WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 901–950 of 1,279 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | LUNA RADIO PLAYER | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 6.24.11.07 |
CVE-2024-10881 |
Wordfence | |
| 6.4 Medium | Listdom – Business Directory and Classified Ads Listings | Cross-Site Scripting Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter |
≤ 3.7.0 |
CVE-2024-11854 |
Wordfence | |
| 6.5 Medium | BP Profile Shortcodes Extra | SQL Injection Authenticated (Contributor+) SQL Injection via tab Parameter |
≤ 2.6.0 |
CVE-2024-11732 |
Wordfence | |
| 6.4 Medium | Ragic Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.2 |
CVE-2024-11431 |
Wordfence | |
| 6.4 Medium | Pricing Tables For WPBakery Page Builder (formerly Visual Composer) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode |
≤ 1.4 |
CVE-2024-10175 |
Wordfence | |
| 6.4 Medium | Spotify Play Button | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode |
≤ 2.11 |
CVE-2024-11192 |
Wordfence | |
| 6.4 Medium | BNE Gallery Extended | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode |
≤ 1.2.1 |
CVE-2024-11119 |
Wordfence | |
| 5.5 Medium | Booster for WooCommerce | Cross-Site Scripting Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode |
≤ 7.2.3 |
CVE-2024-9170 |
Wordfence | |
| 6.1 Medium | Multiple Plugins <= (Various Versions) | Cross-Site Scripting Reflected Cross-Site Scripting via cminds_free_guide Shortcode No login needed |
≤ 1.2.1, ≤ 1.4.1, ≤ 1.4.2, … |
CVE-2024-11202 |
Wordfence | |
| 6.3 Medium | InPost Gallery | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template |
≤ 2.1.4.2 |
CVE-2024-11002 |
Wordfence | |
| 6.8 Medium | YaDisk Files | Cross-Site Scripting Contributor+ Stored XSS via Shortcode |
≤ 1.2.5 |
CVE-2024-10709 |
WPScan | |
| 6.4 Medium | 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 | Cross-Site Scripting 우커머스 결제 플러그인 <= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcode |
≤ 5.1.4 |
CVE-2024-11228 |
Wordfence | |
| 6.4 Medium | 코드엠샵 소셜톡 | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodes |
≤ 1.1.18 |
CVE-2024-11229 |
Wordfence | |
| 6.4 Medium | 우커머스 네이버페이 | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode |
≤ 3.3.7 |
CVE-2024-11231 |
Wordfence | |
| 6.4 Medium | Rescue Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode |
≤ 2.9 |
CVE-2024-11199 |
Wordfence | |
| 6.4 Medium | Memberlite Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcode |
≤ 1.3.9 |
CVE-2024-11227 |
Wordfence | |
| 6.4 Medium | Beds24 Online Booking | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode |
≤ 2.0.27 |
CVE-2024-10177 |
Wordfence | |
| 6.1 Medium | Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes | Cross-Site Scripting Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting No login needed |
≤ 1.1.6 |
CVE-2024-11365 |
Wordfence | |
| 6.4 Medium | WPBakery Visual Composer WHMCS Elements | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode |
≤ 1.0.4 |
CVE-2024-10172 |
Wordfence | |
| 4.3 Medium | UltraAddons for Elementor | Broken Access Control Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode |
≤ 1.1.8 |
CVE-2024-10696 |
Wordfence | |
| 6.4 Medium | Premium Packages - Sell Digital Products Securely | Cross-Site Scripting Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode |
≤ 5.9.3 |
CVE-2024-10164 |
Wordfence | |
| 6.5 Medium | Moka Get Posts Shortcode | Cross-Site Scripting |
≤ 1.0 |
CVE-2024-51804 |
Patchstack | |
| 6.5 Medium | Lewe Bootstrap Visuals | Cross-Site Scripting |
≤ 3.0.1 |
CVE-2024-51810 |
Patchstack | |
| 6.5 Medium | Add Ribbon Shortcode | Cross-Site Scripting |
≤ 1.0.1 |
CVE-2024-51823 |
Patchstack | |
| 6.5 Medium | Boombox Shortcode | Cross-Site Scripting |
≤ 1.0.0 |
CVE-2024-51827 |
Patchstack | |
| 6.5 Medium | Image Carousel Shortcode | Cross-Site Scripting |
≤ 1.2 |
CVE-2024-51842 |
Patchstack | |
| 6.5 Medium | Redirecter | Cross-Site Scripting |
≤ 1.0 |
CVE-2024-51855 |
Patchstack | |
| 6.5 Medium | Olympus Shortcodes | Cross-Site Scripting |
≤ 1.0.4 |
CVE-2024-51857 |
Patchstack | |
| 6.5 Medium | Shortcode Collection | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.4 |
CVE-2024-51864 |
Patchstack | |
| 6.5 Medium | AchillesTheme-shortcodes | Cross-Site Scripting |
≤ 0.1 |
CVE-2024-51878 |
Patchstack | |
| 6.5 Medium | Be Shortcodes | Cross-Site Scripting |
≤ 1.0.0 |
CVE-2024-51881 |
Patchstack | |
| 6.5 Medium | Geoportail Shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 2.4.4 |
CVE-2024-51890 |
Patchstack | |
| 6.5 Medium | Semantic Shortcode | Cross-Site Scripting |
≤ 1.0.1 |
CVE-2024-51898 |
Patchstack | |
| 6.5 Medium | Embed documents shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.5 |
CVE-2024-51904 |
Patchstack | |
| 6.5 Medium | Testimonial Slider Shortcode | Cross-Site Scripting |
≤ 1.1.9 |
CVE-2024-51925 |
Patchstack | |
| 6.4 Medium | Email Subscription Popup | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode |
≤ 1.2.22 |
CVE-2024-11195 |
Wordfence | |
| 6.4 Medium | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | Cross-Site Scripting Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode |
≤ 5.8 |
CVE-2024-10268 |
Wordfence | |
| 6.3 Medium | Drop Shadow Boxes | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution |
≤ 1.7.14 |
CVE-2024-10262 |
Wordfence | |
| 6.4 Medium | Steel | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode |
≤ 1.3.0 |
CVE-2024-10147 |
Wordfence | |
| 6.4 Medium | WP AdCenter – Ad Manager & Adsense Ads | Cross-Site Scripting Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode |
≤ 2.5.7 |
CVE-2024-10113 |
Wordfence | |
| 6.4 Medium | Social Proof (Testimonials) Slider | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode |
≤ 2.2.4 |
CVE-2024-8985 |
Wordfence | |
| 5.3 Medium | Hide Links | Arbitrary Shortcode Execution Unauthenticated Shortcode Execution No login needed |
≤ 1.4.2 |
CVE-2024-9578 |
Wordfence | |
| 6.4 Medium | Slickstream: Engagement and Conversions | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode |
≤ 1.4.4 |
CVE-2024-10179 |
Wordfence | |
| 6.5 Medium | Postcasa Shortcode | Cross-Site Scripting |
≤ 1.0 |
CVE-2024-52352 |
Patchstack | |
| 6.5 Medium | Web Stories Widgets For Elementor | Cross-Site Scripting |
≤ 1.1 Fixed in 1.1.1 |
CVE-2024-52354 |
Patchstack | |
| 6.5 Medium | ML Responsive Audio player with playlist Shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 0.2 |
CVE-2024-51573 |
Patchstack | |
| 6.5 Medium | AMP Img Shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.0.1 |
CVE-2024-51576 |
Patchstack | |
| 6.5 Medium | Emoji Shortcode | Cross-Site Scripting |
≤ 1.0.0 |
CVE-2024-51609 |
Patchstack | |
| 6.5 Medium | Display Terms Shortcode | Cross-Site Scripting |
≤ 1.0.4 |
CVE-2024-51610 |
Patchstack | |
| 6.5 Medium | Reftagger Shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.1 |
CVE-2024-51612 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.