WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 11,801–11,850 of 17,889 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 237 of 358
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Philantro – Donations and Donor Management Plugin philantro Cross-Site Scripting Donations and Donor Management <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.2 CVE-2024-12500 Wordfence
6.4 Medium Easy Waveform Player Plugin easy-waveform-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.0 CVE-2024-11881 Wordfence
6.4 Medium Taeggie Feed Plugin taeggie-feed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 0.1.9 CVE-2024-11748 Wordfence
6.4 Medium ScanCircle Plugin scancircle Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.9.2 CVE-2024-11439 Wordfence
4.3 Medium ElementsReady Addons for Elementor Plugin element-ready-lite Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates ≤ 6.4.8 CVE-2024-10356 Wordfence
5.3 Medium PPWP – Password Protect Pages Plugin password-protect-page Information Disclosure Password Protect Pages <= 1.9.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 1.9.5 CVE-2024-11280 Wordfence
6.1 Medium WooCommerce Additional Fees On Checkout (Free) Plugin woo-additional-fees-on-checkout-wordpress Cross-Site Scripting Reflected Cross-Site Scripting via 'number' No login needed ≤ 1.4.7 CVE-2024-12395 Wordfence
5.3 Medium Calculated Fields Form Plugin calculated-fields-form Denial of Service No login needed ≤ 5.2.63 CVE-2024-12601 Wordfence
6.1 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting Reflected Cross-Site Scripting via status Parameter No login needed ≤ 4.9.1 CVE-2024-12469 Wordfence
6.1 Medium Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS Plugin sikshya Cross-Site Scripting Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter No login needed ≤ 0.0.21 CVE-2024-12127 Wordfence
5.3 Medium Memberful Plugin memberful-wp Information Disclosure Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 1.73.9 CVE-2024-11294 Wordfence
6.1 Medium SMS for WooCommerce Plugin wc-sms Cross-Site Request Forgery Cross-Site Request Forgery to Reflected Cross-Site Scripting No login needed ≤ 2.8.1 CVE-2024-12220 Wordfence
6.1 Medium Stop Registration Spam Plugin stop-registration-spam Cross-Site Request Forgery Cross-Site Request Forgery to Cross-Site Scripting No login needed ≤ 1.23 CVE-2024-12219 Wordfence
4.8 Medium My WP Customize Admin/Frontend Plugin my-wp Cross-Site Scripting Cross-site scripting vulnerability exists in My WP Customize Admin/Frontend versions prior to ver 1.24.1. If a malicious administrative user customizes the administrative page wit… prior to ver 1.24.1 CVE-2024-55864 jpcert
6.1 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting Reflected Cross-Site Scripting via Navigate Parameter No login needed ≤ 1.3.0.5 CVE-2024-12239 Wordfence
6.4 Medium TPG Get Posts Plugin tpg-get-posts Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.6.5 CVE-2024-11906 Wordfence
6.4 Medium Animated Counters Plugin animated-counters Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0 CVE-2024-11905 Wordfence
6.4 Medium Slope Widgets Plugin slope-widgets Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.12 CVE-2024-11902 Wordfence
6.4 Medium Portfolio – Filterable Masonry Portfolio Gallery for Professionals Plugin portfolio-pro Cross-Site Scripting Filterable Masonry Portfolio Gallery for Professionals <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.2 CVE-2024-11900 Wordfence
6.4 Medium CRM Perks – WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout Plugin support-x Cross-Site Scripting WordPress HelpDesk Integration – Zendesk, Freshdesk, HelpScout <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.6 CVE-2024-12443 Wordfence
4.3 Medium Avada Theme avada Cross-Site Request Forgery No login needed ≤ 7.11.10 Fixed in 7.11.11 CVE-2024-54357 Patchstack
4.3 Medium Caldera SMTP Mailer Plugin caldera-smtp-mailer Broken Access Control ≤ 1.0.1 CVE-2024-56003 Patchstack
5.3 Medium XML Multilanguage Sitemap Generator Plugin xml-multilanguage-sitemap-generator Broken Access Control No login needed ≤ 2.0.6 CVE-2024-55999 Patchstack
6.5 Medium Brand Plugin brand Cross-Site Scripting ≤ 1.1.6 Fixed in 1.1.7 CVE-2024-54348 Patchstack
4.3 Medium Advanced Custom Fields PRO Plugin advanced-custom-fields-pro Cross-Site Request Forgery No login needed < 6.3.2 Fixed in 6.3.2 CVE-2024-37251 Patchstack
6.5 Medium Termin-Kalender Plugin termin-kalender Broken Access Control ≤ 0.99.47 Fixed in 1.00.04 CVE-2024-54354 Patchstack
4.9 Medium Bold Page Builder Plugin bold-page-builder Path Traversal ≤ 5.1.5 Fixed in 5.1.6 CVE-2024-54382 Patchstack
6.1 Medium Dreamfox Media Payment gateway per Product for Woocommerce Plugin woocommerce-product-payments Broken Access Control No login needed ≤ 3.5.6 Fixed in 3.5.9 CVE-2024-55996 Patchstack
4.3 Medium Falcon – WordPress Optimizations & Tweaks Plugin falcon Broken Access Control WordPress Optimizations & Tweaks plugin <= 2.8.3 - Broken Access Control ≤ 2.8.3 Fixed in 2.8.4 CVE-2024-54384 Patchstack
5.4 Medium WooCommerce Basic Ordernumbers Plugin woocommerce-basic-ordernumbers Broken Access Control ≤ 1.4.4 CVE-2024-55992 Patchstack
5.3 Medium PixProof Plugin pixproof Broken Access Control No login needed ≤ 2.0.1 CVE-2024-54417 Patchstack
5.3 Medium Job Board Manager Plugin job-board-manager Broken Access Control No login needed ≤ 2.1.61 CVE-2024-55993 Patchstack
6.5 Medium Ksher Plugin ksher-payment Broken Access Control No login needed ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-56001 Patchstack
4.3 Medium 畅言评论系统 Plugin changyan Broken Access Control ≤ 2.0.5 CVE-2024-55994 Patchstack
4.3 Medium Leader Plugin leader Broken Access Control ≤ 2.6.1 CVE-2024-56007 Patchstack
5.3 Medium Spreadr Woocommerce Plugin spreadr-for-woocomerce Broken Access Control No login needed ≤ 1.0.4 Fixed in 1.0.5 CVE-2024-56009 Patchstack
6.5 Medium Gutensee Plugin gutensee Cross-Site Scripting ≤ 1.0.6 Fixed in 1.0.7 CVE-2024-54360 Patchstack
5.9 Medium Better WP Login Page Plugin better-wp-login-page Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.1.2 CVE-2024-54442 Patchstack
6.5 Medium Utech World Time Plugin utech-world-time-for-wp Cross-Site Scripting ≤ 1.0 CVE-2024-54441 Patchstack
6.5 Medium Advanced Data Table For Elementor Plugin advanced-data-table-for-elementor Cross-Site Scripting ≤ 1.0.0 Fixed in 1.0.1 CVE-2024-54443 Patchstack
6.5 Medium Responsive Google Maps | by imbaa Plugin responsive-google-maps Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.2.5 Fixed in 1.2.7 CVE-2024-56011 Patchstack
4.3 Medium WP Mailster Plugin wp-mailster Cross-Site Request Forgery No login needed ≤ 1.8.17.0 Fixed in 1.8.18.0 CVE-2024-54355 Patchstack
5.4 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Request Forgery No login needed ≤ 4.5 Fixed in 4.5.2 CVE-2024-54356 Patchstack
4.3 Medium Bet sport Free Plugin bet-sport-free Cross-Site Request Forgery No login needed ≤ 1.0.0 CVE-2024-54396 Patchstack
5.4 Medium Ui Slider Filter By Price Plugin ui-slider-filter-by-price Cross-Site Request Forgery No login needed ≤ 1.1 CVE-2024-54419 Patchstack
5.4 Medium DTC Documents Plugin dtc-documents Cross-Site Request Forgery No login needed ≤ 1.1.05 CVE-2024-54418 Patchstack
6.5 Medium Posti Shipping Plugin posti-shipping Cross-Site Request Forgery CSRF to Settings Change No login needed ≤ 3.10.3 Fixed in 3.10.4 CVE-2024-56005 Patchstack
4.3 Medium Arabic Webfonts Plugin arabic-webfonts Broken Access Control ≤ 1.4.6 CVE-2024-54402 Patchstack
6.5 Medium Youtube Video Grid Plugin youmax-channel-embeds-for-youtube-businesses Cross-Site Request Forgery CSRF to Settings Change No login needed ≤ 1.9 CVE-2024-54408 Patchstack
5.4 Medium EELV Newsletter Plugin eelv-newsletter Cross-Site Request Forgery No login needed ≤ 4.8.2 CVE-2024-54430 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only