WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 51–82 of 82 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Sogrid Plugin sogrid Local File Inclusion No login needed ≤ 1.5.6 Fixed in 1.5.7 CVE-2024-54374 Patchstack
8.8 High Sogrid Plugin sogrid Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 1.5.2 Fixed in 1.5.5 CVE-2024-54352 Patchstack
7.1 High LabelGrid Tools Plugin label-grid-tools Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.58 Fixed in 1.3.59 CVE-2024-54341 Patchstack
8.8 High Product Carousel Slider & Grid Ultimate for WooCommerce Plugin woo-product-carousel-slider-and-grid-ultimate Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'theme' ≤ 1.9.10 CVE-2024-12040 Wordfence
7.3 High Grid Plus – Unlimited grid layout Plugin grid-plus Arbitrary Shortcode Execution Unlimited grid layout <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via grid_plus_load_by_category No login needed ≤ 1.3.5 CVE-2024-10910 Wordfence
8.8 High Free Responsive Testimonials, Social Proof Reviews, and Customer Reviews – Stars Testimonials Plugin stars-testimonials-with-slider-and-masonry-grid Local File Inclusion Stars Testimonials <= 3.3.3 - Authenticated (Contributor+) Local File Inclusion ≤ 3.3.3 CVE-2024-11429 Wordfence
7.2 High Total Upkeep Plugin boldgrid-backup Remote Code Execution Authenticated (Administrator+) Remote Code Execution via Backup Settings ≤ 1.16.6 CVE-2024-9461 Wordfence
8.1 High Sky Addons – Elementor Addons with Widgets & Templates Plugin sky-elementor-addons Cross-Site Request Forgery Cross-Site Request Forgery to Limited Arbitrary Options Update No login needed ≤ 2.6.1 CVE-2024-11601 Wordfence
8.1 High Sky Addons – Elementor Addons with Widgets & Templates Plugin sky-elementor-addons Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update ≤ 2.6.2 CVE-2024-11104 Wordfence
7.2 High Grid View Gallery Plugin grid-view-gallery PHP Object Injection Authenticated (Editor+) PHP Object Injection ≤ 1.0 CVE-2024-11409 Wordfence
7.3 High Filter & Grids Plugin ymc-smart-filter Authentication Bypass Broken Authentication No login needed ≤ 2.8.33 Fixed in 2.8.34 CVE-2024-39664 Patchstack
7.2 High WordPress Post Grid Layouts with Pagination – Sogrid Plugin sogrid Local File Inclusion Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion ≤ 1.5.6 CVE-2024-8392 Wordfence
8.8 High Post Grid Plugin post-grid SQL Injection Contributor+ SQL Injection < 2.1.13 Fixed in 2.1.13 CVE-2021-4450 Wordfence
7.5 High Justified Image Grid Plugin justified-image-grid Server-Side Request Forgery Unauthenticated Server Side Request Forgery (SSRF) No login needed ≤ 4.6.1 Fixed in 4.7 CVE-2024-43989 Patchstack
8.8 High Post Grid and Gutenberg Blocks Plugin post-grid Privilege Escalation Authenticated (Subscriber+) Privilege Escalation 2.2.87 – 2.2.90 CVE-2024-8253 Wordfence
8.2 High SendGrid Plugin wp-sendgrid-mailer SQL Injection No login needed ≤ 1.4 CVE-2024-43965 Patchstack
8.5 High JetGridBuilder Plugin jetgridbuilder Local File Inclusion ≤ 1.1.2 Fixed in 1.1.3 CVE-2024-43221 Patchstack
7.1 High Post Grid Master Plugin ajax-filter-posts Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.4.10 Fixed in 3.4.11 CVE-2024-43156 Patchstack
8.8 High ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.8.9 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation ≤ 5.8.9 CVE-2024-6411 Wordfence
8.3 High Essential Grid Plugin Broken Access Control Multiple Authenticated Broken Access Control ≤ 3.0.18 Fixed in 3.0.19 CVE-2023-47771 Patchstack
8.8 High Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX Plugin ultimate-post Broken Access Control PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update ≤ 4.1.2 CVE-2024-5326 Wordfence
7.5 High Total Upkeep Plugin boldgrid-backup Path Traversal Arbitrary File Download No login needed ≤ 1.15.8 Fixed in 1.15.9 CVE-2024-24869 Patchstack
7.5 High Grid Gallery – Photo Image Grid Gallery Plugin new-grid-gallery PHP Object Injection Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode ≤ 1.4.3 CVE-2024-1897 Wordfence
7.5 High Post Grid Plugin post-grid Information Disclosure Sensitive Data Exposure via API No login needed ≤ 2.2.78 Fixed in 2.2.79 CVE-2024-32816 Patchstack
7.2 High Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel Plugin wp-carousel-free PHP Object Injection Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Admin+) PHP Object Injection ≤ 2.6.3 CVE-2024-3020 Wordfence
7.1 High Post Grid Plugin post-grid Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.2.74 Fixed in 2.2.76 CVE-2024-30441 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection ≤ 5.7.8 Fixed in 5.7.9 CVE-2024-30491 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection ≤ 5.7.1 Fixed in 5.7.2 CVE-2024-30241 Patchstack
7.5 High Product Carousel Slider & Grid Ultimate for WooCommerce Plugin woo-product-carousel-slider-and-grid-ultimate PHP Object Injection Authenticated(Contributor+) PHP Object Injection ≤ 1.9.7 CVE-2024-1950 Wordfence
7.5 High Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Plugin logo-showcase-ultimate PHP Object Injection Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection ≤ 1.3.8 CVE-2024-1951 Wordfence
8.8 High Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Plugin post-grid-carousel-ultimate PHP Object Injection with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup ≤ 1.6.7 CVE-2024-2006 Wordfence
7.5 High Post Grid Combo – 36+ Gutenberg Blocks Plugin post-grid Information Disclosure Information Exposure via get_posts API Endpoint No login needed ≤ 2.2.68 CVE-2023-7072 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only