WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,101–1,150 of 1,616 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 23 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Local File Inclusion Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion ≤ 2.1.12 Fixed in 2.1.13 CVE-2024-37520 Patchstack
6.4 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.5 CVE-2024-4862 Wordfence
8.5 High Ultimate Bootstrap Elements for Elementor Plugin ultimate-bootstrap-elements-for-elementor Local File Inclusion ≤ 1.4.2 Fixed in 1.4.3 CVE-2024-37462 Patchstack
8.8 High Ultimate Addons for Elementor Plugin header-footer-elementor Privilege Escalation ≤ 1.36.31 Fixed in 1.36.32 CVE-2024-37455 Patchstack
5.5 Medium Elementor Website Builder Plugin elementor Cross-Site Scripting Arbitrary SVG File Download ≤ 3.22.1 Fixed in 3.22.2 CVE-2024-37437 Patchstack
9.9 Critical Zita Elementor Site Library Plugin zita-site-library Remote Code Execution Arbitrary Code Execution ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-37420 Patchstack
7.5 High Cowidgets – Elementor Addons Plugin cowidgets-elementor-addons Local File Inclusion Elementor Addons plugin <= 1.1.1 - Local File Inclusion No login needed ≤ 1.1.1 Fixed in 1.2.0 CVE-2024-37419 Patchstack
8.5 High Masterstudy Elementor Widgets Theme SQL Injection SQL Injection vulnerability in multiple StylemixThemes premium themes ≤ 1.2.2, ≤ 1.3.0 Fixed in 1.2.3 CVE-2024-37090 Patchstack
6.4 Medium Extensions for Elementor Plugin extensions-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget ≤ 2.0.32 CVE-2024-4868 Wordfence
6.4 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'username' ≤ 1.5.112 CVE-2024-6169 Wordfence
6.4 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'email' ≤ 1.5.112 CVE-2024-6170 Wordfence
6.4 Medium Blog, Posts and Category Filter for Elementor Plugin blog-posts-and-category-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post and Category Filter Widget ≤ 1.0.3 CVE-2024-4667 Wordfence
8.8 High Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor SQL Injection Authenticated (Contributor+) Time-Based SQL Injection ≤ 1.5.112 CVE-2024-6166 Wordfence
5.3 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Other IP Address Spoofing to Antispam Bypass No login needed ≤ 1.5.112 CVE-2024-6171 Wordfence
6.5 Medium UltraAddons Elementor Lite Plugin ultraaddons-elementor-lite Cross-Site Scripting ≤ 2.0.2 CVE-2024-37554 Patchstack
6.5 Medium Livemesh Addons for Elementor Plugin addons-for-elementor Local File Inclusion ≤ 8.4.0 Fixed in 8.4.1 CVE-2024-37547 Patchstack
6.5 Medium Image Hover Effects - Caption Hover with Carousel Plugin image-hover-effects-with-carousel Cross-Site Scripting ≤ 3.0.2 CVE-2024-37546 Patchstack
6.5 Medium Elementor Addons, Widgets and Enhancements – Stax Plugin stax-addons-for-elementor Cross-Site Scripting Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) ≤ 1.5.0 Fixed in 1.5.1 CVE-2024-37541 Patchstack
3.1 Low Premium Addons for Elementor Plugin premium-addons-for-elementor Denial of Service Regular Expressions Denial of Service ≤ 4.10.35 CVE-2024-6434 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid ≤ 8.3.7 CVE-2024-3639 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets ≤ 8.3.7 CVE-2024-2926 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Marquee Text Widget, Testimonials Widget, and Testimonial Slider Widgets ≤ 8.4.1 CVE-2024-3638 Wordfence
8.8 High Elementor Addons by Livemesh Plugin addons-for-elementor Local File Inclusion Authenticated (Contributor+) Limited Local File Inclusion via Widgets ≤ 8.4 CVE-2024-2385 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 4.10.36 CVE-2024-6340 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 5.6.1 CVE-2024-4482 Wordfence
6.4 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via read_more_text Parameter ≤ 3.5.5 CVE-2024-5260 Wordfence
8.5 High LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Local File Inclusion Contributor+ Local File Inclusion ≤ 1.3.8.1 Fixed in 1.3.9 CVE-2024-37479 Patchstack
6.4 Medium Rife Elementor Extensions & Templates Plugin rife-elementor-extensions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Widget ≤ 1.2.1 CVE-2024-5504 Wordfence
8.8 High LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Local File Inclusion Authenticated (Contributor+) Local File Inclusion ≤ 1.3.8.1 CVE-2024-5349 Wordfence
6.4 Medium Void Contact Form 7 Widget For Elementor Page Builder Plugin cf7-widget-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute ≤ 2.4 CVE-2024-5419 Wordfence
6.4 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gradient Heading Widget ≤ 3.11.1 CVE-2024-5790 Wordfence
6.4 Medium Extensions for Elementor Plugin extensions-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter ≤ 2.0.30 CVE-2024-5666 Wordfence
6.4 Medium Ultimate Post Kit Addons for Elementor Plugin ultimate-post-kit Cross-Site Scripting (Post Grid, Post Carousel, Post Slider, Category List, Post Tabs, Timeline, Post Ticker, Tag Cloud) <= 3.11.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Count (Static) Widget ≤ 3.11.7 CVE-2024-5662 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.6.0 CVE-2024-4983 Wordfence
5.4 Medium DethemeKit For Elementor Plugin dethemekit-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via URL Parameter of the De Gallery Widget ≤ 2.1.5 CVE-2024-6283 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.5 CVE-2024-4570 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.5 CVE-2024-4569 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Cross-Site Scripting Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.5.5 CVE-2024-5215 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget ≤ 2.6.9.8 CVE-2024-5332 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Cross-Site Scripting Absolute Addons For Elementor <= 2.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Player Widget Settings ≤ 2.5.5 CVE-2024-5173 Wordfence
4.3 Medium Zita Elementor Site Library Plugin zita-site-library Broken Access Control Missing Authorization to Page Creation and Options Modification ≤ 1.6.2 CVE-2024-3249 Wordfence
8.5 High Consulting Elementor Widgets Plugin Local File Inclusion ≤ 1.3.0 Fixed in 1.3.1 CVE-2024-37092 Patchstack
9.9 Critical Consulting Elementor Widgets Plugin Remote Code Execution ≤ 1.3.0, ≤ 1.2.2 Fixed in 1.3.1 CVE-2024-37091 Patchstack
9.0 Critical Consulting Elementor Widgets Plugin Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 1.3.0 Fixed in 1.3.1 CVE-2024-37089 Patchstack
6.4 Medium Table Addons for Elementor Plugin table-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter ≤ 2.1.2 CVE-2024-4313 Wordfence
8.8 High The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin Local File Inclusion Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion ≤ 5.5.6 CVE-2024-5455 Wordfence
6.1 Medium The Plus Addons for Elementor Page Builder Plugin Cross-Site Scripting Reflected Cross-Site Scripting via WP Login and Register Widget No login needed ≤ 5.5.6 CVE-2024-5344 Wordfence
6.4 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 3.5.4 CVE-2024-5036 Wordfence
6.4 Medium WPZOOM Addons for Elementor (Templates, Widgets) Plugin wpzoom-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 1.1.38 CVE-2024-5686 Wordfence
6.4 Medium JetWidgets For Elementor Plugin jetwidgets-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters ≤ 1.0.17 CVE-2024-4626 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only