WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,001–1,050 of 1,401 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 21 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Student+ Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56052 Patchstack
9.1 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Instructor+ Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56054 Patchstack
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56057 Patchstack
9.8 Critical WooCommerce PDF Vouchers Plugin woocommerce-pdf-vouchers Authentication Bypass PDF Vouchers plugin < 4.9.9 - Broken Authentication No login needed ≤ 4.9.9 Fixed in 4.9.9 CVE-2024-54383 Patchstack
9.8 Critical VRPConnector Plugin vrpconnector PHP Object Injection No login needed ≤ 2.0.1 CVE-2024-56058 Patchstack
9.8 Critical Partners Plugin partners PHP Object Injection No login needed ≤ 0.2.0 CVE-2024-56059 Patchstack
9.1 Critical SeedProd Pro Plugin seedprod-coming-soon-pro-5 Remote Code Execution ≤ 6.18.10 CVE-2024-54285 Patchstack
9.3 Critical WPBookit Plugin wpbookit SQL Injection No login needed ≤ 1.6.0 CVE-2024-54280 Patchstack
9.8 Critical Woffice Plugin woffice Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 5.4.14 Fixed in 5.4.15 CVE-2024-43234 Patchstack
9.8 Critical SV100 Companion Plugin sv100-companion Privilege Escalation No login needed ≤ 2.0.02 CVE-2024-54229 Patchstack
9.3 Critical Instant Appointment Plugin instant-appointment SQL Injection No login needed ≤ 1.2 CVE-2024-54361 Patchstack
9.8 Critical Wp NssUser Register Plugin wp-nssuser-register Privilege Escalation No login needed ≤ 1.0.0 CVE-2024-54363 Patchstack
9.6 Critical GitSync Plugin git-sync Cross-Site Request Forgery CSRF to Remote Code Execution No login needed ≤ 1.1.0 CVE-2024-54368 Patchstack
9.8 Critical ForumWP Plugin forumwp PHP Object Injection No login needed ≤ 2.1.0 Fixed in 2.1.1 CVE-2024-54367 Patchstack
9.9 Critical Video & Photo Gallery for Ultimate Member Plugin gallery-for-ultimate-member Arbitrary File Upload ≤ 1.1.0 Fixed in 1.1.1 CVE-2024-54370 Patchstack
9.1 Critical Zita Site Builder Plugin ai-site-builder Broken Access Control Arbitrary Plugin Installation and Activation No login needed ≤ 1.0.2 CVE-2024-54369 Patchstack
9.3 Critical eTemplates Plugin etemplates SQL Injection No login needed ≤ 0.2.1 CVE-2024-55972 Patchstack
9.3 Critical LaunchPage.app Importer Plugin launchpage-app-importer SQL Injection No login needed ≤ 1.1 CVE-2024-55977 Patchstack
9.3 Critical Critical Site Intel Plugin critical-site-intel-stats SQL Injection No login needed ≤ 1.0 CVE-2024-55976 Patchstack
9.3 Critical Code Generator Pro Plugin code-generator-pro SQL Injection No login needed ≤ 1.2 CVE-2024-55978 Patchstack
9.3 Critical Wr Age Verification Plugin wr-age-verification SQL Injection No login needed ≤ 2.0.0 CVE-2024-55980 Patchstack
9.3 Critical Share Buttons – Social Media Plugin rich-web-share-button SQL Injection Social Media plugin <= 1.0.2 - SQL Injection No login needed ≤ 1.0.2 CVE-2024-55982 Patchstack
9.3 Critical Nabz Image Gallery Plugin nabz-image-gallery SQL Injection No login needed ≤ v1.00 CVE-2024-55981 Patchstack
9.3 Critical Navayan CSV Export Plugin navayan-csv-export SQL Injection No login needed ≤ 1.0.9 CVE-2024-55988 Patchstack
9.6 Critical Insertify Plugin insertify Cross-Site Request Forgery CSRF to Remote Code Execution No login needed ≤ 1.1.4 CVE-2024-54372 Patchstack
9.8 Critical Flash News / Post (Responsive) Plugin flashnews-fading-effect-pearlbells Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 4.1 CVE-2024-56012 Patchstack
9.8 Critical vBSSO-lite Plugin vbsso-lite Privilege Escalation Account Takeover No login needed ≤ 1.4.3 CVE-2024-54297 Patchstack
9.8 Critical CoSchool LMS Plugin coschool Privilege Escalation Account Takeover No login needed ≤ 1.4.3 CVE-2024-54296 Patchstack
9.8 Critical ListApp Mobile Manager Plugin listapp-mobile-manager Privilege Escalation Account Takeover No login needed ≤ 1.7.7 CVE-2024-54295 Patchstack
9.8 Critical Firebase OTP Authentication Plugin authentication-via-otp-using-firebase Privilege Escalation Account Takeover No login needed ≤ 1.0.1 CVE-2024-54294 Patchstack
9.8 Critical CE21 Suite Plugin ce21-suite Privilege Escalation No login needed ≤ 2.2.0 Fixed in 2.2.1 CVE-2024-54293 Patchstack
9.3 Critical Appsplate Plugin appsplate SQL Injection No login needed ≤ 2.1.3 CVE-2024-54292 Patchstack
9.8 Critical Mail Picker Plugin mail-picker PHP Object Injection No login needed ≤ 1.0.14 Fixed in 1.0.15 CVE-2024-54273 Patchstack
9.9 Critical Import Export For WooCommerce Plugin import-export-for-woocommerce Arbitrary File Upload ≤ 1.6.2 CVE-2024-54262 Patchstack
10.0 Critical TAX SERVICE Electronic HDM Plugin virtual-hdm-for-taxservice-am SQL Injection No login needed ≤ 1.2.2 Fixed in 1.2.3 CVE-2024-54261 Patchstack
9.8 Critical Eyewear prescription form Plugin eyewear-prescription-form Privilege Escalation Arbitrary Option Update to Privilege Escalation No login needed ≤ 4.0.18 Fixed in 4.0.19 CVE-2024-54239 Patchstack
9.3 Critical Limit Login Attempts Plugin wp-limit-failed-login-attempts SQL Injection No login needed ≤ 5.5 Fixed in 5.6 CVE-2024-54234 Patchstack
9.1 Critical JS Help Desk – Best Help Desk & Support Plugin js-support-ticket Broken Access Control Unauthenticated Settings Change No login needed ≤ 2.7.1 Fixed in 2.7.2 CVE-2022-46838 Patchstack
9.8 Critical Super Backup & Clone - Migrate Plugin Arbitrary File Upload Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload No login needed ≤ 2.3.3 CVE-2024-9290 Wordfence
9.8 Critical Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce Plugin vayu-blocks Broken Access Control Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation No login needed ≤ 1.1.1 CVE-2024-10124 Wordfence
9.3 Critical Revy Plugin revy SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.18 CVE-2024-54215 Patchstack
10.0 Critical Pie Register Premium Plugin pie-register-premium Arbitrary File Upload No login needed < 3.8.3.3 Fixed in 3.8.3.3 CVE-2024-53822 Patchstack
9.8 Critical Sweet Date Theme sweetdate Privilege Escalation No login needed ≤ 3.7.3 Fixed in 3.8.0 CVE-2024-43222 Patchstack
9.8 Critical Integrate Google Drive Plugin integrate-google-drive Broken Access Control Unauthenticated Broken Access Control No login needed ≤ 1.1.99 Fixed in 1.2.0 CVE-2023-32117 Patchstack
9.1 Critical Simple User Registration Plugin wp-registration Broken Access Control Broken Access Control on User Deletion No login needed ≤ 5.5 Fixed in 6.0 CVE-2024-53810 Patchstack
9.3 Critical Auction Plugin wp-auctions SQL Injection No login needed ≤ 3.7 CVE-2024-51615 Patchstack
10.0 Critical Revy Plugin revy Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.18 CVE-2024-54214 Patchstack
9.0 Critical s2Member Plugin s2member Remote Code Execution No login needed ≤ 241114 Fixed in 241216 CVE-2024-51815 Patchstack
9.3 Critical FAT Services Booking Plugin fat-services-booking SQL Injection Unauthenticated SQL Injection No login needed ≤ 5.6 CVE-2024-54221 Patchstack
10.0 Critical Fediverse Embeds Plugin fediverse-embeds Arbitrary File Upload No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2024-52476 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only