WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,101–1,150 of 1,255 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 23 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium WPC Frequently Bought Together for WooCommerce Plugin woo-bought-together Broken Access Control ≤ 7.0.3 Fixed in 7.0.4 CVE-2024-32687 Patchstack
5.3 Medium Active Products Tables for WooCommerce Plugin profit-products-tables-for-woocommerce Broken Access Control No login needed ≤ 1.0.6.2 Fixed in 1.0.6.3 CVE-2024-32691 Patchstack
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.1 CVE-2024-1057 Wordfence
6.1 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting via 's' No login needed ≤ 5.47.0 CVE-2024-3731 Wordfence
6.4 Medium EAN for WooCommerce Plugin ean-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode ≤ 4.9.2 CVE-2023-6892 Wordfence
4.3 Medium EAN for WooCommerce Plugin ean-for-woocommerce Broken Access Control Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode ≤ 4.9.2 CVE-2023-6897 Wordfence
5.9 Medium TeraWallet – For WooCommerce Plugin woo-wallet Cross-Site Scripting ≤ 1.5.0 Fixed in 1.5.1 CVE-2024-32584 Patchstack
5.9 Medium Import Content in WordPress & WooCommerce with Excel Plugin content-excel-importer Cross-Site Scripting ≤ 4.2 Fixed in 4.3 CVE-2024-32585 Patchstack
5.3 Medium Product Feed PRO for WooCommerce Plugin woo-product-feed-pro Information Disclosure Sensitive Data Exposure No login needed ≤ 13.3.1 Fixed in 13.3.2 CVE-2024-32513 Patchstack
4.3 Medium Multi Currency For WooCommerce Plugin wc-multi-currency Broken Access Control ≤ 1.5.5 Fixed in 1.5.6 CVE-2024-32516 Patchstack
4.3 Medium Custom Thank You Page Customize For WooCommerce by Binary Carpenter Plugin bc-woo-custom-thank-you-pages Broken Access Control ≤ 1.4.12 Fixed in 1.4.14 CVE-2024-32517 Patchstack
4.3 Medium GG Woo Feed for WooCommerce Plugin gg-woo-feed Broken Access Control ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-32519 Patchstack
4.3 Medium WPC Grouped Product for WooCommerce Plugin wpc-grouped-product Broken Access Control ≤ 4.4.2 Fixed in 4.4.3 CVE-2024-32520 Patchstack
4.3 Medium Open Close WooCommerce Store Plugin woc-open-close Broken Access Control ≤ 4.9.1 Fixed in 4.9.2 CVE-2024-32522 Patchstack
4.3 Medium Custom Order Statuses for WooCommerce Plugin custom-order-statuses-for-woocommerce Broken Access Control ≤ 1.5.2 CVE-2024-32524 Patchstack
4.3 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Coupon Search ≤ 5.46.0 CVE-2024-3869 Wordfence
4.3 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending ≤ 5.46.0 CVE-2024-3243 Wordfence
4.3 Medium Product Input Fields for WooCommerce Plugin product-input-fields-for-woocommerce Cross-Site Request Forgery No login needed ≤ 1.7.0 Fixed in 1.8.0 CVE-2024-31431 Patchstack
4.3 Medium Currency per Product for WooCommerce Plugin currency-per-product-for-woocommerce Cross-Site Request Forgery No login needed ≤ 1.6.0 Fixed in 1.7.0 CVE-2024-31920 Patchstack
4.3 Medium Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Cross-Site Request Forgery No login needed ≤ 1.2.104 Fixed in 1.2.105 CVE-2024-31940 Patchstack
4.3 Medium MultiParcels Shipping For WooCommerce Plugin multiparcels-shipping-for-woocommerce Cross-Site Request Forgery No login needed < 1.16.9 Fixed in 1.16.9 CVE-2024-32095 Patchstack
4.3 Medium Email Marketing for WooCommerce by Omnisend Plugin omnisend-connect Cross-Site Request Forgery No login needed ≤ 1.14.3 Fixed in 1.14.4 CVE-2024-32101 Patchstack
4.3 Medium Order Delivery Date for WooCommerce Plugin order-delivery-date-for-woocommerce Cross-Site Request Forgery No login needed ≤ 3.20.2 Fixed in 3.21.0 CVE-2024-32434 Patchstack
5.4 Medium Wallet System for WooCommerce Plugin wallet-system-for-woocommerce Cross-Site Request Forgery No login needed ≤ 2.5.9 Fixed in 2.5.10 CVE-2024-32446 Patchstack
5.5 Medium Product Feed Manager Plugin best-woocommerce-feed Path Traversal Directory Traversal ≤ 7.3.15 Fixed in 7.3.16 CVE-2023-52144 Patchstack
4.9 Medium WooCommerce Plugin woocommerce Broken Access Control Contributor+ Private/Draft Products Access < 8.6 Fixed in 8.6 CVE-2024-1310 WPScan
4.4 Medium WPC Smart Quick View for WooCommerce Plugin woo-smart-quick-view Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 4.0.2 CVE-2023-6494 Wordfence
4.3 Medium WooCommerce Shipping Per Product Plugin Broken Access Control ≤ 2.5.4 Fixed in 2.5.5 CVE-2023-51499 Patchstack
4.3 Medium WordPress Comments Import & Export Plugin comments-import-export-woocommerce Cross-Site Request Forgery No login needed ≤ 2.3.5 Fixed in 2.3.6 CVE-2024-31235 Patchstack
5.4 Medium WooCommerce Checkout Field Editor (Checkout Manager) Plugin woo-checkout-regsiter-field-editor Cross-Site Request Forgery No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-31262 Patchstack
4.3 Medium ELEX WooCommerce Dynamic Pricing and Discounts Plugin elex-woocommerce-dynamic-pricing-and-discounts Cross-Site Request Forgery No login needed ≤ 2.1.2 Fixed in 2.1.3 CVE-2024-31364 Patchstack
4.3 Medium ELEX WooCommerce Dynamic Pricing and Discounts Plugin elex-woocommerce-dynamic-pricing-and-discounts Cross-Site Request Forgery No login needed ≤ 2.1.2 Fixed in 2.1.3 CVE-2024-32105 Patchstack
4.3 Medium Finale Lite Plugin finale-woocommerce-sales-countdown-timer-discount Cross-Site Request Forgery No login needed ≤ 2.18.0 Fixed in 2.18.1 CVE-2024-32107 Patchstack
4.3 Medium USPS Shipping for WooCommerce – Live Rates Plugin flexible-shipping-usps Cross-Site Request Forgery No login needed ≤ 1.9.2 Fixed in 1.9.3 CVE-2024-31943 Patchstack
4.3 Medium WooCommerce UPS Shipping – Live Rates and Access Points Plugin flexible-shipping-ups Cross-Site Request Forgery No login needed ≤ 2.2.4 Fixed in 2.2.5 CVE-2024-31944 Patchstack
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget ≤ 2.8.4 CVE-2024-2946 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.11 CVE-2024-2623 Wordfence
5.3 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Information Disclosure Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure No login needed ≤ 5.9.13 CVE-2024-2974 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.11 CVE-2024-2650 Wordfence
5.3 Medium WooCommerce Clover Payment Gateway Plugin woo-clover-gateway-by-zaytech Broken Access Control Missing Authorization via callback_handler No login needed ≤ 1.3.1 CVE-2024-0626 Wordfence
4.3 Medium WooCommerce Plugin woocommerce Cross-Site Request Forgery No login needed ≤ 8.5.2 Fixed in 8.6.0 CVE-2024-22155 Patchstack
6.4 Medium Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel Plugin wp-carousel-free Cross-Site Scripting Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode' ≤ 2.6.3 CVE-2024-2949 Wordfence
5.3 Medium WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin print-invoices-packing-slip-labels-for-woocommerce Broken Access Control Missing Authorization to Unauthenticated Settings Reset No login needed ≤ 4.4.2 CVE-2024-3216 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout ≤ 2.8.3 CVE-2024-2868 Wordfence
6.8 Medium WooCommerce Cart Abandonment Recovery Plugin Cross-Site Request Forgery Templates/Abandoned Orders Deletion via CSRF < 1.2.27 Fixed in 1.2.27 CVE-2024-2322 WPScan
6.5 Medium Product Sort and Display for WooCommerce Plugin woocommerce-product-sort-and-display Broken Access Control Missing Authorization No login needed ≤ 2.4.1 CVE-2024-1807 Wordfence
6.1 Medium WooCommerce Product Filter Plugin Cross-Site Scripting Admin+ Stored XSS No login needed < 1.4.4 Fixed in 1.4.4 CVE-2024-2278 WPScan
4.8 Medium WooCommerce Product Filter Plugin Cross-Site Scripting Reflected XSS < 1.4.4 Fixed in 1.4.4 CVE-2024-2263 WPScan
4.7 Medium WooCommerce Product Filter Plugin Cross-Site Request Forgery Filter Deletion via CSRF No login needed < 1.4.4 Fixed in 1.4.4 CVE-2024-2262 WPScan
6.5 Medium WooCommerce Bookings Calendar Plugin woo-bookings-calendar Cross-Site Scripting ≤ 1.0.36 CVE-2024-31117 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only