WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 1,101–1,150 of 1,458 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 23 of 30
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode ≤ 2.1.11 CVE-2024-10117 Wordfence
7.3 High Uix Shortcodes – Compatible with Gutenberg Plugin uix-shortcodes Arbitrary Shortcode Execution Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.9.9 CVE-2024-9772 Wordfence
6.4 Medium WP show more Plugin wp-show-more Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode ≤ 1.0.7 CVE-2024-9967 Wordfence
6.4 Medium WP-Members Plugin wp-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode ≤ 3.4.9.5 CVE-2024-10374 Wordfence
6.4 Medium Simple News Plugin simple-news Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode ≤ 2.8 CVE-2024-10112 Wordfence
6.4 Medium Beek Widget Extention Plugin beek-widget-extention Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.9.5 CVE-2024-10343 Wordfence
6.4 Medium Bamazoo – Button Generator Plugin bamazoo-button-generator Cross-Site Scripting Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode ≤ 1.0 CVE-2024-10150 Wordfence
6.4 Medium League of Legends Shortcodes Plugin league-of-legends-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2024-10342 Wordfence
6.5 Medium League of Legends Shortcodes Plugin league-of-legends-shortcodes SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 1.0.1 CVE-2024-10341 Wordfence
6.4 Medium Awesome buttons Plugin wp-awesome-buttons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode ≤ 1.0 CVE-2024-10148 Wordfence
6.4 Medium Contact Form 7 - Repeatable Fields Plugin cf7-repeatable-fields Cross-Site Scripting Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode ≤ 2.0.1 CVE-2024-10180 Wordfence
6.4 Medium Compact WP Audio Player Plugin compact-wp-audio-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode ≤ 1.9.13 CVE-2024-10176 Wordfence
4.3 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Information Disclosure Authenticated (Contributor+) Information Disclosure via Shortcode ≤ 1.6.43 CVE-2024-10050 Wordfence
5.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 7.2.2 CVE-2024-8500 Wordfence
6.4 Medium Anchor Episodes Index (Spotify for Podcasters) Plugin anchor-episodes-index Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode ≤ 2.1.10 CVE-2024-10189 Wordfence
8.5 High Simple Code Insert Shortcode Plugin simple-code-insert-shortcode SQL Injection ≤ 1.0 CVE-2024-49613 Patchstack
6.4 Medium StreamWeasels Twitch Integration Plugin streamweasels-twitch-integration Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed Shortcode ≤ 1.8.6 CVE-2024-9897 Wordfence
6.4 Medium Advanced Category and Custom Taxonomy Image Plugin advanced-category-and-custom-taxonomy-image Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode ≤ 1.0.9 CVE-2024-9425 Wordfence
6.4 Medium RSS Feed Widget Plugin rss-feed-widget Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode ≤ 2.9.9 CVE-2024-10057 Wordfence
6.4 Medium Click to Chat – WP Support All-in-One Floating Widget Plugin support-chat Cross-Site Scripting WP Support All-in-One Floating Widget <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsaio_snapchat Shortcode ≤ 2.3.3 CVE-2024-10055 Wordfence
6.4 Medium Arconix Shortcodes Plugin arconix-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.1.12 CVE-2024-9703 Wordfence
6.4 Medium Flat UI Button Plugin flat-ui-button Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode 1.0 CVE-2024-10014 Wordfence
6.5 Medium Shortcode For Elementor Templates Plugin shortcode-support-for-elementor-templates Cross-Site Scripting ≤ 1.0.0 CVE-2024-48022 Patchstack
6.4 Medium Parallax Image Plugin parallax-image Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dd-parallax Shortcode ≤ 1.8 CVE-2024-9898 Wordfence
7.3 High WP Popup Builder – Popup Forms and Marketing Lead Generation Plugin wp-popup-builder Arbitrary Shortcode Execution Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add No login needed ≤ 1.3.5 CVE-2024-9061 Wordfence
6.4 Medium Smart Online Order for Clover Plugin clover-online-orders Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode ≤ 1.5.7 CVE-2024-9895 Wordfence
7.3 High AADMY – Add Auto Date Month Year Into Posts Plugin auto-date-year-month Arbitrary Shortcode Execution Add Auto Date Month Year Into Posts <= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.0.1 CVE-2024-9837 Wordfence
6.4 Medium Rescue Shortcodes Plugin rescue-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.8 CVE-2024-9696 Wordfence
6.4 Medium Social Sharing (by Danny) Plugin dvk-social-sharing Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.7 CVE-2024-9704 Wordfence
6.4 Medium WP Ultimate Post Grid Plugin wp-ultimate-post-grid Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode ≤ 3.9.3 CVE-2024-9051 Wordfence
6.4 Medium Powerpress Plugin powerpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode ≤ 11.9.18 CVE-2024-9543 Wordfence
7.3 High Shortcodes AnyWhere Plugin shortcodes-anywhere Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.0.1 CVE-2024-9581 Wordfence
6.4 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Cross-Site Scripting BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode ≤ 1.3.0 CVE-2024-8987 Wordfence
6.4 Medium CMSMasters Content Composer Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.8.8 CVE-2024-7963 Wordfence
6.4 Medium Bridge Core Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.0 CVE-2024-9292 Wordfence
6.4 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading and Icon Picker Widgets ≤ 2.16.3 CVE-2024-8486 Wordfence
6.4 Medium Display Medium Posts Plugin display-medium-posts Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via display_medium_posts Shortcode ≤ 5.0.1 CVE-2024-9445 Wordfence
6.4 Medium Login Logout Shortcode Plugin login-logout-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter ≤ 1.1.0 CVE-2024-9421 Wordfence
5.4 Medium Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Plugin email-subscribers Arbitrary Shortcode Execution Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 5.7.34 CVE-2024-8254 Wordfence
6.4 Medium Stars Testimonials Plugin stars-testimonials-with-slider-and-masonry-grid Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode ≤ 3.3.1 CVE-2024-8989 Wordfence
6.4 Medium Geo Mashup Plugin geo-mashup Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode ≤ 1.13.13 CVE-2024-8990 Wordfence
6.4 Medium WP-WebAuthn Plugin wp-webauthn Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode ≤ 1.3.3 CVE-2024-9023 Wordfence
6.4 Medium OSM Plugin osm Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes ≤ 6.1.0 CVE-2024-8991 Wordfence
6.4 Medium Themedy Toolbox Plugin themedy-toolbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 1.0.15 CVE-2024-9177 Wordfence
6.4 Medium Material Design Icons Plugin material-design-icons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode ≤ 0.0.5 CVE-2024-9024 Wordfence
6.4 Medium WP GPX Maps Plugin wp-gpx-maps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode ≤ 1.7.08 CVE-2024-9028 Wordfence
6.4 Medium WPZOOM Shortcodes Plugin wpzoom-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode ≤ 1.0.5 CVE-2024-9027 Wordfence
7.3 High Special Text Boxes Plugin tags Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 6.2.4 CVE-2024-8481 Wordfence
6.4 Medium Confetti Fall Animation Plugin confetti-fall-animation Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcode ≤ 1.3.1 CVE-2024-8919 Wordfence
7.3 High MDTF – Meta Data and Taxonomies Filter Plugin wp-meta-data-filter-and-taxonomy-filter Arbitrary Shortcode Execution Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.3.3.3 CVE-2024-8623 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only