WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 51–67 of 67 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.1 Medium Push Notification for Post and BuddyPress Plugin push-notification-for-post-and-buddypress Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.06 CVE-2024-12407 Wordfence
4.3 Medium rtMedia for WordPress, BuddyPress and bbPress Plugin buddypress-media Broken Access Control ≤ 4.6.14 Fixed in 4.6.15 CVE-2023-41951 Patchstack
4.3 Medium BuddyPress Builder for Elementor – BuddyBuilder Plugin stax-buddy-builder Information Disclosure BuddyBuilder <= 1.7.4 - Authenticated (Contributor+) Post Disclosure ≤ 1.7.4 CVE-2024-10778 Wordfence
7.1 High BuddyPress Greeting Message Plugin bp-greeting-message Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.3 CVE-2024-49650 Patchstack
8.1 High BuddyPress Plugin buddypress Path Traversal Authenticated (Subscriber+) Directory Traversal ≤ 14.1.0 CVE-2024-10011 Wordfence
9.8 Critical BuddyPress Better Registration Plugin better-bp-registration Authentication Bypass Broken Authentication No login needed ≤ 1.6 CVE-2024-49247 Patchstack
4.3 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion ≤ 1.3.0 CVE-2024-9067 Wordfence
6.4 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Cross-Site Scripting BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode ≤ 1.3.0 CVE-2024-8987 Wordfence
6.1 Medium BuddyPress Docs Plugin buddypress-docs Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.2.3 CVE-2024-9207 Wordfence
6.5 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify SQL Injection BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection ≤ 1.2.5 CVE-2024-4742 Wordfence
6.4 Medium BuddyPress Plugin buddypress Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 12.5.0 CVE-2024-4892 Wordfence
10.0 Critical BuddyPress Cover Plugin bp-cover Arbitrary File Upload No login needed ≤ 2.1.4.2 CVE-2024-35746 Patchstack
5.3 Medium BuddyPress Members Only Plugin buddypress-members-only Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed ≤ 3.4.8 CVE-2024-0972 Wordfence
6.4 Medium BuddyPress Plugin buddypress Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 12.4.0 CVE-2024-3974 Wordfence
8.8 High rtMedia for WordPress, BuddyPress and bbPress Plugin buddypress-media SQL Injection Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode ≤ 4.6.18 CVE-2024-3293 Wordfence
7.3 High Youzify - Buddypress Moderation Plugin youzify-moderation Cross-Site Scripting Buddypress Moderation plugin <= 1.2.5 - Unauthenticated Cross Site Scripting (XSS) No login needed ≤ 1.2.5 CVE-2024-2864 Patchstack
8.8 High BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages Plugin wc4bp PHP Object Injection Authenticated (Subscriber+) PHP Object Injection in get_simple_request ≤ 3.4.20 CVE-2024-2025 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only