WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 8,701–8,750 of 8,917 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 175 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.1 High	Contact Forms by Cimatti Plugin `contact-forms`	Cross-Site Scripting Unauthenticated Stored Cross Site Scripting (XSS) No login needed	`≤ 1.7.0` Fixed in `1.8.0`	Mar 19, 2024	`CVE-2024-29117`	Patchstack
7.1 High	WooCommerce License Manager Plugin	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.3.1` Fixed in `5.3.2`	Mar 19, 2024	`CVE-2024-29121`	Patchstack
7.1 High	Link Library Plugin `link-library`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 7.6` Fixed in `7.6.1`	Mar 19, 2024	`CVE-2024-29123`	Patchstack
7.1 High	Coupon Affiliates Plugin `woo-coupon-usage`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.12.7` Fixed in `5.12.8`	Mar 19, 2024	`CVE-2024-29125`	Patchstack
7.1 High	Specific Content For Mobile – Customize the mobile version without redirections Plugin `specific-content-for-mobile`	Cross-Site Scripting No login needed	`≤ 0.1.9.5` Fixed in `0.1.9.6`	Mar 19, 2024	`CVE-2024-29126`	Patchstack
7.1 High	Advanced Access Manager Plugin `advanced-access-manager`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 6.9.20` Fixed in `6.9.21`	Mar 19, 2024	`CVE-2024-29127`	Patchstack
7.1 High	POST SMTP Plugin `post-smtp`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.8.6` Fixed in `2.8.7`	Mar 19, 2024	`CVE-2024-29128`	Patchstack
7.1 High	OxyExtras Plugin	Cross-Site Scripting No login needed	`≤ 1.4.4` Fixed in `1.4.5`	Mar 19, 2024	`CVE-2024-29129`	Patchstack
7.1 High	Contact Form 7 – PayPal & Stripe Add-on Plugin `contact-form-7-paypal-add-on`	Cross-Site Scripting PayPal & Stripe Add-on plugin <= 2.0 - Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0` Fixed in `2.1`	Mar 19, 2024	`CVE-2024-29130`	Patchstack
8.5 High	Tourfic Plugin `tourfic`	PHP Object Injection	`≤ 2.11.17` Fixed in `2.11.19`	Mar 19, 2024	`CVE-2024-29136`	Patchstack
7.1 High	Tourfic Plugin `tourfic`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.11.7` Fixed in `2.11.8`	Mar 19, 2024	`CVE-2024-29137`	Patchstack
7.1 High	Restrict User Access – Membership Plugin with Force Plugin `restrict-user-access`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.5` Fixed in `2.6`	Mar 19, 2024	`CVE-2024-29138`	Patchstack
7.1 High	MyCurator Content Curation Plugin `mycurator`	Cross-Site Scripting No login needed	`≤ 3.76` Fixed in `3.77`	Mar 19, 2024	`CVE-2024-29139`	Patchstack
7.1 High	Better Search – Relevant search results Plugin `better-search`	Cross-Site Scripting Stored Cross Site Scripting (XSS) No login needed	`≤ 3.3.0` Fixed in `3.3.1`	Mar 19, 2024	`CVE-2024-29142`	Patchstack
8.8 High	Innovs HR Plugin `innovs-hr-manager`	Cross-Site Request Forgery Employee Creation via CSRF No login needed	`≤ 1.0.3.4`	Mar 18, 2024	`CVE-2024-0858`	WPScan
8.8 High	Enjoy Social Feed Plugin	Cross-Site Request Forgery Unauthenticated Arbitrary Instagram Account Unlinking No login needed	`≤ 6.2.2`	Mar 18, 2024	`CVE-2024-0779`	WPScan
8.8 High	Enjoy Social Feed Plugin	Broken Access Control Subscriber+ Plugin Database Reset	`≤ 6.2.2`	Mar 18, 2024	`CVE-2024-0780`	WPScan
7.1 High	AntiSpam for Contact Form 7 Plugin `cf7-antispam`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.6.0` Fixed in `0.6.1`	Mar 17, 2024	`CVE-2024-27961`	Patchstack
7.1 High	Email Subscription Popup Plugin `email-subscribe`	Cross-Site Scripting No login needed	`≤ 1.2.20` Fixed in `1.2.21`	Mar 17, 2024	`CVE-2024-27960`	Patchstack
7.1 High	WC Shop Sync – Integrate Square and WooCommerce for Seamless Shop Management Plugin `woosquare`	Cross-Site Scripting No login needed	`≤ 4.2.9` Fixed in `4.3`	Mar 17, 2024	`CVE-2024-27959`	Patchstack
7.1 High	Visualizer Plugin `visualizer`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.10.5` Fixed in `3.10.6`	Mar 17, 2024	`CVE-2024-27958`	Patchstack
8.8 High	Social Media Share Buttons Plugin `social-media-builder`	PHP Object Injection Authenticated (Subscriber+) PHP Object Injection	`≤ 2.1.0`	Mar 16, 2024	`CVE-2024-1685`	Wordfence
7.1 High	Fontific \| Google Fonts Plugin `fontific`	Cross-Site Request Forgery CSRF to XSS No login needed	`≤ 0.1.6`	Mar 16, 2024	`CVE-2024-27194`	Patchstack
7.1 High	Watermark RELOADED Plugin `watermark-reloaded`	Cross-Site Request Forgery CSRF to XSS No login needed	`≤ 1.3.5` Fixed in `1.4.0`	Mar 16, 2024	`CVE-2024-27195`	Patchstack
7.1 High	BeePress Plugin `beepress`	Cross-Site Request Forgery CSRF to Stored Cross Site Scripting (XSS) No login needed	`≤ 6.9.8`	Mar 16, 2024	`CVE-2024-27197`	Patchstack
8.8 High	TerraClassifieds Plugin `terraclassifieds`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Account Takeover No login needed	`≤ 2.0.3`	Mar 16, 2024	`CVE-2023-51474`	Patchstack
7.1 High	Ultimate Reviews Plugin `ultimate-reviews`	Cross-Site Scripting Unauthenticated Cross Site Scripting (XSS) No login needed	`≤ 3.2.8` Fixed in `3.2.9`	Mar 15, 2024	`CVE-2024-25597`	Patchstack
7.1 High	Action Network Plugin `wp-action-network`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.4.2` Fixed in `1.4.3`	Mar 15, 2024	`CVE-2024-25921`	Patchstack
7.1 High	PayU India Plugin `payu-india`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.8.8` Fixed in `3.8.9`	Mar 15, 2024	`CVE-2024-27193`	Patchstack
7.1 High	postMash – custom post order Plugin `postmash`	Cross-Site Scripting custom post order plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2.0`	Mar 15, 2024	`CVE-2024-27196`	Patchstack
7.1 High	Configure SMTP Plugin `configure-smtp`	Cross-Site Scripting WordPress Configure SMTP Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS) No login needed	`≤ 3.1`	Mar 15, 2024	`CVE-2024-27192`	Patchstack
7.1 High	GiveWP Plugin `give`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.3.1` Fixed in `3.4.0`	Mar 15, 2024	`CVE-2024-27987`	Patchstack
8.8 High	HUSKY – Products Filter for WooCommerce Professional Plugin `woocommerce-products-filter`	SQL Injection Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injection	`≤ 1.3.5.2`	Mar 15, 2024	`CVE-2024-1795`	Wordfence
7.1 High	Advanced Sermons Plugin `advanced-sermons`	Cross-Site Scripting No login needed	`≤ 3.2` Fixed in `3.3`	Mar 13, 2024	`CVE-2024-27952`	Patchstack
8.8 High	Tutor LMS – eLearning and online course solution Plugin `tutor`	SQL Injection eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection	`≤ 2.6.1`	Mar 13, 2024	`CVE-2024-1751`	Wordfence
7.2 High	AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber Plugin `aweber-web-form-widget`	SQL Injection Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection	`≤ 7.3.14`	Mar 13, 2024	`CVE-2024-1793`	Wordfence
7.5 High	Product Carousel Slider & Grid Ultimate for WooCommerce Plugin `woo-product-carousel-slider-and-grid-ultimate`	PHP Object Injection Authenticated(Contributor+) PHP Object Injection	`≤ 1.9.7`	Mar 13, 2024	`CVE-2024-1950`	Wordfence
8.6 High	Hustle Plugin `wordpress-popup`	Information Disclosure Sensitive Information Exposure via Exposed Hubspot API Keys No login needed	`≤ 7.8.3`	Mar 13, 2024	`CVE-2024-0368`	Wordfence
7.2 High	WP Statistics Plugin `wp-statistics`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed	`≤ 14.5`	Mar 13, 2024	`CVE-2024-2194`	Wordfence
8.8 High	Brizy – Page Builder Plugin `brizy`	Arbitrary File Upload Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload	`≤ 2.4.40`	Mar 13, 2024	`CVE-2024-1311`	Wordfence
7.3 High	Bulgarisation for WooCommerce Plugin	Broken Access Control Missing Authorization No login needed	`≤ 3.0.14`	Mar 13, 2024	`CVE-2024-0683`	Wordfence
8.8 High	News Announcement Scroll Plugin `news-announcement-scroll`	SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode	`≤ 9.0.0`	Mar 13, 2024	`CVE-2023-5663`	Wordfence
7.5 High	Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Plugin `logo-showcase-ultimate`	PHP Object Injection Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection	`≤ 1.3.8`	Mar 13, 2024	`CVE-2024-1951`	Wordfence
8.8 High	Academy LMS – eLearning and online course solution Plugin `academy`	Privilege Escalation eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation	`≤ 1.9.19`	Mar 13, 2024	`CVE-2024-1505`	Wordfence
8.8 High	Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Plugin `post-grid-carousel-ultimate`	PHP Object Injection with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup	`≤ 1.6.7`	Mar 13, 2024	`CVE-2024-2006`	Wordfence
8.8 High	Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Plugin `play-ht`	PHP Object Injection Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Authenticated (Contributor+) PHP Object Injection	`≤ 3.6.4`	Mar 13, 2024	`CVE-2024-1772`	Wordfence
8.8 High	Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce Plugin `enhanced-e-commerce-for-woocommerce-store`	SQL Injection Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.7 - Authenticated (Subscriber+) SQL Injection	`≤ 7.0.7`	Mar 13, 2024	`CVE-2024-1203`	Wordfence
7.2 High	Calculated Fields Form Professional Plugin `calculated-fields-form`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed	`≤ 5.1.56`	Mar 13, 2024	`CVE-2024-2020`	Wordfence
8.1 High	WooCommerce Add to Cart Custom Redirect Plugin `woocommerce-add-to-cart-custom-redirect`	Broken Access Control Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update	`≤ 1.2.13`	Mar 13, 2024	`CVE-2024-1862`	Wordfence
7.2 High	Giveaways and Contests by RafflePress Plugin `rafflepress`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed	`≤ 1.12.5`	Mar 13, 2024	`CVE-2024-1935`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.