WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 7,801–7,850 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 157 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Information Disclosure Sensitive Data Exposure No login needed ≤ 2.8.6 Fixed in 3.0.0 CVE-2023-33321 Patchstack
6.0 Medium Unite Gallery Lite Plugin unite-gallery-lite Local File Inclusion ≤ 1.7.59 Fixed in 1.7.60 CVE-2023-33310 Patchstack
4.3 Medium Editorialmag Theme editorialmag Broken Access Control Authenticated Arbitrary Plugin Activation ≤ 1.1.9 CVE-2023-32129 Patchstack
6.8 Medium Landing Page Builder – Free Landing Page Templates Plugin ultimate-landing-page Local File Inclusion Free Landing Page Templates plugin <= 3.1.9.9 - Local File Inclusion ≤ 3.1.9.9 Fixed in 3.2 CVE-2023-24379 Patchstack
4.9 Medium GMAce Plugin gmace Path Traversal Arbitrary File Download ≤ 1.5.2 CVE-2023-23872 Patchstack
5.3 Medium Conditional Checkout Fields for WooCommerce Plugin Authentication Bypass Broken Authentication No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2022-45070 Patchstack
5.0 Medium Defender Security Plugin defender-security Authentication Bypass Broken Authentication ≤ 3.3.2 Fixed in 3.3.3 CVE-2022-44581 Patchstack
6.5 Medium Popup More Popups Plugin popup-more Cross-Site Scripting Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) ≤ 2.3.1 Fixed in 2.3.3 CVE-2024-32800 Patchstack
6.5 Medium Popup Builder Plugin easy-notify-lite Cross-Site Scripting ≤ 1.1.29 Fixed in 1.1.30 CVE-2024-34567 Patchstack
6.5 Medium DethemeKit For Elementor Plugin dethemekit-for-elementor Cross-Site Scripting ≤ 2.1.2 Fixed in 2.1.3 CVE-2024-34575 Patchstack
6.5 Medium Borderless Plugin borderless Cross-Site Scripting ≤ 1.7.3 CVE-2024-34757 Patchstack
4.3 Medium Bulk Posts Editing Plugin Cross-Site Request Forgery No login needed ≤ 4.2.3 CVE-2024-4204 Wordfence
5.9 Medium Magazine Blocks Plugin magazine-blocks Cross-Site Scripting ≤ 1.3.6 Fixed in 1.3.7 CVE-2024-34760 Patchstack
6.5 Medium iFrame Plugin iframe Cross-Site Scripting ≤ 5.0 CVE-2024-34805 Patchstack
4.4 Medium Order Export & Order Import for WooCommerce Plugin order-import-export-for-woocommerce PHP Object Injection ≤ 2.4.9 Fixed in 2.5.0 CVE-2024-34751 Patchstack
4.3 Medium JCH Optimize Plugin jch-optimize Path Traversal ≤ 4.2.0 Fixed in 4.2.1 CVE-2024-34808 Patchstack
6.4 Medium Yoast SEO Plugin wordpress-seo Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 22.6 CVE-2024-4984 Wordfence
4.3 Medium Bulk Posts Editing Plugin Broken Access Control Authenticated (Subscriber+) Missing Authorization ≤ 4.2.3 CVE-2024-4199 Wordfence
4.3 Medium Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease Plugin Broken Access Control Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure ≤ 2.6.6 CVE-2024-0437 Wordfence
5.4 Medium WordPress RSS Aggregator Plugin wp-rss-aggregator Cross-Site Scripting The 'WordPress RSS Aggregator' WordPress Plugin, versions < 4.23.9 are affected by a Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the 'notice_id' GE… No login needed < 4.23.9 Fixed in 4.23.9 CVE-2024-4860 tenable
6.5 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Cross-Site Scripting ≤ 1.4.8 Fixed in 1.4.9 CVE-2024-35167 Patchstack
5.9 Medium All Bootstrap Blocks Plugin all-bootstrap-blocks Cross-Site Scripting ≤ 1.3.15 Fixed in 1.3.16 CVE-2024-35169 Patchstack
5.9 Medium Sticky banner Plugin sticky-banner Cross-Site Scripting ≤ 1.2.0 Fixed in 1.3.0 CVE-2024-35170 Patchstack
5.3 Medium Easy Digital Downloads Plugin easy-digital-downloads Information Disclosure Sensitive Data Exposure No login needed ≤ 3.2.11 Fixed in 3.2.12 CVE-2024-32100 Patchstack
5.3 Medium ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-34812 Patchstack
5.3 Medium Gutenify Plugin gutenify Information Disclosure Sensitive Data Exposure via API No login needed ≤ 1.4.0 Fixed in 1.4.1 CVE-2024-35165 Patchstack
5.3 Medium Filebird Plugin filebird Information Disclosure WordPress Media Library Folders & File Manager plugin <= 5.6.3 - Sensitive Data Exposure No login needed ≤ 5.6.3 Fixed in 5.6.4 CVE-2024-35166 Patchstack
5.3 Medium Academy LMS Plugin academy Information Disclosure Sensitive Data Exposure No login needed ≤ 1.9.25 Fixed in 1.9.26 CVE-2024-35171 Patchstack
4.4 Medium ShortPixel Adaptive Images Plugin shortpixel-adaptive-images Server-Side Request Forgery ≤ 3.8.3 Fixed in 3.8.4 CVE-2024-35172 Patchstack
5.9 Medium WP SMS Plugin wp-sms Cross-Site Scripting ≤ 6.5.1 Fixed in 6.5.2 CVE-2024-34811 Patchstack
6.4 Medium Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.1 CVE-2024-4630 Wordfence
4.4 Medium Falang multilanguage Plugin falang Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.3.49 CVE-2024-4417 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin learnpress Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter ≤ 4.2.6.5 CVE-2024-4277 Wordfence
6.5 Medium AppPresser Plugin apppresser Broken Access Control No login needed ≤ 4.3.0 Fixed in 4.3.1 CVE-2024-32776 Patchstack
5.4 Medium Unyson Plugin unyson Cross-Site Request Forgery No login needed ≤ 2.7.29 Fixed in 2.7.31 CVE-2024-34814 Patchstack
5.4 Medium WPCal.io – Easy Meeting Scheduler Plugin wpcal Cross-Site Request Forgery No login needed ≤ 0.9.5.8 Fixed in 0.9.5.9 CVE-2024-34816 Patchstack
4.3 Medium Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin integration-for-contact-form-7-and-pipedrive Cross-Site Request Forgery No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2024-34817 Patchstack
4.3 Medium Easy Digital Downloads Plugin easy-digital-downloads Cross-Site Request Forgery No login needed ≤ 3.2.11 Fixed in 3.2.12 CVE-2024-31113 Patchstack
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Other WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration No login needed ≤ 4.2.6.5 CVE-2024-4444 Wordfence
4.3 Medium ShortPixel Adaptive Images Plugin shortpixel-adaptive-images Cross-Site Request Forgery No login needed ≤ 3.8.3 Fixed in 3.8.4 CVE-2024-4689 Patchstack
4.3 Medium Arigato Autoresponder and Newsletter Plugin bft-autoresponder Cross-Site Request Forgery No login needed ≤ 2.7.2.3 Fixed in 2.7.2.4 CVE-2024-34823 Patchstack
4.3 Medium Social Warfare Plugin social-warfare Cross-Site Request Forgery No login needed ≤ 4.4.5.1 Fixed in 4.4.6 CVE-2024-34825 Patchstack
4.3 Medium TranslatePress Plugin translatepress-multilingual Cross-Site Request Forgery TranslatePress plugin <= 2.7.5 - Cross Site Request Forgery (CSRF) No login needed ≤ 2.7.5 Fixed in 2.7.6 CVE-2024-34827 Patchstack
4.3 Medium Church Admin Plugin church-admin Cross-Site Request Forgery No login needed ≤ 4.1.32 Fixed in 4.2.0 CVE-2024-34828 Patchstack
6.4 Medium HTML5 Audio Player- Best WordPress Audio Player Plugin html5-audio-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.2.19 CVE-2024-4398 Wordfence
4.3 Medium Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery ≤ 4.1.6 CVE-2024-1467 Wordfence
4.3 Medium Joli FAQ SEO – WordPress FAQ Plugin Cross-Site Request Forgery WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery No login needed ≤ 1.3.2 CVE-2024-4082 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.1.1 CVE-2024-3923 Wordfence
4.3 Medium Soccer Engine – Soccer Plugin Cross-Site Request Forgery Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery No login needed ≤ 1.12 CVE-2024-4312 Wordfence
6.1 Medium Yoast SEO Plugin wordpress-seo Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 22.5 CVE-2024-4041 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only