Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises.
To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.
The vulnerabilities listed below are virtually patched by the Sucuri Firewall and existing clients are protected. If you don’t have it installed yet, you can use our web application firewall to protect your site against known vulnerabilities.
WordPress 6.5.5 Security & Maintenance Release
A new security update for WordPress has been released which features 3 bug fixes in WordPress 6.5.5, including two cross-site scripting (XSS) vulnerabilities and one path traversal issue.
We strongly encourage you to always keep your CMS patched with the latest core updates to mitigate risk and protect your WordPress website.
WooCommerce – Cross Site Scripting (XSS)
Security Risk: Critical Exploitation Level: No authentication required. Vulnerability: Cross Site Scripting (XSS) Number of Installations: 7,000,000+ Affected Software: WooCommerce <= 8.9.2 Patched Versions: WooCommerce 8.9.3
Mitigation steps: Update to WooCommerce plugin version 8.9.3 or greater.
Essential Addons for Elementor – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5189 Number of Installations: 2,000,000+ Affected Software: Essential Addons for Elementor <= 5.9.23 Patched Versions: Essential Addons for Elementor 5.9.24
Mitigation steps: Update to Essential Addons for Elementor plugin version 5.9.24 or greater.
Elementor Header & Footer Builder – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5757 Number of Installations: 2,000,000+ Affected Software: Elementor Header & Footer Builder <= 1.6.35 Patched Versions: Elementor Header & Footer Builder 1.6.36
Mitigation steps: Update to Elementor Header & Footer Builder plugin version 1.6.36 or greater.
WPS Hide Login – Bypass Vulnerability
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Bypass Vulnerability CVE: CVE-2024-2473 Number of Installations: 1,000,000+ Affected Software: WPS Hide Login <= 1.9.15 Patched Versions: WPS Hide Login 1.9.16
Mitigation steps: Update to WPS Hide Login plugin version 1.9.16 or greater.
Smush Image Optimization – Broken Access Control
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Broken Access Control CVE: CVE-2023-3352 Number of Installations: 1,000,000+ Affected Software: Smush Image Optimization <= 3.16.4 Patched Versions: Smush Image Optimization 3.16.5
Mitigation steps: Update to Smush Image Optimization plugin version 3.16.5 or greater.
Solid Security – Denial of Service Attack
Security Risk: MediumLow Exploitation Level: No authentication required. Vulnerability: Denial of Service Attack CVE: CVE-2022-44593 Number of Installations: 900,000+ Affected Software: Solid Security <= 9.3.1 Patched Versions: Solid Security 9.3.2
Mitigation steps: Update to Solid Security plugin version 9.3.2 or greater.
Premium Addons for Elementor – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5553 Number of Installations: 700,000+ Affected Software: Premium Addons for Elementor <= 4.10.33 Patched Versions: Premium Addons for Elementor 4.10.34
Mitigation steps: Update to Premium Addons for Elementor plugin version 4.10.34 or greater.
Ocean Extra – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5531 Number of Installations: 600,000+ Affected Software: Ocean Extra <= 2.2.8 Patched Versions: Ocean Extra 2.2.9
Mitigation steps: Update to Ocean Extra plugin version 2.2.9 or greater.
SiteOrigin Widgets Bundle – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5090 Number of Installations: 600,000+ Affected Software: SiteOrigin Widgets Bundle <= 1.61.0 Patched Versions: SiteOrigin Widgets Bundle 1.62.0
Mitigation steps: Update to SiteOrigin Widgets Bundle plugin version 1.62.0 or greater.
SiteGuard WP Plugin – Bypass Vulnerability
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Bypass Vulnerability CVE: CVE-2024-37881 Number of Installations: 500,000+ Affected Software: SiteGuard WP Plugin <= 1.7.6 Patched Versions: SiteGuard WP Plugin 1.7.7
Mitigation steps: Update to SiteGuard WP Plugin version 1.7.7 or greater.
Gutenberg Blocks with AI by Kadence WP – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-4863 Number of Installations: 400,000+ Affected Software: Gutenberg Blocks with AI by Kadence WP <= 3.2.38 Patched Versions: Gutenberg Blocks with AI by Kadence WP 3.2.39
Mitigation steps: Update to Gutenberg Blocks with AI by Kadence WP plugin version 3.2.39 or greater.
SEOPress – On-site SEO – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-1168 Number of Installations: 300,000+ Affected Software: SEOPress <= 7.9.0 Patched Versions: SEOPress 7.9.1
Mitigation steps: Update to SEOPress plugin version 7.9.1 or greater.
MetForm – Sensitive Data Exposure
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Sensitive Data Exposure CVE: CVE-2024-4266 Number of Installations: 300,000+ Affected Software: MetForm <= 3.8.8 Patched Versions: MetForm 3.8.9
Mitigation steps: Update to MetForm plugin version 3.8.9 or greater.
WP Go Maps (formerly WP Google Maps) – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5994 Number of Installations: 300,000+ Affected Software: WP Go Maps <= 9.0.38 Patched Versions: WP Go Maps 9.0.39
Mitigation steps: Update to WP Go Maps plugin version 9.0.39 or greater.
WordPress Funnel Builder by CartFlows – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-4632 Number of Installations: 200,000+ Affected Software: WooCommerce Checkout & Funnel Builder by CartFlows <= 2.0.7 Patched Versions: WooCommerce Checkout & Funnel Builder by CartFlows 2.0.8
Mitigation steps: Update to WordPress Funnel Builder by CartFlows plugin version 2.0.8 or greater.
Orbit Fox by ThemeIsle – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-2484 Number of Installations: 200,000+ Affected Software: Orbit Fox by ThemeIsle <= 2.10.34 Patched Versions: Orbit Fox by ThemeIsle 2.10.35
Mitigation steps: Update to Orbit Fox by ThemeIsle plugin version 2.10.35 or greater.
Floating Chat Widget Chaty – Cross Site Scripting (XSS)
Security Risk: Low Exploitation Level: Requires Administrator level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-4149 Number of Installations: 200,000+ Affected Software: Floating Chat Widget– Chaty <= 3.2.2 Patched Versions: Floating Chat Widget Chaty 3.2.3
Mitigation steps: Update to Floating Chat Widget Chaty plugin version 3.2.3 or greater.
Jeg Elementor Kit – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-4479 Number of Installations: 200,000+ Affected Software: Jeg Elementor Kit <= 2.6.5 Patched Versions: Jeg Elementor Kit 2.6.6
Mitigation steps: Update to Jeg Elementor Kit plugin version 2.6.6 or greater.
Popup Builder – Broken Access Control
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Broken Access Control CVE: CVE-2023-6696, CVE-2024-2544 Number of Installations: 200,000+ Affected Software: Popup Builder <= 4.3.1 Patched Versions: Popup Builder 4.3.2
Mitigation steps: Update to Popup Builder plugin version 4.3.2 or greater.
Download Manager – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-1766 Number of Installations: 100,000+ Affected Software: Download Manager <= 3.2.86 Patched Versions: Download Manager 3.2.87
Mitigation steps: Update to Download Manager plugin version 3.2.90 or greater.
FooGallery – Cross Site Scripting (XSS)
Security Risk: Low Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-2122 Number of Installations: 100,000+ Affected Software: FooGallery <= 2.4.15 Patched Versions: FooGallery 2.4.16
Mitigation steps: Update to FooGallery plugin version 2.4.16 or greater.
PowerPack Addons for Elementor – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5787 Number of Installations: 100,000+ Affected Software: PowerPack Addons for Elementor <= 2.7.20 Patched Versions: PowerPack Addons for Elementor 2.7.21
Mitigation steps: Update to PowerPack Addons for Elementor plugin version 2.7.21 or greater.
Sassy Social Plugin – Cross Site Scripting (XSS)
Security Risk: Low Exploitation Level: Requires Administrator level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-4924 Number of Installations: 100,000+ Affected Software: Sassy Social Share <= 3.3.62 Patched Versions: Sassy Social Share 3.3.63
Mitigation steps: Update to Sassy Social Share plugin version 3.3.63 or greater.
Search & Replace – SQL Injection
Security Risk: Low Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: SQL Injection CVE: CVE-2024-4145 Number of Installations: 100,000+ Affected Software: Search & Replace <= 3.2.1 Patched Versions: Search & Replace 3.2.2
Mitigation steps: Update to Search & Replace plugin version 3.2.2 or greater.
ShopLentor – All in One Solution (formerly WooLentor) – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5530 Number of Installations: 100,000+ Affected Software: ShopLentor <= 2.9.0 Patched Versions: ShopLentor 2.9.1
Mitigation steps: Update to ShopLentor plugin version 2.9.1 or greater.
Email Subscribers by Icegram Express – SQL Injection
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: SQL Injection CVE: CVE-2024-37252 Number of Installations: 90,000+ Affected Software: Email Subscribers by Icegram Express <= 5.7.25 Patched Versions: Email Subscribers by Icegram Express 5.7.26
Mitigation steps: Update to Email Subscribers by Icegram Express plugin version 5.7.26 or greater.
Events Manager – Cross Site Scripting (XSS)
Security Risk: Low Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-3492 Number of Installations: 90,000+ Affected Software: Events Manager – Calendar, Bookings, Tickets, and more! <= 6.4.7 Patched Versions: Events Manager – Calendar, Bookings, Tickets, and more! 6.4.8
Mitigation steps: Update to Events Manager – Calendar, Bookings, Tickets, and more! plugin version 6.4.8 or greater.
Defender Security – Malware Scanner, Login Security & Firewall – Broken Authentication
Security Risk: Medium Exploitation Level: No authentication required. Vulnerability: Broken Authentication CVE: CVE-2022-44581 Number of Installations: 90,000+ Affected Software: Defender Security <= 3.3.2 Patched Versions: Defender Security 3.3.3
Mitigation steps: Update to Defender Security plugin version 3.3.3 or greater.
Slider & Popup Builder by Depicter – Broken Access Control
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Broken Access Control CVE: CVE-2024-4390 Number of Installations: 90,000+ Affected Software: Slider & Popup Builder by Depicter <= 3.0.9 Patched Versions: Slider & Popup Builder by Depicter 3.1.0
Mitigation steps: Update to Slider & Popup Builder by Depicter plugin version 3.1.0 or greater.
Email Subscribers by Icegram Express – SQL Injection
Security Risk: Critical Exploitation Level: No authentication required. Vulnerability: SQL Injection CVE: CVE-2024-37252 Number of Installations: 90,000+ Affected Software: Email Subscribers by Icegram Express <= 5.7.23 Patched Versions: Email Subscribers by Icegram Express 5.7.24
Mitigation steps: Update to Email Subscribers by Icegram Express plugin version 5.7.24 or greater.
Bookly – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5584 Number of Installations: 70,000+ Affected Software: WordPress Online Booking and Scheduling Plugin – Bookly <= 23.2 Patched Versions: WordPress Online Booking and Scheduling Plugin – Bookly 23.3
Mitigation steps: Update to WordPress Online Booking and Scheduling Plugin – Bookly plugin version 23.3 or greater.
Woody code snippets – Remote Code Execution (RCE)
Security Risk: High Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Remote Code Execution (RCE) CVE: CVE-2024-3105 Number of Installations: 70,000+ Affected Software: Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 Patched Versions: Woody code snippets – Insert Header Footer Code, AdSense Ads 2.5.1
Mitigation steps: Update to Woody code snippets – Insert Header Footer Code, AdSense Ads plugin version 2.5.1 or greater.
Blog2Social: Social Media Auto Post & Scheduler – SQL Injection
Security Risk: High Exploitation Level: Requires Subscriber or higher level authentication. Vulnerability: SQL Injection CVE: CVE-2024-3549 Number of Installations: 60,000+ Affected Software: Blog2Social: Social Media Auto Post & Scheduler <= 7.4.1 Patched Versions: Blog2Social: Social Media Auto Post & Scheduler 7.4.2
Mitigation steps: Update to Blog2Social: Social Media Auto Post & Scheduler plugin version 7.4.2 or greater.
Media Library Assistant – SQL Injection
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: SQL Injection CVE: CVE-2024-5605 Number of Installations: 70,000+ Affected Software: Media Library Assistant <= 3.16 Patched Versions: Media Library Assistant 3.17
Mitigation steps: Update to Media Library Assistant plugin version 3.17 or greater.
User Profile Picture – Broken Access Control
Security Risk: Low Exploitation Level: Requires Author or higher level authentication. Vulnerability: Broken Access Control CVE: CVE-2024-5639 Number of Installations: 60,000+ Affected Software: User Profile Picture <= 2.6.1 Patched Versions: User Profile Picture 2.6.2
Mitigation steps: Update to User Profile Picture plugin version 2.6.2 or greater.
WP 2FA – Two-factor authentication for WordPress – Sensitive Data Exposure
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Sensitive Data Exposure CVE: CVE-2022-44587 Number of Installations: 60,000+ Affected Software: WP 2FA <= 2.6.3 Patched Versions: WP 2FA 2.6.4
Mitigation steps: Update to WP 2FA plugin version 2.6.4 or greater.
ConvertKit – Broken Access Control
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Broken Access Control CVE: CVE-2024-3961 Number of Installations: 50,000+ Affected Software: ConvertKit <= 2.4.9 Patched Versions: ConvertKit 2.4.9.1
Mitigation steps: Update to ConvertKit plugin version 2.4.9.1 or greater.
Sina Extension for Elementor – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2024-5036 Number of Installations: 50,000+ Affected Software: Sina Extension for Elementor <= 3.5.4 Patched Versions: Sina Extension for Elementor 3.5.5
Mitigation steps: Update to Sina Extension for Elementor plugin version 3.5.5 or greater.
Ultimate Blocks – WordPress Blocks Plugin – Cross Site Scripting (XSS)
Security Risk: Medium Exploitation Level: Requires Contributor or higher level authentication. Vulnerability: Cross Site Scripting (XSS) CVE: CVE-2023-6692 Number of Installations: 50,000+ Affected Software: Ultimate Blocks <= 3.1.0 Patched Versions: Ultimate Blocks 3.1.1
Mitigation steps: Update to Ultimate Blocks plugin version 3.1.1 or greater.
WP Maintenance – Bypass Vulnerability
Security Risk: Low Exploitation Level: No authentication required. Vulnerability: Bypass Vulnerability CVE: CVE-2024-0789 Number of Installations: 50,000+ Affected Software: WP Maintenance <= 6.1.9.2 Patched Versions: WP Maintenance 6.1.9.3
Mitigation steps: Update to WP Maintenance plugin version 6.1.9.3 or greater.
Update your website software to mitigate risk. Users who are not able to update their software with the latest version are encouraged to use a web application firewall to help virtually patch known vulnerabilities and protect their website.
Matt Morrow
Estevao Avillez
John Castro
Pedro Peixoto
Alycia Mitchell
Rianna MacLeod
Sucuri Malware Research Team
Denis Sinegubko
Cesar Anjos
Ashley Sand