Plugin security history

IP2Location Country Blocker Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 9 vulnerability records associated with IP2Location Country Blocker, published between 2022 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

9Total records

0Critical

3High

6Medium

0Low

0Informational

9Patched records

0Currently marked unpatched

2022-01-06First disclosure

2025-02-21Latest disclosure

8 of 9CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	4	4 records
2023	1	1 records
2024	2	2 records
2025	2	2 records

Severity Breakdown

Severity	Records	Share
High	3	33.3%
Medium	6	66.7%

Vulnerability-Type Breakdown

Missing Authorization

3 records33.3%

First: 2022. Latest: 2025.

CSRF

2 records22.2%

First: 2022. Latest: 2024.

Cross-Site Scripting

2 records22.2%

First: 2022. Latest: 2025.

Other

1 record11.1%

First: 2023. Latest: 2023.

Information Disclosure

1 record11.1%

First: 2024. Latest: 2024.

Patch Status

Patched: 9
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

2.38.9
2.38.4
2.34.3
2.33.4
2.29.2
2.26.9
2.26.6
2.26.5

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-2.38.8`	IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function	February 21, 2025	2.38.9	High
`*-2.38.3`	Download IP2Location Country Blocker <= 2.38.3 - Authenticated (Administrator+) Stored Cross-Site Scripting	January 24, 2025	2.38.4	Medium
`*-2.34.2`	Download IP2Location Country Blocker <= 2.34.2 - Cross-Site Request Forgery	April 12, 2024	2.34.3	Medium
`*-2.33.3`	IP2Location Country Blocker <= 2.33.3 - Unauthenticated Sensitive Information Exposure via Debug Log File	January 17, 2024	2.33.4	Medium
`*-2.29.1`	Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing	July 10, 2023	2.29.2	Medium
`[*, 2.26.9)`	IP2Location Country Blocker < 2.26.9 - Authenticated Stored Cross-Site Scripting	February 7, 2022	2.26.9	Medium
`*-2.26.5`	IP2Location Country Blocker <= 2.26.5 - Arbitrary Country Ban via Cross-Site Request Forgery	January 6, 2022	2.26.6	High
`*-2.26.4`	IP2Location Country Blocker <= 2.26.4 - Subscriber+ Arbitrary Country Ban	January 6, 2022	2.26.5	High
`*-2.26.4`	IP2Location Country Blocker <= 2.26.4 - Ban Bypass	January 6, 2022	2.26.5	Medium

Selected source records

Latest Records

HighCVE-2025-1361

IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

Published: February 21, 2025

Affected versions: *-2.38.8
Patched versions: 2.38.9

Original Wordfence record

MediumCVE-2025-24731

Download IP2Location Country Blocker <= 2.38.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions: *-2.38.3
Patched versions: 2.38.4

Original Wordfence record

MediumCVE-2024-32443

Download IP2Location Country Blocker <= 2.34.2 - Cross-Site Request Forgery

Published: April 12, 2024

Affected versions: *-2.34.2
Patched versions: 2.34.3

Original Wordfence record

MediumCVE-2024-22294

IP2Location Country Blocker <= 2.33.3 - Unauthenticated Sensitive Information Exposure via Debug Log File

Published: January 17, 2024

Affected versions: *-2.33.3
Patched versions: 2.33.4

Original Wordfence record

MediumCVE-2023-37865

Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing

Published: July 10, 2023

Affected versions: *-2.29.1
Patched versions: 2.29.2

Original Wordfence record

Medium

IP2Location Country Blocker < 2.26.9 - Authenticated Stored Cross-Site Scripting

Published: February 7, 2022

Affected versions: [*, 2.26.9)
Patched versions: 2.26.9

Original Wordfence record

MediumCVE-2021-25096

IP2Location Country Blocker <= 2.26.4 - Ban Bypass

Published: January 6, 2022

Affected versions: *-2.26.4
Patched versions: 2.26.5

Original Wordfence record

HighCVE-2021-25095

IP2Location Country Blocker <= 2.26.4 - Subscriber+ Arbitrary Country Ban

Published: January 6, 2022

Affected versions: *-2.26.4
Patched versions: 2.26.5

Original Wordfence record

Highest-Severity Records

HighCVE-2025-1361

IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function

Published: February 21, 2025

Affected versions: *-2.38.8
Patched versions: 2.38.9

Original Wordfence record

HighCVE-2021-25095

IP2Location Country Blocker <= 2.26.4 - Subscriber+ Arbitrary Country Ban

Published: January 6, 2022

Affected versions: *-2.26.4
Patched versions: 2.26.5

Original Wordfence record

HighCVE-2021-25108

IP2Location Country Blocker <= 2.26.5 - Arbitrary Country Ban via Cross-Site Request Forgery

Published: January 6, 2022

Affected versions: *-2.26.5
Patched versions: 2.26.6

Original Wordfence record

MediumCVE-2023-37865

Download IP2Location Country Blocker <= 2.29.1 - Bypass via IP Spoofing

Published: July 10, 2023

Affected versions: *-2.29.1
Patched versions: 2.29.2

Original Wordfence record

Medium

IP2Location Country Blocker < 2.26.9 - Authenticated Stored Cross-Site Scripting

Published: February 7, 2022

Affected versions: [*, 2.26.9)
Patched versions: 2.26.9

Original Wordfence record

MediumCVE-2021-25096

IP2Location Country Blocker <= 2.26.4 - Ban Bypass

Published: January 6, 2022

Affected versions: *-2.26.4
Patched versions: 2.26.5

Original Wordfence record

MediumCVE-2024-22294

IP2Location Country Blocker <= 2.33.3 - Unauthenticated Sensitive Information Exposure via Debug Log File

Published: January 17, 2024

Affected versions: *-2.33.3
Patched versions: 2.33.4

Original Wordfence record

MediumCVE-2025-24731

Download IP2Location Country Blocker <= 2.38.3 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions: *-2.38.3
Patched versions: 2.38.4

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory