WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 1,101–1,150 of 1,359 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.5 Medium | SKT Addons for Elementor | Cross-Site Scripting |
≤ 1.8 Fixed in 1.9 |
CVE-2024-34436 |
Patchstack | |
| 6.5 Medium | SKT Addons for Elementor | Cross-Site Scripting |
≤ 1.8 Fixed in 1.9 |
CVE-2024-34445 |
Patchstack | |
| 4.3 Medium | Happy Addons for Elementor | Broken Access Control Broken Access Control on Post Clone |
≤ 3.10.1 Fixed in 3.10.2 |
CVE-2024-24833 |
Patchstack | |
| 6.5 Medium | Magical Addons For Elementor | Cross-Site Scripting |
≤ 1.1.34 Fixed in 1.1.35 |
CVE-2024-34547 |
Patchstack | |
| 6.5 Medium | WidgetKit | Cross-Site Scripting WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) |
≤ 2.4.8 Fixed in 2.5.0 |
CVE-2024-34548 |
Patchstack | |
| 6.5 Medium | Move Addons for Elementor | Cross-Site Scripting |
≤ 1.3.0 Fixed in 1.3.1 |
CVE-2024-34562 |
Patchstack | |
| 6.5 Medium | Gold Addons for Elementor | Cross-Site Scripting |
≤ 1.2.9 Fixed in 1.3.0 |
CVE-2024-34563 |
Patchstack | |
| 5.9 Medium | Xpro Elementor Addons | Cross-Site Scripting |
≤ 1.4.3 |
CVE-2024-34570 |
Patchstack | |
| 6.5 Medium | Fancy Elementor Flipbox | Cross-Site Scripting |
≤ 2.4.2 |
CVE-2024-34572 |
Patchstack | |
| 5.3 Medium | WidgetKit | Broken Access Control No login needed |
≤ 2.5.0 |
CVE-2024-33908 |
Patchstack | |
| 6.5 Medium | The Plus Addons for Elementor Page Builder Lite | Cross-Site Scripting |
≤ 5.4.2 Fixed in 5.5.0 |
CVE-2024-34373 |
Patchstack | |
| 6.5 Medium | ElementsReady Addons for Elementor | Cross-Site Scripting |
≤ 5.8.0 Fixed in 5.9.0 |
CVE-2024-34374 |
Patchstack | |
| 4.3 Medium | Exclusive Addons Elementor | Broken Access Control Broken Access Control on Post Duplication |
≤ 2.6.9.1 Fixed in 2.6.9.2 |
CVE-2024-33914 |
Patchstack | |
| 6.5 Medium | RomethemeKit For Elementor | Broken Access Control No login needed |
≤ 1.4.1 Fixed in 1.4.2 |
CVE-2024-33919 |
Patchstack | |
| 6.5 Medium | Eleblog – Elementor Blog And Magazine Addons | Cross-Site Scripting Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) |
≤ 1.8 |
CVE-2024-33945 |
Patchstack | |
| 4.3 Medium | The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid | Broken Access Control Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization |
≤ 7.6.1 |
CVE-2024-3936 |
Wordfence | |
| 6.4 Medium | Elementor Addon Elements | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.13.3 |
CVE-2024-3743 |
Wordfence | |
| 6.4 Medium | Exclusive Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox |
≤ 2.6.9.2 |
CVE-2024-2751 |
Wordfence | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget |
≤ 2.4.9 |
CVE-2024-3307 |
Wordfence | |
| 6.4 Medium | Fancy Elementor Flipbox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Elementor Flipbox Widget |
≤ 2.5.1 |
CVE-2024-2349 |
Wordfence | |
| 6.4 Medium | Happy Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags |
≤ 3.10.5 |
CVE-2024-3891 |
Wordfence | |
| 6.4 Medium | The Plus Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes |
≤ 5.4.2 |
CVE-2024-3197 |
Wordfence | |
| 6.4 Medium | The Plus Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget |
≤ 5.4.2 |
CVE-2024-3199 |
Wordfence | |
| 6.4 Medium | Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor | Cross-Site Scripting Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.5.9 - Contributor+ Stored Cross-Site Scripting |
≤ 2.0.5.9 |
CVE-2024-4265 |
Wordfence | |
| 6.4 Medium | ElementsKit Elementor addons and Templates Library | Cross-Site Scripting The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Accordion widget in all versions 3.0.7 through 3.1.2 due to insuff… |
3.0.7 – 3.1.2 |
CVE-2024-3650 |
Wordfence | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox Widget |
≤ 2.4.6 |
CVE-2024-2084 |
Wordfence | |
| 6.4 Medium | Happy Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Stack Group, Photo Stack, & Horizontal Timeline |
≤ 3.10.4 |
CVE-2024-3724 |
Wordfence | |
| 6.4 Medium | Exclusive Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Expired Title |
≤ 2.6.9.4 |
CVE-2024-3489 |
Wordfence | |
| 5.3 Medium | EleForms – All In One Form Integration including DB for Elementor | Broken Access Control All In One Form Integration including DB for Elementor <= 2.9.9.7 - Missing Authorization to Sensitive Information Exposure No login needed |
≤ 2.9.9.7 |
CVE-2024-2043 |
Wordfence | |
| 6.4 Medium | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) | Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id |
≤ 2.8.7 |
CVE-2024-3991 |
Wordfence | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion/FAQ |
≤ 2.4.8 |
CVE-2024-2790 |
Wordfence | |
| 5.4 Medium | Premium Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.10.30 |
CVE-2024-4203 |
Wordfence | |
| 6.4 Medium | Premium Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style' |
≤ 4.10.28 |
CVE-2024-3647 |
Wordfence | |
| 6.4 Medium | Jeg Elementor Kit | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget |
≤ 2.6.4 |
CVE-2024-3161 |
Wordfence | |
| 6.4 Medium | Jeg Elementor Kit | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner |
≤ 2.6.4 |
CVE-2024-3819 |
Wordfence | |
| 6.4 Medium | Premium Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.10.28 |
CVE-2024-3885 |
Wordfence | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget |
≤ 2.4.9 |
CVE-2024-3308 |
Wordfence | |
| 6.4 Medium | Royal Elementor Addons and Templates | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes |
≤ 1.3.971 |
CVE-2024-3675 |
Wordfence | |
| 6.4 Medium | Exclusive Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget |
≤ 2.6.9.3 |
CVE-2024-2750 |
Wordfence | |
| 6.4 Medium | Exclusive Addons for Elementor | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid |
≤ 2.6.9.2 |
CVE-2024-2503 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle |
≤ 5.9.15 |
CVE-2024-3728 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.9.17 |
CVE-2024-4156 |
Wordfence | |
| 6.4 Medium | Exclusive Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action |
≤ 2.6.9.4 |
CVE-2024-3985 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.9.15 |
CVE-2024-4003 |
Wordfence | |
| 4.3 Medium | Easy Restaurant Table Booking | Cross-Site Request Forgery No login needed |
≤ 1.0.0 |
CVE-2024-4083 |
Wordfence | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' |
≤ 2.4.6 |
CVE-2024-2085 |
Wordfence | |
| 6.4 Medium | Elementor ImageBox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.2.8 |
CVE-2024-3074 |
Wordfence | |
| 6.4 Medium | LA-Studio Element Kit for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via LaStudioKit Post Author Widget |
≤ 1.3.7.5 |
CVE-2024-3005 |
Wordfence | |
| 6.4 Medium | Jeg Elementor Kit | Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via Elementor Widget URL Custom Attributes |
≤ 2.6.4 |
CVE-2024-0334 |
Wordfence | |
| 4.3 Medium | Master Addons for Elementor | Broken Access Control Broken Access Control on Duplicate Post |
≤ 2.0.5.4.1 Fixed in 2.0.5.6 |
CVE-2024-33595 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.