WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,051–1,100 of 1,401 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 22 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.3 Critical Express Payments Module Plugin express-pay SQL Injection No login needed ≤ 1.1.8 Fixed in 1.1.9 CVE-2024-52474 Patchstack
10.0 Critical Pathomation Plugin pathomation Arbitrary File Upload No login needed ≤ 2.5.1 CVE-2024-52490 Patchstack
9.8 Critical Wawp Plugin automation-web-platform Privilege Escalation Account Takeover No login needed ≤ 3.0.18 Fixed in 3.0.18 CVE-2024-52475 Patchstack
9.9 Critical Widget Options – The #1 WordPress Widget & Block Control Plugin widget-options Remote Code Execution The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution ≤ 4.0.7 CVE-2024-8672 Wordfence
9.8 Critical UserPlus Plugin userplus Privilege Escalation No login needed ≤ 2.0 CVE-2024-52442 Patchstack
9.8 Critical Team Rosters Plugin team-rosters PHP Object Injection No login needed ≤ 4.8.2 CVE-2024-52439 Patchstack
9.8 Critical Xpresslane Fast Checkout Plugin xpresslane-integration-for-woocommerce PHP Object Injection No login needed ≤ 1.0.0 CVE-2024-52440 Patchstack
9.8 Critical Quick Learn Plugin quick-learn PHP Object Injection No login needed ≤ 1.0.1 CVE-2024-52441 Patchstack
9.8 Critical Geolocator Plugin geolocator PHP Object Injection No login needed ≤ 1.1 CVE-2024-52443 Patchstack
9.6 Critical Exclusive Content Password Protect Plugin exclusive-content-password-protect Cross-Site Request Forgery CSRF to Arbitrary File Upload No login needed ≤ 1.1.0 CVE-2024-52402 Patchstack
9.6 Critical Hacklog DownloadManager Plugin hacklog-downloadmanager Cross-Site Request Forgery CSRF to Arbitrary File Upload No login needed ≤ 2.1.4 CVE-2024-52401 Patchstack
9.3 Critical WordPress Video Robot - The Ultimate Video Importer Plugin SQL Injection No login needed ≤ 1.20.0 CVE-2024-52431 Patchstack
9.8 Critical Lis Video Gallery Plugin lis-video-gallery PHP Object Injection No login needed ≤ 0.2.1 CVE-2024-52430 Patchstack
9.8 Critical NIX Anti-Spam Light Plugin nix-anti-spam-light PHP Object Injection No login needed ≤ 0.0.4 CVE-2024-52432 Patchstack
9.8 Critical My Geo Posts Free Plugin my-geo-posts-free PHP Object Injection No login needed ≤ 1.2 CVE-2024-52433 Patchstack
9.9 Critical Event Tickets with Ticket Scanner Plugin event-tickets-with-ticket-scanner Remote Code Execution ≤ 2.3.11 Fixed in 2.3.12 CVE-2024-52427 Patchstack
9.9 Critical WP Quick Setup Plugin wp-quick-setup Remote Code Execution Arbitrary Plugin and Theme Installation to Remote Code Execution ≤ 2.0 CVE-2024-52429 Patchstack
9.1 Critical Popup by Supsystic Plugin popup-by-supsystic Remote Code Execution ≤ 1.10.29 Fixed in 1.10.30 CVE-2024-52434 Patchstack
9.1 Critical Convert Docx2post Plugin convert-docx2post Arbitrary File Upload ≤ 1.4 CVE-2024-52397 Patchstack
9.1 Critical CDI Plugin collect-and-deliver-interface-for-woocommerce Arbitrary File Upload ≤ 5.5.3 Fixed in 5.5.6 CVE-2024-52398 Patchstack
9.9 Critical Writer Helper Plugin writer-helper Arbitrary File Upload ≤ 3.1.6 CVE-2024-52399 Patchstack
9.9 Critical Gallerio Plugin gallerio Arbitrary File Upload ≤ 1.01 CVE-2024-52400 Patchstack
9.9 Critical User Management Plugin user-management Arbitrary File Upload ≤ 1.1 Fixed in 1.2 CVE-2024-52403 Patchstack
9.9 Critical CF7 Reply Manager Plugin cf7-reply-manager Arbitrary File Upload ≤ 1.2.3 CVE-2024-52404 Patchstack
9.9 Critical B-Banner Slider Plugin b-banner-slider Arbitrary File Upload ≤ 1.1 CVE-2024-52405 Patchstack
9.9 Critical CSV to html Plugin csv-to-html Arbitrary File Upload ≤ 3.26 Fixed in 3.27 CVE-2024-52406 Patchstack
9.9 Critical BasePress Migration Tools Plugin basepress-migration-tools Arbitrary File Upload ≤ 1.0.0 CVE-2024-52407 Patchstack
9.9 Critical Push Notifications for WordPress by PushAssist Plugin push-notification-for-wp-by-pushassist Arbitrary File Upload ≤ 3.0.8 CVE-2024-52408 Patchstack
9.8 Critical AJAX Random Posts Plugin ajax-random-posts PHP Object Injection No login needed ≤ 0.3.3 CVE-2024-52409 Patchstack
9.8 Critical Referrer Detector Plugin referrer-detector PHP Object Injection No login needed ≤ 4.2.1.0 CVE-2024-52410 Patchstack
9.8 Critical Advanced Personalization Plugin personalization-by-flowcraft PHP Object Injection No login needed ≤ 1.1.2 CVE-2024-52411 Patchstack
9.8 Critical Xin Theme xin PHP Object Injection No login needed ≤ 1.0.8.1 CVE-2024-52412 Patchstack
9.8 Critical Airin Blog Plugin airin-blog PHP Object Injection No login needed ≤ 1.6.1 Fixed in 1.6.3 CVE-2024-52413 Patchstack
9.8 Critical WDES Responsive Mobile Menu Plugin wdes-responsive-mobile-menu PHP Object Injection No login needed ≤ 5.3.18 CVE-2024-52414 Patchstack
10.0 Critical Debug Tool Plugin debug-tool Remote Code Execution No login needed ≤ 2.2 CVE-2024-52416 Patchstack
9.9 Critical KBucket Plugin kbucket Arbitrary File Upload ≤ 4.2.2 Fixed in 4.2.3 CVE-2024-52369 Patchstack
9.9 Critical Hive Support Plugin hive-support Arbitrary File Upload WordPress Help Desk, Live Chat & AI Chat Bot Plugin for WordPress plugin <= 1.1.1 - Arbitrary File Upload ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-52370 Patchstack
10.0 Critical Easy CSV Importer BETA Plugin easy-csv-importer Arbitrary File Upload No login needed ≤ 7.0.0 CVE-2024-52372 Patchstack
10.0 Critical Devexhub Gallery Plugin devexhub-gallery Arbitrary File Upload No login needed ≤ 2.0.1 CVE-2024-52373 Patchstack
10.0 Critical Do That Task Plugin do-that-task Arbitrary File Upload No login needed ≤ 1.5.5 CVE-2024-52374 Patchstack
10.0 Critical Datasets Manager by Arttia Creative Plugin datasets-manager-by-arttia-creative Arbitrary File Upload No login needed ≤ 1.5 CVE-2024-52375 Patchstack
10.0 Critical Boat Rental Plugin boat-rental-system Arbitrary File Upload No login needed ≤ 1.0.1 CVE-2024-52376 Patchstack
10.0 Critical Instant Image Generator Plugin ai-image Arbitrary File Upload No login needed ≤ 1.5.2 Fixed in 1.5.3 CVE-2024-52377 Patchstack
10.0 Critical kineticPay for WooCommerce Plugin kineticpay-for-woocommerce Arbitrary File Upload No login needed ≤ 2.0.8 Fixed in 3.0 CVE-2024-52379 Patchstack
10.0 Critical Picsmize Plugin picsmize Arbitrary File Upload No login needed ≤ 1.0.0 CVE-2024-52380 Patchstack
9.8 Critical Matix Popup Builder Plugin medma-matix Privilege Escalation Arbitrary Option Update to Privilege Escalation No login needed ≤ 1.0.0 CVE-2024-52382 Patchstack
9.9 Critical Sage AI: Chatbots, OpenAI GPT-4 Bulk Articles, Dalle-3 Image Generation Plugin ai-content-generator Arbitrary File Upload ≤ 2.4.9 CVE-2024-52384 Patchstack
9.1 Critical Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Remote Code Execution Admin+ Remote Code Execution (RCE) ≤ 4.1.15 Fixed in 4.1.17 CVE-2024-52393 Patchstack
9.8 Critical Chartify – WordPress Chart Plugin chart-builder Local File Inclusion WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source No login needed ≤ 2.9.5 CVE-2024-10571 Wordfence
9.8 Critical MultiManager WP – Manage All Your WordPress Sites Easily Plugin multimanager-wp Authentication Bypass Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation No login needed ≤ 1.0.5 CVE-2024-11028 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only