WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.
Showing 1,051–1,100 of 1,458 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.5 Medium | Embed documents shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.5 |
CVE-2024-51904 |
Patchstack | |
| 6.5 Medium | Testimonial Slider Shortcode | Cross-Site Scripting |
≤ 1.1.9 |
CVE-2024-51925 |
Patchstack | |
| 6.4 Medium | Email Subscription Popup | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode |
≤ 1.2.22 |
CVE-2024-11195 |
Wordfence | |
| 7.3 High | GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in | Arbitrary Shortcode Execution The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings No login needed |
≤ 7.1.5 |
CVE-2024-11036 |
Wordfence | |
| 7.3 High | WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup | Arbitrary Shortcode Execution Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form No login needed |
≤ 1.7.5 |
CVE-2024-11038 |
Wordfence | |
| 6.4 Medium | MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar | Cross-Site Scripting Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode |
≤ 5.8 |
CVE-2024-10268 |
Wordfence | |
| 6.3 Medium | Drop Shadow Boxes | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution |
≤ 1.7.14 |
CVE-2024-10262 |
Wordfence | |
| 7.3 High | Uix Slideshow | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.6.5 |
CVE-2024-9839 |
Wordfence | |
| 6.4 Medium | Steel | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via btn Shortcode |
≤ 1.3.0 |
CVE-2024-10147 |
Wordfence | |
| 6.4 Medium | WP AdCenter – Ad Manager & Adsense Ads | Cross-Site Scripting Ad Manager & Adsense Ads <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpadcenter_ad Shortcode |
≤ 2.5.7 |
CVE-2024-10113 |
Wordfence | |
| 6.4 Medium | Social Proof (Testimonials) Slider | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via spslider-block Shortcode |
≤ 2.2.4 |
CVE-2024-8985 |
Wordfence | |
| 5.3 Medium | Hide Links | Arbitrary Shortcode Execution Unauthenticated Shortcode Execution No login needed |
≤ 1.4.2 |
CVE-2024-9578 |
Wordfence | |
| 6.4 Medium | Slickstream: Engagement and Conversions | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slick-grid Shortcode |
≤ 1.4.4 |
CVE-2024-10179 |
Wordfence | |
| 6.5 Medium | Postcasa Shortcode | Cross-Site Scripting |
≤ 1.0 |
CVE-2024-52352 |
Patchstack | |
| 6.5 Medium | Web Stories Widgets For Elementor | Cross-Site Scripting |
≤ 1.1 Fixed in 1.1.1 |
CVE-2024-52354 |
Patchstack | |
| 6.5 Medium | ML Responsive Audio player with playlist Shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 0.2 |
CVE-2024-51573 |
Patchstack | |
| 7.3 High | WP Photo Album Plus | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay No login needed |
≤ 8.8.08.007 |
CVE-2024-10958 |
Wordfence | |
| 6.5 Medium | AMP Img Shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.0.1 |
CVE-2024-51576 |
Patchstack | |
| 6.5 Medium | Emoji Shortcode | Cross-Site Scripting |
≤ 1.0.0 |
CVE-2024-51609 |
Patchstack | |
| 6.5 Medium | Display Terms Shortcode | Cross-Site Scripting |
≤ 1.0.4 |
CVE-2024-51610 |
Patchstack | |
| 6.5 Medium | Reftagger Shortcode | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.1 |
CVE-2024-51612 |
Patchstack | |
| 7.3 High | Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction | Arbitrary Shortcode Execution Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 2.13.0 |
CVE-2024-10261 |
Wordfence | |
| 7.3 High | The FOX – Currency Switcher Professional for WooCommerce | Arbitrary Shortcode Execution Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.4.2.2 |
CVE-2024-10640 |
Wordfence | |
| 8.5 High | Quran Shortcode | SQL Injection |
≤ 1.5 |
CVE-2024-51625 |
Patchstack | |
| 6.4 Medium | myCred | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_link Shortcode |
≤ 2.7.4 |
CVE-2024-10187 |
Wordfence | |
| 6.4 Medium | Simple Shortcode for Google Maps | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.5.4 |
CVE-2024-10621 |
Wordfence | |
| 6.4 Medium | Event Post | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode |
≤ 5.9.6 |
CVE-2024-10186 |
Wordfence | |
| 6.4 Medium | Active Products Tables for WooCommerce. Use constructor to create tables | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode |
≤ 1.0.6.4 |
CVE-2024-10168 |
Wordfence | |
| 4.3 Medium | Contact Form 7 – Dynamic Text Extension | Information Disclosure Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode |
≤ 4.5 |
CVE-2024-10084 |
Wordfence | |
| 7.3 High | Tickera – WordPress Event Ticketing | Arbitrary Shortcode Execution WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 3.5.4.4 |
CVE-2024-10263 |
Wordfence | |
| 6.4 Medium | Shortcodes Blocks Creator Ultimate | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.1.3 |
CVE-2024-10340 |
Wordfence | |
| 6.5 Medium | Elo Rating Shortcode | Cross-Site Scripting |
≤ 1.0.3 Fixed in 1.0.4 |
CVE-2024-51678 |
Patchstack | |
| 5.3 Medium | Arconix Shortcodes | Broken Access Control No login needed |
≤ 2.1.11 Fixed in 2.1.12 |
CVE-2024-38769 |
Patchstack | |
| 6.4 Medium | AtomChat | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode |
≤ 1.1.5 |
CVE-2024-10232 |
Wordfence | |
| 6.5 Medium | SIP Reviews Shortcode for WooCommerce | SQL Injection Authenticated (Contributor+) SQL Injection |
≤ 1.2.3 |
CVE-2024-6479 |
Wordfence | |
| 6.4 Medium | SIP Reviews Shortcode for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting |
≤ 1.2.3 |
CVE-2024-6480 |
Wordfence | |
| 6.4 Medium | WP Simple Anchors Links | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode |
≤ 1.0.0 |
CVE-2024-9446 |
Wordfence | |
| 6.4 Medium | HT Team Member | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode |
≤ 1.1.4 |
CVE-2024-10223 |
Wordfence | |
| 7.2 High | WPAdverts – Classifieds | Cross-Site Scripting Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode No login needed |
≤ 2.1.6 |
CVE-2024-10108 |
Wordfence | |
| 6.4 Medium | Widget or Sidebar Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 0.6.1 |
CVE-2024-9885 |
Wordfence | |
| 7.3 High | Enable Shortcodes inside Widgets,Comments and Experts | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.0.0 |
CVE-2024-9846 |
Wordfence | |
| 6.4 Medium | WP Baidu Map | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.2.2 |
CVE-2024-9886 |
Wordfence | |
| 6.4 Medium | T(-) Countdown | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.4.8 |
CVE-2024-9884 |
Wordfence | |
| 6.4 Medium | Arconix Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode |
≤ 2.1.13 |
CVE-2024-10226 |
Wordfence | |
| 6.4 Medium | Newsletters | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via newsletters_video Shortcode |
≤ 4.9.9.4 |
CVE-2024-10181 |
Wordfence | |
| 6.4 Medium | SMSAlert - WooCommerce | Cross-Site Scripting WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode |
≤ 3.7.5 |
CVE-2024-10233 |
Wordfence | |
| 6.4 Medium | StreamWeasels YouTube Integration | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode |
≤ 1.3.2 |
CVE-2024-10185 |
Wordfence | |
| 6.4 Medium | SW Kick Integration - Blocks and Shortcodes for Embedding Kick Streams | Cross-Site Scripting Blocks and Shortcodes for Embedding Kick Streams <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sw-kick-embed Shortcode |
≤ 1.1.1 |
CVE-2024-10184 |
Wordfence | |
| 6.4 Medium | affiliate-toolkit | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode |
≤ 3.6.5 |
CVE-2024-10227 |
Wordfence | |
| 6.5 Medium | CodePen Embedded Pens Shortcode | Cross-Site Scripting |
≤ 1.0.2 Fixed in 1.0.3 |
CVE-2024-50440 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.