WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,101–7,150 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 143 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Cross-Site Scripting ≤ 1.4.16 Fixed in 1.4.17 CVE-2024-43292 Patchstack
6.5 Medium Bold Timeline Lite Plugin bold-timeline-lite Cross-Site Scripting ≤ 1.2.0 Fixed in 1.2.1 CVE-2024-43294 Patchstack
6.5 Medium Custom Layouts – Post + Product grids made easy Plugin custom-layouts Cross-Site Scripting Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) ≤ 1.4.11 Fixed in 1.4.12 CVE-2024-43305 Patchstack
6.5 Medium Structured Content Plugin structured-content Cross-Site Scripting ≤ 1.6.2 Fixed in 1.6.3 CVE-2024-43307 Patchstack
6.5 Medium Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor Plugin gutentor Cross-Site Scripting Gutenberg Blocks – Page Builder for Gutenberg Editor plugin <= 3.3.5 - Cross Site Scripting (XSS) ≤ 3.3.5 Fixed in 3.3.6 CVE-2024-43308 Patchstack
6.5 Medium WP Telegram Widget and Join Link Plugin wptelegram-widget Cross-Site Scripting ≤ 2.1.27 Fixed in 2.1.28 CVE-2024-43309 Patchstack
6.5 Medium e2pdf Plugin e2pdf Cross-Site Scripting Export To Pdf Tool for WordPress plugin <= 1.25.05 - Cross Site Scripting (XSS) ≤ 1.25.05 Fixed in 1.25.11 CVE-2024-43318 Patchstack
6.5 Medium Livemesh Addons for WPBakery Page Builder Plugin addons-for-visual-composer Cross-Site Scripting ≤ 3.9 Fixed in 3.9.1 CVE-2024-43320 Patchstack
6.5 Medium Team Showcase Plugin team Cross-Site Scripting ≤ 1.22.23 Fixed in 1.22.24 CVE-2024-43321 Patchstack
5.9 Medium Clever Addons for Elementor Plugin cafe-lite Cross-Site Scripting ≤ 2.2.0 Fixed in 2.2.1 CVE-2024-43324 Patchstack
6.5 Medium Allegiant Theme allegiant Cross-Site Scripting ≤ 1.2.7 CVE-2024-43329 Patchstack
6.5 Medium Responsive Blocks – WordPress Gutenberg Blocks Plugin responsive-block-editor-addons Cross-Site Scripting WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) ≤ 1.8.8 Fixed in 1.8.9 CVE-2024-43335 Patchstack
5.9 Medium WooCommerce Plugin woocommerce Cross-Site Scripting ≤ 9.1.2 Fixed in 9.1.3 CVE-2024-39666 Patchstack
6.5 Medium Ultimate Store Kit Elementor Addons Plugin ultimate-store-kit Cross-Site Scripting ≤ 1.6.4 Fixed in 2.0.0 CVE-2024-43342 Patchstack
6.5 Medium Icegram Plugin icegram Cross-Site Scripting Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) ≤ 3.1.25 Fixed in 3.1.26 CVE-2024-43344 Patchstack
6.5 Medium Modal Window Plugin modal-window Cross-Site Scripting create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) ≤ 6.0.3 Fixed in 6.0.4 CVE-2024-43346 Patchstack
5.9 Medium Button contact VR Plugin button-contact-vr Cross-Site Scripting ≤ 4.7.3 CVE-2024-43347 Patchstack
6.5 Medium All Bootstrap Blocks Plugin all-bootstrap-blocks Cross-Site Scripting ≤ 1.3.19 Fixed in 1.3.20 CVE-2024-43349 Patchstack
6.5 Medium Bravada Theme bravada Cross-Site Scripting ≤ 1.1.2 CVE-2024-43351 Patchstack
6.5 Medium GivingPress Lite Theme givingpress-lite Cross-Site Scripting ≤ 1.8.6 CVE-2024-43352 Patchstack
6.5 Medium myCred Plugin mycred Cross-Site Scripting ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-43353 Patchstack
6.5 Medium WPSection Plugin wpsection Local File Inclusion Contributor+ Limited Local File Inclusion ≤ 1.3.8 Fixed in 1.3.9 CVE-2024-43165 Patchstack
6.5 Medium Event Manager for WooCommerce Plugin mage-eventpress Local File Inclusion ≤ 4.2.1 Fixed in 4.2.2 CVE-2024-43138 Patchstack
6.5 Medium BetterDocs Plugin betterdocs Local File Inclusion ≤ 3.5.8 Fixed in 3.5.9 CVE-2024-43129 Patchstack
6.5 Medium WooCommerce Product Table Lite Plugin wc-product-table-lite Remote Code Execution Arbitrary Code Execution No login needed ≤ 3.5.1 Fixed in 3.8.6 CVE-2024-43128 Patchstack
6.5 Medium LearnPress Plugin learnpress Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.2.6.8.2 Fixed in 4.2.6.9 CVE-2024-39642 Patchstack
5.3 Medium Send Users Email Plugin send-users-email Information Disclosure Sensitive Data Exposure No login needed ≤ 1.5.1 Fixed in 1.5.2 CVE-2024-38760 Patchstack
5.3 Medium Coming Soon Plugin responsive-coming-soon-page Information Disclosure Responsive Coming Soon & Maintenance Mode plugin <= 1.6.3 - Sensitive Data Exposure No login needed ≤ 1.6.3 CVE-2024-38756 Patchstack
6.5 Medium Zoho Campaigns Plugin zoho-campaigns Cross-Site Scripting ≤ 2.0.8 Fixed in 2.1.0 CVE-2024-38752 Patchstack
5.3 Medium Olive One Click Demo Import Plugin olive-one-click-demo-import Information Disclosure Sensitive Data Exposure No login needed ≤ 1.1.2 CVE-2024-38749 Patchstack
5.3 Medium MBE eShip Plugin mail-boxes-etc Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.2 CVE-2024-38742 Patchstack
5.3 Medium SmartMag Theme smartmag-responsive-retina-wordpress-magazine Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 10.1.0 Fixed in 10.1.0 CVE-2024-37930 Patchstack
5.3 Medium WP2Speed Faster Plugin wp2speed Information Disclosure Optimize PageSpeed Insights Score 90-100 plugin <= 1.0.1 - Sensitive Data Exposure No login needed ≤ 1.0.1 CVE-2024-37924 Patchstack
5.9 Medium Slider by Soliloquy Plugin soliloquy-lite Broken Access Control Broken Access Control to XSS ≤ 2.7.6 Fixed in 2.7.7 CVE-2024-35775 Patchstack
6.5 Medium Card Elements for Elementor Plugin card-elements-for-elementor Cross-Site Scripting ≤ 1.2.2 Fixed in 1.2.3 CVE-2024-43123 Patchstack
6.5 Medium Graphina Plugin graphina-elementor-charts-and-graphs Cross-Site Scripting ≤ 1.8.10 Fixed in 2.0.0 CVE-2024-43124 Patchstack
6.5 Medium WP Table Builder – WordPress Table Plugin wp-table-builder Cross-Site Scripting ≤ 1.4.15 Fixed in 1.5.0 CVE-2024-43125 Patchstack
5.9 Medium Football Pool Plugin football-pool Cross-Site Scripting ≤ 2.11.10 Fixed in 2.12.1 CVE-2024-43130 Patchstack
6.5 Medium Themify Shortcodes Plugin themify-shortcodes Cross-Site Scripting ≤ 2.1.1 Fixed in 2.1.2 CVE-2024-43133 Patchstack
5.9 Medium WappPress Plugin wapppress-builds-android-app-for-website Cross-Site Scripting ≤ 6.0.4 Fixed in 6.0.5 CVE-2024-43137 Patchstack
6.5 Medium Football Pool Plugin football-pool Cross-Site Scripting ≤ 2.11.9 Fixed in 2.11.10 CVE-2024-43139 Patchstack
6.5 Medium Selection Lite Plugin selection-lite Cross-Site Scripting ≤ 1.11 Fixed in 1.12 CVE-2024-43147 Patchstack
5.9 Medium StreamCast Plugin streamcast Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 2.2.3 Fixed in 2.2.4 CVE-2024-43148 Patchstack
6.5 Medium CM Tooltip Glossary Plugin enhanced-tooltipglossary Cross-Site Scripting ≤ 4.3.7 Fixed in 4.3.9 CVE-2024-43149 Patchstack
6.5 Medium Xpro Elementor Addons Plugin xpro-elementor-addons Cross-Site Scripting ≤ 1.4.4.2 Fixed in 1.4.4.3 CVE-2024-43150 Patchstack
6.5 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) ≤ 1.5.9 Fixed in 1.5.10 CVE-2024-43151 Patchstack
5.9 Medium 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin interactive-3d-flipbook-powered-physics-engine Cross-Site Scripting ≤ 1.15.6 Fixed in 1.15.7 CVE-2024-43152 Patchstack
6.5 Medium ComboBlocks Plugin post-grid Cross-Site Scripting ≤ 2.2.86 Fixed in 2.2.87 CVE-2024-43155 Patchstack
5.9 Medium Depicter Slider Plugin depicter Cross-Site Scripting ≤ 3.1.2 Fixed in 3.2.0 CVE-2024-43161 Patchstack
6.5 Medium Blockspare Plugin blockspare Cross-Site Scripting ≤ 3.2.0 Fixed in 3.2.1 CVE-2024-43164 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only