WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 851–900 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 18 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Auto iFrame Plugin auto-iframe Cross-Site Scripting Contributor+ XSS via Shortcode < 2.0 Fixed in 2.0 CVE-2024-10151 WPScan
6.5 Medium mcjh button shortcode Plugin mcjh-button-shortcode Cross-Site Scripting ≤ 1.6.4 CVE-2025-22558 Patchstack
6.4 Medium Marketplace Items Plugin marketplace-items Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.5.5 CVE-2024-12437 Wordfence
5.3 Medium Tabs Shortcode Plugin Cross-Site Scripting Contributor+ XSS via Shortcode No login needed ≤ 2.0.2 CVE-2024-11606 WPScan
4.3 Medium FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor Plugin post-block Broken Access Control Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor <= 6.0.0 - Missing Authorization to Authenticated (Subscriber+) Shortcode Export ≤ 6.0.0 CVE-2024-10536 Wordfence
6.4 Medium Social Rocket Plugin social-rocket Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.4 CVE-2024-9702 Wordfence
6.4 Medium Marketplace Items Plugin marketplace-items Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'marketplace' Shortcode ≤ 1.5.5 CVE-2024-12439 Wordfence
6.4 Medium Chat Support for Viber – Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode Plugin chat-viber Cross-Site Scripting Chat Bubble and Chat Button for Gutenberg, Elementor and Shortcode <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.7.3 CVE-2024-12457 Wordfence
4.4 Medium Toggles Shortcode and Widget Plugin toggles-shortcode-and-widget Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.14 CVE-2024-12207 Wordfence
6.5 Medium Design for Contact Form 7 Style WordPress Plugin – CF7 WOW Styler Plugin cf7-styler Arbitrary Shortcode Execution CF7 WOW Styler <= 1.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting No login needed ≤ 1.7.1 CVE-2024-12419 Wordfence
6.4 Medium Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce Plugin formaloo-form-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.1.3.2 CVE-2024-11934 Wordfence
6.4 Medium Taskbuilder – WordPress Project & Task Management Plugin taskbuilder Cross-Site Scripting WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode ≤ 3.0.6 CVE-2024-11930 Wordfence
6.5 Medium Arconix Shortcodes Plugin arconix-shortcodes Cross-Site Scripting ≤ 2.1.14 Fixed in 2.1.15 CVE-2024-56242 Patchstack
6.5 Medium Category Post Shortcode Plugin category-post-shortcode Cross-Site Scripting ≤ 2.4 CVE-2024-56021 Patchstack
6.3 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Arbitrary Shortcode Execution The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 3.8.22 CVE-2024-12238 Wordfence
5.9 Medium WP-SVG Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcode ≤ 0.9 CVE-2024-11644 WPScan
6.4 Medium MagicPost Plugin magicpost Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode ≤ 1.2.1 CVE-2024-12591 Wordfence
6.4 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Staff Widget ≤ 2.17.2 CVE-2024-12588 Wordfence
6.4 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via aux_contact_box and aux_gmaps Shortcodes ≤ 2.17.0 CVE-2024-9545 Wordfence
6.4 Medium Multi-column Tag Map Plugin multi-column-tag-map Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode ≤ 17.0.33 CVE-2024-11196 Wordfence
6.4 Medium One Click Upsell Funnel for WooCommerce Plugin woo-one-click-upsell-funnel Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode ≤ 3.4.9 CVE-2024-11938 Wordfence
5.4 Medium Serious Slider Plugin cryout-serious-slider Cross-Site Scripting Contributor+ Stored XSS via Shortcode < 1.2.7 Fixed in 1.2.7 CVE-2024-11108 WPScan
5.4 Medium Tithe.ly Giving Button Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcode ≤ 1.1 CVE-2024-11841 WPScan
6.4 Medium Ganohrs Toggle Shortcode Plugin ganohrs-toggle-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 0.2.4 CVE-2024-12459 Wordfence
4.3 Medium Shortcodes for Elementor Plugin Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 1.0.4 CVE-2024-10690 Wordfence
4.3 Medium Get Post Content Shortcode Plugin get-post-content-shortcode Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via post_content Shortcode ≤ 0.4 CVE-2024-12447 Wordfence
6.4 Medium WooCommerce Cart Count Shortcode Plugin woo-cart-count-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.4 CVE-2024-12517 Wordfence
6.5 Medium Quran Phrases About Most People Shortcodes Plugin quran-phrases-about-most-people-shortcodes Cross-Site Scripting ≤ 1.4 Fixed in 1.5 CVE-2024-54334 Patchstack
6.4 Medium Out of the Block: OpenStreetMap Plugin ootb-openstreetmap Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via ootb_query Shortcode ≤ 2.8.3 CVE-2024-11827 Wordfence
6.3 Medium Notibar – Notification Bar Plugin notibar Arbitrary Shortcode Execution Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text ≤ 2.1.4 CVE-2024-11012 Wordfence
6.5 Medium Simple Link Directory Plugin simple-link-directory Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 8.4.5 CVE-2024-12417 Wordfence
6.5 Medium Coupon Affiliates – Affiliate Plugin for WooCommerce Plugin woo-coupon-usage Arbitrary Shortcode Execution Affiliate Plugin for WooCommerce <= 5.16.7.1 - Unauthenticated Arbitrary Shortcode Execution and Reflected Cross-Site Scripting No login needed ≤ 5.16.7.1 CVE-2024-12421 Wordfence
6.5 Medium WPMobile.App — Android and iOS Mobile Application Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 11.52 CVE-2024-12420 Wordfence
5.4 Medium SVG Shortcode Plugin svg-shortcode Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload ≤ 1.0.1 CVE-2024-12574 Wordfence
6.5 Medium WoodMart Theme Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 8.0.3 CVE-2024-12333 Wordfence
6.4 Medium Social Media Shortcodes Plugin social-media-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.0 CVE-2024-11871 Wordfence
4.3 Medium Snippet Shortcodes Plugin shortcode-variables Broken Access Control Authenticated (Subscriber+) Shortcode Deletion ≤ 4.1.6 CVE-2024-12018 Wordfence
6.4 Medium Arena.IM – Live Blogging for real-time events Plugin arena-liveblog-and-chat-tool Cross-Site Scripting Live Blogging for real-time events <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via arena_embed_amp Shortcode ≤ 0.4.1 CVE-2024-12463 Wordfence
6.4 Medium Surbma | SalesAutopilot Shortcode Plugin surbma-salesautopilot-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.5 CVE-2024-11433 Wordfence
4.7 Medium Login Widget With Shortcode Plugin login-sidebar-widget Open Redirect No login needed ≤ 6.1.2 CVE-2024-54255 Patchstack
4.3 Medium Shortcodes Plugin wc-shortcodes Broken Access Control No login needed ≤ 3.46 CVE-2023-23725 Patchstack
4.3 Medium Display custom fields in the frontend – Post and User Profile Fields Plugin shortcode-to-display-post-and-user-data Broken Access Control ≤ 1.2.0 Fixed in 1.2.1 CVE-2023-31073 Patchstack
4.3 Medium Shortcoder Plugin shortcoder Broken Access Control ≤ 6.3 Fixed in 6.3.1 CVE-2023-49849 Patchstack
6.1 Medium Shortcodes Blocks Creator Ultimate Plugin ultimate-shortcodes-creator Cross-Site Scripting Reflected Cross-Site Scripting via _wpnonce No login needed ≤ 2.2.0 CVE-2024-12167 Wordfence
6.1 Medium Shortcodes Blocks Creator Ultimate Plugin ultimate-shortcodes-creator Cross-Site Scripting Reflected Cross-Site Scripting via 'page' No login needed ≤ 2.2.0 CVE-2024-12166 Wordfence
6.3 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Arbitrary Shortcode Execution Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 4.0.51 CVE-2024-10681 Wordfence
6.3 Medium Pojo Forms Plugin pojo-forms Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode ≤ 1.4.7 CVE-2024-10909 Wordfence
6.4 Medium Cookielay Plugin cookielay Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode ≤ 1.2.0 CVE-2024-10320 Wordfence
6.4 Medium myCred – Loyalty Points and Rewards Plugin mycred Cross-Site Scripting Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode ≤ 2.7.5.2 CVE-2024-11201 Wordfence
6.4 Medium Contact Form Builder Plugin contact-form-with-a-meeting-scheduler-by-vcita Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode ≤ 4.10.4 CVE-2024-10056 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only