WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,001–7,050 of 9,010 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 141 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High WP Travel Plugin wp-travel Broken Access Control No login needed ≤ 7.8.0 Fixed in 7.8.1 CVE-2023-47224 Patchstack
8.8 High WooODT Lite Plugin byconsole-woo-order-delivery-time Broken Access Control Arbitrary Site Option Update ≤ 2.4.6 Fixed in 2.4.7 CVE-2023-47179 Patchstack
7.1 High My Shortcodes Plugin my-shortcodes Broken Access Control ≤ 2.3 CVE-2023-46632 Patchstack
7.3 High BetterLinks Plugin betterlinks Broken Access Control No login needed ≤ 1.6.0 Fixed in 1.6.1 CVE-2023-45104 Patchstack
7.1 High Leads CRM Plugin leads-crm Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0.13 CVE-2024-56027 Patchstack
7.1 High Lemonade Social Networks Autoposter Pinterest Plugin lemonade-sna-pinterest-edition Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0 CVE-2024-56028 Patchstack
7.1 High Easy Language Switcher Plugin easy-language-switcher Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0 CVE-2024-56029 Patchstack
7.1 High 10CentMail Plugin 10centmail-subscription-management-and-analytics Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.1.50 CVE-2024-56030 Patchstack
7.1 High FV Descriptions Plugin fv-descriptions Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.4 Fixed in 1.5 CVE-2024-56032 Patchstack
7.1 High FAQs Plugin faqs Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.2 CVE-2024-56033 Patchstack
7.1 High Services updates for customers Plugin service-updates-for-customers Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0 CVE-2024-56034 Patchstack
7.1 High Upload Scanner Plugin upload-scanner Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2 CVE-2024-56035 Patchstack
7.1 High odPhotogallery Plugin od-photogallery-plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.5.3 CVE-2024-56036 Patchstack
7.1 High User Referral Plugin user-referral-free Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 8.0 CVE-2024-56037 Patchstack
7.1 High SendSMS Plugin sendsms Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.9 CVE-2024-56038 Patchstack
7.1 High HTML Forms Plugin html-forms Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-56060 Patchstack
7.1 High WP SuperBackup Plugin indeed-wp-superbackup Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.3 Fixed in 2.4 CVE-2024-56069 Patchstack
7.4 High WP SuperBackup Plugin indeed-wp-superbackup Broken Access Control Multiple Subscriber+ Broken Access Control vulnerabilities ≤ 2.3.3 Fixed in 2.4 CVE-2024-56070 Patchstack
8.8 High EditionGuard for WooCommerce – eBook Sales with DRM Plugin editionguard-for-woocommerce-ebook-sales-with-drm Cross-Site Request Forgery eBook Sales with DRM plugin <= 3.4.2 - CSRF to Privilege Escalation No login needed ≤ 3.4.2 CVE-2024-56207 Patchstack
8.8 High gap-hub-user-role Plugin gap-hub-user-role Cross-Site Request Forgery CSRF to Broken Authentication No login needed ≤ 3.4.1 CVE-2024-56206 Patchstack
8.8 High Sinking Dropdowns Plugin sinking-dropdowns Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 1.25 CVE-2024-56204 Patchstack
8.8 High Wayne Audio Player Plugin wayne-audio-player Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 1.0 CVE-2024-56203 Patchstack
8.8 High RepairBuddy Plugin computer-repair-shop Privilege Escalation Account Takeover ≤ 3.8119 Fixed in 3.8120 CVE-2024-56061 Patchstack
8.5 High VibeBP Plugin vibebp SQL Injection ≤ 1.9.9.5.1 Fixed in 1.9.9.5.1 CVE-2024-56041 Patchstack
7.5 High WP SuperBackup Plugin indeed-wp-superbackup PHP Object Injection Subscriber+ PHP Object Injection ≤ 2.3.3 Fixed in 2.4 CVE-2024-56068 Patchstack
7.5 High WP SuperBackup Plugin indeed-wp-superbackup Broken Access Control Unauthenticated Backup File Download No login needed ≤ 2.3.3 Fixed in 2.4 CVE-2024-56067 Patchstack
7.1 High Kleo Plugin kleo Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.4.4 Fixed in 5.4.4 CVE-2024-56209 Patchstack
7.1 High Userpro Plugin userpro Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.1.9 CVE-2024-56210 Patchstack
7.1 High Gulri Slider Plugin gulri-slider Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.5.8 Fixed in 3.5.9 CVE-2024-56223 Patchstack
7.1 High Royal Elementor Addons Plugin royal-elementor-addons Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.7.1001 Fixed in 1.7.1002 CVE-2024-56226 Patchstack
7.1 High Wishlist for WooCommerce Plugin wish-list-for-woocommerce Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.1.2 Fixed in 3.1.3 CVE-2024-56228 Patchstack
7.1 High KinTPV WooConnect Plugin kintpv-connect Cross-Site Scripting No login needed ≤ 8.129 Fixed in 8.141 CVE-2024-56233 Patchstack
7.1 High WooCommerce PDF Vouchers Plugin woocommerce-pdf-vouchers Cross-Site Scripting PDF Vouchers plugin < 4.9.9 - Cross Site Scripting (XSS) No login needed ≤ 4.9.9 Fixed in 4.9.9 CVE-2024-56265 Patchstack
7.1 High WP Nice Loader Plugin wp-nice-loader Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 0.1.0.4 CVE-2024-56232 Patchstack
8.5 High Userpro Plugin userpro SQL Injection ≤ 5.1.9 CVE-2024-56212 Patchstack
8.8 High Userpro Plugin userpro Broken Access Control Authenticated Arbitrary User Meta Update ≤ 5.1.9 CVE-2024-56211 Patchstack
8.3 High Userpro Plugin userpro Local File Inclusion No login needed ≤ 5.1.9 CVE-2024-56214 Patchstack
7.5 High Dynamic Product Category Grid, Slider for WooCommerce Plugin dynamic-product-categories-design Local File Inclusion ≤ 1.1.3 Fixed in 1.1.4 CVE-2024-56230 Patchstack
7.5 High WP Data Access – App, Table, Form and Chart Builder Plugin wp-data-access SQL Injection App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection No login needed ≤ 5.5.22 CVE-2024-12428 Wordfence
8.8 High WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor Plugin wte-elementor-widgets Local File Inclusion Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor <= 1.3.7 - Authenticated (Contributor+) Local File Inclusion ≤ 1.3.7 CVE-2024-12272 Wordfence
8.8 High PlugVersions – Easily rollback to previous versions of your plugins Plugin Broken Access Control Easily rollback to previous versions of your plugins <= 0.0.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Creation ≤ 0.0.7 CVE-2024-12881 Wordfence
8.8 High ALL In One Custom Login Page Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+)Privilege Escalation ≤ 7.1.1 CVE-2024-12594 Wordfence
8.8 High eCommerce Product Catalog Plugin ecommerce-product-catalog Cross-Site Request Forgery Cross-Site Request Forgery to Password Reset No login needed ≤ 3.3.43 CVE-2024-12771 Wordfence
7.2 High Custom Product Tabs For WooCommerce Plugin wb-custom-product-tabs-for-woocommerce PHP Object Injection Authenticated (Shop Manager+) PHP Object Injection ≤ 1.2.4 CVE-2024-12721 Wordfence
8.8 High SMSA Shipping(official) Plugin smsa-shipping-official Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion ≤ 2.3 CVE-2024-12066 Wordfence
7.3 High kk Star Ratings – Rate Post & Collect User Feedbacks Plugin kk-star-ratings Arbitrary Shortcode Execution Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 5.4.10 CVE-2024-11977 Wordfence
7.3 High Download Manager Plugin download-manager Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 3.3.03 CVE-2024-11740 Wordfence
8.5 High WPLMS Plugin wplms_plugin SQL Injection Subscriber+ SQL Injection ≤ 1.9.9.5.3 Fixed in 1.9.9.5.3 CVE-2024-56047 Patchstack
7.6 High WPLMS Plugin wplms_plugin SQL Injection Instructor+ SQL Injection ≤ 1.9.9.5.3 Fixed in 1.9.9.5.3 CVE-2024-56053 Patchstack
8.8 High WPLMS Plugin wplms_plugin Privilege Escalation Arbitrary Option Update to Privilege Escalation ≤ 1.9.9 Fixed in 1.9.9.1 CVE-2024-56048 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only