PatchTheCVEwpbeginner vulnerabilities
Recent CVEs affecting wpbeginner products. 4 tracked.
wpbeginner has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2025-06-26. Highest priority: CVE-2024-10878 (score 31/100).
- CVE-2025-5275 MEDIUM 4.4 UPGRADE The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPr
- CVE-2025-4577 MEDIUM 6.4 UPGRADE The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to S
- CVE-2024-10878 MEDIUM 6.1 UPGRADE The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Script
- CVE-2024-10045 MEDIUM 4.3 UPGRADE The Transients Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,
FAQ
How do I fix wpbeginner vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is wpbeginner being exploited right now?
None of the tracked wpbeginner CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which wpbeginner CVE should I patch first?
CVE-2024-10878 currently ranks highest (31/100): The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Script.