(647) 243-4688

Did you know we’re running a Bug Bounty Extravaganza again?

Earn over 6x our usual bounty rates, up to $10,000,  for all vulnerabilities submitted through May 27th, 2024 when you opt to have Wordfence handle responsible disclosure!

Last week, there were 77 vulnerabilities disclosed in 53 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 30 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected.

Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, like the WordPress community, so individuals and organizations alike can utilize that data to make the internet more secure. That is why the Wordfence Intelligence user interface, vulnerability API, webhook integration, and Wordfence CLI Vulnerability Scanner are all completely free to access and utilize both personally and commercially, and why we are running this weekly vulnerability report.

Enterprises, Hosting Providers, and even Individuals can use the Wordfence CLI Vulnerability Scanner to run regular vulnerability scans across the sites they protect. Or alternatively, utilize the vulnerability Database API to receive a complete dump of our database of over 14,000 vulnerabilities and then utilize the webhook integration to stay on top of the newest vulnerabilities added in real-time, as well as any updates made to the database, all for free.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

New Firewall Rules Deployed Last Week

The Wordfence Threat Intelligence Team reviews each vulnerability to determine impact and severity, along with assessing the likelihood of exploitation, to verify that the Wordfence Firewall provides sufficient protection.

The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week:

Addon Library <= 1.3.76 – Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Bricks <= 1.9.6 – Unauthenticated Remote Code Execution via queryEditor – Extended Protection

Wordfence Premium, Care, and Response customers received this protection immediately, while users still running the free version of Wordfence will receive this enhanced protection after a 30 day delay.

Total Unpatched & Patched Vulnerabilities Last Week

Patch Status
Number of Vulnerabilities

Patched
61

Unpatched
16

Total Vulnerabilities by CVSS Severity Last Week

Severity Rating
Number of Vulnerabilities

Low Severity
1

Medium Severity
65

High Severity
10

Critical Severity
1

Total Vulnerabilities by CWE Type Last Week

Vulnerability Type by CWE
Number of Vulnerabilities

Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
24

Cross-Site Request Forgery (CSRF)
12

Missing Authorization
12

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
10

Improper Access Control
6

Information Exposure
3

Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
2

Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
2

Deserialization of Untrusted Data
1

Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’)
1

Improper Privilege Management
1

Server-Side Request Forgery (SSRF)
1

Unprotected Storage of Credentials
1

Unrestricted Upload of File with Dangerous Type
1

Researchers That Contributed to WordPress Security Last Week

Researcher Name
Number of Vulnerabilities

10

10

6

5

4

4

4

3

3

2

2

2

2

2

2

1

1

1

1

1

1

1

1

Sh

1

1

1

1

1

1

1

Are you a security researcher who would like to be featured in our weekly vulnerability report? You can responsibly disclose your WordPress vulnerability discoveries to us and earn a bounty on in-scope vulnerabilities through our Bug Bounty Program. Responsibly disclosing your vulnerability discoveries to us will also get your name added on the Wordfence Intelligence leaderboard along with being mentioned in our weekly vulnerability report.

WordPress Plugins with Reported Vulnerabilities Last Week

Software Name
Software Slug

3D FlipBook – PDF Flipbook WordPress

interactive-3d-flipbook-powered-physics-engine

Academy LMS – eLearning and online course solution for WordPress

academy

Addon Library

addon-library

Admin side data storage for Contact Form 7

admin-side-data-storage-for-contact-form-7

Archivist – Custom Archive Templates

archivist-custom-archive-templates

Backup Bolt

backup-bolt

BackWPup – WordPress Backup Plugin

backwpup

Beaver Builder – WordPress Page Builder

beaver-builder-lite-version

Brizy – Page Builder

brizy

Change Table Prefix

change-table-prefix

Colibri Page Builder

colibri-page-builder

Coming Soon Maintenance Mode

coming-soon-maintenance-mode

Contact Form builder with drag & drop for WordPress – Kali Forms

kali-forms

Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce

cost-of-goods-for-woocommerce

Custom Order Statuses for WooCommerce

custom-order-statuses-for-woocommerce

Database Reset

wordpress-database-reset

Elementor Addon Elements

addon-elements-for-elementor-page-builder

Enhanced Text Widget

enhanced-text-widget

Error Log Viewer by BestWebSoft

error-log-viewer

Event Tickets and Registration

event-tickets

Featured Image from URL (FIFU)

featured-image-from-url

File Manager Pro

wp-file-manager-pro

FormFacade – WordPress plugin for Google Forms

formfacade

Heureka

heureka

KODO Qiniu

kodo-qiniu

Link Library

link-library

Maintenance Page

maintenance-page

Oliver POS – A WooCommerce Point of Sale (POS)

oliver-pos

Page Builder: Pagelayer – Drag and Drop website builder

pagelayer

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress

wp-user-avatar

Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease

password-protected

PeproDev Ultimate Invoice

pepro-ultimate-invoice

Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio

play-ht

Plugin Groups

plugin-groups

Product Catalog Mode For WooCommerce

woocommerce-catalog-enquiry

RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

custom-registration-form-builder-with-submission-manager

Relevanssi – A Better Search

relevanssi

Scalable Vector Graphics (SVG)

scalable-vector-graphics-svg

Schema & Structured Data for WP & AMP

schema-and-structured-data-for-wp

Simple Job Board

simple-job-board

Social Sharing Plugin – Sassy Social Share

sassy-social-share

SuperFaktura WooCommerce

woocommerce-superfaktura

Tabs Shortcode and Widget

tabs-shortcode-and-widget

Tutor LMS – eLearning and online course solution

tutor

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin

ultimate-member

User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds

userfeedback-lite

WooCommerce Google Sheet Connector

wc-gsheetconnector

WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce

wp-event-manager

WP Shortcodes Plugin — Shortcodes Ultimate

shortcodes-ultimate

wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin

wpdatatables

WPify Woo Czech

wpify-woo

YARPP – Yet Another Related Posts Plugin

yet-another-related-posts-plugin

YML for Yandex Market

yml-for-yandex-market

WordPress Themes with Reported Vulnerabilities Last Week

Software Name
Software Slug

Colibri WP

colibri-wp

Vulnerability Details

Please note that if you run the Wordfence plugin on your WordPress site, with the scanner enabled, you should’ve already been notified if your site was affected by any of these vulnerabilities. If you’d like to receive real-time notifications whenever a vulnerability is added to the Wordfence Intelligence Vulnerability Database, check out our Slack and HTTP Webhook Integration, which is completely free to utilize.

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1710
Patch Status
Unpatched
Published
Feb 23, 2024

Affected Software
Addon Library
Researcher

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1311
Patch Status
Patched
Published
Feb 23, 2024

Affected Software
Brizy – Page Builder
Researcher

CVSS Rating
High (8.8)
CVE-ID
CVE-2024-1358
Patch Status
Patched
Published
Feb 21, 2024

Affected Software
Elementor Addon Elements
Researcher

CVSS Rating
High (7.5)
CVE-ID
CVE-2024-25933
Patch Status
Unpatched
Published
Feb 20, 2024

Affected Software
PeproDev Ultimate Invoice
Researcher

CVSS Rating
High (7.3)
CVE-ID
CVE-2024-0702
Patch Status
Patched
Published
Feb 19, 2024

CVSS Rating
High (7.2)
CVE-ID
CVE-2024-1776
Patch Status
Unpatched
Published
Feb 22, 2024

CVSS Rating
High (7.1)
CVE-ID
CVE-2024-25932
Patch Status
Unpatched
Published
Feb 20, 2024

Affected Software
Change Table Prefix
Researcher

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-1559
Patch Status
Patched
Published
Feb 19, 2024

Affected Software
Link Library
Researcher

CVSS Rating
Medium (6.5)
CVE-ID
CVE-2024-1108
Patch Status
Patched
Published
Feb 20, 2024

Affected Software
Plugin Groups
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1081
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0897
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0896
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1296
Patch Status
Patched
Published
Feb 23, 2024

Affected Software
Brizy – Page Builder
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1291
Patch Status
Patched
Published
Feb 23, 2024

Affected Software
Brizy – Page Builder
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1393
Patch Status
Patched
Published
Feb 21, 2024

Affected Software
Elementor Addon Elements
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1392
Patch Status
Patched
Published
Feb 21, 2024

Affected Software
Elementor Addon Elements
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1422
Patch Status
Patched
Published
Feb 21, 2024

Affected Software
Elementor Addon Elements
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1496
Patch Status
Patched
Published
Feb 19, 2024

Affected Software
Featured Image from URL (FIFU)
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-25934
Patch Status
Unpatched
Published
Feb 20, 2024

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1448
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2023-7085
Patch Status
Unpatched
Published
Feb 20, 2024

Affected Software
Scalable Vector Graphics (SVG)
Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-1586
Patch Status
Patched
Published
Feb 19, 2024

Researcher

CVSS Rating
Medium (6.4)
CVE-ID
CVE-2024-0719
Patch Status
Unpatched
Published
Feb 20, 2024

Affected Software
Tabs Shortcode and Widget
Researcher

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-1810
Patch Status
Patched
Published
Feb 23, 2024

Researcher

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2023-7015
Patch Status
Patched
Published
Feb 20, 2024

Affected Software
File Manager Pro

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-0976
Patch Status
Patched
Published
Feb 23, 2024

CVSS Rating
Medium (6.1)
CVE-ID
CVE-2024-1365
Patch Status
Patched
Published
Feb 23, 2024

Affected Software
YML for Yandex Market
Researcher

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1038
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-25930
Patch Status
Unpatched
Published
Feb 20, 2024

Researcher

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1758
Patch Status
Patched
Published
Feb 23, 2024

Affected Software
SuperFaktura WooCommerce
Researcher

CVSS Rating
Medium (5.4)
CVE-ID
CVE-2024-1128
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1779
Patch Status
Unpatched
Published
Feb 22, 2024

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2023-7236
Patch Status
Unpatched
Published
Feb 20, 2024

Affected Software
Backup Bolt
Researcher

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1475
Patch Status
Patched
Published
Feb 19, 2024

Affected Software
Coming Soon Maintenance Mode
Researcher

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2023-6821
Patch Status
Patched
Published
Feb 20, 2024

Researcher

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1370
Patch Status
Patched
Published
Feb 21, 2024

Affected Software
Maintenance Page
Researcher

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1462
Patch Status
Patched
Published
Feb 21, 2024

Affected Software
Maintenance Page
Researcher

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1380
Patch Status
Patched
Published
Feb 22, 2024

Affected Software
Relevanssi – A Better Search
Researcher

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-0593
Patch Status
Patched
Published
Feb 20, 2024

Affected Software
Simple Job Board
Researcher

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1562
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (5.3)
CVE-ID
CVE-2024-1492
Patch Status
Patched
Published
Feb 19, 2024

Affected Software
WPify Woo Czech
Researcher

CVSS Rating
Medium (4.7)
CVE-ID
CVE-2024-1501
Patch Status
Patched
Published
Feb 20, 2024

Affected Software
Database Reset
Researcher

CVSS Rating
Medium (4.4)
CVE-ID
CVE-2024-0559
Patch Status
Patched
Published
Feb 20, 2024

Affected Software
Enhanced Text Widget
Researcher

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1777
Patch Status
Unpatched
Published
Feb 22, 2024

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1778
Patch Status
Unpatched
Published
Feb 22, 2024

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1165
Patch Status
Patched
Published
Feb 23, 2024

Affected Software
Brizy – Page Builder
Researcher

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1362
Patch Status
Patched
Published
Feb 22, 2024

Affected Software
Colibri Page Builder
Researcher

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1361
Patch Status
Patched
Published
Feb 22, 2024

Affected Software
Colibri Page Builder
Researcher

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1360
Patch Status
Patched
Published
Feb 22, 2024

Affected Software
Colibri WP
Researcher

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1218
Patch Status
Patched
Published
Feb 19, 2024

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1053
Patch Status
Patched
Published
Feb 21, 2024

Affected Software
Event Tickets and Registration
Researcher

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-25931
Patch Status
Unpatched
Published
Feb 20, 2024

Affected Software
Heureka
Researcher

CVSS Rating
Medium (4.3)
CVE-ID
Unknown
Patch Status
Patched
Published
Feb 23, 2024

Affected Software
KODO Qiniu
Researcher(s): Unknown

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-25929
Patch Status
Patched
Published
Feb 20, 2024

Researcher

CVSS Rating
Medium (4.3)
CVE-ID
Unknown
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1288
Patch Status
Patched
Published
Feb 19, 2024

CVSS Rating
Medium (4.3)
CVE-ID
CVE-2024-1133
Patch Status
Patched
Published
Feb 20, 2024

CVSS Rating
Low (2.2)
CVE-ID
CVE-2023-5775
Patch Status
Patched
Published
Feb 23, 2024

As a reminder, Wordfence has curated an industry leading vulnerability database with all known WordPress core, theme, and plugin vulnerabilities known as Wordfence Intelligence.

This database is continuously updated, maintained, and populated by Wordfence’s highly credentialed and experienced vulnerability researchers through in-house vulnerability research, vulnerability researchers submitting directly to us through our Bug Bounty Program, and by monitoring varying sources to capture all publicly available WordPress vulnerability information and adding additional context where we can.

Click here to sign-up for our mailing list to receive weekly vulnerability reports like this and important WordPress Security reports in your inbox the moment they are published.

The post Wordfence Intelligence Weekly WordPress Vulnerability Report (February 19, 2024 to February 25, 2024) appeared first on Wordfence.