Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes of website compromises.

To help educate website owners about potential threats to their environments, we’ve compiled a list of important security updates and vulnerability patches for the WordPress ecosystem this past month.

The vulnerabilities listed below are virtually patched by the Sucuri Firewall and existing clients are protected. If you don’t have it installed yet, you can use our web application firewall to protect your site against known vulnerabilities.

WordPress 6.6.1 Maintenance Release

WordPress 6.6.1 has been released, featuring 7 Core bug fixes and 9 Block Editor bug fixes. Read the Release Candidate announcement for a detailed overview of the changes.

We strongly encourage WordPress users to always keep their CMS patched with the latest core updates to mitigate risk and protect the WordPress environment.

WooCommerce – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-39666
Number of Installations: 7,000,000+
Affected Software: WooCommerce <= 9.1.2
Patched Versions: WooCommerce 9.1.3

Mitigation steps: Update to WooCommerce plugin version 9.1.3 or greater.

LiteSpeed Cache – Privilege Escalation

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: Privilege Escalation
CVE: CVE-2024-28000
Number of Installations: 5,000,000+
Affected Software: LiteSpeed Cache <= 6.3.0.1
Patched Versions: LiteSpeed Cache 6.4

Mitigation steps: Update to LiteSpeed Cache plugin version 6.4 or greater.

Essential Addons for Elementor – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7092
Number of Installations: 2,000,000+
Affected Software: Essential Addons for Elementor <= 5.9.27
Patched Versions: Essential Addons for Elementor 6.0.0

Mitigation steps: Update to Essential Addons for Elementor plugin version 6.0.0 or greater.

Spectra – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7590
Number of Installations: 900,000+
Affected Software: Spectra <= 2.14.1
Patched Versions: Spectra 2.15.1

Mitigation steps: Update to Spectra plugin version 2.15.1 or greater.

Popup Maker – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7054
Number of Installations: 700,000+
Affected Software: Popup Maker <= 1.19.0
Patched Versions: Popup Maker 1.19.1

Mitigation steps: Update to Popup Maker plugin version 1.19.1 or greater.

Premium Addons for Elementor – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-6824
Number of Installations: 700,000+
Affected Software: Premium Addons for Elementor <= 4.10.38
Patched Versions: Premium Addons for Elementor 4.10.39

Mitigation steps: Update to Premium Addons for Elementor plugin version 4.10.39 or greater.

Meta Box – Broken Access Control

Security Risk: High
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43235
Number of Installations: 600,000+
Affected Software: Meta Box <= 5.9.10
Patched Versions: Meta Box 5.9.11

Mitigation steps: Update to Meta Box plugin version 5.9.11 or greater.

SiteOrigin Widgets Bundle – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-5901
Number of Installations: 600,000+
Affected Software: SiteOrigin Widgets Bundle <= 1.62.2
Patched Versions: SiteOrigin Widgets Bundle 1.62.3

Mitigation steps: Update to SiteOrigin Widgets Bundle plugin version 1.62.3 or greater.

Easy Table of Contents – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7082
Number of Installations: 500,000+
Affected Software: Easy Table of Contents <= 2.0.67.1
Patched Versions: Easy Table of Contents 2.0.68

Mitigation steps: Update to Easy Table of Contents plugin version 2.0.68 or greater.

Formidable Forms – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-6725
Number of Installations: 400,000+
Affected Software: Formidable Forms <= 6.11.1
Patched Versions: Formidable Forms 6.11.2

Mitigation steps: Update to Formidable Forms plugin version 6.11.2 or greater.

Gutenberg Blocks with AI by Kadence WP – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-6884
Number of Installations: 400,000+
Affected Software: Gutenberg Blocks with AI by Kadence WP <= 3.2.38
Patched Versions: Gutenberg Blocks with AI by Kadence WP 3.2.39

Mitigation steps: Update to Gutenberg Blocks with AI by Kadence WP plugin version 3.2.39 or greater.

Fonts Plugin – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43302
Number of Installations: 200,000+
Affected Software: Fonts Plugin <= 3.7.7
Patched Versions: Fonts Plugin 3.7.8

Mitigation steps: Update to Fonts Plugin plugin version 3.7.8 or greater.

White Label CMS – Reflected Cross Site Scripting (XSS)

Security Risk: High
Exploitation Level: No authentication required.
Vulnerability: XSS
CVE: CVE-2024-43303
Number of Installations: 200,000+
Affected Software: White Label CMS <= 2.7.4
Patched Versions: White Label CMS 2.7.5

Mitigation steps: Update to White Label CMS plugin version 2.7.5 or greater.

Download Manager – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-6208
Number of Installations: 100,000+
Affected Software: Download Manager <= 3.2.97
Patched Versions: Download Manager 3.2.98

Mitigation steps: Update to Download Manager plugin version 3.2.98 or greater.

Essential Blocks – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-5595
Number of Installations: 100,000+
Affected Software: Essential Blocks < 4.7.0
Patched Versions: Essential Blocks 4.7.0

Mitigation steps: Update to Essential Blocks plugin version 4.7.0 or greater.

Inline Related Posts – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-6487
Number of Installations: 100,000+
Affected Software: Inline Related Posts < 3.8.0
Patched Versions: Inline Related Posts 3.8.0

Mitigation steps: Update to Inline Related Posts version 3.8.0 or greater.

My Sticky Bar – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-4090
Number of Installations: 100,000+
Affected Software: My Sticky Bar (formerly myStickymenu) <= 2.7.1
Patched Versions: My Sticky Bar (formerly myStickymenu) 2.7.2

Mitigation steps: Update to My Sticky Bar plugin version 2.7.2 or greater.

DearFlip – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-4367
Number of Installations: 100,000+
Affected Software: DearFlip <= 2.2.55
Patched Versions: DearFlip 2.2.56

Mitigation steps: Update to DearFlip plugin version 2.2.56 or greater.

AMP for WP – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43146
Number of Installations: 100,000+
Affected Software: AMP for WP <= 1.0.96.1
Patched Versions: AMP for WP 1.0.97

Mitigation steps: Update to AMP for WP plugin version 1.0.97 or greater.

Aruba HiSpeed Cache – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43119
Number of Installations: 100,000+
Affected Software: Aruba HiSpeed Cache <= 2.0.12
Patched Versions: Aruba HiSpeed Cache 2.0.13

Mitigation steps: Update to Aruba HiSpeed Cache plugin version 2.0.13 or greater.

Element Pack Elementor Addons – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7247
Number of Installations: 100,000+
Affected Software: Element Pack Elementor Addons <= 5.7.2
Patched Versions: Element Pack Elementor Addons 5.7.3

Mitigation steps: Update to Element Pack Elementor Addons plugin version 5.7.3 or greater.

Slider & Popup Builder by Depicter – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-43161
Number of Installations: 100,000+
Affected Software: Slider & Popup Builder by Depicter <= 3.1.2
Patched Versions: Slider & Popup Builder by Depicter 3.2.0

Mitigation steps: Update to Slider & Popup Builder by Depicter plugin version 3.2.0 or greater.

FooBox – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-5668
Number of Installations: 100,000+
Affected Software: FooBox <= 2.7.28
Patched Versions: FooBox 2.7.32

Mitigation steps: Update to FooBox plugin version 2.7.32 or greater.

Hummingbird Performance – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43118
Number of Installations: 100,000+
Affected Software: Hummingbird Performance <= 3.9.1
Patched Versions: Hummingbird Performance 3.9.2

Mitigation steps: Update to Hummingbird Performance plugin version 3.9.2 or greater.

Robin image optimizer – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43122
Number of Installations: 100,000+
Affected Software: Robin image optimizer <= 1.6.9
Patched Versions: Robin image optimizer 1.7.0

Mitigation steps: Update to Robin image optimizer plugin version 1.7.0 or greater.

GiveWP – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-5940, CVE-2024-5939
Number of Installations: 100,000+
Affected Software: GiveWP <= 3.13.9
Patched Versions: GiveWP 3.14.0

Mitigation steps: Update to GiveWP plugin version 3.14.0 or greater.

The Ultimate Video Player For WordPress – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43285
Number of Installations: 100,000+
Affected Software: The Ultimate Video Player For WordPress <= 3.0.2
Patched Versions: The Ultimate Video Player For WordPress 3.0.3

Mitigation steps: Update to The Ultimate Video Player For WordPress plugin version 3.0.3 or greater.

SEO Plugin by Squirrly SEO – SQL Injection

Security Risk: High
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: SQL Injection
CVE: CVE-2024-43286
Number of Installations: 100,000+
Affected Software: SEO Plugin by Squirrly SEO <= 12.3.19
Patched Versions: SEO Plugin by Squirrly SEO 12.3.20

Mitigation steps: Update to SEO Plugin by Squirrly SEO plugin version 12.3.20 or greater.

The Plus Addons for Elementor – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-5763
Number of Installations: 100,000+
Affected Software: The Plus Addons for Elementor <= 5.6.2
Patched Versions: The Plus Addons for Elementor 5.6.3

Mitigation steps: Update to The Plus Addons for Elementor plugin version 5.6.3 or greater.

Asset CleanUp: Page Speed Booster – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43314
Number of Installations: 100,000+
Affected Software: Asset CleanUp: Page Speed Booster <= 1.3.9.3
Patched Versions: Asset CleanUp: Page Speed Booster 1.3.9.4

Mitigation steps: Update to Asset CleanUp: Page Speed Booster plugin version 1.3.9.4 or greater.

Email Encoder – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-4483
Number of Installations: 90,000+
Affected Software: Email Encoder <= 2.2.1
Patched Versions: Email Encoder 2.2.2

Mitigation steps: Update to Email Encoder plugin version 2.2.2 or greater.

Social Feed Gallery – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-39640
Number of Installations: 90,000+
Affected Software: Social Feed Gallery <= 4.3.9
Patched Versions: Social Feed Gallery 4.4.0

Mitigation steps: Update to Social Feed Gallery plugin version 4.4.0 or greater.

WP Mobile Menu – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-2508
Number of Installations: 90,000+
Affected Software: WP Mobile Menu <= 2.8.4.4
Patched Versions: WP Mobile Menu 2.8.5

Mitigation steps: Update to WP Mobile Menu plugin version 2.8.5 or greater.

LearnPress – SQL Injection

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: SQL Injection
CVE: CVE-2024-7548
Number of Installations: 90,000+
Affected Software: LearnPress <= 4.2.6.9.3
Patched Versions: LearnPress 4.2.6.9.4

Mitigation steps: Update to LearnPress plugin version 4.2.6.9.4 or greater.

Tutor LMS – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Instructor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-43231
Number of Installations: 90,000+
Affected Software: Tutor LMS <= 2.7.3
Patched Versions: Tutor LMS 2.7.4

Mitigation steps: Update to Tutor LMS plugin version 2.7.4 or greater.

Tutor LMS – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Tutor Instructor or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43142
Number of Installations: 90,000+
Affected Software: Tutor LMS <= 2.7.3
Patched Versions: Tutor LMS 2.7.4

Mitigation steps: Update to Tutor LMS plugin version 2.7.4 or greater.

Ajax Search Lite – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7084
Number of Installations: 80,000+
Affected Software: Ajax Search Lite <= 4.12
Patched Versions: Ajax Search Lite 4.12.1

Mitigation steps: Update to Ajax Search Lite plugin version 4.12.1 or greater.

Folders – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7317
Number of Installations: 80,000+
Affected Software: Folders <= 3.0.3
Patched Versions: Folders 3.0.4

Mitigation steps: Update to Folders plugin version 3.0.4 or greater.

3D FlipBook – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Editor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-43152
Number of Installations: 70,000+
Affected Software: 3D FlipBook <= 1.15.6
Patched Versions: 3D FlipBook 1.15.7

Mitigation steps: Update to 3D FlipBook plugin version 1.15.7 or greater.

Clone – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43298
Number of Installations: 70,000+
Affected Software: Clone <= 2.4.5
Patched Versions: Clone 2.4.6

Mitigation steps: Update to Clone plugin version 2.4.6 or greater.

FOX – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43297
Number of Installations: 60,000+
Affected Software: FOX <= 1.4.2
Patched Versions: FOX 1.4.2.1

Mitigation steps: Update to FOX plugin version 1.4.2.1 or greater.

WP Table Builder – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-43125
Number of Installations: 60,000+
Affected Software: WP Table Builder <= 1.4.15
Patched Versions: WP Table Builder 1.5.0

Mitigation steps: Update to WP Table Builder plugin version 1.5.0 or greater.

Blog2Social – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Author or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7302
Number of Installations: 60,000+
Affected Software: Blog2Social <= 7.5.4
Patched Versions: Blog2Social 7.5.5

Mitigation steps: Update to Blog2Social plugin version 7.5.5 or greater.

Bold Page Builder – Cross Site Scripting (XSS)

Security Risk: Medium
Exploitation Level: Requires Contributor or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-7100
Number of Installations: 50,000+
Affected Software: Bold Page Builder <= 5.0.2
Patched Versions: Bold Page Builder 5.0.3

Mitigation steps: Update to Bold Page Builder plugin version 5.0.3 or greater.

Easy Digital Downloads – SQL Injection

Security Risk: Critical
Exploitation Level: No authentication required.
Vulnerability: SQLi
CVE: CVE-2024-5057
Number of Installations: 50,000+
Affected Software: Easy Digital Downloads <= 3.2.12
Patched Versions: Easy Digital Downloads 3.3.1

Mitigation steps: Update to Easy Digital Downloads plugin version 3.3.1 or greater.

User Profile Builder – Broken Access Control

Security Risk: Medium
Exploitation Level: No authentication required.
Vulnerability: Broken Access Control
CVE: CVE-2024-6366
Number of Installations: 50,000+
Affected Software: User Profile Builder <= 3.11.7
Patched Versions: User Profile Builder 3.11.8

Mitigation steps: Update to User Profile Builder plugin version 3.11.8 or greater.

Category Posts Widget – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-6158
Number of Installations: 50,000+
Affected Software: Category Posts Widget <= 4.9.16
Patched Versions: Category Posts Widget 4.9.17

Mitigation steps: Update to Category Posts Widget plugin version 4.9.17 or greater.

Easy Digital Downloads – Cross Site Scripting (XSS)

Security Risk: Low
Exploitation Level: Requires Administrator or higher level authentication.
Vulnerability: XSS
CVE: CVE-2024-6692
Number of Installations: 50,000+
Affected Software: Easy Digital Downloads <= 3.3.2
Patched Versions: Easy Digital Downloads 3.3.3

Mitigation steps: Update to Easy Digital Downloads plugin version 3.3.3 or greater.

Easy Digital Downloads – Broken Access Control

Security Risk: Medium
Exploitation Level: Requires Subscriber or higher level authentication.
Vulnerability: Broken Access Control
CVE: CVE-2024-43162
Number of Installations: 50,000+
Affected Software: Easy Digital Downloads <= 3.2.12
Patched Versions: Easy Digital Downloads 3.3.1

Mitigation steps: Update to Easy Digital Downloads plugin version 3.3.1 or greater.

Update your website software to mitigate risk. Users who are not able to update their software with the latest version are encouraged to use a web application firewall to help virtually patch known vulnerabilities and protect their website.