WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,151–7,200 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 144 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Spectra Plugin ultimate-addons-for-gutenberg Cross-Site Scripting ≤ 2.14.1 Fixed in 2.15.1 CVE-2024-7590 Patchstack
6.5 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Cross-Site Scripting ≤ 1.3.9.2 CVE-2024-43210 Patchstack
6.5 Medium Filr Plugin filr-protection Cross-Site Scripting ≤ 1.2.4 Fixed in 1.2.5 CVE-2024-43216 Patchstack
6.5 Medium Mediavine Control Panel Plugin mediavine-control-panel Cross-Site Scripting ≤ 2.10.4 Fixed in 2.10.5 CVE-2024-43218 Patchstack
6.5 Medium YaMaps Plugin yamaps Cross-Site Scripting ≤ 0.6.27 CVE-2024-43224 Patchstack
6.5 Medium Enter Addons Plugin enteraddons Cross-Site Scripting ≤ 2.1.7 CVE-2024-43225 Patchstack
6.5 Medium WP Dashboard Notes Plugin wp-dashboard-notes Cross-Site Scripting ≤ 1.0.11 CVE-2024-43226 Patchstack
6.5 Medium BetterDocs Plugin betterdocs Cross-Site Scripting Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin <= 3.5.8 - Cross Site Scripting (XSS) ≤ 3.5.8 Fixed in 3.5.9 CVE-2024-43227 Patchstack
6.5 Medium Tutor LMS Plugin tutor Cross-Site Scripting ≤ 2.7.3 Fixed in 2.7.4 CVE-2024-43231 Patchstack
6.4 Medium Lightbox & Modal Popup WordPress Plugin – FooBox Plugin foobox-image-lightbox Cross-Site Scripting FooBox <= 2.7.28 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes ≤ 2.7.28 CVE-2024-5668 Wordfence
5.4 Medium Falang multilanguage Plugin falang Broken Access Control Missing Authorization to Translation Update and Information Exposure ≤ 1.3.52 CVE-2024-6869 Wordfence
6.1 Medium WordPress File Upload Plugin Arbitrary File Upload Unauthenticated Stored XSS No login needed < 4.24.8 Fixed in 4.24.8 CVE-2024-6494 WPScan
6.1 Medium WordPress File Upload Plugin Arbitrary File Upload Reflected XSS No login needed < 4.24.8 Fixed in 4.24.8 CVE-2024-6651 WPScan
5.4 Medium Cooked Plugin cooked Cross-Site Scripting WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode < 1.8.1 CVE-2024-41816 GitHub_M
4.3 Medium TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder Plugin templatespare Broken Access Control TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update ≤ 2.4.2 CVE-2024-6872 Wordfence
5.9 Medium Pretty Simple Popup Builder Plugin pretty-simple-popup-builder Cross-Site Scripting ≤ 1.0.9 Fixed in 1.0.10 CVE-2024-39626 Patchstack
5.9 Medium NextGEN Gallery Plugin nextgen-gallery Cross-Site Scripting NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) ≤ 3.59.3 Fixed in 3.59.4 CVE-2024-39627 Patchstack
5.9 Medium Himalayas Theme himalayas Cross-Site Scripting ≤ 1.3.2 CVE-2024-39629 Patchstack
5.8 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.0.1 Fixed in 6.0.0.2 CVE-2024-39643 Patchstack
6.5 Medium Black Widgets For Elementor Plugin black-widgets Cross-Site Scripting ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-39644 Patchstack
5.9 Medium Eventin Plugin wp-event-solution Cross-Site Scripting ≤ 4.0.5 Fixed in 4.0.6 CVE-2024-39648 Patchstack
6.5 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting ≤ 5.9.26 Fixed in 5.9.27 CVE-2024-39649 Patchstack
6.5 Medium LiquidPoll – Advanced Polls for Creators and Brands Plugin wp-poll Cross-Site Scripting Unauthenticated Cross Site Scripting (XSS) No login needed ≤ 3.3.77 Fixed in 3.3.78 CVE-2024-39655 Patchstack
6.5 Medium WP-PostRatings Plugin wp-postratings Cross-Site Scripting ≤ 1.91.1 Fixed in 1.91.2 CVE-2024-39659 Patchstack
5.9 Medium Photo Engine Plugin wplr-sync Cross-Site Scripting ≤ 6.3.1 Fixed in 6.3.2 CVE-2024-39660 Patchstack
6.5 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Authenticated Cross Site Scripting (XSS) ≤ 2.2.4 Fixed in 2.2.5 CVE-2024-39661 Patchstack
6.5 Medium Black Widgets For Elementor Plugin black-widgets Cross-Site Scripting ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-39662 Patchstack
6.5 Medium Filter & Grids Plugin ymc-smart-filter Cross-Site Scripting ≤ 2.9.2 Fixed in 2.9.3 CVE-2024-39665 Patchstack
6.5 Medium Element Pack Elementor Addons Plugin bdthemes-element-pack-lite Cross-Site Scripting ≤ 5.6.11 Fixed in 5.6.12 CVE-2024-39667 Patchstack
6.5 Medium Extensions for Elementor Plugin extensions-for-elementor Cross-Site Scripting ≤ 2.0.31 Fixed in 2.0.32 CVE-2024-39668 Patchstack
5.4 Medium Edubin Plugin edubin Server-Side Request Forgery No login needed ≤ 9.2.0 CVE-2024-39637 Patchstack
4.3 Medium The Pack Elementor addons Plugin the-pack-addon Local File Inclusion ≤ 2.0.8.6 Fixed in 2.0.8.7 CVE-2024-38768 Patchstack
6.5 Medium JetWidgets for Elementor and WooCommerce Plugin jetwoo-widgets-for-elementor Local File Inclusion Contributor+ Limited Local File Inclusion ≤ 1.1.7 Fixed in 1.1.8 CVE-2024-38772 Patchstack
4.9 Medium AI Engine: ChatGPT Chatbot Plugin ai-engine Server-Side Request Forgery ≤ 2.4.7 Fixed in 2.4.8 CVE-2024-38791 Patchstack
5.5 Medium Timetable and Event Schedule Plugin mp-timetable PHP Object Injection ≤ 2.4.13 CVE-2024-39630 Patchstack
6.4 Medium Element Pack - Addon for Elementor Page Builder Plugin Cross-Site Scripting Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL ≤ 7.9.0 CVE-2024-2455 Wordfence
6.5 Medium HTML Forms – Simple WordPress Forms Plugin Cross-Site Request Forgery Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF No login needed < 1.3.34 Fixed in 1.3.34 CVE-2024-6412 WPScan
5.3 Medium Campaign Monitor Plugin forms-for-campaign-monitor Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 2.8.15 CVE-2024-6569 Wordfence
5.8 Medium Ultimate WordPress Auction Plugin ultimate-auction Broken Access Control Missing Authorization to Unauthenticated Email Creation No login needed ≤ 4.2.7 CVE-2024-6591 Wordfence
4.3 Medium FunnelKit – Funnel Builder for WooCommerce Checkout Plugin funnel-builder Broken Access Control Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update ≤ 3.4.6 CVE-2024-6836 Wordfence
5.4 Medium Search & Replace Plugin search-and-replace PHP Object Injection Deserialization of untrusted data No login needed ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-38759 Patchstack
6.4 Medium JSON Content Importer Plugin json-content-importer Server-Side Request Forgery JSON Content Importer plugin <= 1.5.6 - Server Side Request Forgery (SSRF) ≤ 1.5.6 Fixed in 1.6.0 CVE-2024-38723 Patchstack
4.9 Medium Magical Addons For Elementor Plugin magical-addons-for-elementor Server-Side Request Forgery ≤ 1.1.41 Fixed in 1.1.42 CVE-2024-38730 Patchstack
4.3 Medium Academy LMS Plugin academy Broken Access Control ≤ 2.0.4 Fixed in 2.0.5 CVE-2024-38701 Patchstack
6.5 Medium Elementor – Header, Footer & Blocks Template Plugin header-footer-elementor Cross-Site Scripting Contributor+ DOM-Based Cross Site Scripting (XSS) ≤ 1.6.35 Fixed in 1.6.36 CVE-2024-33933 Patchstack
6.5 Medium Elegant Themes Icons Plugin elegant-themes-icons Cross-Site Scripting ≤ 1.3 CVE-2024-37100 Patchstack
6.5 Medium WP Post Author Plugin wp-post-author Cross-Site Scripting ≤ 3.6.7 Fixed in 3.6.8 CVE-2024-37101 Patchstack
6.5 Medium My Favorites Plugin my-favorites Cross-Site Scripting ≤ 1.4.3 Fixed in 1.4.4 CVE-2024-37114 Patchstack
6.5 Medium Sinatra Theme sinatra Cross-Site Scripting ≤ 1.3 CVE-2024-37116 Patchstack
5.9 Medium Tabs Plugin vc-tabs Cross-Site Scripting ≤ 4.0.6 CVE-2024-37120 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only