WordPress 7.1.1 contains 9 known security vulnerabilities, including 4 high-severity issues that put thousands of websites at immediate risk. These vulnerabilities range from SQL injection attacks to local file inclusion exploits, potentially allowing attackers to steal data, modify content, or take complete control of your site.
If you're running WordPress 7.1.1, you're not alone—over 1,021 websites still use this vulnerable version. However, staying on this version leaves your site exposed to serious security breaches. Understanding these vulnerabilities and taking immediate action is essential to protecting your business, customer data, and reputation.
In this guide, we'll break down the most critical CVEs affecting WordPress 7.1.1, show you how to identify if your site is vulnerable, and provide step-by-step instructions to secure your WordPress installation.
WordPress 7.1.1 is a specific version of WordPress, the world's most popular website-building platform used by millions of sites. If you're unsure which version you're running, it's the number you see in your WordPress dashboard's bottom right corner or in your site's backend settings. Version numbers matter because WordPress releases security patches regularly, and older versions like 7.1.1 contain known security flaws that hackers actively exploit.
Think of WordPress versions like software updates on your phone—each new version patches security holes and adds features. Staying on an outdated version is like leaving your front door unlocked. Attackers know about these vulnerabilities and target sites running older versions because they're easier to compromise. The sooner you update to a newer, patched version, the sooner you eliminate these known attack vectors.
9 CVEs found. The most critical are explained below.
A flaw in the Quiz and Survey Master plugin (versions before 7.1.12) allows attackers to manipulate quiz result pages. Hackers can inject malicious code into the quiz results, which gets executed against your website's database.
Impact: Attackers could steal sensitive data from your database, modify quiz results, or take control of your website's information.
↗ View on NVDThe Porto theme (versions up to 7.1.0) has a security flaw that allows users with contributor access or higher to view files they shouldn't be able to access. An attacker with limited account permissions can read sensitive website files.
Impact: Hackers could expose your website's configuration files, database credentials, or other private information stored on your server.
↗ View on NVDThe Custom Login Page Styler plugin has a flaw that allows attackers with low-level accounts to gain higher-level permissions they shouldn't have. Someone with basic access could elevate themselves to administrator level.
Impact: An attacker could gain full control of your website, modify content, install malware, or lock you out of your own site.
↗ View on NVDThe Advanced Page Visit Counter plugin is vulnerable to database attacks similar to the Quiz plugin issue. Attackers can inject malicious commands into the plugin's analytics tracking system.
Impact: Hackers could steal visitor data, modify statistics, or compromise your entire database.
↗ View on NVDThe WordPress Infinite Scroll plugin (versions up to 7.1.1) doesn't properly filter content added through its shortcode feature. An attacker with editing privileges can inject harmful scripts that affect other users.
Impact: Malicious scripts could steal visitor information, redirect users to dangerous sites, or compromise user accounts.
↗ View on NVDThe Quiz and Survey Master plugin (versions before 7.1.18) doesn't properly filter quiz result pages. An attacker can insert malicious scripts that execute when visitors view their quiz results.
Impact: Attackers could steal user credentials, redirect visitors to phishing sites, or compromise user accounts through malicious scripts.
↗ View on NVDShowing first 10 of 3. View all on NVD ↗
| CVE ID | Severity | Score | Published | Description |
|---|---|---|---|---|
| CVE-2024-10472 | MEDIUM | 5.9 | 2025-03-25 | The Stylish Price List WordPress plugin before 7.1.12 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Sto… |
| CVE-2022-41634 | MEDIUM | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress. |
| CVE-2024-13530 | MEDIUM | 4.3 | 2025-01-31 | The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login URL – Sign in , Sign out plugin for WordPress is vulnerable… |
Plain English · Fix recommendations · Instant PDF & HTML download
Scan your site in 30 seconds. Used by 500+ web agencies.
WordPress 7.1.1 poses significant security risks with 4 high-severity vulnerabilities that could lead to data theft, site compromise, or complete takeover. The good news is that updating takes just minutes and instantly eliminates these known attack vectors. Don't wait for attackers to exploit your site—take action today to secure your WordPress installation.
SiteRecipe.com makes WordPress security simple. Our platform automatically scans your WordPress site for all known vulnerabilities, alerts you to critical threats, and provides step-by-step remediation guidance. Visit SiteRecipe.com today for a free security scan and discover exactly what vulnerabilities affect your site. Your WordPress security is too important to leave to chance.
Web agencies use SiteRecipe to produce branded PDF security reports in 30 seconds.