WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 11,601–11,650 of 17,889 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 233 of 358
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	WPAdverts Plugin `wpadverts`	Cross-Site Request Forgery No login needed	`≤ 2.1.2` Fixed in `2.1.3`	Jan 2, 2025	`CVE-2024-37238`	Patchstack
4.3 Medium	Loco Translate Plugin `loco-translate`	Cross-Site Request Forgery No login needed	`≤ 2.6.9` Fixed in `2.6.10`	Jan 2, 2025	`CVE-2024-37236`	Patchstack
4.3 Medium	Groundhogg Plugin `groundhogg`	Cross-Site Request Forgery No login needed	`≤ 3.4.2.3` Fixed in `3.4.3`	Jan 2, 2025	`CVE-2024-37235`	Patchstack
4.3 Medium	Chic Lite Plugin `chic-lite`	Cross-Site Request Forgery No login needed	`≤ 1.1.3` Fixed in `1.1.4`	Jan 2, 2025	`CVE-2024-37104`	Patchstack
4.3 Medium	Education Zone Plugin `education-zone`	Cross-Site Request Forgery No login needed	`≤ 1.3.4` Fixed in `1.3.5`	Jan 2, 2025	`CVE-2024-37103`	Patchstack
4.3 Medium	Vilva Plugin `vilva`	Cross-Site Request Forgery No login needed	`≤ 1.2.2` Fixed in `1.2.3`	Jan 2, 2025	`CVE-2024-37102`	Patchstack
4.3 Medium	MasterStudy LMS Plugin `masterstudy-lms-learning-management-system`	Cross-Site Request Forgery No login needed	`≤ 3.2.1` Fixed in `3.2.2`	Jan 2, 2025	`CVE-2024-37093`	Patchstack
4.3 Medium	Flo Forms Plugin `flo-forms`	Broken Access Control	`≤ 1.0.41` Fixed in `1.0.42`	Jan 2, 2025	`CVE-2023-47692`	Patchstack
6.5 Medium	Animator Plugin `scroll-triggered-animations`	Broken Access Control Unauthenticated Plugin Settings Change No login needed	`≤ 3.0.10` Fixed in `3.0.11`	Jan 2, 2025	`CVE-2023-47689`	Patchstack
5.4 Medium	Dragfy Addons for Elementor Plugin `dragfy-addons-for-elementor`	Broken Access Control Broken Access Control + CSRF	`≤ 1.0.2`	Jan 2, 2025	`CVE-2023-47661`	Patchstack
4.3 Medium	BadgeOS Plugin `badgeos`	Broken Access Control	`≤ 3.7.1.6`	Jan 2, 2025	`CVE-2023-47647`	Patchstack
4.3 Medium	Visitors Traffic Real Time Statistics Plugin `visitors-traffic-real-time-statistics`	Broken Access Control	`≤ 7.2` Fixed in `7.3`	Jan 2, 2025	`CVE-2023-47557`	Patchstack
4.3 Medium	Auto Tag Creator Plugin `auto-tag-creator`	Broken Access Control	`≤ 1.0.2`	Jan 2, 2025	`CVE-2023-47523`	Patchstack
5.3 Medium	Seers Plugin `seers-cookie-consent-banner-privacy-policy`	Broken Access Control No login needed	`≤ 8.1.1` Fixed in `8.1.2`	Jan 2, 2025	`CVE-2023-47515`	Patchstack
5.3 Medium	CoCart – Headless ecommerce Plugin `cart-rest-api-for-woocommerce`	Broken Access Control Headless ecommerce plugin <= 3.11.2 - Broken Access Control No login needed	`≤ 3.11.2` Fixed in `3.12.0`	Jan 2, 2025	`CVE-2023-47241`	Patchstack
5.4 Medium	Short URL Plugin `shorten-url`	Broken Access Control	`≤ 1.6.8`	Jan 2, 2025	`CVE-2023-47225`	Patchstack
5.3 Medium	Simple Job Board Plugin `simple-job-board`	Broken Access Control No login needed	`≤ 2.10.5` Fixed in `2.10.6`	Jan 2, 2025	`CVE-2023-47188`	Patchstack
5.4 Medium	Animated Rotating Words Plugin `css3-rotating-words`	Broken Access Control	`≤ 5.4` Fixed in `5.5`	Jan 2, 2025	`CVE-2023-47187`	Patchstack
5.3 Medium	GiveWP Plugin `give`	Broken Access Control No login needed	`≤ 2.33.1` Fixed in `2.33.2`	Jan 2, 2025	`CVE-2023-47183`	Patchstack
6.5 Medium	Finale Lite Plugin `finale-woocommerce-sales-countdown-timer-discount`	Broken Access Control Sales Countdown Timer & Discount for WooCommerce plugin <= 2.16.0 - Arbitrary Content Deletion No login needed	`≤ 2.16.0` Fixed in `2.17.0`	Jan 2, 2025	`CVE-2023-47180`	Patchstack
6.5 Medium	WordPress CTA Plugin `easy-sticky-sidebar`	Broken Access Control No login needed	`≤ 1.5.8` Fixed in `1.5.9`	Jan 2, 2025	`CVE-2023-46644`	Patchstack
5.3 Medium	kk Star Ratings Plugin `kk-star-ratings`	Broken Access Control No login needed	`≤ 5.4.5` Fixed in `5.4.6`	Jan 2, 2025	`CVE-2023-46639`	Patchstack
5.3 Medium	Generate Dummy Posts Plugin `generate-dummy-posts`	Broken Access Control No login needed	`≤ 1.0.0`	Jan 2, 2025	`CVE-2023-46637`	Patchstack
5.3 Medium	YITH WooCommerce Product Add-Ons Plugin `yith-woocommerce-product-add-ons`	Broken Access Control No login needed	`≤ 4.2.0` Fixed in `4.2.1`	Jan 2, 2025	`CVE-2023-46635`	Patchstack
5.4 Medium	Glossary Plugin `wp-glossary`	Broken Access Control	`≤ 3.1.2`	Jan 2, 2025	`CVE-2023-46633`	Patchstack
6.5 Medium	Product Recommendation Quiz for eCommerce Plugin `product-recommendation-quiz-for-ecommerce`	Broken Access Control No login needed	`≤ 2.1.2` Fixed in `2.2.0`	Jan 2, 2025	`CVE-2023-46631`	Patchstack
4.3 Medium	WP Word Count Plugin `wp-word-count`	Broken Access Control	`≤ 3.2.4`	Jan 2, 2025	`CVE-2023-46628`	Patchstack
5.4 Medium	Draw Attention Plugin `draw-attention`	Broken Access Control	`≤ 2.0.15` Fixed in `2.0.16`	Jan 2, 2025	`CVE-2023-46616`	Patchstack
4.3 Medium	Mediabay Plugin `mediabay-lite`	Broken Access Control	`≤ 1.6`	Jan 2, 2025	`CVE-2023-46612`	Patchstack
5.3 Medium	YOP Poll Plugin `yop-poll`	Authentication Bypass Vote Manipulation Due to Broken Captcha Control No login needed	`≤ 6.5.28` Fixed in `6.5.29`	Jan 2, 2025	`CVE-2023-46611`	Patchstack
6.5 Medium	Quill Forms Plugin `quillforms`	Broken Access Control Broken Access Control + CSRF	`≤ 3.3.0` Fixed in `3.4.0`	Jan 2, 2025	`CVE-2023-46610`	Patchstack
6.5 Medium	FeedFocal Plugin `feedfocal`	Broken Access Control No login needed	`≤ 1.2.2` Fixed in `1.3.0`	Jan 2, 2025	`CVE-2023-46609`	Patchstack
5.3 Medium	DoLogin Security Plugin `dologin`	Broken Access Control Multiple Broken Access Control No login needed	`≤ 3.7.1` Fixed in `3.8`	Jan 2, 2025	`CVE-2023-46608`	Patchstack
5.4 Medium	WP iCal Availability Plugin `wp-ical-availability`	Broken Access Control No login needed	`≤ 1.0.3`	Jan 2, 2025	`CVE-2023-46607`	Patchstack
5.3 Medium	AtomChat Plugin `atomchat`	Broken Access Control No login needed	`≤ 1.1.4` Fixed in `1.1.5`	Jan 2, 2025	`CVE-2023-46606`	Patchstack
5.3 Medium	Convertful – Your Ultimate On-Site Conversion Tool Plugin `convertful`	Broken Access Control Your Ultimate On-Site Conversion Tool plugin <= 2.5 - Broken Access Control No login needed	`≤ 2.5` Fixed in `2.6`	Jan 2, 2025	`CVE-2023-46605`	Patchstack
5.3 Medium	wpDiscuz Plugin `wpdiscuz`	Broken Access Control No login needed	`≤ 7.6.10` Fixed in `7.6.11`	Jan 2, 2025	`CVE-2023-46309`	Patchstack
5.3 Medium	MW WP Form Plugin `mw-wp-form`	Broken Access Control No login needed	`≤ 4.4.5` Fixed in `5.0.0`	Jan 2, 2025	`CVE-2023-46206`	Patchstack
4.3 Medium	Just Custom Fields Plugin `just-custom-fields`	Broken Access Control	`≤ 3.3.2`	Jan 2, 2025	`CVE-2023-46203`	Patchstack
4.3 Medium	Social proof testimonials and reviews by Repuso Plugin `social-testimonials-and-reviews-widget`	Broken Access Control	`≤ 4.97` Fixed in `5.00`	Jan 2, 2025	`CVE-2023-46196`	Patchstack
6.5 Medium	Headline Analyzer Plugin `headline-analyzer`	Broken Access Control No login needed	`≤ 1.3.1` Fixed in `1.3.2`	Jan 2, 2025	`CVE-2023-46195`	Patchstack
4.3 Medium	Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin `freesoul-deactivate-plugins`	Broken Access Control	`≤ 2.1.3` Fixed in `2.1.4`	Jan 2, 2025	`CVE-2023-46188`	Patchstack
5.3 Medium	Kali Forms Plugin `kali-forms`	Broken Access Control No login needed	`≤ 2.3.27` Fixed in `2.3.28`	Jan 2, 2025	`CVE-2023-46083`	Patchstack
5.3 Medium	Broken Link Checker \| Finder Plugin `broken-link-finder`	Broken Access Control No login needed	`≤ 2.4.2` Fixed in `2.5.0`	Jan 2, 2025	`CVE-2023-46082`	Patchstack
4.3 Medium	ApplyOnline – Application Form Builder and Manager Plugin `apply-online`	Broken Access Control Application Form Builder and Manager plugin <= 2.5.3 - Broken Access Control	`≤ 2.5.3` Fixed in `2.5.4`	Jan 2, 2025	`CVE-2023-46080`	Patchstack
5.4 Medium	Ashe Extra Plugin `ashe-extra`	Broken Access Control Broken Access Control + CSRF	`≤ 1.2.9` Fixed in `1.2.92`	Jan 2, 2025	`CVE-2023-46079`	Patchstack
5.3 Medium	DX Delete Attached Media Plugin `dx-delete-attached-media`	Broken Access Control Broken Access Control vulnerability + CSRF No login needed	`≤ 2.0.5.1` Fixed in `2.0.6`	Jan 2, 2025	`CVE-2023-46073`	Patchstack
5.4 Medium	RumbleTalk Live Group Chat Plugin `rumbletalk-chat-a-chat-with-themes`	Broken Access Control	`≤ 6.2.5` Fixed in `6.2.6`	Jan 2, 2025	`CVE-2023-45828`	Patchstack
5.3 Medium	Poll Maker Plugin `poll-maker`	Broken Access Control No login needed	`≤ 4.7.1` Fixed in `4.7.2`	Jan 2, 2025	`CVE-2023-45766`	Patchstack
4.3 Medium	WP ERP Plugin `erp`	Broken Access Control	`≤ 1.12.6` Fixed in `1.12.7`	Jan 2, 2025	`CVE-2023-45765`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.