WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 601–650 of 675 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 8.6 High | WC Marketplace | Broken Access Control No login needed |
≤ 4.0.25 Fixed in 4.0.26 |
CVE-2024-24703 |
Patchstack | |
| 8.6 High | Checkout Field Editor for WooCommerce (Pro) | Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed |
≤ 3.6.2 Fixed in 3.6.3 |
CVE-2024-35658 |
Patchstack | |
| 7.5 High | Advanced Local Pickup for WooCommerce | Broken Access Control No login needed |
≤ 1.6.2 Fixed in 1.6.3 |
CVE-2024-31283 |
Patchstack | |
| 7.1 High | WC Marketplace | Broken Access Control |
≤ 4.1.3 Fixed in 4.1.4 |
CVE-2024-31304 |
Patchstack | |
| 7.5 High | BizPrint | Broken Access Control No login needed |
≤ 4.3.39 Fixed in 4.5.4 |
CVE-2024-32777 |
Patchstack | |
| 8.8 High | Finale Lite | Broken Access Control Subscriber+ Arbitrary Plugin Installation/Activation |
≤ 2.18.0 Fixed in 2.18.1 |
CVE-2024-30485 |
Patchstack | |
| 7.1 High | New Order Notification for Woocommerce | Broken Access Control |
≤ 2.0.2 |
CVE-2024-31098 |
Patchstack | |
| 7.1 High | Active Products Tables for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0.6.3 Fixed in 1.0.6.4 |
CVE-2024-35730 |
Patchstack | |
| 7.1 High | Auto Coupons for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 3.0.14 Fixed in 3.0.15 |
CVE-2024-35733 |
Patchstack | |
| 8.8 High | XootiX Framework <= Various Plugin Versions | Broken Access Control Missing Authorization to Arbitrary Options Update |
≤ 2.6, ≤ 2.6.1, 2.5, … |
CVE-2024-5324 |
Wordfence | |
| 8.8 High | XforWooCommerce | Local File Inclusion Authenticated Local File Inclusion |
≤ 2.0.2 |
CVE-2024-33628 |
Patchstack | |
| 7.2 High | YITH WooCommerce Ajax Search | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 2.4.0 |
CVE-2024-4455 |
Wordfence | |
| 8.8 High | HUSKY – Products Filter for WooCommerce (formerly WOOF) | Remote Code Execution |
≤ 1.3.5.2 Fixed in 1.3.5.3 |
CVE-2024-32680 |
Patchstack | |
| 8.3 High | Premmerce Permalink Manager for WooCommerce | Local File Inclusion No login needed |
≤ 2.3.10 Fixed in 2.3.11 |
CVE-2024-27971 |
Patchstack | |
| 7.2 High | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | Privilege Escalation |
≤ 4.2.1 Fixed in 4.3.0 |
CVE-2023-51546 |
Patchstack | |
| 7.2 High | EAN for WooCommerce | Privilege Escalation Arbitrary Option Update to Privilege Escalation |
≤ 4.8.9 Fixed in 4.9.0 |
CVE-2024-34370 |
Patchstack | |
| 7.6 High | WooCommerce One Page Checkout | Local File Inclusion |
≤ 2.3.0 Fixed in 2.4.0 |
CVE-2023-35881 |
Patchstack | |
| 8.5 High | Sendinblue for WooCommerce | Path Traversal Arbitrary File Download and Deletion |
≤ 4.0.17 Fixed in 4.0.18 |
CVE-2024-32807 |
Patchstack | |
| 7.2 High | WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting | SQL Injection Authenticated (AccountingManager+) SQL Injection |
≤ 1.13.1 |
CVE-2024-1173 |
Wordfence | |
| 7.2 High | PDF Invoices & Packing Slips for WooCommerce | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 3.8.0 |
CVE-2024-3045 |
Wordfence | |
| 7.2 High | PDF Invoices & Packing Slips for WooCommerce | Server-Side Request Forgery Unauthenticated Server-Side Request Forgery No login needed |
≤ 3.8.0 |
CVE-2024-3047 |
Wordfence | |
| 8.1 High | Customer Email Verification for WooCommerce | Authentication Bypass Email Verification and Authentication Bypass due to Insufficient Randomness No login needed |
≤ 2.7.4 |
CVE-2024-4185 |
Wordfence | |
| 7.5 High | Email Customizer for WooCommerce | Information Disclosure Sensitive Data Exposure No login needed |
≤ 2.6.0 Fixed in 2.6.1 |
CVE-2024-32781 |
Patchstack | |
| 7.6 High | WooCommerce Multilingual & Multicurrency | SQL Injection |
≤ 5.3.3.1 Fixed in 5.3.4 |
CVE-2024-32602 |
Patchstack | |
| 7.2 High | WooCommerce Google Feed Manager | SQL Injection Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting |
≤ 2.4.2 |
CVE-2024-3067 |
Wordfence | |
| 7.6 High | Product Feed on WooCommerce for Google | SQL Injection Auth. SQL Injection (SQLi) |
≤ 3.5.7 |
CVE-2024-32087 |
Patchstack | |
| 8.1 High | WooCommerce Customers Manager | SQL Injection Subscriber+ SQL Injection |
< 29.7 Fixed in 29.7 |
CVE-2024-0399 |
WPScan | |
| 7.5 High | Wholesale For WooCommerce | Broken Access Control Unauthenticated Arbitrary Post/Page No login needed |
≤ 2.3.0 Fixed in 2.3.1 |
CVE-2024-31297 |
Patchstack | |
| 7.2 High | Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | PHP Object Injection Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection |
≤ 2.6.3 |
CVE-2024-3020 |
Wordfence | |
| 7.5 High | WooCommerce Cloak Affiliate Links | Broken Access Control Missing Authorization to Unauthenticated Permalink Modification No login needed |
≤ 1.0.33 |
CVE-2024-1308 |
Wordfence | |
| 7.1 High | ELEX WooCommerce Dynamic Pricing and Discounts | Cross-Site Scripting No login needed |
≤ 2.1.2 Fixed in 2.1.3 |
CVE-2024-31255 |
Patchstack | |
| 7.1 High | Woocommerce Social Media Share Buttons | Cross-Site Request Forgery CSRF to Cross Site Scripting (XSS) No login needed |
≤ 1.3.0 |
CVE-2024-31109 |
Patchstack | |
| 7.2 High | HUSKY – Products Filter Professional for WooCommerce | Local File Inclusion Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion |
≤ 1.3.5.2 |
CVE-2024-3061 |
Wordfence | |
| 7.2 High | WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.13.1 |
CVE-2024-0609 |
Wordfence | |
| 7.1 High | Preview E-mails for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.2.1 Fixed in 2.2.2 |
CVE-2024-27999 |
Patchstack | |
| 8.2 High | PDF Invoices and Packing Slips For WooCommerce | PHP Object Injection |
≤ 1.3.7 Fixed in 1.3.8 |
CVE-2024-30230 |
Patchstack | |
| 7.1 High | BizPrint | Cross-Site Request Forgery CSRF to XSS No login needed |
≤ 4.5.5 Fixed in 4.5.6 |
CVE-2024-29773 |
Patchstack | |
| 7.1 High | Booster for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 7.1.7 Fixed in 7.1.8 |
CVE-2024-29760 |
Patchstack | |
| 7.1 High | Conversios.io | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 6.9.1 Fixed in 7.0.0 |
CVE-2024-29794 |
Patchstack | |
| 7.1 High | Shipping with Venipak for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.19.5 Fixed in 1.19.6 |
CVE-2024-29805 |
Patchstack | |
| 7.1 High | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 4.4.0 Fixed in 4.4.1 |
CVE-2024-22288 |
Patchstack | |
| 7.1 High | Product Feed PRO for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 13.2.5 Fixed in 13.2.6 |
CVE-2024-24800 |
Patchstack | |
| 8.8 High | BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages | PHP Object Injection Authenticated (Subscriber+) PHP Object Injection in get_simple_request |
≤ 3.4.20 |
CVE-2024-2025 |
Wordfence | |
| 7.1 High | YITH WooCommerce Product Add-Ons | Cross-Site Scripting No login needed |
≤ 4.5.0 Fixed in 4.6.0 |
CVE-2024-27994 |
Patchstack | |
| 8.8 High | Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring | Arbitrary File Upload Order notifications, Order management, Lead management, Uptime Monitoring <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload |
≤ 1.2.2 |
CVE-2024-1205 |
Wordfence | |
| 7.1 High | WooThumbs for WooCommerce by Iconic | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 5.5.3 Fixed in 5.5.4 |
CVE-2024-29116 |
Patchstack | |
| 7.1 High | WooCommerce License Manager | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 5.3.1 Fixed in 5.3.2 |
CVE-2024-29121 |
Patchstack | |
| 7.1 High | WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management | Cross-Site Scripting No login needed |
≤ 4.2.9 Fixed in 4.3 |
CVE-2024-27959 |
Patchstack | |
| 8.8 High | HUSKY – Products Filter for WooCommerce Professional | SQL Injection Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injection |
≤ 1.3.5.2 |
CVE-2024-1795 |
Wordfence | |
| 7.5 High | Product Carousel Slider & Grid Ultimate for WooCommerce | PHP Object Injection Authenticated(Contributor+) PHP Object Injection |
≤ 1.9.7 |
CVE-2024-1950 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.