WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 51–85 of 85 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | 10WebAnalytics | Broken Access Control |
≤ 1.2.12 |
CVE-2023-47807 |
Patchstack | |
| 4.3 Medium | WP Crowdfunding | Broken Access Control |
≤ 2.1.5 Fixed in 2.1.6 |
CVE-2023-41870 |
Patchstack | |
| 4.3 Medium | WP Crowdfunding | Broken Access Control Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation |
≤ 2.1.12 |
CVE-2024-11911 |
Wordfence | |
| 6.4 Medium | WP Crowdfunding | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.1.15 |
CVE-2024-11910 |
Wordfence | |
| 6.6 Medium | WDesignkit | Arbitrary File Upload |
≤ 1.0.40 Fixed in 1.1.0 |
CVE-2024-53811 |
Patchstack | |
| 6.4 Medium | Pricing Tables For WPBakery Page Builder (formerly Visual Composer) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode |
≤ 1.4 |
CVE-2024-10175 |
Wordfence | |
| 6.4 Medium | Save as PDF Plugin by Pdfcrowd | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.2.1 |
CVE-2024-10891 |
Wordfence | |
| 4.3 Medium | Crowdsignal Dashboard – Polls, Surveys & more | Cross-Site Request Forgery No login needed |
≤ 3.1.3 Fixed in 3.1.4 |
CVE-2024-43338 |
Patchstack | |
| 7.1 High | Hebrew Date | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 2.1.0 Fixed in 2.3.0 |
CVE-2024-52388 |
Patchstack | |
| 6.5 Medium | Wd-image-magnifier-xoss | Cross-Site Scripting |
≤ 1.0 |
CVE-2024-51840 |
Patchstack | |
| 9.8 Critical | WDES Responsive Mobile Menu | PHP Object Injection No login needed |
≤ 5.3.18 |
CVE-2024-52414 |
Patchstack | |
| 6.4 Medium | WP Crowdfunding | Broken Access Control Settings Change |
≤ 2.1.10 Fixed in 2.1.11 |
CVE-2024-43937 |
Patchstack | |
| 7.1 High | CWD 3D Image Gallery | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0 |
CVE-2024-49632 |
Patchstack | |
| 6.4 Medium | WP Crowdfunding | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode |
≤ 2.1.11 |
CVE-2024-10117 |
Wordfence | |
| 6.1 Medium | 10Web Social Post Feed | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.2.9 |
CVE-2024-9607 |
Wordfence | |
| 7.1 High | CJ Change Howdy | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 3.3.1 |
CVE-2024-49223 |
Patchstack | |
| 4.8 Medium | Slider by 10Web | Cross-Site Scripting Admin+ Stored XSS |
< 1.2.59 Fixed in 1.2.59 |
CVE-2024-8283 |
WPScan | |
| 8.8 High | Slider by 10Web – Responsive Image Slider | SQL Injection Responsive Image Slider <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter |
≤ 1.2.57 |
CVE-2024-7150 |
Wordfence | |
| 8.8 High | FundEngine – Donation and Crowdfunding Platform | Privilege Escalation Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation |
≤ 1.7.0 |
CVE-2024-6698 |
Wordfence | |
| 5.4 Medium | Slider by 10Web | Cross-Site Scripting Editor+ Stored XSS |
< 1.2.57 Fixed in 1.2.57 |
CVE-2024-6408 |
WPScan | |
| 5.4 Medium | IgnitionDeck Crowdfunding Platform | Broken Access Control Missing Authorization |
≤ 1.9.8 |
CVE-2024-4410 |
Wordfence | |
| 5.9 Medium | Save as PDF plugin by Pdfcrowd | Cross-Site Scripting |
≤ 4.0.0 Fixed in 4.0.1 |
CVE-2024-37549 |
Patchstack | |
| 6.1 Medium | Slider by 10Web | Cross-Site Scripting Editor+ Stored XSS No login needed |
< 1.2.56 Fixed in 1.2.56 |
CVE-2024-6026 |
WPScan | |
| 5.3 Medium | WP Fundraising Donation and Crowdfunding Platform | Broken Access Control Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control No login needed |
≤ 1.6.4 Fixed in 1.7.0 |
CVE-2024-34758 |
Patchstack | |
| 6.5 Medium | Save as PDF plugin by Pdfcrowd | Cross-Site Scripting |
≤ 3.2.3 Fixed in 3.3.0 |
CVE-2024-35649 |
Patchstack | |
| 6.5 Medium | Save as PDF plugin by Pdfcrowd | Broken Access Control Broken Access Control to Stored XSS |
≤ 3.2.0 Fixed in 3.2.1 |
CVE-2024-33684 |
Patchstack | |
| 7.1 High | Slider by 10Web | Cross-Site Scripting No login needed |
≤ 1.2.54 Fixed in 1.2.55 |
CVE-2024-32578 |
Patchstack | |
| 5.9 Medium | Save as PDF plugin by Pdfcrowd | Cross-Site Scripting |
≤ 3.2.1 Fixed in 3.2.2 |
CVE-2024-31930 |
Patchstack | |
| 5.9 Medium | Save as Image plugin by Pdfcrowd | Cross-Site Scripting |
≤ 3.2.1 Fixed in 3.2.2 |
CVE-2024-31931 |
Patchstack | |
| 7.6 High | 10Web Map Builder for Google Maps | SQL Injection |
≤ 1.0.74 |
CVE-2024-31116 |
Patchstack | |
| 5.4 Medium | Crowdsignal Dashboard – Polls, Surveys & more | Cross-Site Request Forgery No login needed |
≤ 3.0.11 Fixed in 3.1.0 |
CVE-2023-51489 |
Patchstack | |
| 7.1 High | Crowdsignal Dashboard – Polls, Surveys & more | Cross-Site Scripting Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS) No login needed |
≤ 3.0.11 Fixed in 3.1.0 |
CVE-2023-51488 |
Patchstack | |
| 7.2 High | Contact Form by WD | SQL Injection Admin+ SQLi |
≤ 1.13.23 |
CVE-2023-2655 |
WPScan | |
| 4.8 Medium | WP Crowdfunding | Cross-Site Scripting Admin+ Stored XSS |
< 2.1.10 Fixed in 2.1.10 |
CVE-2023-6163 |
WPScan | |
| 6.1 Medium | WP Crowdfunding | Cross-Site Scripting Reflected XSS No login needed |
< 2.1.9 Fixed in 2.1.9 |
CVE-2023-6161 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.