Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,323 High 9,483 Medium 18,323 Low 369 Not scored 15

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.

Showing 601–650 of 835 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 13 of 17
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Contact Form, Survey & Form Builder – MightyForms Plugin mightyforms Cross-Site Scripting MightyForms <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.9 CVE-2024-11897 Wordfence
8.8 High Funnelforms Free Plugin funnelforms-free PHP Object Injection Authenticated (Contributor+) PHP Object Injection ≤ 3.7.5.1 CVE-2024-10587 Wordfence
6.1 Medium Campaign Monitor Forms by Optin Cat Plugin campaign-monitor-wp Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.5.7 CVE-2024-11326 Wordfence
5.2 Medium AWeber Forms by Optin Cat Plugin aweber-wp Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.5.7 CVE-2024-11325 Wordfence
4.3 Medium Smart Marketing SMS and Newsletters Forms Plugin smart-marketing-for-wp Broken Access Control ≤ 5.0.4 Fixed in 5.0.5 CVE-2024-53784 Patchstack
4.3 Medium WordPress Contact Forms by Cimatti Plugin contact-forms Cross-Site Request Forgery Cross-Site Request Forgery via process_bulk_action Function No login needed ≤ 1.9.2 CVE-2024-10521 Wordfence
4.8 Medium Everest Forms Plugin everest-forms Cross-Site Scripting Admin+ Stored XSS < 3.0.4.2 Fixed in 3.0.4.2 CVE-2024-10471 WPScan
3.5 Low WPForms Plugin wpforms-lite Cross-Site Scripting Admin+ Stored XSS < 1.9.1.6 Fixed in 1.9.1.6 CVE-2024-7056 WPScan
6.1 Medium Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder Plugin formidable Cross-Site Scripting Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter No login needed ≤ 6.16.1.2 CVE-2024-11188 Wordfence
6.4 Medium HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents Plugin hipaatizer Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.4 CVE-2024-11332 Wordfence
4.8 Medium Formidable Forms Plugin formidable Cross-Site Scripting Admin+ Stored XSS < 6.14.1 Fixed in 6.14.1 CVE-2024-9768 WPScan
6.1 Medium MailChimp Forms by MailMunch Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.2.3 CVE-2024-8726 Wordfence
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) ≤ 3.8.16 Fixed in 3.8.18 CVE-2024-50514 Patchstack
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) ≤ 3.8.16 Fixed in 3.8.18 CVE-2024-50515 Patchstack
6.5 Medium SV Forms Plugin sv-forms Cross-Site Scripting ≤ 2.0.05 CVE-2024-51877 Patchstack
6.5 Medium Mage Front End Forms Plugin mage-forms Cross-Site Scripting ≤ 1.1.4 CVE-2024-52339 Patchstack
6.5 Medium Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera Plugin wp-website-creator Cross-Site Scripting ≤ 4.0 CVE-2024-52347 Patchstack
4.3 Medium EleForms – All In One Form Integration including DB for Elementor Plugin all-contact-form-integration-for-elementor Cross-Site Request Forgery All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request Forgery No login needed ≤ 2.9.9.9 CVE-2024-6628 Wordfence
4.3 Medium WPForms – Easy Form Builder Plugin wpforms-lite Cross-Site Request Forgery Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion No login needed ≤ 1.9.1.6 CVE-2024-10593 Wordfence
6.5 Medium Styler for Ninja Forms Plugin styler-for-ninja-forms-lite Broken Access Control Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license ≤ 3.3.4 CVE-2024-10717 Wordfence
6.1 Medium Constant Contact Forms by MailMunch Plugin constant-contact-forms-by-mailmunch Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.1.2 Fixed in 2.1.3 CVE-2024-9614 Wordfence
10.0 Critical Forms Plugin forms-by-made-it Arbitrary File Upload No login needed ≤ 2.8.0 Fixed in 2.8.1 CVE-2024-51791 Patchstack
7.1 High Forms: 3rd-Party Post Again Plugin forms-3rdparty-post-again Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.3 CVE-2024-51783 Patchstack
9.8 Critical RegistrationMagic – User Registration Plugin with Custom Registration Forms Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery No login needed ≤ 6.0.2.6 Fixed in 6.0.2.7 CVE-2024-10508 Wordfence
5.3 Medium EleForms – All In One Form Integration including DB for Elementor Plugin all-contact-form-integration-for-elementor Broken Access Control All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization No login needed ≤ 2.9.9.9 CVE-2024-6626 Wordfence
5.3 Medium CRM Perks Forms Plugin crm-perks-forms Broken Access Control No login needed ≤ 1.1.5 Fixed in 1.1.6 CVE-2024-37463 Patchstack
6.5 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37510 Patchstack
5.3 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37506 Patchstack
5.3 Medium EleForms Plugin all-contact-form-integration-for-elementor Broken Access Control No login needed ≤ 2.9.9.9 CVE-2024-38748 Patchstack
5.9 Medium MailChimp Subscribe Forms Plugin mailchimp-subscribe-sm Cross-Site Scripting Stored Cross-Site Scripting ≤ 4.0.9.9 CVE-2024-43211 Patchstack
5.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation No login needed ≤ 1.36.0 CVE-2024-9700 Wordfence
7.5 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation ≤ 1.35.1 CVE-2024-10402 Wordfence
6.1 Medium Forms for Mailchimp by Optin Cat – Grow Your MailChimp List Plugin mailchimp-wp Cross-Site Scripting Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting No login needed ≤ 2.5.6 CVE-2024-8870 Wordfence
6.1 Medium FormFacade – WordPress plugin for Google Forms Plugin formfacade Cross-Site Scripting WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting No login needed ≤ 1.3.6 Fixed in 1.3.7 CVE-2024-9613 Wordfence
6.4 Medium File Upload Types by WPForms Plugin file-upload-types Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.4.0 Fixed in 1.5.0 CVE-2024-10016 Wordfence
8.2 High SafetyForms Plugin safetymails-forms Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 1.0.0 CVE-2024-49615 Patchstack
6.1 Medium GetResponse Forms by Optin Cat Plugin getresponse Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.5.7 CVE-2024-8740 Wordfence
8.5 High Zoho CRM Lead Magnet Plugin zoho-crm-forms SQL Injection ≤ 1.7.9.7 Fixed in 1.7.9.8 CVE-2024-49297 Patchstack
7.5 High Contact Forms, Live Support, CRM, Video Messages Plugin live-support-tickets Information Disclosure Sensitive Data Exposure No login needed ≤ 1.10.2 Fixed in 1.11.1 CVE-2024-49235 Patchstack
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation No login needed ≤ 1.35.1 CVE-2024-9351 Wordfence
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation No login needed ≤ 1.35.1 CVE-2024-9352 Wordfence
7.3 High WP Popup Builder – Popup Forms and Marketing Lead Generation Plugin wp-popup-builder Arbitrary Shortcode Execution Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add No login needed ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-9061 Wordfence
7.1 High Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'create_mollie_profile' ≤ 4.3.7 CVE-2023-7294 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_mollie_account_details' ≤ 4.3.7 CVE-2023-7293 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_notice_dismiss' ≤ 4.3.7 CVE-2023-7292 Wordfence
7.1 High Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'create_mollie_account' ≤ 4.3.7 CVE-2023-7291 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_for_verified_profiles' ≤ 4.3.7 CVE-2023-7290 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_sw_save_api_keys' ≤ 4.3.7 CVE-2023-7289 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'update_profile_preference' ≤ 4.3.7 CVE-2023-7288 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'pt_cancel_subscription' ≤ 4.3.7 CVE-2023-7287 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only