WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,601–7,650 of 9,010 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 153 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Todo Custom Field Plugin todo-custom-field Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.0.4 CVE-2024-49642 Patchstack
8.8 High Bstone Demo Importer Plugin bstone-demo-importer Privilege Escalation ≤ 1.0.1 CVE-2024-50481 Patchstack
8.8 High Masteriyo LMS – eLearning and Online Course Builder Plugin learning-management-system Broken Access Control eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation ≤ 1.13.3 CVE-2024-10008 Wordfence
7.5 High NewsCard Plugin newscard Local File Inclusion No login needed ≤ 1.3 Fixed in 1.4 CVE-2024-50434 Patchstack
7.5 High Meta News Plugin meta-news Local File Inclusion No login needed ≤ 1.1.7 Fixed in 1.1.8 CVE-2024-50435 Patchstack
7.5 High Clean Retina Plugin clean-retina Local File Inclusion No login needed ≤ 3.0.6 Fixed in 3.0.7 CVE-2024-50436 Patchstack
7.5 High The Pack Elementor addons Plugin the-pack-addon Local File Inclusion ≤ 2.0.9 Fixed in 2.1.0 CVE-2024-50453 Patchstack
7.5 High Qode Essential Addons Plugin qode-essential-addons Local File Inclusion ≤ 1.6.3 Fixed in 1.6.4 CVE-2024-50457 Patchstack
7.1 High Church Admin Plugin church-admin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.0.0 Fixed in 5.0.0 CVE-2024-50438 Patchstack
7.1 High YITH WooCommerce Product Add-Ons Plugin yith-woocommerce-product-add-ons Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.14.1 Fixed in 4.14.2 CVE-2024-50448 Patchstack
8.5 High Premium SEO Pack Plugin premium-seo-pack SQL Injection ≤ 1.6.001 CVE-2024-50465 Patchstack
8.1 High Advanced Online Ordering and Delivery Platform Plugin advanced-online-ordering-and-delivery-platform Local File Inclusion No login needed ≤ 2.0.0 CVE-2024-50497 Patchstack
8.8 High Token Login Plugin token-login Authentication Bypass Broken Authentication ≤ 1.0.3 CVE-2024-50488 Patchstack
8.8 High Namaste! LMS Plugin namaste-lms PHP Object Injection ≤ 2.6.3 Fixed in 2.6.4 CVE-2024-50408 Patchstack
8.8 High WPC Shop as a Customer for WooCommerce Plugin wpc-shop-as-customer PHP Object Injection ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-50416 Patchstack
7.3 High MDTF Plugin wp-meta-data-filter-and-taxonomy-filter Remote Code Execution Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability No login needed ≤ 1.3.3.4 Fixed in 1.3.3.5 CVE-2024-50450 Patchstack
8.3 High ScottCart Plugin scottcart Remote Code Execution No login needed ≤ 1.1 CVE-2024-50492 Patchstack
7.2 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Remote Code Execution Authenticated (Administrator+) Arbitrary PHP Code Injection ≤ 7.86 CVE-2024-9162 Wordfence
7.5 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation ≤ 1.35.1 CVE-2024-10402 Wordfence
7.3 High Uix Shortcodes – Compatible with Gutenberg Plugin uix-shortcodes Arbitrary Shortcode Execution Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.9.9 CVE-2024-9772 Wordfence
7.2 High WordPress Post Grid Layouts with Pagination – Sogrid Plugin sogrid Local File Inclusion Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion ≤ 1.5.6 CVE-2024-8392 Wordfence
8.8 High School Management System – WPSchoolPress Plugin wpschoolpress Broken Access Control WPSchoolPress <= 2.2.10 - Insecure Direct Object Reference to Authenticated (Teacher+) Account Takeover/Privilege Escalation ≤ 2.2.10 CVE-2024-9637 Wordfence
8.8 High User Toolkit Plugin user-toolkit Authentication Bypass Authenticated (Subscriber+) Authentication Bypass ≤ 1.2.3 CVE-2024-9890 Wordfence
8.8 High AMP for WP – Accelerated Mobile Pages Plugin accelerated-mobile-pages Cross-Site Request Forgery Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation No login needed ≤ 1.0.99.1 CVE-2024-9598 Wordfence
8.8 High Mapster WP Maps Plugin mapster-wp-maps Broken Access Control Incorrect Authorization to Authenticated (Contributor+) Arbitrary Options Update ≤ 1.5.0 CVE-2024-9235 Wordfence
8.1 High BuddyPress Plugin buddypress Path Traversal Authenticated (Subscriber+) Directory Traversal ≤ 14.1.0 CVE-2024-10011 Wordfence
8.1 High App Builder – Create Native Android & iOS Apps On The Flight Plugin app-builder Privilege Escalation Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP No login needed ≤ 5.3.7 CVE-2024-9302 Wordfence
7.6 High Product Filter by WBW Plugin woo-product-filter SQL Injection ≤ 2.7.0 Fixed in 2.7.1 CVE-2024-49691 Patchstack
7.5 High Qi Blocks Plugin qi-blocks Local File Inclusion ≤ 1.3.2 Fixed in 1.3.3 CVE-2024-49690 Patchstack
7.5 High Mags Plugin mags Local File Inclusion No login needed ≤ 1.1.6 Fixed in 1.1.7 CVE-2024-49701 Patchstack
7.2 High Backup and Staging by WP Time Capsule Plugin wp-time-capsule PHP Object Injection ≤ 1.22.21 Fixed in 1.22.22 CVE-2024-49684 Patchstack
7.7 High 3D Work In Progress Plugin renee-work-in-progress Arbitrary File Deletion ≤ 1.0.3 CVE-2024-49657 Patchstack
8.8 High iBryl Switch User Plugin ibryl-switch-user Privilege Escalation Account Takeover ≤ 1.0.1 CVE-2024-49675 Patchstack
8.1 High ProfilePress - Pro Plugin Authentication Bypass Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 4.11.1 CVE-2024-9947 Wordfence
7.2 High WooCommerce Order Proposal Plugin Privilege Escalation Authenticated (Shop Manager+) Privilege Escalation via Order Proposal ≤ 2.0.5 CVE-2024-9927 Wordfence
8.6 High TeploBot - Telegram Bot for WP Plugin green-wp-telegram-bot-by-teplitsa Information Disclosure Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure No login needed ≤ 1.3 CVE-2024-9627 Wordfence
8.8 High Rover IDX Plugin rover-idx Authentication Bypass Authenticated (Subscriber+) Authentication Bypass to Administrator ≤ 3.0.0.2905 CVE-2024-10002 Wordfence
7.6 High FunnelKit Automations Plugin wp-marketing-automations SQL Injection ≤ 3.1.2 Fixed in 3.2.0 CVE-2024-47328 Patchstack
7.2 High TS Poll – Survey, Versus Poll, Image Poll, Video Poll Plugin poll-wp SQL Injection Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injection < 2.4.0 Fixed in 2.4.0 CVE-2024-8625 WPScan
7.1 High GoogleDrive folder list Plugin googledrive-folder-list Cross-Site Request Forgery CSRF to Stored Cross Site Scripting (XSS) No login needed ≤ 2.2.2 CVE-2024-49335 Patchstack
7.1 High AVChat Video Chat Plugin avchat-3 Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 2.2 CVE-2024-49605 Patchstack
7.1 High Endless Posts Navigation Plugin endless-posts-navigation Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 2.2.7 Fixed in 2.2.8 CVE-2024-49629 Patchstack
8.5 High MPG Plugin multiple-pages-generator-by-porthas SQL Injection MPG plugin <= 3.4.7 - SQL Injection ≤ 3.4.7 Fixed in 3.4.8 CVE-2024-47325 Patchstack
8.5 High Author Discussion Plugin author-discussion SQL Injection ≤ 0.2.2 CVE-2024-49609 Patchstack
8.5 High SW Contact Form Plugin sw-contact-form SQL Injection ≤ 1.0 CVE-2024-49612 Patchstack
8.5 High Simple Code Insert Shortcode Plugin simple-code-insert-shortcode SQL Injection ≤ 1.0 CVE-2024-49613 Patchstack
8.5 High SermonAudio Widgets Plugin sermonaudio-widgets SQL Injection ≤ 1.9.3 CVE-2024-49614 Patchstack
8.2 High SafetyForms Plugin safetymails-forms Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 1.0.0 CVE-2024-49615 Patchstack
8.5 High Rate Own Post Plugin rate-own-post SQL Injection ≤ 1.0 CVE-2024-49616 Patchstack
8.2 High Back Link Tracker Plugin back-link-tracker Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 1.0.0 CVE-2024-49617 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only