WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 8,251–8,300 of 8,917 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 166 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High Ultimate Addons for Beaver Builder Plugin ultimate-addons-for-beaver-builder-lite Privilege Escalation ≤ 1.35.14 Fixed in 1.35.15 CVE-2023-51398 Patchstack
8.8 High ARMember Plugin armember-membership Privilege Escalation ≤ 4.0.10 Fixed in 4.0.11 CVE-2023-51356 Patchstack
8.8 High Ultimate Addons for Elementor Plugin header-footer-elementor Privilege Escalation ≤ 1.36.20 Fixed in 1.36.21 CVE-2023-50890 Patchstack
7.5 High Adifier System Plugin Local File Inclusion No login needed < 3.1.4 Fixed in 3.1.4 CVE-2023-49753 Patchstack
8.8 High JetEngine Plugin Privilege Escalation ≤ 3.2.4 Fixed in 3.2.5 CVE-2023-48757 Patchstack
7.3 High wpForo Forum Plugin wpforo Privilege Escalation No login needed ≤ 2.2.3 Fixed in 2.2.4 CVE-2023-47868 Patchstack
8.8 High Thrive Theme Builder Theme Privilege Escalation Authenticated Privilege Escalation < 3.24.0 Fixed in 3.24.0 CVE-2023-47782 Patchstack
8.0 High WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin miniorange-login-openid Privilege Escalation Authenticated Privilege Escalation ≤ 7.6.6 Fixed in 7.6.7 CVE-2023-47683 Patchstack
7.2 High WP User Frontend Plugin wp-user-frontend Privilege Escalation Authenticated Privilege Escalation ≤ 3.6.5 Fixed in 3.6.6 CVE-2023-47682 Patchstack
8.6 High The Plus Addons for Elementor Pro Plugin Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 5.2.8 Fixed in 5.2.9 CVE-2023-47178 Patchstack
8.2 High ICS Calendar Plugin ics-calendar Server-Side Request Forgery SSRF and Arbitrary File Read No login needed ≤ 10.12.0.3 Fixed in 10.12.0.4 CVE-2023-46784 Patchstack
7.1 High Ultimate Addons for WPBakery Page Builder Plugin Local File Inclusion No login needed ≤ 3.19.14 Fixed in 3.19.15 CVE-2023-46205 Patchstack
8.8 High Themify Ultra Theme Privilege Escalation Authenticated Privilege Escalation ≤ 7.3.5 Fixed in 7.3.6 CVE-2023-46145 Patchstack
7.1 High Events Rich Snippets for Google Plugin rich-snippets-vevents Cross-Site Request Forgery CSRF Leading to Privilege Escalation No login needed ≤ 1.8 CVE-2023-44478 Patchstack
7.5 High WP Express Checkout (Accept PayPal Payments) Plugin wp-express-checkout Price Manipulation No login needed ≤ 2.3.7 Fixed in 2.3.8 CVE-2024-30527 Patchstack
8.8 High WZone Plugin Privilege Escalation ≤ 14.0.10 CVE-2024-33549 Patchstack
8.8 High WP Masquerade Plugin wp-masquerade Privilege Escalation Authenticated Account Takeover ≤ 1.1.0 CVE-2024-33550 Patchstack
7.2 High Instant Images Plugin instant-images Privilege Escalation Arbitrary Option Update to Privilege Escalation ≤ 6.1.0 Fixed in 6.1.1 CVE-2024-33569 Patchstack
7.2 High EAN for WooCommerce Plugin ean-for-woocommerce Privilege Escalation Arbitrary Option Update to Privilege Escalation ≤ 4.8.9 Fixed in 4.9.0 CVE-2024-34370 Patchstack
8.6 High Simple Membership Plugin simple-membership Privilege Escalation Unauthenticated Membership Role Privilege Escalation No login needed ≤ 4.3.4 Fixed in 4.3.5 CVE-2023-41957 Patchstack
8.8 High Simple Membership Plugin simple-membership Privilege Escalation Authenticated Account Takeover ≤ 4.3.4 Fixed in 4.3.5 CVE-2023-41956 Patchstack
8.8 High Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Privilege Escalation Contributor+ Privilege Escalation ≤ 5.8.8 Fixed in 5.8.9 CVE-2023-41955 Patchstack
8.6 High ProfilePress Plugin wp-user-avatar Privilege Escalation Unauthenticated Limited Privilege Escalation No login needed ≤ 4.13.1 Fixed in 4.13.2 CVE-2023-41954 Patchstack
8.8 High GiveWP Plugin give Privilege Escalation GiveWP Manager+ Privilege Escalation ≤ 2.33.0 Fixed in 2.33.1 CVE-2023-41665 Patchstack
8.8 High WPvivid Backup and Migration Plugin wpvivid-backuprestore Privilege Escalation Privilege Escalation on Staging Environment ≤ 0.9.90 Fixed in 0.9.91 CVE-2023-41243 Patchstack
8.6 High Phlox Shop Plugin Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 2.0.0 CVE-2023-39163 Patchstack
8.6 High Phlox Portfolio Plugin auxin-portfolio Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2023-38399 Patchstack
7.6 High Shortcodes and extra features for Phlox Plugin auxin-elements Local File Inclusion Unauthenticated Local File Inclusion ≤ 2.14.0 Fixed in 2.15.0 CVE-2023-37888 Patchstack
7.2 High JetFormBuilder Plugin jetformbuilder Privilege Escalation Authenticated Privilege Escalation ≤ 3.0.8 Fixed in 3.0.9 CVE-2023-37866 Patchstack
8.8 High Booking Package Plugin booking-package Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.5.98 Fixed in 1.5.99 CVE-2023-37389 Patchstack
7.3 High Consulting Theme consulting Local File Inclusion No login needed ≤ 6.5.6 Fixed in 6.5.7 CVE-2023-37385 Patchstack
7.6 High WooCommerce One Page Checkout Plugin Local File Inclusion ≤ 2.3.0 Fixed in 2.4.0 CVE-2023-35881 Patchstack
7.6 High JupiterX Theme Local File Inclusion Auth. Local File Inclusion ≤ 3.0.0 Fixed in 3.1.0 CVE-2023-32110 Patchstack
7.7 High Bookly Plugin bookly-responsive-appointment-booking-tool Arbitrary File Deletion Authenticated Arbitrary File Deletion ≤ 21.7.1 Fixed in 21.8 CVE-2023-26526 Patchstack
7.1 High Shortcodes Ultimate Plugin shortcodes-ultimate Path Traversal Arbitrary File Download ≤ 5.12.6 Fixed in 5.12.7 CVE-2023-25050 Patchstack
7.6 High Redirection for Contact Form 7 Plugin wpcf7-redirect Privilege Escalation ≤ 2.7.0 Fixed in 2.8.0 CVE-2023-23990 Patchstack
7.5 High My Tickets Plugin my-tickets Price Manipulation Payment Bypass No login needed ≤ 1.9.11 Fixed in 1.9.12 CVE-2023-23988 Patchstack
7.6 High Rank Math SEO Plugin seo-by-rank-math Local File Inclusion ≤ 1.0.107.2 Fixed in 1.0.107.3 CVE-2023-23888 Patchstack
7.6 High OceanWP Theme oceanwp Local File Inclusion Authenticated Local File Inclusion ≤ 3.4.1 Fixed in 3.4.2 CVE-2023-23700 Patchstack
7.7 High YARPP Plugin yet-another-related-posts-plugin Local File Inclusion ≤ 5.30.4 Fixed in 5.30.5 CVE-2022-45374 Patchstack
7.7 High 1003 Mortgage Application Plugin 1003-mortgage-application Local File Inclusion ≤ 1.75 Fixed in 1.80 CVE-2022-45368 Patchstack
8.2 High XStore Core Plugin et-core-plugin Arbitrary File Upload Limited Arbitrary File Upload No login needed ≤ 5.3.8 Fixed in 5.3.9 CVE-2024-33556 Patchstack
7.1 High Landing Page Builder Plugin page-builder-add Cross-Site Scripting No login needed ≤ 1.5.1.8 Fixed in 1.5.1.9 CVE-2024-34752 Patchstack
7.5 High ShiftController Employee Shift Scheduling Plugin shiftcontroller PHP Object Injection Authenticated (Contributor+) PHP Object Injection ≤ 4.9.57 CVE-2024-4733 Wordfence
7.5 High ConvertPlus Plugin PHP Object Injection Authenticated (Contributor+) PHP Object Injection ≤ 3.5.26 CVE-2024-4838 Wordfence
8.8 High Tutor LMS Pro Plugin Broken Access Control Missing Authorization to SQL Injection ≤ 2.7.0 CVE-2024-4352 Wordfence
8.8 High Tutor LMS Pro Plugin Broken Access Control Missing Authorization to Privilege Escalation ≤ 2.7.0 CVE-2024-4351 Wordfence
7.3 High Tutor LMS Pro Plugin Broken Access Control Missing Authorization No login needed ≤ 2.7.0 CVE-2024-4222 Wordfence
8.8 High Newsletter Popup Plugin Cross-Site Request Forgery List Deletion via CSRF No login needed ≤ 1.2 CVE-2024-3643 WPScan
8.8 High Tutor LMS Plugin tutor SQL Injection Authenticated (Instructor+) SQL Injection ≤ 2.7.0 CVE-2024-4318 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only