Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,323 High 9,483 Medium 18,323 Low 369 Not scored 15

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.

Showing 801–835 of 835 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 17 of 17
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Contact Form builder with drag & drop for WordPress – Kali Forms Plugin kali-forms Broken Access Control Kali Forms <= 2.3.41 - Missing Authorization ≤ 2.3.41 Fixed in 2.3.50 CVE-2024-1218 Wordfence
7.6 High Contact Form builder with drag & drop for WordPress – Kali Forms Plugin kali-forms Broken Access Control Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation ≤ 2.3.41 Fixed in 2.3.50 CVE-2024-1217 Wordfence
7.1 High WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc Plugin wp-sms Cross-Site Scripting WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 6.5.2 Fixed in 6.5.3 CVE-2024-24881 Patchstack
6.4 Medium Payment Forms for Paystack Plugin payment-forms-for-paystack Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.4.1 Fixed in 3.4.2 CVE-2023-5665 Wordfence
4.3 Medium Views for WPForms Plugin views-for-wpforms-lite Cross-Site Request Forgery Cross-Site Request Forgery via save_view No login needed ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-0373 Wordfence
6.1 Medium Formidable Forms Plugin formidable Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 6.7.2 Fixed in 6.8 CVE-2024-0660 Wordfence
4.9 Medium PDF Generator For Fluent Forms Plugin Cross-Site Scripting ≤ 1.1.7 CVE-2023-6953 Wordfence
4.3 Medium Views for WPForms Plugin views-for-wpforms-lite Broken Access Control Missing Authorization via create_view ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-0371 Wordfence
5.3 Medium Advanced Forms for ACF Plugin advanced-forms Broken Access Control Missing Authorization to Unauthenticated Form Settings Export No login needed ≤ 1.9.3.2 CVE-2024-1121 Wordfence
4.3 Medium Views for WPForms Plugin views-for-wpforms-lite Broken Access Control Missing Authorization via save_view ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-0370 Wordfence
4.3 Medium Views for WPForms Plugin views-for-wpforms-lite Cross-Site Request Forgery Cross-Site Request Forgery via create_view No login needed ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-0374 Wordfence
4.3 Medium Views for WPForms Plugin views-for-wpforms-lite Broken Access Control Missing Authorization via get_form_fields ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-0372 Wordfence
5.9 Medium Ninja Forms Contact Form Plugin ninja-forms SQL Injection Unauthenticated Second Order SQL Injection No login needed ≤ 3.7.1 Fixed in 3.7.3 CVE-2024-0685 Wordfence
7.1 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 5.2.4.1 Fixed in 5.2.4.2 CVE-2023-51509 Patchstack
5.9 Medium Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! Plugin everest-forms Cross-Site Scripting WordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS) ≤ 2.0.4.1 Fixed in 2.0.5 CVE-2023-51695 Patchstack
5.9 Medium CRM Perks Forms – WordPress Form Builder Plugin crm-perks-forms Cross-Site Scripting WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS) ≤ 1.1.2 Fixed in 1.1.3 CVE-2023-51536 Patchstack
6.5 Medium Keap Official Opt-in Forms Plugin infusionsoft-official-opt-in-forms Cross-Site Scripting WordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS) ≤ 1.0.11 CVE-2023-52192 Patchstack
5.3 Medium NEX-Forms – Ultimate Form Builder – Contact forms and much more Plugin nex-forms-express-wp-form-builder Broken Access Control Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read() No login needed ≤ 8.5.6 Fixed in 8.5.7 CVE-2024-1130 Wordfence
5.3 Medium NEX-Forms – Ultimate Form Builder – Contact forms and much more Plugin nex-forms-express-wp-form-builder Broken Access Control Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred() No login needed ≤ 8.5.6 Fixed in 8.5.7 CVE-2024-1129 Wordfence
5.3 Medium NEX-Forms – Ultimate Form Builder – Contact forms and much more Plugin nex-forms-express-wp-form-builder Broken Access Control Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() No login needed ≤ 8.5.6 Fixed in 8.5.7 CVE-2024-0907 Wordfence
7.5 High Contact Form builder with drag & drop for WordPress – Kali Forms Plugin kali-forms Broken Access Control Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR) No login needed ≤ 2.3.36 Fixed in 2.3.37 CVE-2024-22305 Patchstack
4.4 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title ≤ 5.1.5 Fixed in 5.1.7 CVE-2024-0618 Wordfence
7.2 High WPForms Pro Plugin Cross-Site Scripting The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient… No login needed ≤ 1.8.5.3 CVE-2023-7063 Wordfence
7.5 High Formidable Forms Plugin formidable PHP Object Injection Unauthenticated PHP Object Injection No login needed < 6.2 Fixed in 6.2 CVE-2023-1405 WPScan
6.1 Medium Superforms Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed < 6.0.4 Fixed in 6.0.4 CVE-2022-0402 WPScan
4.8 Medium Easy Forms for Mailchimp Plugin Cross-Site Scripting Admin+ Stored Cross-Site Scripting ≤ 6.8.10 CVE-2023-4925 WPScan
4.8 Medium Keap Official Opt-in Forms Plugin infusionsoft-official-opt-in-forms Cross-Site Scripting Admin+ Stored XSS ≤ 1.0.11 CVE-2023-6941 WPScan
6.5 Medium Constant Contact Forms by MailMunch Plugin constant-contact-forms-by-mailmunch Cross-Site Scripting WordPress Constant Contact Forms by MailMunch Plugin <= 2.0.11 is vulnerable to Cross Site Scripting (XSS) ≤ 2.0.11 CVE-2024-22137 Patchstack
8.1 High Piotnet Forms Plugin piotnetforms Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.0.28 CVE-2023-6220 Wordfence
7.2 High ARForms Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_url No login needed ≤ 1.5.8 CVE-2023-6828 Wordfence
4.4 Medium Formidable Forms Plugin formidable Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 6.7 CVE-2023-6842 Wordfence
6.5 Medium Formidable Forms Plugin formidable Content Injection HTML Injection No login needed ≤ 6.7 CVE-2023-6830 Wordfence
5.9 Medium cformsII Plugin cforms2 Cross-Site Scripting WordPress CformsII Plugin <= 15.0.5 is vulnerable to Cross Site Scripting (XSS) ≤ 15.0.5 CVE-2023-52203 Patchstack
5.3 Medium Constant Contact Forms Plugin constant-contact-forms Information Disclosure WordPress Constant Contact Forms Plugin <= 2.4.2 is vulnerable to Sensitive Data Exposure No login needed ≤ 2.4.2 CVE-2023-52208 Patchstack
5.4 Medium NEX-Forms – Ultimate Form Builder – Contact forms and much more Plugin nex-forms-express-wp-form-builder Cross-Site Request Forgery Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 8.5.2 Fixed in 8.5.5 CVE-2023-52120 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only