WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 5,851–5,900 of 6,499 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 118 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High WooCommerce PDF Vouchers Plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed < 4.9.5 Fixed in 4.9.5 CVE-2024-39652 Patchstack
7.1 High Tin Canny Reporting for LearnDash Plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.3.0.7 Fixed in 4.3.0.8 CVE-2024-39656 Patchstack
7.1 High WP Fast Total Search Plugin fulltext-search Cross-Site Scripting No login needed ≤ 1.68.232 Fixed in 1.69.234 CVE-2024-39663 Patchstack
7.5 High Zephyr Project Manager Plugin zephyr-project-manager Information Disclosure Sensitive Data Exposure via Export File No login needed ≤ 3.3.99 Fixed in 3.3.100 CVE-2024-38761 Patchstack
8.3 High Better Find and Replace Plugin real-time-auto-find-and-replace PHP Object Injection No login needed ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-39636 Patchstack
8.0 High WPForms User Registration Plugin Privilege Escalation Authenticated Privilege Escalation ≤ 2.1.0 Fixed in 2.1.2 CVE-2023-52209 Patchstack
7.1 High MakeStories (for Google Web Stories) Plugin makestories-helper Path Traversal Arbitrary File Download and SSRF ≤ 3.0.3 Fixed in 3.0.4 CVE-2024-38746 Patchstack
7.2 High CTX Feed Plugin webappick-product-feed-for-woocommerce Privilege Escalation Arbitrary Options Update ≤ 6.5.6 Fixed in 6.5.7 CVE-2024-38775 Patchstack
8.0 High ListingPro Plugin listingpro-plugin Local File Inclusion ≤ 2.9.4 Fixed in 2.9.5 CVE-2024-39621 Patchstack
8.5 High ListingPro Theme listingpro Local File Inclusion ≤ 2.9.4 Fixed in 2.9.5 CVE-2024-39624 Patchstack
8.8 High PowerPack for Beaver Builder Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.33.0 Fixed in 2.33.1 CVE-2024-39633 Patchstack
8.8 High PowerPack Pro for Elementor Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.10.14 Fixed in 2.10.15 CVE-2024-39634 Patchstack
7.2 High Lifetime free Drag & Drop Contact Form Builder for WordPress VForm Plugin v-form Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 2.1.5 CVE-2024-6770 Wordfence
7.2 High BerqWP Plugin searchpro Server-Side Request Forgery Unauthenticated Non-Blind Server Side Request Forgery (SSRF) No login needed ≤ 1.7.5 Fixed in 1.7.6 CVE-2024-37942 Patchstack
7.1 High Seraphinite Post .DOCX Source Plugin seraphinite-post-docx-source Server-Side Request Forgery No login needed ≤ 2.16.9 Fixed in 2.16.10 CVE-2024-38728 Patchstack
7.6 High Spiffy Calendar Plugin spiffy-calendar SQL Injection ≤ 4.9.11 Fixed in 4.9.12 CVE-2024-38692 Patchstack
8.5 High Barcode Scanner with Inventory & Order Manager Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders SQL Injection ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-38708 Patchstack
8.5 High DirectoryPress Plugin directorypress SQL Injection ≤ 3.6.10 CVE-2024-38755 Patchstack
7.6 High UiPress lite Plugin uipress-lite SQL Injection ≤ 3.4.06 Fixed in 3.4.07 CVE-2024-38788 Patchstack
7.1 High Shortcodes by United Themes Plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed < 5.0.5 Fixed in 5.0.5 CVE-2024-37097 Patchstack
7.1 High Uncanny Automator Pro Plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.3 Fixed in 5.3.0.1 CVE-2024-37117 Patchstack
7.1 High Enfold Theme Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.6.9 Fixed in 5.6.10 CVE-2024-37199 Patchstack
7.1 High Demo Awesome Plugin demo-awesome Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.1 Fixed in 1.0.2 CVE-2024-37206 Patchstack
7.1 High Ali2Woo Lite Plugin ali2woo-lite Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.3.5 Fixed in 3.3.7 CVE-2024-37211 Patchstack
7.1 High All In One Redirection Plugin all-in-one-redirection Cross-Site Scripting No login needed ≤ 2.2.0 CVE-2024-37245 Patchstack
7.1 High Permalink Manager Lite Plugin permalink-manager Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.4.3.3 Fixed in 2.4.3.4 CVE-2024-37257 Patchstack
7.1 High Social Rocket Plugin social-rocket Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.3 Fixed in 1.3.4 CVE-2024-37258 Patchstack
7.1 High The Ultimate WordPress Toolkit – WP Extended Plugin wpextended Cross-Site Scripting No login needed ≤ 2.4.7 Fixed in 3.0.0 CVE-2024-37259 Patchstack
7.1 High WP-Lister Lite for Amazon Plugin wp-lister-for-amazon Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.6.16 Fixed in 2.6.17 CVE-2024-37261 Patchstack
7.1 High Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.4.2 Fixed in 4.4.3 CVE-2024-37262 Patchstack
7.1 High Groundhogg Plugin groundhogg Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.4.2.3 Fixed in 3.4.3 CVE-2024-37264 Patchstack
7.1 High Striking Theme striking-r Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.4 Fixed in 2.3.5 CVE-2024-37267 Patchstack
7.1 High NextScripts Plugin social-networks-auto-poster-facebook-twitter-g Cross-Site Scripting No login needed ≤ 4.4.7 CVE-2024-37275 Patchstack
7.1 High WP Photo Album Plus Plugin wp-photo-album-plus Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 8.8.00.002 Fixed in 8.8.00.003 CVE-2024-37416 Patchstack
7.1 High Mailster Plugin mailster Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.0.9 Fixed in 4.0.10 CVE-2024-37433 Patchstack
7.1 High Uncanny Toolkit Pro for LearnDash Plugin uncanny-toolkit-pro Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed < 4.1.4.1 Fixed in 4.1.4.1 CVE-2024-37436 Patchstack
7.1 High PayPlus Payment Gateway Plugin payplus-payment-gateway Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 6.6.8 Fixed in 6.6.9 CVE-2024-37459 Patchstack
7.1 High IdeaPush Plugin ideapush Cross-Site Scripting No login needed ≤ 8.65 Fixed in 8.66 CVE-2024-37461 Patchstack
7.1 High bbPress Notify Plugin bbpress-notify-nospam Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.18.3 Fixed in 2.18.4 CVE-2024-37485 Patchstack
7.1 High CopySafe Web Protection Plugin wp-copysafe-web Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.15 Fixed in 4.0 CVE-2024-38781 Patchstack
7.1 High WP Directory Kit Plugin wpdirectorykit Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-37487 Patchstack
7.1 High MakeCommerce for WooCommerce Plugin makecommerce Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.5.1 Fixed in 3.5.2 CVE-2024-37509 Patchstack
7.1 High Counterpoint Theme counterpoint Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.8.1 CVE-2024-37559 Patchstack
7.1 High ARForms Form Builder Plugin arforms-form-builder Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.7 Fixed in 1.6.8 CVE-2024-37920 Patchstack
7.1 High MBE eShip Plugin mail-boxes-etc Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.1.2 CVE-2024-37953 Patchstack
7.1 High Simple Responsive Slider Plugin simple-responsive-slider Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.2.2.5 CVE-2024-37954 Patchstack
7.1 High codoc Plugin codoc Cross-Site Scripting No login needed ≤ 0.9.51.12 Fixed in 0.9.52 CVE-2024-37961 Patchstack
7.1 High WooCommerce Predictive Search Plugin woocommerce-predictive-search Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 6.0.1 CVE-2024-38669 Patchstack
7.1 High AdPush Plugin adsense-plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.50 CVE-2024-38672 Patchstack
7.1 High Multisite Content Copier/Updater Plugin wp-multisite-content-copier Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.5.0 CVE-2024-38673 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only