WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 951–1,000 of 1,359 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 20 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium OSM Map Widget for Elementor Plugin osm-map-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 1.2.2 CVE-2024-4663 Wordfence
6.4 Medium PDF Viewer for Elementor Plugin pdf-viewer-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via render ≤ 2.9.3 CVE-2024-0845 Wordfence
6.4 Medium Stratum – Elementor Widgets Plugin stratum Cross-Site Scripting Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 1.4.1 CVE-2024-5611 Wordfence
6.4 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Tabs and JKit - Accordion Widgets ≤ 2.6.5 CVE-2024-4479 Wordfence
6.4 Medium ElementsKit Elementor addons and Templates Library Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Motion Text and Table Widgets ≤ 3.6.2 CVE-2024-5263 Wordfence
6.4 Medium EleSpare – News, Magazine and Blog Addons for Elementor Plugin elespare Cross-Site Scripting Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget ≤ 3.1.2 CVE-2024-4615 Wordfence
6.4 Medium PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget ≤ 2.7.20 CVE-2024-5787 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget ≤ 1.6.35 CVE-2024-5757 Wordfence
5.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget ≤ 1.13.3 CVE-2024-2092 Wordfence
6.4 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Plugin bdthemes-element-pack-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via onclick events ≤ 5.6.11 CVE-2024-3925 Wordfence
6.4 Medium CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More Plugin woolementor Cross-Site Scripting Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 4.4.1 CVE-2024-4564 Wordfence
4.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 4.10.33 CVE-2024-5553 Wordfence
6.4 Medium Events Addon for Elementor Plugin events-addon-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.1.4 CVE-2024-4669 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.23 CVE-2024-5189 Wordfence
4.3 Medium Elementor Website Builder Plugin elementor Broken Access Control ≤ 3.13.2 Fixed in 3.13.3 CVE-2023-33922 Patchstack
5.3 Medium MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Plugin metform Information Disclosure Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure No login needed ≤ 3.8.8 CVE-2024-4266 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget ≤ 2.9.0 CVE-2024-5530 Wordfence
4.3 Medium Bosa Elementor Addons and Templates for WooCommerce Plugin bosa-elementor-for-woocommerce Broken Access Control ≤ 1.0.12 Fixed in 1.0.13 CVE-2024-35724 Patchstack
4.3 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Broken Access Control ≤ 1.3.6 Fixed in 1.3.7.4 CVE-2024-35725 Patchstack
5.3 Medium RomethemeForm For Elementor Plugin romethemeform Broken Access Control No login needed ≤ 1.1.2 Fixed in 1.1.3 CVE-2024-32727 Patchstack
4.3 Medium Advanced Testimonial Carousel for Elementor Plugin advanced-testimonial-carousel-for-elementor Broken Access Control ≤ 3.0.0 Fixed in 3.0.1 CVE-2024-32783 Patchstack
6.5 Medium Master Addons for Elementor Plugin master-addons Broken Access Control Broken Access Control on API No login needed ≤ 2.0.5.4.1 Fixed in 2.0.5.6 CVE-2024-35660 Patchstack
6.5 Medium Master Addons for Elementor Plugin master-addons Cross-Site Scripting ≤ 2.0.5.9 Fixed in 2.0.6.0 CVE-2024-35688 Patchstack
6.5 Medium Master Addons for Elementor Plugin master-addons Cross-Site Scripting ≤ 2.0.6.0 Fixed in 2.0.6.1 CVE-2024-35702 Patchstack
6.5 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Cross-Site Scripting ≤ 3.5.3 Fixed in 3.5.4 CVE-2024-35703 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.5.4 Fixed in 5.5.5 CVE-2024-35709 Patchstack
6.5 Medium Testimonial Carousel For Elementor Plugin testimonials-carousel-elementor Cross-Site Scripting ≤ 10.1.1 Fixed in 10.2.0 CVE-2024-35713 Patchstack
6.5 Medium Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor Plugin master-addons Broken Access Control Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification No login needed ≤ 2.0.6.1 CVE-2024-5382 Wordfence
6.4 Medium Royal Elementor Addons and Templates Plugin royal-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.976 CVE-2024-4488 Wordfence
6.4 Medium Royal Elementor Addons and Templates Plugin royal-elementor-addons Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG Uploads ≤ 1.3.976 CVE-2024-4489 Wordfence
6.4 Medium Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Plugin bdthemes-prime-slider-lite Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget ≤ 3.14.7 CVE-2024-5640 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget ≤ 5.8.15 CVE-2024-5612 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.22 CVE-2024-5188 Wordfence
6.4 Medium ElementsReady Addons for Elementor Plugin element-ready-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.1.0 CVE-2024-5152 Wordfence
6.4 Medium Magical Addons For Elementor Plugin magical-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.39 CVE-2024-5161 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via URLs ≤ 2.1.2 CVE-2024-4458 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets ≤ 2.1.2 CVE-2024-4212 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles ≤ 2.1.2 CVE-2024-4459 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags ≤ 2.1.2 CVE-2024-2922 Wordfence
6.4 Medium Qi Addons For Elementor Plugin qi-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget ≤ 1.7.2 CVE-2024-4364 Wordfence
6.4 Medium Clever Addons for Elementor Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets ≤ 2.1.9 CVE-2024-2350 Wordfence
6.4 Medium Image Hover Effects for Elementor with Lightbox and Flipbox Plugin image-hover-effects-with-carousel Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters ≤ 3.0.2 CVE-2024-5001 Wordfence
5.3 Medium Restrict for Elementor Plugin restrict-for-elementor Information Disclosure Protection Mechanism Bypass No login needed ≤ 1.0.7 CVE-2024-0910 Wordfence
4.3 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Broken Access Control Missing Authorization to Page/Post Creation ≤ 1.3.5 CVE-2024-4788 Wordfence
4.3 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Broken Access Control ≤ 1.5.109 Fixed in 1.5.110 CVE-2024-35674 Patchstack
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget ≤ 4.0.1 CVE-2024-5571 Wordfence
6.4 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter ≤ 1.3.2 CVE-2024-5006 Wordfence
5.3 Medium Move Addons for Elementor Plugin move-addons Broken Access Control No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-30525 Patchstack
4.3 Medium RT Easy Builder – Advanced addons for Elementor Plugin rt-easy-builder-advanced-addons-for-elementor Broken Access Control ≤ 2.0 Fixed in 2.1 CVE-2024-30484 Patchstack
6.5 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting ≤ 2.1.2 CVE-2024-35666 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only