WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 12,351–12,400 of 17,889 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 248 of 358
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Futurio Extra Plugin futurio-extra Cross-Site Scripting ≤ 2.0.14 Fixed in 2.0.15 CVE-2024-53802 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.2.1 Fixed in 5.2.2 CVE-2024-53801 Patchstack
6.5 Medium Captivate Sync Plugin captivatesync-trade Cross-Site Scripting ≤ 2.0.22 Fixed in 2.0.26 CVE-2024-53820 Patchstack
5.9 Medium Z-Downloads Plugin z-downloads Cross-Site Scripting ≤ 1.11.7 Fixed in 1.11.8 CVE-2024-54206 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.6.14 Fixed in 6.0.1 CVE-2024-53823 Patchstack
5.9 Medium Auction Plugin wp-auctions Cross-Site Scripting ≤ 3.7 CVE-2024-54207 Patchstack
5.9 Medium Borderless Plugin borderless Cross-Site Scripting Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin <= 1.5.8 - Cross Site Scripting (XSS) ≤ 1.5.8 Fixed in 1.5.9 CVE-2024-54211 Patchstack
6.5 Medium Advanced Element Bucket Addons for Elementor Plugin cs-element-bucket Cross-Site Scripting ≤ 1.0.2 CVE-2024-54210 Patchstack
6.5 Medium Magical Addons For Elementor Plugin magical-addons-for-elementor Cross-Site Scripting ≤ 1.3.6 Fixed in 1.3.7 CVE-2024-54212 Patchstack
6.5 Medium ZionBuilder Plugin zionbuilder Cross-Site Scripting Zion Builder plugin <= 3.6.16 - Cross Site Scripting (XSS) ≤ 3.6.16 Fixed in 3.6.17 CVE-2024-54213 Patchstack
5.4 Medium Maspik – Spam blacklist Plugin contact-forms-anti-spam Cross-Site Request Forgery CSRF to Settings Change ≤ 2.2.7 Fixed in 2.2.8 CVE-2024-53806 Patchstack
4.3 Medium Namaste! LMS Plugin namaste-lms Cross-Site Request Forgery No login needed ≤ 2.6.4.1 Fixed in 2.6.5 CVE-2024-53809 Patchstack
6.6 Medium WDesignkit Plugin wdesignkit Arbitrary File Upload ≤ 1.0.40 Fixed in 1.1.0 CVE-2024-53811 Patchstack
6.5 Medium KiviCare – Clinic & Patient Management System (EHR) Plugin kivicare-clinic-management-system SQL Injection Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection ≤ 3.6.4 CVE-2024-11729 Wordfence
6.5 Medium KiviCare – Clinic & Patient Management System (EHR) Plugin kivicare-clinic-management-system SQL Injection Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Doctor/Receptionist+) SQL Injection ≤ 3.6.4 CVE-2024-11730 Wordfence
6.3 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Arbitrary Shortcode Execution Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 4.0.51 CVE-2024-10681 Wordfence
6.3 Medium Pojo Forms Plugin pojo-forms Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode ≤ 1.4.7 CVE-2024-10909 Wordfence
6.4 Medium Smart PopUp Blaster Plugin smart-popup-blaster Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.3 CVE-2024-11339 Wordfence
4.3 Medium PowerPack Elementor Addons (Free Widgets, Extensions and Templates) Plugin powerpack-lite-for-elementor Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 2.8.1 CVE-2024-10692 Wordfence
4.3 Medium XLTab – Accordions and Tabs for Elementor Page Builder Plugin xl-tab Information Disclosure Accordions and Tabs for Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Post Disclosure ≤ 1.4 CVE-2024-10689 Wordfence
6.1 Medium Folder Gallery Plugin folder-gallery Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting No login needed ≤ 1.7.4 CVE-2024-11823 Wordfence
6.1 Medium ForumWP – Forum & Discussion Board Plugin forumwp Cross-Site Scripting Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter No login needed ≤ 2.1.2 CVE-2024-11204 Wordfence
6.1 Medium Next-Cart Store to WooCommerce Migration Plugin nextcart-woocommerce-migration Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.9.2 CVE-2024-11687 Wordfence
5.3 Medium Ultimate Coming Soon & Maintenance Plugin ultimate-coming-soon Broken Access Control Missing Authorization to Unauthenticated Template Activation No login needed ≤ 1.0.9 CVE-2024-9706 Wordfence
5.3 Medium Friends Plugin friends Broken Access Control Missing Authorization No login needed ≤ 3.2.1 CVE-2024-12028 Wordfence
6.4 Medium TwentyTwenty Plugin twentytwenty Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.1 CVE-2024-11352 Wordfence
5.4 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 4.5.1 CVE-2024-9872 Wordfence
4.3 Medium Gold Addons for Elementor Plugin gold-addons-for-elementor Broken Access Control Missing Authorization to Authenticated (Subscriber+) License Activation/Deactivation ≤ 1.3.2 CVE-2024-12110 Wordfence
6.4 Medium Cookielay Plugin cookielay Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode ≤ 1.2.0 CVE-2024-10320 Wordfence
6.4 Medium ONLYOFFICE Docs Plugin onlyoffice Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.0 CVE-2024-11450 Wordfence
6.1 Medium Splash Sync Plugin splash-connector Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.0.7 CVE-2024-11368 Wordfence
6.1 Medium PDF Builder for WooCommerce. Create invoices,packing slips and more Plugin woo-pdf-invoice-builder Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.2.136 CVE-2024-11276 Wordfence
4.3 Medium Message Filter for Contact Form 7 Plugin cf7-message-filter Broken Access Control Missing Authorization to Authenticated (Subscriber+) Filter Updates/Deletions ≤ 1.6.3 CVE-2024-12027 Wordfence
6.1 Medium Clickbank WordPress Plugin (Storefront) Plugin clickbank-storefront Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 1.7 CVE-2024-11336 Wordfence
6.4 Medium NewsMash Theme newsmash Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.71 CVE-2024-10849 Wordfence
5.4 Medium Event Tickets with Ticket Scanner Plugin event-tickets-with-ticket-scanner Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 2.4.3 CVE-2024-9866 Wordfence
4.3 Medium Ultimate Coming Soon & Maintenance Plugin ultimate-coming-soon Broken Access Control Missing Authorization to Authenticated (Subscriber+) Template Name Update ≤ 1.0.9 CVE-2024-9705 Wordfence
4.3 Medium CLUEVO LMS, E-Learning Platform Plugin cluevo-lms Cross-Site Request Forgery Cross-Site Request Forgery to Module Deletion No login needed ≤ 1.13.2 CVE-2024-11444 Wordfence
5.3 Medium WP Private Content Plus Plugin wp-private-content-plus Information Disclosure Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 3.6.1 CVE-2024-11292 Wordfence
6.1 Medium WP Media Optimizer (.webp) Plugin wp-media-optimizer-webp Cross-Site Scripting Reflected Cross-Site Scripting via wpmowebp-css-resources and wpmowebp-js-resources Parameters No login needed ≤ 1.4.0 CVE-2024-12060 Wordfence
6.1 Medium ForumWP – Forum & Discussion Board Plugin forumwp Cross-Site Scripting Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting No login needed ≤ 2.1.2 CVE-2024-10879 Wordfence
6.1 Medium WP System Plugin wp-system Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 1.1.1 CVE-2024-12003 Wordfence
4.8 Medium Sticky Social Icons Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.2.1 CVE-2024-10551 WPScan
4.3 Medium 3DPrint Lite Plugin 3dprint-lite Cross-Site Request Forgery Settings Update via CSRF No login needed < 2.1 Fixed in 2.1 CVE-2024-10480 WPScan
6.4 Medium myCred – Loyalty Points and Rewards Plugin mycred Cross-Site Scripting Loyalty Points and Rewards plugin <= 2.7.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via mycred_send Shortcode ≤ 2.7.5.2 CVE-2024-11201 Wordfence
6.1 Medium Broadcast Plugin threewp-broadcast Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 51.01 CVE-2024-11379 Wordfence
4.4 Medium Video Gallery Plugin video-wc-gallery Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 2.4.1 CVE-2024-9769 Wordfence
6.1 Medium Flixita Theme flixita Cross-Site Scripting Reflected Cross-Site Scripting via id Parameter No login needed ≤ 1.0.82 CVE-2024-10836 Wordfence
6.1 Medium Accounting for WooCommerce Plugin accounting-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.6 CVE-2024-11324 Wordfence
4.3 Medium AnyWhere Elementor Plugin Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 1.2.11 CVE-2024-10777 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only