WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,051–7,100 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 142 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Ninja Forms Plugin ninja-forms Cross-Site Request Forgery No login needed ≤ 3.8.6 Fixed in 3.8.7 CVE-2024-39628 Patchstack
4.3 Medium LearnPress Plugin learnpress Cross-Site Request Forgery No login needed ≤ 4.2.6.8.2 Fixed in 4.2.6.9 CVE-2024-39641 Patchstack
5.4 Medium Tutor LMS Plugin tutor Cross-Site Request Forgery No login needed ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-39645 Patchstack
4.3 Medium Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce Plugin sender-net-automated-emails Cross-Site Request Forgery No login needed ≤ 2.6.18 Fixed in 2.6.19 CVE-2024-39657 Patchstack
4.3 Medium Simple Local Avatars Plugin simple-local-avatars Cross-Site Request Forgery No login needed ≤ 2.7.10 Fixed in 2.7.11 CVE-2024-43116 Patchstack
4.3 Medium Hummingbird Plugin hummingbird-performance Cross-Site Request Forgery No login needed ≤ 3.9.1 Fixed in 3.9.2 CVE-2024-43117 Patchstack
4.3 Medium Analytify Plugin wp-analytify Cross-Site Request Forgery CSRF Leading to Optout No login needed ≤ 5.3.1 Fixed in 5.4.0 CVE-2024-43265 Patchstack
4.3 Medium Backup and Restore Plugin wp-backitup Cross-Site Request Forgery No login needed ≤ 1.50 CVE-2024-43269 Patchstack
4.3 Medium Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin mailin Cross-Site Request Forgery No login needed ≤ 3.1.82 Fixed in 3.1.83 CVE-2024-43287 Patchstack
4.3 Medium WP Data Access Plugin wp-data-access Cross-Site Request Forgery No login needed ≤ 5.5.7 Fixed in 5.5.9 CVE-2024-43295 Patchstack
5.4 Medium SpeedyCache Plugin speedycache Cross-Site Request Forgery No login needed ≤ 1.1.8 Fixed in 1.1.9 CVE-2024-43299 Patchstack
4.3 Medium Stripe Payments For WooCommerce by Checkout Plugin checkout-plugins-stripe-woo Cross-Site Request Forgery No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2024-43316 Patchstack
4.3 Medium Dark Mode for WP Dashboard Plugin dark-mode-for-wp-dashboard Cross-Site Request Forgery No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2024-43325 Patchstack
4.3 Medium WP User Manager Plugin wp-user-manager Cross-Site Request Forgery User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) No login needed ≤ 2.9.10 Fixed in 2.9.11 CVE-2024-43336 Patchstack
4.3 Medium Brave Popup Builder Plugin brave-popup-builder Cross-Site Request Forgery No login needed ≤ 0.7.0 Fixed in 0.7.1 CVE-2024-43337 Patchstack
4.3 Medium Advanced Form Integration Plugin advanced-form-integration Cross-Site Request Forgery The Easiest Integration Plugin plugin <= 1.89.4 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.89.4 Fixed in 1.89.6 CVE-2024-43340 Patchstack
5.5 Medium Zephyr Project Manager Plugin zephyr-project-manager Cross-Site Scripting ≤ .3.102 Fixed in 3.3.103 CVE-2024-43915 Patchstack
4.3 Medium oik Plugin oik Arbitrary File Deletion No login needed ≤ 4.12.0 Fixed in 4.12.1 CVE-2024-43356 Patchstack
5.4 Medium WebinarPress Plugin wp-webinarsystem Cross-Site Request Forgery WebinarPress plugin <= 1.33.20 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.33.20 Fixed in 1.33.21 CVE-2024-43339 Patchstack
4.3 Medium Zephyr Project Manager Plugin zephyr-project-manager Broken Access Control Insecure Direct Object References (IDOR) ≤ 3.3.102 Fixed in 3.3.103 CVE-2024-43916 Patchstack
5.3 Medium myCred Plugin mycred Information Disclosure Sensitive Data Exposure No login needed ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-43214 Patchstack
5.3 Medium Shared Files Plugin shared-files Arbitrary File Upload Premium Download Manager & Secure File Sharing with Frontend File Upload plugin <= 1.7.28 - Sensitive Data Exposure No login needed ≤ 1.7.28 Fixed in 1.7.29 CVE-2024-43230 Patchstack
6.5 Medium Bit Form Pro Plugin Information Disclosure Authenticated Sensitive Data Exposure ≤ 2.6.4 CVE-2024-43251 Patchstack
6.5 Medium Leopard - WordPress offload media Plugin Information Disclosure Subscriber+ Sensitive Data Exposure ≤ 2.0.36 CVE-2024-43257 Patchstack
5.3 Medium Store Locator Plus Plugin store-locator-le Information Disclosure Sensitive Data Exposure No login needed ≤ 2311.17.01 CVE-2024-43258 Patchstack
5.3 Medium Order Export for WooCommerce Plugin order-export-and-more-for-woocommerce Information Disclosure Sensitive Data Exposure No login needed ≤ 3.23 Fixed in 3.24 CVE-2024-43259 Patchstack
5.3 Medium Create by Mediavine Plugin mediavine-create Information Disclosure Sensitive Data Exposure No login needed ≤ 1.9.8 Fixed in 1.9.9 CVE-2024-43264 Patchstack
5.3 Medium Contest Gallery Plugin contest-gallery Information Disclosure Unauthenticated Comment UserID And IP address Disclosure No login needed ≤ 23.1.2 Fixed in 23.1.3 CVE-2024-43283 Patchstack
4.3 Medium Flash & HTML5 Video Plugin html5-video-player Information Disclosure Sensitive Data Exposure ≤ 2.5.31 Fixed in 2.5.32 CVE-2024-43319 Patchstack
5.9 Medium WP Testimonial Widget Plugin wp-testimonial-widget Cross-Site Scripting ≤ 3.1 CVE-2024-43967 Patchstack
5.3 Medium WordPress Button Plugin MaxButtons Plugin maxbuttons Information Disclosure Full Path Disclosure No login needed ≤ 9.7.8 CVE-2024-6499 Wordfence
5.3 Medium WP SMS Plugin wp-sms Broken Access Control No login needed ≤ 6.9.3 Fixed in 6.9.4 CVE-2024-43331 Patchstack
5.4 Medium Plugin Notes Plus Plugin plugin-notes-plus Broken Access Control Arbitrary Content Deletion ≤ 1.2.7 Fixed in 1.2.8 CVE-2024-43326 Patchstack
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.1.0 Fixed in 6.0.1.1 CVE-2024-43317 Patchstack
5.3 Medium Void Elementor Post Grid Addon for Elementor Page builder Plugin void-elementor-post-grid-addon-for-elementor-page-builder Local File Inclusion ≤ 2.3 Fixed in 2.4 CVE-2024-43281 Patchstack
4.7 Medium Salon booking system Plugin salon-booking-system Open Redirect No login needed ≤ 10.8.1 Fixed in 10.9 CVE-2024-43280 Patchstack
5.3 Medium Icegram Plugin icegram Authentication Bypass Unauthenticated Unpublished Campaign Viewer No login needed ≤ 3.1.24 Fixed in 3.1.25 CVE-2024-43272 Patchstack
4.7 Medium Easy PayPal Buy Now Button Plugin wp-ecommerce-paypal Open Redirect No login needed ≤ 1.9 Fixed in 1.9.1 CVE-2024-43236 Patchstack
5.3 Medium Sensei LMS Plugin sensei-lms Broken Access Control No login needed ≤ 4.23.1, ≤ 4.23.1.1.23.1 Fixed in 4.24.0 CVE-2024-35686 Patchstack
4.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control Insecure Direct Object Reference (IDOR) ≤ 1.11.4 Fixed in 1.11.5 CVE-2024-43239 Patchstack
5.4 Medium WP Job Portal Plugin wp-job-portal Broken Access Control Insecure Direct Object References (IDOR) ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-43266 Patchstack
4.3 Medium wpForo Forum Plugin wpforo Broken Access Control Insecure Direct Object References (IDOR) ≤ 2.3.4 Fixed in 2.3.5 CVE-2024-43288 Patchstack
5.4 Medium Zephyr Project Manager Plugin zephyr-project-manager Broken Access Control Insecure Direct Object References (IDOR) ≤ 3.3.100 Fixed in 3.3.101 CVE-2024-43322 Patchstack
5.3 Medium Propovoice CRM Plugin propovoice Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.7.6.4 CVE-2024-43350 Patchstack
6.5 Medium Busiprof Theme busiprof Cross-Site Scripting ≤ 2.4.8 CVE-2024-43262 Patchstack
6.5 Medium Visual Composer Starter Theme visual-composer-starter Cross-Site Scripting ≤ 3.3 CVE-2024-43263 Patchstack
6.5 Medium Mega Addons For Elementor Plugin ultimate-addons-for-elementor Cross-Site Scripting ≤ 1.9 CVE-2024-43267 Patchstack
6.5 Medium Meta Field Block Plugin display-a-meta-field-as-block Cross-Site Scripting ≤ 1.2.13 Fixed in 1.2.14 CVE-2024-43278 Patchstack
6.5 Medium WP Travel Gutenberg Blocks Plugin wp-travel-blocks Cross-Site Scripting ≤ 3.5.1 Fixed in 3.6.0 CVE-2024-43284 Patchstack
5.9 Medium Void Contact Form 7 Widget For Elementor Page Builder Plugin cf7-widget-elementor Cross-Site Scripting ≤ 2.4.1 Fixed in 2.4.2 CVE-2024-43291 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only