WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.
Showing 501–550 of 741 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.5 Medium | Easy Chart Builder | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.3 |
CVE-2025-25077 |
Patchstack | |
| 6.5 Medium | Google Earth Embed | Cross-Site Scripting |
≤ 1.0 |
CVE-2025-25078 |
Patchstack | |
| 7.1 High | RomanCart | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.0.2 |
CVE-2025-23685 |
Patchstack | |
| 6.4 Medium | Stockdio Historical Chart | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.8.18 |
CVE-2024-13349 |
Wordfence | |
| 8.8 High | MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics | Broken Access Control CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update |
≤ 1.5.9 |
CVE-2024-10591 |
Wordfence | |
| 6.4 Medium | Alex Reservations: Smart Restaurant Booking | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.0.5 |
CVE-2024-13380 |
Wordfence | |
| 7.5 High | WooCommerce Wishlist | Information Disclosure Unauthenticated Wishlist Disclosure via download_pdf_file Function No login needed |
≤ 1.8.7 |
CVE-2024-13694 |
Wordfence | |
| 6.5 Medium | WP Smart Tooltip | Cross-Site Scripting |
≤ 1.0.0 |
CVE-2025-23669 |
Patchstack | |
| 4.3 Medium | GoHero Store Customizer for WooCommerce | Broken Access Control Missing Authorization to Unuthenticated Settings Update |
≤ 3.5 Fixed in 4.0 |
CVE-2024-12826 |
Wordfence | |
| 4.3 Medium | Starter Templates | Cross-Site Request Forgery No login needed |
≤ 4.4.9 Fixed in 4.4.10 |
CVE-2025-24568 |
Patchstack | |
| 4.3 Medium | Product Size Charts Plugin for WooCommerce | Broken Access Control |
≤ 2.4.5 Fixed in 2.4.6 |
CVE-2025-23991 |
Patchstack | |
| 6.4 Medium | Precious Metals Charts and Widgets | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-site Scripting |
≤ 1.2.8 |
CVE-2024-13572 |
Wordfence | |
| 7.6 High | Smart Manager | SQL Injection |
≤ 8.52.0 Fixed in 8.53.0 |
CVE-2025-22710 |
Patchstack | |
| 5.4 Medium | WordPress Graphs & Charts | Broken Access Control |
≤ 2.0.8 |
CVE-2025-23961 |
Patchstack | |
| 6.5 Medium | Google Org Chart | Cross-Site Scripting |
≤ 1.0.1 |
CVE-2025-23928 |
Patchstack | |
| 7.1 High | SEOReseller Partner | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.3.15 |
CVE-2025-23805 |
Patchstack | |
| 7.1 High | Theme My Ontraport Smartform | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.2.11 |
CVE-2025-23717 |
Patchstack | |
| 7.1 High | ECT Add to Cart Button | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.4 |
CVE-2025-23471 |
Patchstack | |
| 6.5 Medium | HireHive Job | Cross-Site Scripting |
≤ 2.9.0 |
CVE-2025-22746 |
Patchstack | |
| 7.1 High | Partners | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.2.0 |
CVE-2025-22751 |
Patchstack | |
| 6.4 Medium | WP Smart TV | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.1.8 |
CVE-2024-12818 |
Wordfence | |
| 7.1 High | Smart Agenda | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 4.7 Fixed in 4.8 |
CVE-2025-22506 |
Patchstack | |
| 6.4 Medium | GatorMail SmartForms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.1.0 Fixed in 1.1.1 |
CVE-2024-11386 |
Wordfence | |
| 5.3 Medium | Shopping Cart & eCommerce Store | Broken Access Control Missing Authorization to Order Updates No login needed |
≤ 5.7.8 Fixed in 5.7.9 |
CVE-2024-12712 |
Wordfence | |
| 7.1 High | Opencart Product in WP | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0.1 |
CVE-2025-22335 |
Patchstack | |
| 5.4 Medium | PixelYourSite – Your smart PIXEL (TAG) Manager | Cross-Site Request Forgery No login needed |
≤ 10.0.1.2 Fixed in 10.0.2 |
CVE-2025-22300 |
Patchstack | |
| 6.5 Medium | Smart Custom Fields | Cross-Site Scripting |
≤ 5.0.0 Fixed in 5.0.1 |
CVE-2025-22308 |
Patchstack | |
| 6.1 Medium | SmartEmailing.cz | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 2.2.0 Fixed in 2.2.6 |
CVE-2024-12261 |
Wordfence | |
| 6.5 Medium | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts | SQL Injection Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection |
≤ 2.6.16 Fixed in 2.6.17 |
CVE-2024-12195 |
Wordfence | |
| 6.1 Medium | WP Smart Import : Import any XML File to | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.1.2 |
CVE-2024-12701 |
Wordfence | |
| 5.4 Medium | WoodMart | Broken Access Control |
≤ 7.2.1 Fixed in 7.2.2 |
CVE-2023-32240 |
Patchstack | |
| 6.5 Medium | Smartsupp – live chat, chatbots, AI and lead generation | Cross-Site Request Forgery No login needed |
≤ 3.6 Fixed in 3.7 |
CVE-2024-38790 |
Patchstack | |
| 4.3 Medium | Preschool and Kindergarten | Cross-Site Request Forgery No login needed |
≤ 1.2.1 Fixed in 1.2.2 |
CVE-2024-37413 |
Patchstack | |
| 5.3 Medium | CoCart – Headless ecommerce | Broken Access Control Headless ecommerce plugin <= 3.11.2 - Broken Access Control No login needed |
≤ 3.11.2 Fixed in 3.12.0 |
CVE-2023-47241 |
Patchstack | |
| 4.3 Medium | Smart Manager | Broken Access Control |
≤ 8.45.0 Fixed in 8.46.0 |
CVE-2024-49687 |
Patchstack | |
| 6.5 Medium | Smart Shopify Product | Broken Access Control Arbitrary Content Deletion |
≤ 1.0.2 |
CVE-2024-56031 |
Patchstack | |
| 9.8 Critical | AI Magic | Privilege Escalation SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation No login needed |
≤ 1.0.4 Fixed in 1.0.6 |
CVE-2024-56205 |
Patchstack | |
| 7.5 High | WP Data Access – App, Table, Form and Chart Builder | SQL Injection App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection No login needed |
≤ 5.5.22 Fixed in 5.5.23 |
CVE-2024-12428 |
Wordfence | |
| 6.5 Medium | Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking | SQL Injection Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection |
≤ 2.15.3 Fixed in 2.15.4 |
CVE-2024-12032 |
Wordfence | |
| 6.5 Medium | Booking Calendar WpDevArt | SQL Injection Authenticated (Contributor+) SQL Injection |
≤ 3.2.19 |
CVE-2024-10856 |
Wordfence | |
| 6.4 Medium | WordPress Simple Shopping Cart | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.0.7 Fixed in 5.0.8 |
CVE-2024-12622 |
Wordfence | |
| 6.4 Medium | Particle Background | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.0.2 |
CVE-2024-11775 |
Wordfence | |
| 9.8 Critical | Partners | PHP Object Injection No login needed |
≤ 0.2.0 |
CVE-2024-56059 |
Patchstack | |
| 7.1 High | Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 3.9 |
CVE-2024-54386 |
Patchstack | |
| 7.1 High | WP Flipkart Importer | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.4 |
CVE-2024-54432 |
Patchstack | |
| 6.4 Medium | Smart PopUp Blaster | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.4.3 |
CVE-2024-12458 |
Wordfence | |
| 6.4 Medium | WooCommerce Cart Count Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.0.4 |
CVE-2024-12517 |
Wordfence | |
| 6.5 Medium | Barter | Cross-Site Scripting |
≤ 1.6 Fixed in 1.7 |
CVE-2024-54346 |
Patchstack | |
| 5.4 Medium | Abandoned Cart Lite for WooCommerce | Cross-Site Request Forgery |
≤ 5.16.1 Fixed in 5.16.2 |
CVE-2023-41671 |
Patchstack | |
| 4.3 Medium | Donations Made Easy – Smart Donations | Broken Access Control Smart Donations plugin <= 4.0.12 - Broken Access Control |
≤ 4.0.12 |
CVE-2023-38475 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.