WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 51–100 of 104 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection No login needed ≤ 3.19.4 CVE-2025-0912 Wordfence
5.8 Medium Give – Divi Donation Modules Plugin give-donation-modules-for-divi Information Disclosure Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure No login needed ≤ 2.0.0 Fixed in 2.0.1 CVE-2025-22633 Patchstack
6.1 Medium Accept Donations with PayPal & Stripe Plugin easy-paypal-donation Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.4.4 CVE-2024-13728 Wordfence
6.4 Medium CanadaHelps Embedded Donation Plugin embedded-cdn Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.1 CVE-2024-11778 Wordfence
7.1 High Paytm Payment Donation Plugin paytm-donation Cross-Site Scripting Donation Plugin plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2025-24635 Patchstack
7.1 High SKT Donation Plugin skt-donation Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.9 Fixed in 2.0 CVE-2025-24535 Patchstack
6.4 Medium Philantro – Donations and Donor Management Plugin philantro Cross-Site Scripting Donations and Donor Management <= 5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via donate Shortcode ≤ 5.3 CVE-2024-13527 Wordfence
7.1 High Causes – Donation Plugin causes Cross-Site Scripting Donation plugin <= 1.0.01 - Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.01 CVE-2025-23621 Patchstack
6.5 Medium Charity-thermometer Plugin charitydonation-thermometer Cross-Site Scripting ≤ 1.1.2 CVE-2025-23860 Patchstack
9.8 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.19.2 - Unauthenticated PHP Object Injection No login needed ≤ 3.19.2 CVE-2024-12877 Wordfence
6.5 Medium Donation Block For PayPal Plugin donations-block Cross-Site Scripting ≤ 2.2.0 Fixed in 2.3.1 CVE-2025-22525 Patchstack
6.4 Medium Quill Forms | Conversational Multi Step Forms, Surveys & quizzes Plugin quillforms Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.10.0 CVE-2024-11826 Wordfence
6.1 Medium GTPayment Donations Plugin Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 1.0.0 CVE-2024-11607 WPScan
6.4 Medium Philantro – Donations and Donor Management Plugin philantro Cross-Site Scripting Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.2 CVE-2024-12500 Wordfence
4.3 Medium Donations Made Easy – Smart Donations Plugin smart-donations Broken Access Control Smart Donations plugin <= 4.0.12 - Broken Access Control ≤ 4.0.12 CVE-2023-38475 Patchstack
6.5 Medium Stripe Donation Plugin bin-stripe-donation Cross-Site Scripting ≤ 1.2.5 CVE-2024-53752 Patchstack
6.1 Medium Kudos Donations – Easy donations and payments with Mollie Plugin kudos-donations Cross-Site Scripting Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting No login needed ≤ 3.2.9 CVE-2024-11684 Wordfence
6.1 Medium Kudos Donations – Easy donations and payments with Mollie Plugin kudos-donations Cross-Site Scripting Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg' No login needed ≤ 3.2.9 CVE-2024-11685 Wordfence
6.1 Medium Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Plugin charitable Cross-Site Scripting Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting No login needed ≤ 1.8.3 CVE-2024-10876 Wordfence
6.5 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37510 Patchstack
5.3 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37506 Patchstack
5.3 Medium AidWP Plugin wp-stripe-donation Broken Access Control No login needed ≤ 3.2.3 Fixed in 3.2.4 CVE-2024-50459 Patchstack
7.1 High Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'create_mollie_profile' ≤ 4.3.7 CVE-2023-7294 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_mollie_account_details' ≤ 4.3.7 CVE-2023-7293 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_notice_dismiss' ≤ 4.3.7 CVE-2023-7292 Wordfence
7.1 High Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'create_mollie_account' ≤ 4.3.7 CVE-2023-7291 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_for_verified_profiles' ≤ 4.3.7 CVE-2023-7290 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_sw_save_api_keys' ≤ 4.3.7 CVE-2023-7289 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'update_profile_preference' ≤ 4.3.7 CVE-2023-7288 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'pt_cancel_subscription' ≤ 4.3.7 CVE-2023-7287 Wordfence
9.8 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution No login needed ≤ 3.16.3 CVE-2024-9634 Wordfence
9.8 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection No login needed ≤ 3.16.1 CVE-2024-8353 Wordfence
7.2 High GiveWP – Donation Plugin and Fundraising Platform Plugin give SQL Injection Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter ≤ 3.16.1 CVE-2024-9130 Wordfence
5.4 Medium GiveWP Plugin give Cross-Site Request Forgery Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) No login needed ≤ 3.15.1 Fixed in 3.16.0 CVE-2024-47315 Patchstack
9.8 Critical Donation Forms by Charitable – Donations Plugin & Fundraising Platform Plugin charitable Broken Access Control Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation No login needed ≤ 1.8.1.14 CVE-2024-8791 Wordfence
6.5 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update No login needed ≤ 3.13.0 CVE-2024-5940 Wordfence
5.3 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure No login needed ≤ 3.13.0 CVE-2024-5939 Wordfence
10.0 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution No login needed ≤ 3.14.1 CVE-2024-5932 Wordfence
5.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion ≤ 3.14.1 CVE-2024-5941 Wordfence
8.8 High FundEngine – Donation and Crowdfunding Platform Plugin wp-fundraising-donation Privilege Escalation Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation ≤ 1.7.0 CVE-2024-6698 Wordfence
6.8 Medium Donation Block for PayPal Plugin donations-block Cross-Site Scripting Unauthenticated Stored XSS ≤ 2.1.0 CVE-2024-6021 WPScan
5.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions ≤ 3.13.0 CVE-2024-5977 Wordfence
6.1 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin Cross-Site Scripting Contributor+ Stored XSS No login needed ≤ 1.7 CVE-2024-5448 WPScan
5.4 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.7 CVE-2024-5447 WPScan
9.8 Critical Lifeline Donation Plugin lifeline-donation Authentication Bypass No login needed ≤ 1.2.6 CVE-2024-5432 Wordfence
5.3 Medium WP Fundraising Donation and Crowdfunding Platform Plugin wp-fundraising-donation Broken Access Control Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control No login needed ≤ 1.6.4 Fixed in 1.7.0 CVE-2024-34758 Patchstack
6.5 Medium Recurring PayPal Donations Plugin recurring-donation Cross-Site Scripting ≤ 1.7 Fixed in 1.8 CVE-2024-35676 Patchstack
4.4 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin paypal-pay-buy-donation-and-cart-buttons-shortcode Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 1.7 CVE-2024-3065 Wordfence
6.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Cross-Site Scripting Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.10.0 CVE-2024-3714 Wordfence
7.5 High Easy Accept Payments Plugin wordpress-easy-paypal-payment-or-donation-accept-plugin Broken Access Control No login needed ≤ 4.9.10 Fixed in 5.0 CVE-2024-33591 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only