WP <= 7.1.9.6 – Authentication Bypass via Password Reset

Checkout Mestres WP <= 7.1.9.6 – Missing Authorization to Unauthenticated Arbitrary Options Update

WP Frontend Profile <= 1.3.1 – Unauthenticated Privilege Escalation

WP MLM Unilevel <= 4.0 – Unauthenticated Privilege Escalation

TerraClassifieds <= 2.0.3 Unauthenticated Arbitrary File Upload

Rencontre – Dating Site <= 3.10.1 – Privilege Escalation

WP MLM <= 4.0 – Unauthenticated Arbitrary File Upload

Theme per user <= 1.0.1 – Unauthenticated PHP Object Injection

Active Products Tables for WooCommerce <= 1.0.6 – Unauthenticated PHP Object Injection

Checkout Mestres WP <= 7.1.9.6 – Unauthenticated SQL Injection

WebinarIgnition <= 3.05.0 – Unauthenticated SQL Injection

Recipe Maker For Your Food Blog from Zip Recipes <= 8.1.0 – Authenticated(Contributor+) SQL Injection

WP Mail Log Plugin <= 1.1.2 – Authenticated(Contributor+) Arbitrary File Upload

Ultimate Addons for Beaver Builder <= 1.35.14 – Authenticated(Contributor+) Privilege Escalation

ARI Stream Quiz <= 1.3.0 – Authenticated (Contributor+) PHP Object Injection

TerraClassifieds <= 2.0.3 – Cross-Site Request Forgery

Verge3D <= 4.5.2 – Authenticated(Subscriber+) Arbitrary File Upload

Rencontre – Dating Site <= 3.11.1 – Authenticated (Subscriber+) PHP Object Injection

MF Gig Calendar <=1.2.1 – Authenticated(Contributor+) SQL Injection

Job Manager & Career – Manage job board listings, and recruitments <= 1.4.4 – Cross-Site Request Forgery to PHP Object Injection

Booking Manager <= 2.1.5 – Authenticated(Contributor+) SQL Injection via Shortcode

JVM rich text icons <= 1.2.6 – Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion

Uncode Core <= 2.8.8 – Privilege Escalation

Events Shortcodes & Templates For The Events Calendar <= 2.3.1 – Authenticated (Contributor+) SQL Injection via shortcode

ARMember <= 4.0.10 – Authenticated(Subscriber+) Privilege Escalation

JVM rich text icons <= 1.2.3 – Authenticated(Subscriber+) Arbitrary File Upload

BookingPress <= 1.0.72 – Authenticated (Contributor+) SQL Injection

Build App Online <= 1.0.19 – Missing Authorization Authenticated(Subscriber+) Arbitrary Options Update

Most And Least Read Posts Widget <=2.5.16 – Authenticated(Contributor+) SQL Injection via Widget settings

Uncode Core <= 2.8.8 – Authenticated (Subscriber+) Arbitrary File Deletion

Backup Migration 1.0.8 – 1.3.9 – Remote File Inclusion via content-dir

Backup Migration <= 1.3.9 – Unauthenticated Path Traversal to Arbitrary File Deletion

Everest Backup <= 2.1.9 – Sensitive Information Exposure via Log File

WP Stripe Checkout <= 1.2.2.37 – Sensitive Information Exposure via Debug Log

WC Marketplace <= 4.0.23 – Missing Authorization via mvx_save_dashpages

WebinarIgnition <= 3.05.0 – Authenticated(Subscriber+) PHP Object Injection

Local Delivery Drivers for WooCommerce <= 1.9.0 – Missing Authorization to Driver Account Takeover

Custom 404 Pro <= 3.10.0 – Unauthenticated Stored Cross-Site Scripting via logging

WooCommerce PDF Invoices <= 4.2.1 – Authenticated(Shop Manager+) Arbitrary Options Update via JSON Import

Welcart e-Commerce <= 2.9.3 – Authenticated(Editor+) SQL Injection

Backup Migration <= 1.3.9 – Authenticated (Admin+) OS Command Injection via url

Clockwork SMS Notfications <= 3.0.4 – Authenticated(Administrator+) SQL Injection

Media File Renamer <= 5.7.7 – Authenticated(Administrator+) Remote Code Execution

E2Pdf <= 1.20.23 – Authenticated(Administrator+) SQL Injection

404 Solution <= 2.34.0 – Authenticated(Administrator+) SQL Injection

Mail logging – WP Mail Catcher <= 2.1.3 – Authenticated(Administrator+) SQL Injection

WP Adminify <= 3.1.6 – Authenticated(Administrator+) SQL Injection

Page Generator <= 1.7.1 – Authenticated(Administrator+) SQL Injection

Simply Schedule Appointments <= 1.6.5.27 – Authenticated(Administrator+) SQL Injection

Pre* Party Resource Hints <= 1.8.18 – Authenticated(Administrator+) SQL Injection

Login Lockdown – Protect Login Form <= 2.06 – Authenticated(Administrator+) SQL Injection

YITH WooCommerce Product Add-Ons <= 4.3.0 – Authenticated(Shop Manager+) PHP Object Injection

Fluent Support <= 1.7.6 – Authenticated(Administrator+) SQL Injection

Automation By Autonami <= 2.6.1 – Authenticated(Administrator+) SQL Injection

Store Locator WordPress <= 1.4.14 – Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion

Squirrly SEO – Advanced Pack <= 2.3.8 – Authenticated(Administrator+) SQL Injection

GEO my WordPress <= 4.0.2 – Authenticated(Administrator+) SQL Injection

RegistrationMagic Plugin <= 5.2.4.5 – Authenticated(Administrator+) SQL Injection

WS Form LITE <= 1.9.170 – Authenticated(Administrator+) SQL Injection

GeoDirectory <= 2.3.28 – Authenticated(Administrator+) SQL Injection

Funnel Builder for WordPress by FunnelKit <= 2.14.3 – Authenticated(Administrator+) SQL Injection

Advanced Form Integration <= 1.75.0 – Authenticated(Administrator+) SQL Injection

BookIt <= 2.4.3 – Authenticated(Administrator+) SQL Injection

EnvíaloSimple <= 2.1 Unauthenticated PHP Object Injection

WooCommerce Stripe Payment Gateway <= 7.6.1 – Insecure Direct Object Reference via update_payment_intent_ajax

Affiliates Manager <= 2.9.31 – Cross-Site Request Forgery via multiple AJAX actions

FunnelKit Checkout <= 3.10.3 – Unauthenticated Arbitrary Content Deletion

Piotnet Forms <= 1.0.25 – Missing Authorization via multiple AJAX actions

weForms <= 1.6.18 – Missing Authorization via export_form_entries

Sensei LMS <= 4.17.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Schema & Structured Data for WP & AMP <= 1.23 – Authenticated (Contributor+) Stored Cross-Site Scripting

Product Code for WooCommerce <= 1.4.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

Icegram <= 3.1.19 – Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Message

Insert or Embed Articulate Content into WordPress <= 4.3000000021 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

WooCommerce Menu Extension <= 1.6.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

Active Products Tables for WooCommerce <= 1.0.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

WP Crowdfunding <= 2.1.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

Pay with Vipps for WooCommerce <= 1.14.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

Colibri Page Builder <= 1.0.239 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Booking for Appointments and Events Calendar – Amelia <= 1.0.85 – Stored Cross-Site Scripting via Shortcode

My Agile Privacy <= 2.1.7 – Authenticated (Contributor+) Stored Cross-Site Scripting vis Shortcode

WP Tabs <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Currency Converter Widget <= 3.0.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Colibri Page Builder <= 1.0.240 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Zoho Forms <= 3.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Advanced Access Manager <= 6.9.15 – Authenticated (Contributor+) Stored Cross-Site Scripting

WP Affiliate Disclosure <= 1.2.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via $id

Seos Contact Form <= 1.8.0 – Authenticated (Administrator+) Stored Cross-Site Scripting

HashBar – WordPress Notification Bar <= 1.4.1 – Authenticated (Author+) Stored Cross-Site Scripting

WPCS – WordPress Currency Switcher Professional <= 1.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

WP Remote Site Search <= 1.0.4 – Authenticated (Contributor+) Stored Cross-Site Scripting

CURCY – Multi Currency for WooCommerce <= 2.2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

If-So Dynamic Content Personalization <= 1.6.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Auto Amazon Links <= 5.3.6 – Authenticated (Contributor+) Stored Cross-Site Scripting

Limit Login Attempts Reloaded <= 2.25.26 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Divi <= 4.23.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

iframe Shortcode <= 2.0 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

Restaurant Reservations <= 1.8 – Authenticated (Contributor+) Stored Cross-Site Scripting

CSS & JavaScript Toolbox <= 11.7 – Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode

WordPress.com Editing Toolkit <= 3.78784 – Authenticated (Contributor+) Stored Cross-Site Scripting

BuddyPress <= 11.3.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Stock Ticker <= 3.23.4 – Authenticated (Contributor+) Stored Cross-Site Scritping

Back Button Widget <= 1.6.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Easy Video Player <= 1.2.2.10 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

AMP for WP – Accelerated Mobile Pages <= 1.0.92 – Authenticated (Contributor+) Cross-Site Scripting via Shortcode

WP User Profile Avatar <= 1.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Dan’s Embedder for Google Calendar <= 1.2 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CBX Bookmark & Favorite <= 1.7.13 – Authenticated (Contributor+) Stored Cross-Site Scripting

Easy Digital Downloads <= 3.2.5 – Authenticated (Contributor+) Stored Cross-Site Scripting

WordPress Infinite Scroll – Ajax Load More <= 6.1.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Themify Icons <= 2.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting

Advanced Access Manager <= 6.9.18 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting

Simple Membership <= 4.3.8 – Reflected Cross-Site Scripting Vulnerability via environment_mode

WP Google Maps <= 9.0.27 – Unauthenticated Stored Cross-Site Scripting via REST API

New User Approve <= 2.5.1 – Cross-Site Request Forgery via admin_notices

HT Mega – Absolute Addons For Elementor <= 2.3.8 – Reflected Cross-Site Scripting

Impreza <= 8.17.4 – Reflected Cross-Site Scripting

TheGem <= 5.9.1 – Reflected Cross-Site Scripting

Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 – Reflected Cross-Site Scripting

Google Photos Gallery with Shortcodes <= 4.0.2 – Reflected Cross-Site Scripting

Uncode Core <= 2.8.6 – Reflected Cross-Site Scripting

HTML Forms <= 1.3.28 – Authenticated (Administrator+) Cross-Site Scripting

NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.5 – Authenticated (Admin+) SQL Injection

ZeroBounce Email Verification & Validation <= 1.0.11 – Authenticated (Administrator+) Stored Cross-Site Scripting

Stylish Price List <= 7.0.17 – Missing Authorization

JSM file_get_contents() Shortcode <= 2.7.0 – Authenticated (Contributor+) Server-Side Request Forgery via Shortcode

Simple Staff List <= 2.2.4 – Missing Authorization via ajax_flush_rewrite_rules and staff_member_export

ARI Stream Quiz <= 1.2.32 – Cross-Site Request Forgery

WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 – Authenticated (Contributor+) Stored Cross-Site Scripting

Happy Addons for Elementor <= 3.9.1.1 – Server Side Request Forgery (SSRF)

Molongui <= 4.7.3 – Missing Authorization

FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 – Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting

Doofinder for WooCommerce <= 2.0.33 – Missing Authorization via multiple AJAX actions

Business Directory Plugin <= 6.3.9 – Missing Authorization via dispatch

Essential Blocks for Gutenberg <= 4.2.0 – Incorrect Authorization Checks

WooCommerce Warranty Requests <= 2.2.7 – Missing Authorization

Block IPs for Gravity Forms <= 1.0.1 – Cross-Site Request Forgery

WP Optin Wheel <= 1.4.2 – Sensitive Information Exposure via Log File

Rate my Post – WP Rating System <= 3.4.2 – IP Address Spoofing

Customer Reviews for WooCommerce <= 5.38.1 – Missing Authorization via CR_Manual

Poll Maker <= 4.8.0 – Missing Authorization

Paid Memberships Pro <= 2.12.5 – Missing Authorization via API

AI Power: Complete AI Pack – Powered by GPT-4 <= 1.8.1 – Missing Authorization to Sensitive Data Exposure

Database Cleaner <= 0.9.8 – Sensitive Information Exposure via Log File

Beaver Builder – WordPress Page Builder <= 2.7.2 – Authenticated (Contributor+) Stored Cross-Site Scripting

RegistrationMagic <= 5.2.5.0 – IP Spoofing

MC4WP <= 4.9.9 – Missing Authorization via listen

Product Catalog Simple <= 1.7.6 – Sensitive Information Exposure via Product CSV

Uncanny Automator <= 5.1.0.2 – Sensitive Information Exposure via Log File

LA-Studio Element Kit for Elementor <= 1.1.5 – Missing Authorization

WooCommerce Canada Post Shipping <= 2.8.3 – Missing Authorization

Branda <= 3.4.14 – IP Address Spoofing

Send Users Email <= 1.4.3 – Sensitive Information Exposure via Error Logs

User Feedback <= 1.0.10 – Missing Authorization

WooPayments – Fully Integrated Solution Built and Supported by Woo <= 6.6.2 – Unauthenticated Insecure Direct Object Reference

404 Solution <= 2.33.0 – Sensitive Information Exposure via Log File

WP User Profile Avatar <= 1.0.0 – Authenticated (Author+) Insecure Direct Object Reference to Avatar Deletion/Update

Awesome Support <= 6.1.5 – Missing Authorization via wpas_load_reply_history

RegistrationMagic <= 5.2.5.0 – Form Submission Limit Bypass

Quiz And Survey Master <= 8.1.16 – Missing Authorization

Defender Security <= 4.1.0 – Sensitive Information Exposure via Log File

Metform Elementor Contact Form Builder <= 3.4.0 – Missing Authorization via submit

Affiliates Manager <= 2.9.30 – Sensitive Information Exposure via Log File

Conversios.io <= 6.5.0 – Missing Authorization

eCommerce Product Catalog <= 3.3.26 – Sensitive Information Exposure via CSV Files

FastDup <= 2.1.7 – Sensitive Information Exposure via Log File

All-in-one Floating Contact Form – My Sticky Elements <= 2.1.3 – Missing Authorization

WooCommerce Warranty Requests <= 2.2.7 – Missing Authorization

Everest Forms <= 2.0.3 – Unauthorized Form Submission via Disabled Forms

BuddyBoss Theme <= 2.4.60 – Missing Authorization

Easy Digital Downloads <= 3.1.5 – Missing Authorization

Image Source Control <= 2.17.0 – Sensitive Information Exposure via Log File

WooCommerce Product Vendors <= 2.2.2 – Missing Authorization

Malware Scanner <= 4.7.1 – IP Spoofing

WooCommerce Product Vendors <= 2.2.1 – Missing Authorization

iFrame <= 4.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via srcdoc

Enable Media Replace <= 4.1.4 – Reflected Cross-Site Scripting

Menu Image, Icons made easy <= 3.10 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Ultimate Dashboard <= 3.7.11 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Accredible Certificates & Open Badges <= 1.4.8 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Photo Gallery by 10Web <= 1.8.18 – Authenticated (Administrator+) Stored Cross-Site Scripting via Widget

Everest Forms <= 2.0.4.1 – Authenticated (Administrator+) Stored Cross-Site Scripting

WP Review Slider <= 12.7 – Authenticated (Administrator+) Stored Cross-Site Scripting

WP Chat App <= 3.4.4 – Authenticated (Administrator+) Stored Cross-Site Scripting

weForms – Easy Drag & Drop Contact Form Builder For WordPress <= 1.6.17 – Authenticated (Admin+) Stored Cross-Site Scripting

Brave Popup Builder <= 0.6.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

Sticky Chat Widget <= 1.1.8 – Authenticated (Administrator+) Stored Cross-Site Scripting

Event Management Tickets Booking <= 1.3.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Multi Step Form <= 1.7.13 – Authenticated (Administrator+) Stored Cross-Site Scripting

Custom Post Carousels with Owl <= 1.4.6 – Authenticated (Editor+) Stored Cross-Site Scripting

CRM Perks Forms <= 1.1.2 – Authenticated (Administrator+) Stored Cross-Site Scripting

Simple Counter <= 1.0.2 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

WP Edit Username <= 1.0.5 – Authenticated (Administrator+) Stored Cross-Site Scripting via settings

Loan Repayment Calculator and Application Form <= 2.9.3 – Authenticated (Admin+) Stored Cross-Site Scripting

WooCommerce Easy Duplicate Product <= 0.3.0.7 – Missing Authorization via wedp_duplicate_product_action

EnvíaloSimple <= 2.1 – Cross-Site Request Forgery

Simple Job Board <= 2.10.6 – Cross-Site Request Forgery

Webba Booking <= 4.5.33 – Cross-Site Request Forgery

Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 – Cross-Site Request Forgery via apbct_settings__update_account_email

Custom Twitter Feeds (Tweets Widget) <= 2.1.2 – Cross-Site Request Forgery

Republish Old Posts <= 1.21 – Cross-Site Request Forgery via rop_options_page

Advanced Access Manager <= 6.9.18 – Authenticated (Author+) Open Redirect

Floating Button <= 6.0 – Cross-Site Request Forgery via process_bulk_action

Rise Blocks – A Complete Gutenberg Page Builder <= 3.1 – Cross-Site Request Forgery

WP Simple Booking Calendar <= 2.0.8.4 – Cross-Site Request Forgery

Icegram <= 3.1.18 – Cross-Site Request Forgery via save_campaign_preview

White Label <= 2.9.0 – Cross-Site Request Forgery via white_label_reset_wl_admins

Ultimate Addons for Beaver Builder <= 1.35.13 – Authenticated(Contributor+) Directory Traversal to Arbitrary File Download

HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.3 – Cross-Site Request Forgery

Duplicator <= 1.5.7 – Cross-Site Request Forgery via views/tools/diagnostics/information.php

Quiz And Survey Master <= 8.1.18 – Cross-Site Request Forgery

Thrive Automator <= 1.17 – Cross-Site Request Forgery

Spam protection, AntiSpam, FireWall by CleanTalk <= 6.20 – Cross-Site Request Forgery

WPC Product Bundles for WooCommerce <= 7.3.1 – Cross-Site Request Forgery

GPT3 AI Content Writer <= 1.8.12 – Cross-Site Request Forgery

Apollo13 Framework Extensions <= 1.9.1 – Cross-Site Request Forgery

WooCommerce Ship to Multiple Addresses <= 3.8.9 – Missing Authorization

WooCommerce PDF Invoice Builder <= 1.2.101 – Cross-Site Request Forgery

Paid Member Subscriptions <= 2.10.4 – Cross-Site Request Forgery via ajax_add_log_entry

HT Mega <= 2.3.3 – Cross-Site Request Forgery via Several Functions

FunnelKit Checkout <= 3.10.3 – Authenticated(Subscriber+) Missing Authorization to Arbitrary Plugin Activation

ProfileGrid <= 5.6.6 – Missing Authorization

Dynamic Content for Elementor < 2.12.5 – Cross-Site Request Forgery

Product Filter by WBW <= 2.5.0 – Missing Authorization via getListForTbl

Export Media URLs <= 1.0 – Cross-Site Request Forgery

Calculated Fields Form <= 1.2.28 – Authenticated (Contributor+) Open Redirect via Shortcode

Inline Image Upload for BBPress <= 1.1.18 – Cross-Site Request Forgery via hm_bbpui_admin_page

WooCommerce Shipping Per Product <= 2.5.4 – Missing Authorization

Easy PayPal Buy Now Button <= 1.8.1 – Cross-Site Request Forgery

BulkGate SMS Plugin for WooCommerce <= 3.0.2 – Missing Authorization via Multiple AJAX Actions

FunnelKit Checkout <= 3.10.3 – Authenticated(Subscriber+) Missing Authorization to Settings Change

Booster Elite for WooCommerce <= 7.1.2 – Authenticated(Subscriber+) Content Injection

MStore API <= 4.10.1 – Cross-Site Request Forgery

Add Any Extension to Pages <= 1.4 – Cross-Site Request Forgery via aaetp_options_page

Sirv <= 7.1.2 – Missing Authorization via sirv_disconnect

Integrate Google Drive <= 1.3.3 – Missing Authorization via save_settings

Anti Hacker <= 4.34 – Cross-Site Request Forgery via antihacker_ajax_scan

NEX-Forms – Ultimate Form Builder <= 8.5.2 – Cross-Site Request Forgery

Split Test For Elementor <= 1.6.9 – Cross-Site Request Forgery

GS Logo Slider <= 3.5.1 – Cross-Site Request Forgery

WP Job Portal <= 2.0.6 – Cross-Site Request Forgery

ProjectHuddle Client Site <= 1.0.34 – Missing Authorization via ph_child_ajax_notice_handler

Slider by Soliloquy <= 2.7.2 – Missing Authorization

Awesome Support <= 6.1.5 – Cross-Site Request Forgery

Advanced Category Template <= 0.1 – Cross-Site Request Forgery

NitroPack <= 1.10.2 – Cross-Site Request Forgery

Crowdsignal Dashboard – Polls, Surveys & more <= 3.0.11 – Cross-Site Request Forgery via update_rating

Strong Testimonials <= 3.1.10 – Cross-Site Request Forgery

Eazy Plugin Manager <= 4.1.2 – Missing Authorization via update_options

Ultimate Addons for WPBakery <= 3.19.17 – Cross-Site Request Forgery

Product Table by WBW <= 1.8.6 – Cross-Site Request Forgery via saveGroup

Customize My Account for WooCommerce <= 1.8.3 – Cross-Site Request Forgery via restore_my_account_tabs

Product Feed Manager <= 7.3.15 – Authenticated (Admin+) Directory Traversal

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us using our CVE Request form, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (December 18, 2023 to December 31, 2023) appeared first on Wordfence.