WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 1,001–1,050 of 1,457 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 21 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Display custom fields in the frontend – Post and User Profile Fields Plugin shortcode-to-display-post-and-user-data Broken Access Control ≤ 1.2.0 Fixed in 1.2.1 CVE-2023-31073 Patchstack
4.3 Medium Shortcoder Plugin shortcoder Broken Access Control ≤ 6.3 Fixed in 6.3.1 CVE-2023-49849 Patchstack
6.1 Medium Shortcodes Blocks Creator Ultimate Plugin ultimate-shortcodes-creator Cross-Site Scripting Reflected Cross-Site Scripting via _wpnonce No login needed ≤ 2.2.0 CVE-2024-12167 Wordfence
6.1 Medium Shortcodes Blocks Creator Ultimate Plugin ultimate-shortcodes-creator Cross-Site Scripting Reflected Cross-Site Scripting via 'page' No login needed ≤ 2.2.0 CVE-2024-12166 Wordfence
7.1 High Awesome Shortcodes Plugin awesome-shortcodes Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.7.2 Fixed in 1.7.3 CVE-2024-54209 Patchstack
6.3 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Arbitrary Shortcode Execution Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 4.0.51 CVE-2024-10681 Wordfence
6.3 Medium Pojo Forms Plugin pojo-forms Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode ≤ 1.4.7 CVE-2024-10909 Wordfence
6.4 Medium Cookielay Plugin cookielay Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode ≤ 1.2.0 CVE-2024-10320 Wordfence
6.4 Medium myCred – Loyalty Points and Rewards Plugin mycred Cross-Site Scripting Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode ≤ 2.7.5.2 CVE-2024-11201 Wordfence
6.4 Medium Contact Form Builder Plugin contact-form-with-a-meeting-scheduler-by-vcita Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode ≤ 4.10.4 CVE-2024-10056 Wordfence
6.4 Medium LUNA RADIO PLAYER Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 6.24.11.07 CVE-2024-10881 Wordfence
6.4 Medium Listdom – Business Directory and Classified Ads Listings Plugin listdom Cross-Site Scripting Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter ≤ 3.7.0 CVE-2024-11854 Wordfence
7.3 High Authors List Plugin authors-list Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax No login needed ≤ 2.0.4 CVE-2024-10952 Wordfence
6.5 Medium BP Profile Shortcodes Extra Plugin bp-profile-shortcodes-extra SQL Injection Authenticated (Contributor+) SQL Injection via tab Parameter ≤ 2.6.0 CVE-2024-11732 Wordfence
7.1 High amr shortcodes Plugin amr-shortcodes Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.7 CVE-2024-52464 Patchstack
7.1 High Custom Shortcode Sidebars Plugin custom-shortcode-sidebars Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.2 CVE-2024-53736 Patchstack
6.4 Medium Ragic Shortcode Plugin ragic-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2 CVE-2024-11431 Wordfence
6.4 Medium Pricing Tables For WPBakery Page Builder (formerly Visual Composer) Plugin pricing-tables-for-visual-composer Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode ≤ 1.4 CVE-2024-10175 Wordfence
6.4 Medium Spotify Play Button Plugin spotify-play-button-for-wordpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via spotifyplaybutton Shortcode ≤ 2.11 CVE-2024-11192 Wordfence
6.4 Medium BNE Gallery Extended Plugin bne-gallery-extended Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode ≤ 1.2.1 CVE-2024-11119 Wordfence
5.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Authenticated (ShopManager+) Stored Cross-Site Scripting via wcj_product_meta Shortcode ≤ 7.2.3 CVE-2024-9170 Wordfence
6.1 Medium Multiple Plugins <= (Various Versions) Plugin cm-pop-up-banners Cross-Site Scripting Reflected Cross-Site Scripting via cminds_free_guide Shortcode No login needed ≤ 1.2.1, ≤ 1.4.1, ≤ 1.4.2, … CVE-2024-11202 Wordfence
6.3 Medium InPost Gallery Plugin inpost-gallery Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via inpost_gallery_get_shortcode_template ≤ 2.1.4.2 CVE-2024-11002 Wordfence
6.8 Medium YaDisk Files Plugin wp-yadisk-files Cross-Site Scripting Contributor+ Stored XSS via Shortcode ≤ 1.2.5 CVE-2024-10709 WPScan
6.4 Medium 워드프레스 결제 심플페이 – 우커머스 결제 플러그인 Plugin pgall-for-woocommerce Cross-Site Scripting 우커머스 결제 플러그인 <= 5.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting pafw_instant_payment Shortcode ≤ 5.1.4 CVE-2024-11228 Wordfence
6.4 Medium 코드엠샵 소셜톡 Plugin mshop-naver-talktalk Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via add_plus_friends and add_plus_talk Shortcodes ≤ 1.1.18 CVE-2024-11229 Wordfence
6.4 Medium 우커머스 네이버페이 Plugin mshop-npay Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mnp_purchase Shortcode ≤ 3.3.7 CVE-2024-11231 Wordfence
7.3 High Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation Plugin get-a-quote-button-for-woocommerce Arbitrary Shortcode Execution Get a Quote Button – Product Enquiry Form Popup – Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form No login needed ≤ 1.4 CVE-2024-11034 Wordfence
6.4 Medium Rescue Shortcodes Plugin rescue-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode ≤ 2.9 CVE-2024-11199 Wordfence
6.4 Medium Memberlite Shortcodes Plugin memberlite-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via memberlite_accordion Shortcode ≤ 1.3.9 CVE-2024-11227 Wordfence
6.4 Medium Beds24 Online Booking Plugin beds24-online-booking Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode ≤ 2.0.27 CVE-2024-10177 Wordfence
6.1 Medium Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes Plugin security-force Cross-Site Scripting Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting No login needed ≤ 1.1.6 CVE-2024-11365 Wordfence
6.4 Medium WPBakery Visual Composer WHMCS Elements Plugin void-visual-whmcs-element Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode ≤ 1.0.4 CVE-2024-10172 Wordfence
4.3 Medium UltraAddons for Elementor Plugin ultraaddons-elementor-lite Broken Access Control Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode ≤ 1.1.8 CVE-2024-10696 Wordfence
6.4 Medium Premium Packages - Sell Digital Products Securely Plugin wpdm-premium-packages Cross-Site Scripting Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode ≤ 5.9.3 CVE-2024-10164 Wordfence
7.3 High WooCommerce Product Table Lite Plugin wc-product-table-lite Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution & Reflected Cross-Site Scripting No login needed ≤ 3.8.6 CVE-2024-10899 Wordfence
7.1 High Awesome Shortcodes For Genesis Plugin awesome-shortcodes-for-genesis Cross-Site Scripting No login needed ≤ 1.1.8 CVE-2024-51638 Patchstack
6.5 Medium Moka Get Posts Shortcode Plugin moka-get-posts Cross-Site Scripting ≤ 1.0 CVE-2024-51804 Patchstack
6.5 Medium Lewe Bootstrap Visuals Plugin shortcode-bootstrap-visuals Cross-Site Scripting ≤ 3.0.1 CVE-2024-51810 Patchstack
6.5 Medium Add Ribbon Shortcode Plugin add-ribbon Cross-Site Scripting ≤ 1.0.1 CVE-2024-51823 Patchstack
6.5 Medium Boombox Shortcode Plugin boombox-shortcode Cross-Site Scripting ≤ 1.0.0 CVE-2024-51827 Patchstack
6.5 Medium Image Carousel Shortcode Plugin image-carousel-shortcode Cross-Site Scripting ≤ 1.2 CVE-2024-51842 Patchstack
6.5 Medium Redirecter Plugin shortcode-for-redirection Cross-Site Scripting ≤ 1.0 CVE-2024-51855 Patchstack
6.5 Medium Olympus Shortcodes Plugin olympus-shortcodes Cross-Site Scripting ≤ 1.0.4 CVE-2024-51857 Patchstack
6.5 Medium Shortcode Collection Plugin shortcode-collection Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.4 CVE-2024-51864 Patchstack
6.5 Medium AchillesTheme-shortcodes Plugin achilles-shortcodes Cross-Site Scripting ≤ 0.1 CVE-2024-51878 Patchstack
6.5 Medium Be Shortcodes Plugin be-shortcodes Cross-Site Scripting ≤ 1.0.0 CVE-2024-51881 Patchstack
6.5 Medium Geoportail Shortcode Plugin geoportail-shortcode Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 2.4.4 CVE-2024-51890 Patchstack
6.5 Medium Semantic Shortcode Plugin semantic-shortcode Cross-Site Scripting ≤ 1.0.1 CVE-2024-51898 Patchstack
6.5 Medium Embed documents shortcode Plugin embed-documents-shortcode Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.5 CVE-2024-51904 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only