WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 1,051–1,100 of 1,359 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Happy Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 3.10.8 |
CVE-2024-5088 |
Wordfence | |
| 6.4 Medium | Piotnet Addons For Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 2.4.26 |
CVE-2024-4432 |
Wordfence | |
| 6.4 Medium | Testimonial Carousel For Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 10.1.1 |
CVE-2024-4698 |
Wordfence | |
| 6.4 Medium | DethemeKit For Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 2.1.3 |
CVE-2024-4374 |
Wordfence | |
| 6.4 Medium | Happy Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter |
≤ 3.10.8 |
CVE-2024-4865 |
Wordfence | |
| 4.3 Medium | Integration for Contact Form 7 and Salesforce | Cross-Site Request Forgery No login needed |
≤ 1.3.9 Fixed in 1.4.0 |
CVE-2024-34755 |
Patchstack | |
| 5.3 Medium | Royal Elementor Addons | Authentication Bypass IP Bypass No login needed |
≤ 1.3.93 Fixed in 1.3.95 |
CVE-2024-32786 |
Patchstack | |
| 6.4 Medium | Qi Addons For Elementor | Local File Inclusion |
≤ 1.6.3 Fixed in 1.6.4 |
CVE-2023-47679 |
Patchstack | |
| 6.5 Medium | DethemeKit For Elementor | Cross-Site Scripting |
≤ 2.1.2 Fixed in 2.1.3 |
CVE-2024-34575 |
Patchstack | |
| 6.4 Medium | Master Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.0.6.0 |
CVE-2024-3134 |
Wordfence | |
| 5.0 Medium | Elementor Header & Footer Builder | Content Injection Authenticated (Author+) HTML Injection |
≤ 1.6.26 |
CVE-2024-2619 |
Wordfence | |
| 6.4 Medium | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor | Cross-Site Scripting Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.0.6.0 |
CVE-2024-4580 |
Wordfence | |
| 6.4 Medium | Elementor Header & Footer Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.6.28 |
CVE-2024-4634 |
Wordfence | |
| 6.4 Medium | Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget |
≤ 3.10.7 |
CVE-2024-4391 |
Wordfence | |
| 5.4 Medium | Royal Elementor Addons and Templates | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Form Builder Widget |
≤ 1.3.974 |
CVE-2024-3887 |
Wordfence | |
| 6.4 Medium | Happy Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group Widget |
≤ 3.10.7 |
CVE-2024-4478 |
Wordfence | |
| 6.4 Medium | Mega Elements | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget |
≤ 1.2.1 |
CVE-2024-4702 |
Wordfence | |
| 6.4 Medium | Sina Extension for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-site Scriping via 'Sina Particle Layer' |
≤ 3.5.3 |
CVE-2024-4373 |
Wordfence | |
| 6.4 Medium | Exclusive Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget |
≤ 2.6.9.6 |
CVE-2024-4618 |
Wordfence | |
| 6.4 Medium | WPZOOM Addons for Elementor (Templates, Widgets) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box Widget |
≤ 1.1.36 |
CVE-2024-4370 |
Wordfence | |
| 6.4 Medium | Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg | Cross-Site Scripting Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 1.5.3 |
CVE-2024-4666 |
Wordfence | |
| 6.4 Medium | Sina Extension for Elementor | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Cross-Site Scripting |
≤ 3.5.3 |
CVE-2024-4333 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.20 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.9.20 |
CVE-2024-4624 |
Wordfence | |
| 6.4 Medium | 140+ Widgets | Best Addons For Elementor – FREE | Cross-Site Scripting FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 1.4.3 |
CVE-2024-4440 |
Wordfence | |
| 6.5 Medium | Envo's Elementor Templates & Widgets for WooCommerce | Cross-Site Scripting |
≤ 1.4.8 Fixed in 1.4.9 |
CVE-2024-35167 |
Patchstack | |
| 5.3 Medium | ShopBuilder – Elementor WooCommerce Builder Addons | Information Disclosure Sensitive Data Exposure No login needed |
≤ 2.1.8 Fixed in 2.1.9 |
CVE-2024-34812 |
Patchstack | |
| 6.4 Medium | Thim Elementor Kit | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter |
≤ 1.1.9 |
CVE-2024-4329 |
Wordfence | |
| 6.4 Medium | Starter Templates — Elementor, WordPress & Beaver Builder Templates | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.2.1 |
CVE-2024-4630 |
Wordfence | |
| 6.4 Medium | Graphina – Elementor Charts and Graphs | Cross-Site Scripting Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 1.8.9 |
CVE-2024-4574 |
Wordfence | |
| 4.3 Medium | Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms | Cross-Site Request Forgery No login needed |
≤ 1.2.0 Fixed in 1.2.1 |
CVE-2024-34817 |
Patchstack | |
| 6.1 Medium | Unlimited Elements For Elementor (Free Widgets, Addons, Templates) | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.5.102 |
CVE-2024-3547 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles' |
≤ 5.9.19 |
CVE-2024-4275 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets |
≤ 5.9.19 |
CVE-2024-4449 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' |
≤ 5.9.19 |
CVE-2024-4448 |
Wordfence | |
| 6.4 Medium | The Plus Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate |
≤ 5.4.2 |
CVE-2024-2785 |
Wordfence | |
| 4.3 Medium | Starter Templates — Elementor, WordPress & Beaver Builder Templates | Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery |
≤ 4.1.6 |
CVE-2024-1467 |
Wordfence | |
| 6.4 Medium | The Plus Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.4.2 |
CVE-2024-0445 |
Wordfence | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget |
≤ 2.5.0 |
CVE-2024-3990 |
Wordfence | |
| 6.4 Medium | Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget |
≤ 1.1.37 |
CVE-2024-2923 |
Wordfence | |
| 6.4 Medium | Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) | Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 3.14.3 |
CVE-2024-4339 |
Wordfence | |
| 6.4 Medium | Enter Addons – Ultimate Template Builder for Elementor | Cross-Site Scripting Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget |
≤ 2.1.5 |
CVE-2024-3831 |
Wordfence | |
| 6.4 Medium | Image Hover Effects - Elementor Addon | Cross-Site Scripting Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget |
≤ 1.4.1 |
CVE-2024-1166 |
Wordfence | |
| 6.4 Medium | EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter |
≤ 3.9.16 |
CVE-2024-4316 |
Wordfence | |
| 6.4 Medium | Enter Addons – Ultimate Template Builder for Elementor | Cross-Site Scripting Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag |
≤ 2.1.5 |
CVE-2024-3680 |
Wordfence | |
| 6.4 Medium | Elementor Website Builder Pro | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 3.21.0 |
CVE-2024-4107 |
Wordfence | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify |
≤ 2.5.0 |
CVE-2024-3989 |
Wordfence | |
| 5.4 Medium | Ultimate Store Kit Elementor Addons | PHP Object Injection No login needed |
≤ 2.0.3 Fixed in 2.0.4 |
CVE-2024-4606 |
Patchstack | |
| 6.5 Medium | Thim Elementor Kit | Cross-Site Scripting |
≤ 1.1.8 Fixed in 1.1.9 |
CVE-2024-34415 |
Patchstack | |
| 6.5 Medium | BlogLentor | Cross-Site Scripting Blog Designer Pack for Elementor plugin <= 1.0.8 - Cross Site Scripting (XSS) |
≤ 1.0.8 |
CVE-2024-34421 |
Patchstack | |
| 6.5 Medium | Better Elementor Addons | Cross-Site Scripting |
≤ 1.4.4 Fixed in 1.4.5 |
CVE-2024-34432 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.