WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 501–550 of 569 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 11 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Plugin bdthemes-element-pack-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events ≤ 5.6.11 CVE-2024-3925 Wordfence
6.4 Medium Events Addon for Elementor Plugin events-addon-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.1.4 CVE-2024-4669 Wordfence
5.3 Medium Tickera Plugin tickera-event-ticketing-system Broken Access Control No login needed ≤ 3.5.2.6 Fixed in 3.5.2.7 CVE-2024-35729 Patchstack
8.2 High EventPrime Plugin eventprime-event-calendar-management Price Manipulation Booking Price Manipulation No login needed ≤ 3.3.4 Fixed in 3.3.5 CVE-2024-31275 Patchstack
4.3 Medium Events Manager Plugin events-manager Broken Access Control ≤ 6.4.6.4 Fixed in 6.4.7 CVE-2024-30515 Patchstack
6.5 Medium Event Theme event Cross-Site Scripting ≤ 1.2.2 Fixed in 1.2.3 CVE-2024-35711 Patchstack
7.1 High Event Tickets with Ticket Scanner Plugin event-tickets-with-ticket-scanner Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2024-35652 Patchstack
9.1 Critical The Events Calendar Plugin the-events-calendar Cross-Site Scripting Reflected XSS No login needed < 6.4.0.1 Fixed in 6.4.0.1 CVE-2024-4180 WPScan
4.3 Medium CP Multi View Event Calendar Plugin cp-multi-view-calendar Broken Access Control Missing Authorization Leading To Feedback Submission ≤ 1.4.10 Fixed in 1.4.11 CVE-2023-28492 Patchstack
3.7 Low Event Espresso 4 Decaf Plugin event-espresso-decaf Broken Access Control Bypass No login needed ≤ 4.10.44.decaf Fixed in 4.10.45.decaf CVE-2023-27437 Patchstack
4.3 Medium Shield Security – Smart Bot Blocking & Intrusion Prevention Security Plugin wp-simple-firewall Cross-Site Request Forgery Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery No login needed ≤ 19.1.10 CVE-2024-4344 Wordfence
4.3 Medium Event post Plugin event-post Broken Access Control Missing Authorization ≤ 5.9.4 CVE-2024-1376 Wordfence
7.1 High Events Rich Snippets for Google Plugin rich-snippets-vevents Cross-Site Request Forgery CSRF Leading to Privilege Escalation No login needed ≤ 1.8 CVE-2023-44478 Patchstack
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Information Disclosure Sensitive Data Exposure No login needed ≤ 2.8.6 Fixed in 3.0.0 CVE-2023-33321 Patchstack
6.4 Medium Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget ≤ 3.10.7 CVE-2024-4391 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' ≤ 5.9.19 CVE-2024-4448 Wordfence
3.8 Low EasyEvent Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.0.0 CVE-2024-3628 WPScan
7.5 High MF Gig Calendar Plugin Cross-Site Request Forgery Arbitrary Event Deletion via CSRF No login needed ≤ 1.2.1 CVE-2024-3756 WPScan
5.9 Medium EventON Plugin eventon-lite Cross-Site Scripting ≤ 2.2.14 CVE-2024-33940 Patchstack
7.5 High Event Monster Plugin event-monster PHP Object Injection Authenticated(Contributor+) PHP Object Injection via Custom Meta ≤ 1.3.9 CVE-2024-1895 Wordfence
9.9 Critical Timetable and Event Schedule by MotoPress Plugin mp-timetable SQL Injection Authenticated (Contributor+) SQL Injection ≤ 2.4.11 CVE-2024-3342 Wordfence
5.3 Medium Tickera Plugin tickera-event-ticketing-system Broken Access Control Ticket leakage through IDOR No login needed < 3.5.2.5 Fixed in 3.5.2.5 CVE-2023-7252 WPScan
4.3 Medium The Events Calendar Plugin the-events-calendar Cross-Site Request Forgery No login needed ≤ 6.3.0 Fixed in 6.3.1 CVE-2024-31433 Patchstack
4.3 Medium Church Content – Sermons, Events and More Plugin church-theme-content Cross-Site Request Forgery No login needed ≤ 2.6 Fixed in 2.6.1 CVE-2024-32094 Patchstack
7.1 High WP Google Analytics Events Plugin wp-google-analytics-events Cross-Site Scripting No-Code Custom Event Tracking for Google Analytics plugin <= 2.8.0 - Reflected Cross-Site Scripting No login needed ≤ 2.8.0 Fixed in 2.8.1 CVE-2024-32145 Patchstack
4.3 Medium WP Event Aggregator Plugin wp-event-aggregator Cross-Site Request Forgery No login needed ≤ 1.7.6 Fixed in 1.7.7 CVE-2024-31371 Patchstack
4.3 Medium Event Tickets and Registration Plugin event-tickets Information Disclosure Improper Authorization to Information Disclosure ≤ 5.8.2 CVE-2024-2261 Wordfence
5.9 Medium Themify Event Post Plugin themify-event-post Cross-Site Scripting ≤ 1.2.7 Fixed in 1.2.8 CVE-2024-30440 Patchstack
4.3 Medium Events Manager Plugin events-manager Cross-Site Request Forgery No login needed ≤ 6.4.7.1 Fixed in 6.4.7.2 CVE-2024-30421 Patchstack
4.3 Medium Events Manager Plugin events-manager Cross-Site Request Forgery No login needed ≤ 6.4.7.1 CVE-2024-2110 Wordfence
6.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.4.7.1 CVE-2024-2111 Wordfence
5.9 Medium EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting ≤ 3.3.9 Fixed in 3.4.0 CVE-2024-29776 Patchstack
8.2 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control No login needed ≤ 3.3.9 Fixed in 3.4.0 CVE-2024-24832 Patchstack
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval ≤ 3.4.2 CVE-2024-1126 Wordfence
5.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Price Manipulation Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass No login needed ≤ 3.4.2 CVE-2024-1321 Wordfence
4.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated(Administator+) Stored Cross-Site Scripting via settings ≤ 6.4.6.4 CVE-2024-0614 Wordfence
6.1 Medium WP Event Manager Plugin wp-event-manager Cross-Site Scripting Reflected Cross-Site Scripting via plugin No login needed ≤ 3.1.41 CVE-2024-0976 Wordfence
6.1 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 1.0.98 - Reflected Cross-Site Scripting No login needed ≤ 1.0.98 CVE-2024-1484 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export ≤ 3.4.1 CVE-2024-1127 Wordfence
7.4 High Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar ≤ 5.9.9 CVE-2024-1536 Wordfence
5.4 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion ≤ 3.4.3 CVE-2024-1125 Wordfence
6.5 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Cross-Site Scripting Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 3.4.3 CVE-2024-1320 Wordfence
6.5 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite ≤ 3.4.2 CVE-2024-1123 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending ≤ 3.4.3 CVE-2024-1124 Wordfence
5.3 Medium SportsPress – Sports Club & League Manager Plugin sportspress Broken Access Control Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update No login needed ≤ 2.7.17 CVE-2024-1178 Wordfence
4.3 Medium Event Tickets Plus Plugin Information Disclosure Contributor+ Attendees Lists Disclosure < 5.9.1 Fixed in 5.9.1 CVE-2024-1319 WPScan
6.5 Medium Event Tickets and Registration Plugin event-tickets Broken Access Control Contributor+ Arbitrary Events Access < 5.8.1, < 5.9.1 Fixed in 5.8.1 CVE-2024-1316 WPScan
4.3 Medium Event Tickets and Registration Plugin event-tickets Broken Access Control Missing Authorization ≤ 5.8.1 CVE-2024-1053 Wordfence
8.2 High Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – Plugin mage-eventpress PHP Object Injection WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection ≤ 4.1.1 Fixed in 4.1.2 CVE-2024-24796 Patchstack
5.3 Medium Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin Plugin wp-event-solution Broken Access Control Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export No login needed ≤ 3.3.50 CVE-2024-1122 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only