WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,151–1,200 of 1,255 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 24 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Popup Cart Lite for WooCommerce Plugin woocommerce-woocart-popup-lite Cross-Site Request Forgery No login needed ≤ 1.1 CVE-2024-31100 Patchstack
6.5 Medium WC Marketplace Plugin dc-woocommerce-multi-vendor Cross-Site Scripting ≤ 4.1.3 Fixed in 4.1.4 CVE-2024-30433 Patchstack
4.3 Medium HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin woocommerce-products-filter Cross-Site Request Forgery No login needed ≤ 1.3.5.1 Fixed in 1.3.5.2 CVE-2024-30462 Patchstack
5.3 Medium Klarna Payments for WooCommerce Plugin klarna-payments-for-woocommerce Broken Access Control No login needed ≤ 3.2.4 Fixed in 3.3.0 CVE-2024-30477 Patchstack
4.3 Medium Custom WooCommerce Checkout Fields Editor Plugin add-fields-to-checkout-page-woocommerce Cross-Site Request Forgery No login needed ≤ 1.3.0 Fixed in 1.3.1 CVE-2024-30518 Patchstack
5.3 Medium Wholesale For WooCommerce Plugin Information Disclosure Unauthenticated Sensitive Data Exposure No login needed ≤ 2.3.0 Fixed in 2.3.1 CVE-2024-30469 Patchstack
5.3 Medium FG PrestaShop to WooCommerce Plugin fg-prestashop-to-woocommerce Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 4.45.1 Fixed in 4.47.0 CVE-2024-30511 Patchstack
4.3 Medium Import Export WordPress Users Plugin users-customers-import-export-for-wp-woocommerce Path Traversal ≤ 2.5.2 Fixed in 2.5.3 CVE-2024-30492 Patchstack
4.3 Medium WOOCS – WooCommerce Currency Switcher Plugin woocommerce-currency-switcher Cross-Site Request Forgery Currency Switcher Professional for WooCommerce plugin <= 1.4.1.7 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.4.1.7 Fixed in 1.4.1.8 CVE-2024-30458 Patchstack
6.5 Medium WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Plugin erp SQL Injection Authenticated (Subscriber+) SQL Injection ≤ 1.13.1 CVE-2024-0608 Wordfence
6.5 Medium Booster Plus for WooCommerce Plugin Information Disclosure Auth. Sensitive Data Exposure < 7.1.2 Fixed in 7.1.2 CVE-2023-52231 Patchstack
6.5 Medium Booster Elite for WooCommerce Plugin Information Disclosure Auth. Sensitive Data Exposure < 7.1.2 Fixed in 7.1.2 CVE-2023-52234 Patchstack
5.4 Medium WooCommerce Stripe Payment Gateway Plugin woocommerce-gateway-stripe Cross-Site Request Forgery No login needed ≤ 7.6.0 Fixed in 7.6.1 CVE-2023-44999 Patchstack
6.5 Medium Gratisfaction Plugin gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce Cross-Site Scripting ≤ 4.3.4 Fixed in 4.3.5 CVE-2024-29798 Patchstack
5.9 Medium WCFM – Frontend Manager for WooCommerce Plugin wc-frontend-manager Cross-Site Scripting ≤ 6.7.8 Fixed in 6.7.9 CVE-2024-29929 Patchstack
4.3 Medium WooCommerce Conversion Tracking Plugin woocommerce-conversion-tracking Broken Access Control ≤ 2.0.11 Fixed in 2.0.12 CVE-2024-24711 Patchstack
4.3 Medium Location Picker at Checkout for WooCommerce Plugin map-location-picker-at-checkout-for-woocommerce Broken Access Control ≤ 1.8.9 Fixed in 1.9.0 CVE-2024-24719 Patchstack
6.5 Medium WooCommerce Box Office Plugin woocommerce-box-office Broken Access Control ≤ 1.2.2 Fixed in 1.2.3 CVE-2024-24799 Patchstack
6.5 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control No login needed ≤ 1.5.0 Fixed in 1.6.0 CVE-2023-27608 Patchstack
6.4 Medium Custom WooCommerce Checkout Fields Editor Plugin add-fields-to-checkout-page-woocommerce Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 1.3.1 CVE-2024-1697 Wordfence
6.1 Medium WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.4.1 CVE-2024-0957 Wordfence
6.5 Medium YITH WooCommerce Gift Cards Premium Plugin yith-woocommerce-gift-cards-premium Cross-Site Scripting Unauth. Gift Card Creation Leading to Stored XSS No login needed ≤ 3.23.1 Fixed in 3.24.0 CVE-2022-44633 Patchstack
5.4 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control Settings Change ≤ 1.5.0 Fixed in 1.6.0 CVE-2023-27607 Patchstack
6.5 Medium Automation By Autonami Plugin wp-marketing-automations Cross-Site Scripting ≤ 2.8.2 Fixed in 2.8.3 CVE-2024-2580 Patchstack
6.5 Medium Free Downloads WooCommerce Plugin download-now-for-woocommerce Cross-Site Scripting ≤ 3.5.8.2 Fixed in 3.5.8.3 CVE-2024-27969 Patchstack
4.3 Medium Live Sales Notification for Woocommerce – Woomotiv Plugin Cross-Site Request Forgery Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_review No login needed ≤ 3.4.3 CVE-2024-1325 Wordfence
5.3 Medium Order Tip for WooCommerce Plugin order-tip-woo Broken Access Control Missing Authorization to Unauthenticated Data Export No login needed ≤ 1.3.1 CVE-2024-1119 Wordfence
5.4 Medium Permalink Manager Plugin permalink-manager-for-woocommerce Broken Access Control Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification ≤ 2.4.3.1 CVE-2024-2538 Wordfence
4.3 Medium WooCommerce POS Plugin Information Disclosure Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure ≤ 1.4.11 CVE-2024-2384 Wordfence
6.1 Medium Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms Plugin advanced-form-integration SQL Injection Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integration_id No login needed ≤ 1.82.0 CVE-2024-2387 Wordfence
4.3 Medium Builder for WooCommerce reviews shortcodes – ReviewShort Plugin woo-product-reviews-shortcode Cross-Site Request Forgery ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.01.3 Fixed in 1.01.4 CVE-2024-29093 Patchstack
5.9 Medium WooCommerce Google Feed Manager Plugin wp-product-feed-manager Cross-Site Scripting ≤ 2.2.0 Fixed in 2.3.0 CVE-2024-29112 Patchstack
5.3 Medium Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates Plugin Broken Access Control Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure No login needed ≤ 2.6.6 CVE-2024-1857 Wordfence
5.4 Medium WooCommerce PDF Invoice Builder Plugin woo-pdf-invoice-builder Cross-Site Request Forgery No login needed ≤ 1.2.101 Fixed in 1.2.102 CVE-2023-51486 Patchstack
4.3 Medium Customize My Account for WooCommerce Plugin customize-my-account-for-woocommerce Cross-Site Request Forgery No login needed ≤ 1.8.3 Fixed in 1.8.4 CVE-2023-51369 Patchstack
4.3 Medium HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin woocommerce-products-filter Cross-Site Request Forgery No login needed ≤ 1.3.4.3 Fixed in 1.3.4.4 CVE-2023-50861 Patchstack
5.9 Medium Doofinder for WooCommerce Plugin doofinder-for-woocommerce Cross-Site Scripting ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-25596 Patchstack
6.4 Medium HUSKY – Products Filter for WooCommerce Professional Plugin woocommerce-products-filter Cross-Site Scripting Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.5.1 CVE-2024-1796 Wordfence
4.3 Medium SMS Alert Order Notifications – WooCommerce Plugin Cross-Site Request Forgery WooCommerce <= 3.6.9 - Cross-Site Request Forgery No login needed ≤ 3.6.9 CVE-2024-1489 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table ≤ 5.9.9 CVE-2024-1537 Wordfence
4.3 Medium TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds Plugin woo-wallet Broken Access Control Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds <= 1.4.10 - Missing Authorization to Authenticated (Subscriber+) User Email Export ≤ 1.4.10 CVE-2024-1690 Wordfence
6.4 Medium Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde ≤ 7.1.7 CVE-2024-1534 Wordfence
5.3 Medium Password Protected Store for WooCommerce Plugin password-protected-woo-store Information Disclosure Information Exposure via REST API No login needed ≤ 2.2 CVE-2024-1088 Wordfence
5.3 Medium NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce Plugin finale-woocommerce-sales-countdown-timer-discount Broken Access Control Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure No login needed ≤ 2.17.0, ≤ 2.18.0 CVE-2024-1120 Wordfence
4.3 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Broken Access Control WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access Control ≤ 5.38.1 Fixed in 5.38.2 CVE-2023-51692 Patchstack
5.4 Medium MailerLite – WooCommerce integration Plugin woo-mailerlite Cross-Site Request Forgery WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 2.0.8 Fixed in 2.0.9 CVE-2023-52223 Patchstack
4.3 Medium Custom Order Statuses for WooCommerce Plugin custom-order-statuses-for-woocommerce Cross-Site Request Forgery WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.5.2 CVE-2024-25930 Patchstack
4.3 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Cross-Site Request Forgery Cross-Site Request Forgery via ajax_plugin_activation No login needed ≤ 1.4.4 CVE-2024-0767 Wordfence
4.3 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Broken Access Control Missing Authorization via templates_ajax_request ≤ 1.4.4 CVE-2024-0766 Wordfence
6.3 Medium Oliver POS – A WooCommerce Point of Sale (POS) Plugin Cross-Site Request Forgery A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgery No login needed ≤ 2.4.1.8 CVE-2024-1954 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only