WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.
Showing 1,051–1,100 of 1,280 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5253 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5252 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5255 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5254 |
Wordfence | |
| 6.4 Medium | WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce | Cross-Site Scripting Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode |
≤ 3.1.43 |
CVE-2024-2691 |
Wordfence | |
| 4.7 Medium | Shortcodes Ultimate Pro | Cross-Site Scripting Contributor+ Stored Cross-Site Scripting XSS No login needed |
< 7.1.5 Fixed in 7.1.5 |
CVE-2024-4217 |
WPScan | |
| 6.5 Medium | WPCS | Arbitrary Shortcode Execution WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution No login needed |
≤ 1.2.0.3 |
CVE-2024-38700 |
Patchstack | |
| 6.4 Medium | MP3 Audio Player for Music, Radio & Podcast by Sonaar | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode |
≤ 5.5 |
CVE-2024-5664 |
Wordfence | |
| 6.4 Medium | UltraAddons for Elementor | Cross-Site Scripting Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 1.1.6 |
CVE-2024-4866 |
Wordfence | |
| 5.4 Medium | Ninja Forms | Arbitrary Shortcode Execution Subscriber+ Arbitrary Shortcode Execution |
≤ 3.8.4 Fixed in 3.8.5 |
CVE-2024-37934 |
Patchstack | |
| 6.4 Medium | oik | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode |
≤ 4.10.3 |
CVE-2024-6391 |
Wordfence | |
| 6.4 Medium | Squelch Tabs and Accordions Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode |
≤ 0.4.8 |
CVE-2024-5946 |
Wordfence | |
| 6.4 Medium | Simple Alert Boxes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode |
≤ 1.4.0 |
CVE-2024-5937 |
Wordfence | |
| 6.4 Medium | OSM – OpenStreetMap | Cross-Site Scripting OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 6.0.3 |
CVE-2024-3603 |
Wordfence | |
| 6.4 Medium | Webico Slider Flatsome Addons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode |
≤ 2.0.1 |
CVE-2024-5881 |
Wordfence | |
| 4.3 Medium | Snippet Shortcodes | Cross-Site Request Forgery No login needed |
≤ 4.1.4 |
CVE-2024-4543 |
Wordfence | |
| 6.4 Medium | Boot Store | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.6.4 |
CVE-2024-5938 |
Wordfence | |
| 6.4 Medium | Stock Ticker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode |
≤ 3.24.4 |
CVE-2024-6363 |
Wordfence | |
| 6.4 Medium | Scylla lite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.8.3 |
CVE-2024-5922 |
Wordfence | |
| 6.4 Medium | Theron Lite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 2.0 |
CVE-2024-5925 |
Wordfence | |
| 6.4 Medium | Silesia | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.0.6 |
CVE-2024-5788 |
Wordfence | |
| 6.4 Medium | Create by Mediavine | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode |
≤ 1.9.7 |
CVE-2024-5601 |
Wordfence | |
| 6.4 Medium | Mosaic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.7.1 |
CVE-2024-5965 |
Wordfence | |
| 6.4 Medium | Grey Opaque | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode |
≤ 2.0.1 |
CVE-2024-5966 |
Wordfence | |
| 6.4 Medium | Flatsome | Multi-Purpose Responsive WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 3.18.7 |
CVE-2024-5346 |
Wordfence | |
| 6.5 Medium | Page Builder: Live Composer | Cross-Site Scripting Contributor+ Shortcode Cross Site Scripting (XSS) |
≤ 1.5.42 |
CVE-2024-35779 |
Patchstack | |
| 6.1 Medium | PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode | Cross-Site Scripting Contributor+ Stored XSS No login needed |
≤ 1.7 |
CVE-2024-5448 |
WPScan | |
| 5.4 Medium | PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode | Cross-Site Scripting Admin+ Stored XSS |
≤ 1.7 |
CVE-2024-5447 |
WPScan | |
| 6.1 Medium | DOP Shortcodes | Cross-Site Scripting Contributor+ Stored XSS via Shortcode No login needed |
≤ 1.2 |
CVE-2024-4377 |
WPScan | |
| 6.4 Medium | Flatsome | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.18.7 |
CVE-2024-5156 |
Wordfence | |
| 6.4 Medium | MaxGalleria | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode |
≤ 6.4.4 |
CVE-2024-5970 |
Wordfence | |
| 6.4 Medium | Master Slider – Responsive Touch Slider | Cross-Site Scripting Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode |
≤ 3.9.10 |
CVE-2024-4375 |
Wordfence | |
| 6.4 Medium | Collapse-O-Matic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.8.5.8 |
CVE-2024-4095 |
Wordfence | |
| 6.4 Medium | Video Gallery – YouTube Playlist, Channel Gallery by YotuWP | Local File Inclusion YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode |
≤ 1.3.13 |
CVE-2024-4551 |
Wordfence | |
| 6.4 Medium | Shariff Wrapper | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.6.13 |
CVE-2024-2695 |
Wordfence | |
| 6.4 Medium | Restaurant Menu and Food Ordering | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.4.0 |
CVE-2024-1399 |
Wordfence | |
| 5.4 Medium | WordPress Jitsi Shortcode | Cross-Site Scripting Contributor+ Stored XSS via Shortcode No login needed |
≤ 0.1 |
CVE-2024-3978 |
WPScan | |
| 5.1 Medium | WordPress Jitsi Shortcode | Cross-Site Scripting Admin+ Stored XSS |
≤ 0.1 |
CVE-2024-3977 |
WPScan | |
| 6.4 Medium | Events Manager – Calendar, Bookings, Tickets, and more! | Cross-Site Scripting Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes |
≤ 6.4.7.3 |
CVE-2024-3492 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 3.2.92 |
CVE-2024-5266 |
Wordfence | |
| 5.3 Medium | Builder for WooCommerce reviews shortcodes – ReviewShort | Broken Access Control ReviewShort plugin <= 1.01.5 - Broken Access Control No login needed |
≤ 1.01.5 Fixed in 1.01.6 |
CVE-2024-34763 |
Patchstack | |
| 6.4 Medium | Custom Field Template | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode |
≤ 2.6.1 |
CVE-2023-6745 |
Wordfence | |
| 6.4 Medium | One Page Express Companion | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode |
≤ 1.6.37 |
CVE-2024-4703 |
Wordfence | |
| 6.4 Medium | Colibri Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode |
≤ 1.0.276 |
CVE-2024-4451 |
Wordfence | |
| 6.4 Medium | Colibri Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.276 |
CVE-2024-5038 |
Wordfence | |
| 6.4 Medium | Rotating Tweets (Twitter widget and shortcode) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.9.10 |
CVE-2024-5141 |
Wordfence | |
| 6.4 Medium | Materialis Companion | Cross-Site Scripting Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode |
≤ 1.3.41 |
CVE-2024-4707 |
Wordfence | |
| 6.4 Medium | Testimonials Widget | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode |
≤ 4.0.4 |
CVE-2024-4705 |
Wordfence | |
| 6.4 Medium | Easy Social Like Box – Popup – Sidebar Widget | Cross-Site Scripting Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.0 |
CVE-2024-5224 |
Wordfence | |
| 6.5 Medium | Album and Image Gallery plus Lightbox | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 2.0 |
CVE-2024-4194 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.