WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,651–7,700 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 154 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Pixgraphy Theme pixgraphy Cross-Site Scripting ≤ 1.3.8 Fixed in 1.3.9 CVE-2024-35740 Patchstack
6.5 Medium Woody ad snippets Plugin insert-php Cross-Site Scripting ≤ 2.4.10 CVE-2024-35751 Patchstack
5.9 Medium Stellissimo Text Box Plugin stellissimo-text-box Cross-Site Scripting ≤ 1.1.4 CVE-2024-35752 Patchstack
6.5 Medium TemplatesNext OnePager Plugin templatesnext-onepager Cross-Site Scripting ≤ 1.3.3 CVE-2024-35753 Patchstack
6.5 Medium Weather Widget Pro Plugin weather-in-any-city-widget Cross-Site Scripting ≤ 1.1.40 CVE-2024-35755 Patchstack
5.9 Medium Tooltip CK Plugin tooltip-ck Cross-Site Scripting ≤ 2.2.15 CVE-2024-35756 Patchstack
6.4 Medium TablePress – Tables in WordPress made easy Plugin tablepress Server-Side Request Forgery Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind ≤ 2.3.1 CVE-2024-4354 Wordfence
6.5 Medium Music Store - WordPress eCommerce Plugin music-store SQL Injection WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitr… prior to 1.1.14 CVE-2024-36082 jpcert
6.4 Medium WordPress prettyPhoto Plugin prettyphoto Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter ≤ 1.2.3 CVE-2024-5162 Wordfence
4.3 Medium WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing Plugin wp-dark-mode Broken Access Control WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization ≤ 5.0.4 CVE-2024-5449 Wordfence
4.3 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Broken Access Control ≤ 1.5.109 Fixed in 1.5.110 CVE-2024-35674 Patchstack
4.3 Medium Pure Chat Plugin pure-chat Cross-Site Request Forgery No login needed ≤ 2.22 Fixed in 2.3 CVE-2024-35673 Patchstack
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Information Disclosure WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API No login needed ≤ 4.2.6.8 CVE-2024-5483 Wordfence
5.3 Medium Move Addons for Elementor Plugin move-addons Broken Access Control No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-30525 Patchstack
5.4 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control ≤ 4.9.10 Fixed in 4.9.11 CVE-2024-30528 Patchstack
4.3 Medium RT Easy Builder – Advanced addons for Elementor Plugin rt-easy-builder-advanced-addons-for-elementor Broken Access Control ≤ 2.0 Fixed in 2.1 CVE-2024-30484 Patchstack
5.3 Medium Integrate Google Drive Plugin integrate-google-drive Broken Access Control No login needed ≤ 1.3.93 Fixed in 1.3.94 CVE-2024-35670 Patchstack
6.5 Medium Picture Gallery Plugin picture-gallery Cross-Site Scripting ≤ 1.5.11 Fixed in 1.5.12 CVE-2024-34759 Patchstack
6.5 Medium Save as PDF plugin by Pdfcrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting ≤ 3.2.3 Fixed in 3.3.0 CVE-2024-35649 Patchstack
6.5 Medium WP Flow Plus Plugin wp-imageflow2 Cross-Site Scripting ≤ 5.2.2 Fixed in 5.2.3 CVE-2024-35651 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.8.0 Fixed in 45.9.0 CVE-2024-35653 Patchstack
6.5 Medium Responsive Theme responsive Cross-Site Scripting ≤ 5.0.3 Fixed in 5.0.3.1 CVE-2024-35654 Patchstack
5.9 Medium Brave Plugin brave-popup-builder Cross-Site Scripting Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) ≤ 0.6.9 Fixed in 0.7.0 CVE-2024-35655 Patchstack
6.5 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting ≤ 2.1.2 CVE-2024-35666 Patchstack
6.5 Medium Cowidgets – Elementor Addons Plugin cowidgets-elementor-addons Cross-Site Scripting Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) ≤ 1.1.1 CVE-2024-35782 Patchstack
6.5 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Local File Inclusion ≤ 3.5.1 Fixed in 3.5.2 CVE-2024-34384 Patchstack
6.5 Medium Better Elementor Addons Plugin better-elementor-addons Local File Inclusion ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-33541 Patchstack
5.3 Medium Malware Scanner Plugin miniorange-malware-protection Authentication Bypass IP Restriction Bypass No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2023-52176 Patchstack
5.3 Medium Rate my Post – WP Rating System Plugin rate-my-post Broken Access Control WP Rating System plugin <= 3.4.2 - Broken Access Control No login needed ≤ 3.4.2 Fixed in 3.4.3 CVE-2023-51667 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Form Submission Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51544 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass IP Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51543 Patchstack
5.3 Medium Branda Plugin branda-white-labeling Authentication Bypass IP Restriction Bypass No login needed ≤ 3.4.14 Fixed in 3.4.15 CVE-2023-51542 Patchstack
6.5 Medium Booster Elite for WooCommerce Plugin Authentication Bypass Authenticated Production Creation/Modification < 7.1.3 Fixed in 7.1.3 CVE-2023-51511 Patchstack
6.5 Medium Responsive Slick Slider Plugin responsive-slick-slider Content Injection No login needed ≤ 1.4 CVE-2023-49852 Patchstack
5.3 Medium WP Photo Album Plus Plugin wp-photo-album-plus Information Disclosure IP Bypass No login needed ≤ 8.5.02.005 Fixed in 8.6.01.005 CVE-2023-49774 Patchstack
5.3 Medium Restricted Site Access Plugin restricted-site-access Authentication Bypass IP Restriction Bypass No login needed ≤ 7.4.1 Fixed in 7.5.0 CVE-2023-48753 Patchstack
6.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Authentication Bypass Authenticated Production Creation/Modification ≤ 7.1.2 Fixed in 7.1.3 CVE-2023-48747 Patchstack
5.3 Medium Captcha Code Plugin captcha-code-authentication Authentication Bypass Captcha Bypass No login needed ≤ 2.9 Fixed in 3.0 CVE-2023-48745 Patchstack
5.3 Medium Contact Form Email Plugin contact-form-to-email Authentication Bypass Captcha Bypass No login needed ≤ 1.3.41 Fixed in 1.3.42 CVE-2023-48318 Patchstack
5.3 Medium Form Maker by 10Web Plugin form-maker Authentication Bypass Captcha Bypass Vulnerability No login needed ≤ 1.15.20 Fixed in 1.15.21 CVE-2023-48290 Patchstack
5.3 Medium Stripe Payments Plugin stripe-payments Content Injection No login needed ≤ 2.0.79 Fixed in 2.0.80 CVE-2023-48285 Patchstack
5.3 Medium WP Forms Puzzle Captcha Plugin wp-forms-puzzle-captcha Authentication Bypass Captcha Bypass No login needed ≤ 4.1 CVE-2023-48276 Patchstack
5.3 Medium Maspik – Spam blacklist Plugin contact-forms-anti-spam Authentication Bypass Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass No login needed ≤ 0.10.3 Fixed in 0.10.4 CVE-2023-48271 Patchstack
5.4 Medium ARI Stream Quiz Plugin ari-stream-quiz Content Injection WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection ≤ 1.3.2 Fixed in 1.3.3 CVE-2023-47513 Patchstack
5.3 Medium Defender Security Plugin defender-security Authentication Bypass Masked Login Area View Bypass No login needed ≤ 4.2.0 Fixed in 4.2.1 CVE-2023-47189 Patchstack
5.3 Medium wpDiscuz Plugin wpdiscuz Content Injection No login needed ≤ 7.6.10 Fixed in 7.6.11 CVE-2023-46310 Patchstack
5.4 Medium Responsive Tabs Plugin responsive-tabs Content Injection HTML Content Injection < 4.0.6 Fixed in 4.0.6 CVE-2023-45635 Patchstack
4.3 Medium WP Content Pilot – Autoblogging & Affiliate Marketing Plugin wp-content-pilot Content Injection HTML Injection ≤ 1.3.3 Fixed in 1.3.4 CVE-2023-45053 Patchstack
5.3 Medium Captcha/Honeypot for Contact Form 7 Plugin captcha-for-contact-form-7 Other Capcha Bypass No login needed ≤ 1.11.3 Fixed in 1.11.4 CVE-2023-45009 Patchstack
5.3 Medium WP Captcha Plugin wp-captcha Authentication Bypass Captcha Bypass No login needed ≤ 2.0.0 CVE-2023-44235 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only