WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 51–75 of 75 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode ≤ 7.2.3 CVE-2024-9170 Wordfence
6.1 Medium Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 7.2.3 CVE-2024-9239 Wordfence
8.1 High Ads Booster by Ads Pro Plugin free-wp-booster-by-ads-pro Local File Inclusion No login needed ≤ 1.12 CVE-2024-52428 Patchstack
4.3 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 1.3.6 CVE-2024-10794 Wordfence
4.3 Medium Asset CleanUp: Page Speed Booster Plugin wp-asset-clean-up Broken Access Control ≤ 1.3.9.3 Fixed in 1.3.9.4 CVE-2024-43314 Patchstack
6.5 Medium Blockbooster Theme blockbooster Broken Access Control No login needed ≤ 1.0.10 Fixed in 1.0.11 CVE-2024-43979 Patchstack
9.8 Critical Giveaway Boost Plugin giveaway-boost PHP Object Injection No login needed ≤ 2.1.4 CVE-2024-49332 Patchstack
7.2 High Boost Your Blog's Engagement with WP Post Author Plugin wp-post-author SQL Injection Authenticated (Administrator+) SQL Injection ≤ 3.8.1 CVE-2024-8757 Wordfence
6.4 Medium Marketing and SEO Booster Plugin marketing-and-seo-booster Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.9.10 CVE-2024-9066 Wordfence
6.5 Medium Booster Plus for WooCommerce Plugin Information Disclosure Authenticated Arbitrary WordPress Option Disclosure < 7.1.3 Fixed in 7.1.3 CVE-2023-52230 Patchstack
6.5 Medium Booster Plus for WooCommerce Plugin Broken Access Control Authenticated Arbitrary Post/Page Deletion < 7.1.2 Fixed in 7.1.2 CVE-2023-52232 Patchstack
4.3 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Broken Access Control Missing Authorization to Page/Post Creation ≤ 1.3.5 CVE-2024-4788 Wordfence
6.4 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter ≤ 1.3.2 CVE-2024-5006 Wordfence
6.5 Medium Booster Elite for WooCommerce Plugin Authentication Bypass Authenticated Production Creation/Modification < 7.1.3 Fixed in 7.1.3 CVE-2023-51511 Patchstack
6.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Authentication Bypass Authenticated Production Creation/Modification ≤ 7.1.2 Fixed in 7.1.3 CVE-2023-48747 Patchstack
5.3 Medium Booster Extension Plugin booster-extension Information Disclosure Basic Information Exposure via booster_extension_authorbox_shortcode_display No login needed ≤ 1.2.0 CVE-2024-2109 Wordfence
6.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 7.1.8 CVE-2024-3957 Wordfence
4.3 Medium SEO Booster Plugin seo-booster Cross-Site Request Forgery No login needed ≤ 3.8.9 Fixed in 3.8.10 CVE-2024-32438 Patchstack
6.5 Medium Booster Plus for WooCommerce Plugin Information Disclosure Auth. Sensitive Data Exposure < 7.1.2 Fixed in 7.1.2 CVE-2023-52231 Patchstack
6.5 Medium Booster Elite for WooCommerce Plugin Information Disclosure Auth. Sensitive Data Exposure < 7.1.2 Fixed in 7.1.2 CVE-2023-52234 Patchstack
7.1 High Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 7.1.7 Fixed in 7.1.8 CVE-2024-29760 Patchstack
8.8 High Elite Booster for WooCommerce Plugin woocommerce-jetpack Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload ≤ 7.1.7 CVE-2024-1986 Wordfence
6.4 Medium Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde ≤ 7.1.7 CVE-2024-1534 Wordfence
5.3 Medium Build & Control Block Patterns – Boost up Gutenberg Editor Plugin control-block-patterns Broken Access Control Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization No login needed ≤ 1.3.5.4 CVE-2024-1095 Wordfence
6.4 Medium Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 7.1.6 CVE-2024-1054 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only