WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,401–7,450 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 149 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium WP Job Portal Plugin wp-job-portal Cross-Site Scripting ≤ 2.1.3 Fixed in 2.1.4 CVE-2024-35760 Patchstack
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting ≤ 4.4.0 Fixed in 4.4.1 CVE-2024-35761 Patchstack
6.5 Medium Serious Slider Plugin cryout-serious-slider Cross-Site Scripting ≤ 1.2.4 Fixed in 1.2.5 CVE-2024-35762 Patchstack
6.5 Medium Excellent Theme excellent Cross-Site Scripting ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-35763 Patchstack
6.5 Medium Church Admin Plugin church-admin Cross-Site Scripting ≤ 4.4.4 Fixed in 4.4.5 CVE-2024-35764 Patchstack
5.9 Medium Page Builder: Live Composer Plugin live-composer-page-builder Cross-Site Scripting ≤ 2.1.22 CVE-2024-35768 Patchstack
5.9 Medium Slideshow SE Plugin slideshow-se Cross-Site Scripting ≤ 2.5.17 CVE-2024-35769 Patchstack
6.5 Medium DImage 360 Plugin dimage-360 Cross-Site Scripting ≤ 2.0 CVE-2024-35774 Patchstack
6.5 Medium Page Builder: Live Composer Plugin live-composer-page-builder Cross-Site Scripting Contributor+ Shortcode Cross Site Scripting (XSS) ≤ 1.5.42 CVE-2024-35779 Patchstack
6.5 Medium Typing Text Plugin typing-text Cross-Site Scripting ≤ 1.2.5 Fixed in 1.2.6 CVE-2024-5058 Patchstack
6.4 Medium Branda – White Label WordPress, Custom Login Page Customizer Plugin branda-white-labeling Cross-Site Scripting White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload ≤ 3.4.17 CVE-2024-5191 Wordfence
6.5 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify SQL Injection BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection ≤ 1.2.5 CVE-2024-4742 Wordfence
5.9 Medium Slider Revolution Plugin Cross-Site Scripting < 6.7.11 Fixed in 6.7.11 CVE-2024-34443 Patchstack
5.4 Medium GamiPress Plugin gamipress Cross-Site Request Forgery CSRF Leading to Settings Change No login needed ≤ 2.5.6 Fixed in 2.5.7 CVE-2023-25697 Patchstack
6.5 Medium Attorney Theme attorney Broken Access Control Unauth. Arbitrary Content Deletion No login needed ≤ 3 CVE-2022-45832 Patchstack
5.4 Medium JupiterX Core Plugin Broken Access Control Multiple Auth. Broken Access Control 3.0.0 – 3.3.0 Fixed in 3.3.5 CVE-2023-38394 Patchstack
5.4 Medium Fusion Builder Plugin Broken Access Control Authenticated Broken Access Control ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39310 Patchstack
5.4 Medium Spectra Plugin ultimate-addons-for-gutenberg Broken Access Control ≤ 2.6.6 Fixed in 2.6.7 CVE-2023-36676 Patchstack
6.5 Medium Schema Pro Plugin Broken Access Control No login needed ≤ 2.7.8 Fixed in 2.7.9 CVE-2023-36683 Patchstack
6.5 Medium Premium Addons PRO Plugin Broken Access Control ≤ 2.9.0 Fixed in 2.9.1 CVE-2023-37869 Patchstack
6.5 Medium WooCommerce Ship to Multiple Addresses Plugin Broken Access Control ≤ 3.8.5 Fixed in 3.8.6 CVE-2023-37872 Patchstack
6.5 Medium AutomateWoo Plugin Broken Access Control No login needed ≤ 5.7.5 Fixed in 5.7.6 CVE-2023-36512 Patchstack
5.4 Medium Elementor Pro Plugin Broken Access Control Auth. Broken Access Control ≤ 3.13.0 Fixed in 3.13.1 CVE-2023-35050 Patchstack
4.3 Medium Avada Theme Broken Access Control Authenticated Broken Access Control ≤ 7.11.1 Fixed in 7.11.2 CVE-2023-39922 Patchstack
5.4 Medium Paid Memberships Pro Plugin Broken Access Control ≤ 1.2.3 Fixed in 1.2.4 CVE-2023-39990 Patchstack
4.3 Medium Elements kit Elementor addons Plugin elementskit-lite Broken Access Control ≤ 2.9.0 Fixed in 2.9.1 CVE-2023-39993 Patchstack
5.4 Medium Astra Bulk Edit Plugin astra-bulk-edit Broken Access Control ≤ 1.2.7 Fixed in 1.2.8 CVE-2023-44148 Patchstack
5.4 Medium Pre-Publish Checklist Plugin pre-publish-checklist Broken Access Control ≤ 1.1.1 Fixed in 1.1.2 CVE-2023-44151 Patchstack
6.5 Medium WooCommerce Checkout Manager Plugin woocommerce-checkout-manager Broken Access Control No login needed ≤ 7.3.0 Fixed in 7.3.1 CVE-2023-47681 Patchstack
4.3 Medium Jetpack Plugin jetpack Broken Access Control Contributor+ Broken Access Control < 12.7 Fixed in 12.7 CVE-2023-47788 Patchstack
6.3 Medium JetElements For Elementor Plugin Broken Access Control ≤ 2.6.13 Fixed in 2.6.13.1 CVE-2023-48761 Patchstack
6.5 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting animation and page builder blocks plugin <= 8.8.9.1 - Cross Site Scripting (XSS) ≤ 8.8.9.1 Fixed in 8.9.4 CVE-2024-35765 Patchstack
4.3 Medium Master Slider Plugin master-slider Cross-Site Request Forgery No login needed ≤ 3.9.10 CVE-2023-50900 Patchstack
6.4 Medium Ultimate Blocks – WordPress Blocks Plugin Cross-Site Scripting WordPress Blocks Plugin <= 3.0.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via metabox ≤ 3.1.0 CVE-2023-6692 Wordfence
5.3 Medium Ibtana - WordPress Website Builder Plugin ibtana-visual-editor Broken Access Control WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update No login needed ≤ 1.2.3.3 CVE-2024-5541 Wordfence
6.5 Medium Scheduling Plugin – Online Booking Plugin calendar-booking Broken Access Control Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection No login needed ≤ 3.5.10 CVE-2024-1634 Wordfence
4.3 Medium ProjectHuddle Client Site Plugin projecthuddle-child-site Broken Access Control ≤ 1.0.34 Fixed in 1.0.35 CVE-2023-51376 Patchstack
5.4 Medium WordPress Jitsi Shortcode Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcode No login needed ≤ 0.1 CVE-2024-3978 WPScan
5.1 Medium WordPress Jitsi Shortcode Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 0.1 CVE-2024-3977 WPScan
5.3 Medium Everest Forms Plugin everest-forms Broken Access Control No login needed ≤ 2.0.3 Fixed in 2.0.3.1 CVE-2023-51377 Patchstack
6.5 Medium WooCommerce Warranty Requests Plugin Broken Access Control No login needed ≤ 2.2.7 Fixed in 2.3.0 CVE-2023-51495 Patchstack
5.3 Medium WooCommerce Warranty Requests Plugin Broken Access Control No login needed ≤ 2.2.7 Fixed in 2.3.0 CVE-2023-51496 Patchstack
5.3 Medium Ninja Tables Plugin ninja-tables Broken Access Control No login needed ≤ 5.0.5 Fixed in 5.0.6 CVE-2024-23504 Patchstack
5.4 Medium WooCommerce Ship to Multiple Addresses Plugin Broken Access Control ≤ 3.8.9 Fixed in 3.8.10 CVE-2023-51497 Patchstack
5.3 Medium Quiz And Survey Master Plugin quiz-master-next Broken Access Control No login needed ≤ 8.1.16 Fixed in 8.1.17 CVE-2023-51507 Patchstack
5.4 Medium Business Directory Plugin business-directory-plugin Broken Access Control Easy Listing Directories for WordPress plugin <= 6.3.9 - Broken Access Control ≤ 6.3.9 Fixed in 6.3.10 CVE-2023-51516 Patchstack
4.3 Medium WooCommerce Easy Duplicate Product Plugin woo-easy-duplicate-product Broken Access Control ≤ 0.3.0.7 Fixed in 0.3.0.8 CVE-2023-51523 Patchstack
6.5 Medium SKU Label Changer For WooCommerce Plugin woo-sku-label-changer Broken Access Control No login needed ≤ 3.0 Fixed in 3.0.1 CVE-2023-29174 Patchstack
5.3 Medium SendPress Newsletters Plugin sendpress Broken Access Control No login needed ≤ 1.23.11.6 CVE-2023-35040 Patchstack
4.3 Medium Fat Rat Collect Plugin fat-rat-collect Broken Access Control ≤ 2.6.7 Fixed in 2.6.8 CVE-2023-35045 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only