WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 951–1,000 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 20 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium myCred Plugin mycred Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode ≤ 2.7.4 CVE-2024-10187 Wordfence
6.4 Medium Simple Shortcode for Google Maps Plugin simple-google-maps-short-code Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.5.4 CVE-2024-10621 Wordfence
6.4 Medium Event Post Plugin event-post Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode ≤ 5.9.6 CVE-2024-10186 Wordfence
6.4 Medium Active Products Tables for WooCommerce. Use constructor to create tables Plugin profit-products-tables-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode ≤ 1.0.6.4 CVE-2024-10168 Wordfence
4.3 Medium Contact Form 7 – Dynamic Text Extension Plugin contact-form-7-dynamic-text-extension Information Disclosure Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode ≤ 4.5 CVE-2024-10084 Wordfence
6.4 Medium Shortcodes Blocks Creator Ultimate Plugin ultimate-shortcodes-creator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.1.3 CVE-2024-10340 Wordfence
6.5 Medium Elo Rating Shortcode Plugin elo-rating-shortcode Cross-Site Scripting ≤ 1.0.3 Fixed in 1.0.4 CVE-2024-51678 Patchstack
5.3 Medium Arconix Shortcodes Plugin arconix-shortcodes Broken Access Control No login needed ≤ 2.1.11 Fixed in 2.1.12 CVE-2024-38769 Patchstack
6.4 Medium AtomChat Plugin atomchat Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode ≤ 1.1.5 CVE-2024-10232 Wordfence
6.5 Medium SIP Reviews Shortcode for WooCommerce Plugin sip-reviews-shortcode-woocommerce SQL Injection Authenticated (Contributor+) SQL Injection ≤ 1.2.3 CVE-2024-6479 Wordfence
6.4 Medium SIP Reviews Shortcode for WooCommerce Plugin sip-reviews-shortcode-woocommerce Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting ≤ 1.2.3 CVE-2024-6480 Wordfence
6.4 Medium WP Simple Anchors Links Plugin wp-simple-anchors-links Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode ≤ 1.0.0 CVE-2024-9446 Wordfence
6.4 Medium HT Team Member Plugin ht-team-member Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode ≤ 1.1.4 CVE-2024-10223 Wordfence
6.4 Medium Widget or Sidebar Shortcode Plugin widget-or-sidebar-per-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.6.1 CVE-2024-9885 Wordfence
6.4 Medium WP Baidu Map Plugin wp-baidu-map Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.2.2 CVE-2024-9886 Wordfence
6.4 Medium T(-) Countdown Plugin t-countdown Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.4.8 CVE-2024-9884 Wordfence
6.4 Medium Arconix Shortcodes Plugin arconix-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode ≤ 2.1.13 CVE-2024-10226 Wordfence
6.4 Medium Newsletters Plugin newsletters-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode ≤ 4.9.9.4 CVE-2024-10181 Wordfence
6.4 Medium SMSAlert - WooCommerce Plugin sms-alert Cross-Site Scripting WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode ≤ 3.7.5 CVE-2024-10233 Wordfence
6.4 Medium StreamWeasels YouTube Integration Plugin streamweasels-youtube-integration Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode ≤ 1.3.2 CVE-2024-10185 Wordfence
6.4 Medium SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams Plugin streamweasels-kick-integration Cross-Site Scripting Blocks and Shortcodes for Embedding Kick Streams <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode ≤ 1.1.1 CVE-2024-10184 Wordfence
6.4 Medium affiliate-toolkit Plugin affiliate-toolkit-starter Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode ≤ 3.6.5 CVE-2024-10227 Wordfence
6.5 Medium CodePen Embedded Pens Shortcode Plugin codepen-embedded-pen-shortcode Cross-Site Scripting ≤ 1.0.2 Fixed in 1.0.3 CVE-2024-50440 Patchstack
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode ≤ 2.1.11 CVE-2024-10117 Wordfence
6.4 Medium WP show more Plugin wp-show-more Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode ≤ 1.0.7 CVE-2024-9967 Wordfence
6.4 Medium WP-Members Plugin wp-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode ≤ 3.4.9.5 CVE-2024-10374 Wordfence
6.4 Medium Simple News Plugin simple-news Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode ≤ 2.8 CVE-2024-10112 Wordfence
6.4 Medium Beek Widget Extention Plugin beek-widget-extention Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.9.5 CVE-2024-10343 Wordfence
6.4 Medium Bamazoo – Button Generator Plugin bamazoo-button-generator Cross-Site Scripting Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode ≤ 1.0 CVE-2024-10150 Wordfence
6.4 Medium League of Legends Shortcodes Plugin league-of-legends-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2024-10342 Wordfence
6.5 Medium League of Legends Shortcodes Plugin league-of-legends-shortcodes SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 1.0.1 CVE-2024-10341 Wordfence
6.4 Medium Awesome buttons Plugin wp-awesome-buttons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode ≤ 1.0 CVE-2024-10148 Wordfence
6.4 Medium Contact Form 7 - Repeatable Fields Plugin cf7-repeatable-fields Cross-Site Scripting Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode ≤ 2.0.1 CVE-2024-10180 Wordfence
6.4 Medium Compact WP Audio Player Plugin compact-wp-audio-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode ≤ 1.9.13 CVE-2024-10176 Wordfence
4.3 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Information Disclosure Authenticated (Contributor+) Information Disclosure via Shortcode ≤ 1.6.43 CVE-2024-10050 Wordfence
5.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 7.2.2 CVE-2024-8500 Wordfence
6.4 Medium Anchor Episodes Index (Spotify for Podcasters) Plugin anchor-episodes-index Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode ≤ 2.1.10 CVE-2024-10189 Wordfence
6.4 Medium StreamWeasels Twitch Integration Plugin streamweasels-twitch-integration Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed Shortcode ≤ 1.8.6 CVE-2024-9897 Wordfence
6.4 Medium Advanced Category and Custom Taxonomy Image Plugin advanced-category-and-custom-taxonomy-image Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode ≤ 1.0.9 CVE-2024-9425 Wordfence
6.4 Medium RSS Feed Widget Plugin rss-feed-widget Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode ≤ 2.9.9 CVE-2024-10057 Wordfence
6.4 Medium Click to Chat – WP Support All-in-One Floating Widget Plugin support-chat Cross-Site Scripting WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode ≤ 2.3.3 CVE-2024-10055 Wordfence
6.4 Medium Arconix Shortcodes Plugin arconix-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.1.12 CVE-2024-9703 Wordfence
6.4 Medium Flat UI Button Plugin flat-ui-button Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode 1.0 CVE-2024-10014 Wordfence
6.5 Medium Shortcode For Elementor Templates Plugin shortcode-support-for-elementor-templates Cross-Site Scripting ≤ 1.0.0 CVE-2024-48022 Patchstack
6.4 Medium Parallax Image Plugin parallax-image Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode ≤ 1.8 CVE-2024-9898 Wordfence
6.4 Medium Smart Online Order for Clover Plugin clover-online-orders Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode ≤ 1.5.7 CVE-2024-9895 Wordfence
6.4 Medium Rescue Shortcodes Plugin rescue-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.8 CVE-2024-9696 Wordfence
6.4 Medium Social Sharing (by Danny) Plugin dvk-social-sharing Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.7 CVE-2024-9704 Wordfence
6.4 Medium WP Ultimate Post Grid Plugin wp-ultimate-post-grid Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode ≤ 3.9.3 CVE-2024-9051 Wordfence
6.4 Medium Powerpress Plugin powerpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode ≤ 11.9.18 CVE-2024-9543 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only