Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,324 High 9,486 Medium 18,376 Low 376 Not scored 1

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.

Showing 8,351–8,400 of 9,208 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 168 of 185
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Content Injection No login needed ≤ 5.1.9.2 Fixed in 5.1.9.3 CVE-2023-23989 Patchstack
6.5 Medium WP-FormAssembly Plugin formassembly-web-forms Path Traversal Auth. Arbitrary File Read ≤ 2.0.5 Fixed in 2.0.6 CVE-2022-45852 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Insecure Direct Object References (IDOR) ≤ 5.7.9 Fixed in 5.8.0 CVE-2024-32772 Patchstack
5.4 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Insecure Direct Object Reference (IDOR) ≤ 5.7.9 Fixed in 5.8.0 CVE-2024-32808 Patchstack
5.3 Medium Rate my Post – WP Rating System Plugin rate-my-post Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.4.4 Fixed in 3.4.5 CVE-2024-32823 Patchstack
5.9 Medium Image Slider Widget Plugin image-slider-widget Cross-Site Scripting ≤ 1.1.125 Fixed in 1.1.127 CVE-2024-32707 Patchstack
6.5 Medium myCred Plugin mycred Cross-Site Scripting ≤ 2.6.3 Fixed in 2.6.4 CVE-2024-32711 Patchstack
6.5 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting ≤ 2.6.3 Fixed in 2.6.4 CVE-2024-32721 Patchstack
5.9 Medium Coupon & Discount Code Reveal Button Plugin coupon-reveal-button Cross-Site Scripting ≤ 1.2.5 Fixed in 1.2.6 CVE-2024-32722 Patchstack
5.9 Medium Advanced Floating Content Plugin advanced-floating-content-lite Cross-Site Scripting ≤ 1.2.5 Fixed in 1.2.6 CVE-2024-32723 Patchstack
6.5 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting ≤ 4.10.25 Fixed in 4.10.26 CVE-2024-32791 Patchstack
5.9 Medium Widget Post Slider Plugin widget-post-slider Cross-Site Scripting ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-32801 Patchstack
5.9 Medium All-in-one Like Widget Plugin all-in-one-facebook-like-widget Cross-Site Scripting ≤ 2.2.7 Fixed in 2.2.8 CVE-2024-32815 Patchstack
5.9 Medium List Custom Taxonomy Widget Plugin list-custom-taxonomy-widget Cross-Site Scripting ≤ 4.1 Fixed in 4.2 CVE-2024-32833 Patchstack
5.9 Medium WooCommerce Shipping Label Plugin shipping-labels-for-woo Cross-Site Scripting ≤ 2.3.8 Fixed in 2.3.9 CVE-2024-32834 Patchstack
6.5 Medium RTMKit Plugin rometheme-for-elementor Cross-Site Scripting ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-32956 Patchstack
5.3 Medium StreamWeasels Twitch Integration Plugin streamweasels-twitch-integration Information Disclosure API Sensitive Data Exposure No login needed ≤ 1.7.8 Fixed in 1.8.0 CVE-2024-32716 Patchstack
5.9 Medium VikRentCar Plugin vikrentcar Information Disclosure Sensitive Data Exposure via Invoices No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2024-32780 Patchstack
4.3 Medium HT Mega Plugin ht-mega-for-elementor Information Disclosure Sensitive Data Exposure ≤ 2.4.7 Fixed in 2.4.8 CVE-2024-32782 Patchstack
5.3 Medium FG Joomla to Plugin fg-joomla-to-wordpress Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 4.20.2 Fixed in 4.21.0 CVE-2024-32788 Patchstack
4.3 Medium WP Fusion Lite Plugin wp-fusion-lite Information Disclosure Sensitive Data Exposure ≤ 3.42.10 Fixed in 3.43.0 CVE-2024-32796 Patchstack
4.4 Medium Import and export users and customers Plugin import-users-from-csv-with-meta PHP Object Injection ≤ 1.26.2 Fixed in 1.26.3 CVE-2024-32817 Patchstack
5.4 Medium Import Export WordPress Users Plugin users-customers-import-export-for-wp-woocommerce PHP Object Injection Deserialization of untrusted data No login needed ≤ 2.5.3 Fixed in 2.5.4 CVE-2024-32835 Patchstack
4.9 Medium The Pack Elementor addons Plugin the-pack-addon Server-Side Request Forgery ≤ 2.0.8.2 Fixed in 2.0.8.3 CVE-2024-32718 Patchstack
4.9 Medium Embed Google Photos album Plugin embed-google-photos-album-easily Server-Side Request Forgery ≤ 2.1.9 Fixed in 2.2.1 CVE-2024-32775 Patchstack
6.4 Medium SuperFaktura WooCommerce Plugin woocommerce-superfaktura Server-Side Request Forgery ≤ 1.40.3 Fixed in 1.40.4 CVE-2024-32803 Patchstack
5.4 Medium Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Server-Side Request Forgery ≤ 4.0.11 Fixed in 4.0.12 CVE-2024-32812 Patchstack
4.9 Medium Culqi Plugin culqi-checkout Server-Side Request Forgery ≤ 3.0.14 Fixed in 3.0.15 CVE-2024-32819 Patchstack
4.9 Medium FV Flowplayer Video Player Plugin fv-wordpress-flowplayer Server-Side Request Forgery ≤ 7.5.43.7212 Fixed in 7.5.45.7212 CVE-2024-32955 Patchstack
6.5 Medium Max Addons Pro for Bricks Plugin Broken Access Control Unauthenticated Plugin Settings Reset No login needed ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-32951 Patchstack
5.3 Medium Shared Files Plugin shared-files Broken Access Control No login needed ≤ 1.7.16 Fixed in 1.7.17 CVE-2024-32679 Patchstack
6.4 Medium GeoDirectory – WordPress Business Directory Plugin, or Classified Directory Plugin Cross-Site Scripting WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode ≤ 2.3.48 CVE-2024-3732 Wordfence
4.3 Medium Prime Slider – Addons For Elementor Plugin bdthemes-prime-slider-lite Broken Access Control ≤ 3.13.2 Fixed in 3.13.3 CVE-2024-32681 Patchstack
5.3 Medium Wp Ultimate Review Plugin wp-ultimate-review Broken Access Control Broken Access Control on Review No login needed ≤ 2.2.5 Fixed in 2.3.0 CVE-2024-32684 Patchstack
4.3 Medium WPC Frequently Bought Together for WooCommerce Plugin woo-bought-together Broken Access Control ≤ 7.0.3 Fixed in 7.0.4 CVE-2024-32687 Patchstack
6.5 Medium MyRewards Plugin woorewards Broken Access Control ≤ 5.3.0 Fixed in 5.3.1 CVE-2024-32688 Patchstack
5.3 Medium Active Products Tables for WooCommerce Plugin profit-products-tables-for-woocommerce Broken Access Control No login needed ≤ 1.0.6.2 Fixed in 1.0.6.3 CVE-2024-32691 Patchstack
6.5 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting ≤ 3.10.4 Fixed in 3.10.5 CVE-2024-32698 Patchstack
6.5 Medium HelloAsso Plugin helloasso Cross-Site Scripting ≤ 1.1.5 Fixed in 1.1.6 CVE-2024-32697 Patchstack
6.5 Medium Infographic Maker – iList Plugin infographic-and-list-builder-ilist Cross-Site Scripting ≤ 4.6.6 Fixed in 4.6.8 CVE-2024-32696 Patchstack
5.9 Medium RSS Feed Widget Plugin rss-feed-widget Cross-Site Scripting ≤ 2.9.7 Fixed in 2.9.8 CVE-2024-32690 Patchstack
6.4 Medium hCaptcha Plugin hcaptcha-for-forms-and-more Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode ≤ 4.0.0 Fixed in 4.0.1 CVE-2024-4014 Wordfence
5.3 Medium Wp Ultimate Review Plugin wp-ultimate-review Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 2.2.5 Fixed in 2.3.0 CVE-2024-32683 Patchstack
6.4 Medium LearnPress – WordPress LMS Plugin Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.6.4 CVE-2024-3560 Wordfence
6.8 Medium Store Locator Plugin agile-store-locator Arbitrary File Deletion WordPress Store Locator WordPress Plugin <= 1.4.14 is vulnerable to Arbitrary File Deletion ≤ 1.4.14 CVE-2023-50885 Patchstack
4.3 Medium WP Social Comments Plugin gs-facebook-comments Broken Access Control ≤ 1.7.3 Fixed in 1.7.4 CVE-2024-32689 Patchstack
5.3 Medium Backup Migration Plugin backup-backup Information Disclosure Sensitive Data Exposure via Log No login needed ≤ 1.4.3 Fixed in 1.4.4 CVE-2024-32686 Patchstack
5.5 Medium Really Simple SSL Plugin really-simple-ssl Server-Side Request Forgery ≤ 7.2.3 Fixed in 8.0.0 CVE-2024-31229 Patchstack
6.5 Medium WP-FormAssembly Plugin formassembly-web-forms Cross-Site Scripting ≤ 2.0.10 Fixed in 2.0.11 CVE-2023-49768 Patchstack
5.9 Medium Navigation menu as Dropdown Widget Plugin navigation-menu-as-dropdown-widget Cross-Site Scripting ≤ 1.3.4 Fixed in 1.3.5 CVE-2024-32126 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only