WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.
Showing 1,201–1,250 of 1,457 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Squelch Tabs and Accordions Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode |
≤ 0.4.8 |
CVE-2024-5946 |
Wordfence | |
| 6.4 Medium | Simple Alert Boxes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode |
≤ 1.4.0 |
CVE-2024-5937 |
Wordfence | |
| 6.4 Medium | OSM – OpenStreetMap | Cross-Site Scripting OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 6.0.3 |
CVE-2024-3603 |
Wordfence | |
| 6.4 Medium | Webico Slider Flatsome Addons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode |
≤ 2.0.1 |
CVE-2024-5881 |
Wordfence | |
| 4.3 Medium | Snippet Shortcodes | Cross-Site Request Forgery No login needed |
≤ 4.1.4 |
CVE-2024-4543 |
Wordfence | |
| 6.4 Medium | Boot Store | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.6.4 |
CVE-2024-5938 |
Wordfence | |
| 6.4 Medium | Stock Ticker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode |
≤ 3.24.4 |
CVE-2024-6363 |
Wordfence | |
| 6.4 Medium | Scylla lite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.8.3 |
CVE-2024-5922 |
Wordfence | |
| 6.4 Medium | Theron Lite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 2.0 |
CVE-2024-5925 |
Wordfence | |
| 6.4 Medium | Silesia | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.0.6 |
CVE-2024-5788 |
Wordfence | |
| 6.4 Medium | Create by Mediavine | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode |
≤ 1.9.7 |
CVE-2024-5601 |
Wordfence | |
| 8.8 High | WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce | Local File Inclusion Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode |
≤ 2.2.25 |
CVE-2024-5431 |
Wordfence | |
| 6.4 Medium | Mosaic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode |
≤ 1.7.1 |
CVE-2024-5965 |
Wordfence | |
| 6.4 Medium | Grey Opaque | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode |
≤ 2.0.1 |
CVE-2024-5966 |
Wordfence | |
| 6.4 Medium | Flatsome | Multi-Purpose Responsive WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 3.18.7 |
CVE-2024-5346 |
Wordfence | |
| 6.5 Medium | Page Builder: Live Composer | Cross-Site Scripting Contributor+ Shortcode Cross Site Scripting (XSS) |
≤ 1.5.42 |
CVE-2024-35779 |
Patchstack | |
| 6.1 Medium | PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode | Cross-Site Scripting Contributor+ Stored XSS No login needed |
≤ 1.7 |
CVE-2024-5448 |
WPScan | |
| 5.4 Medium | PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode | Cross-Site Scripting Admin+ Stored XSS |
≤ 1.7 |
CVE-2024-5447 |
WPScan | |
| 6.1 Medium | DOP Shortcodes | Cross-Site Scripting Contributor+ Stored XSS via Shortcode No login needed |
≤ 1.2 |
CVE-2024-4377 |
WPScan | |
| 6.4 Medium | Flatsome | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.18.7 |
CVE-2024-5156 |
Wordfence | |
| 6.4 Medium | MaxGalleria | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode |
≤ 6.4.4 |
CVE-2024-5970 |
Wordfence | |
| 6.4 Medium | Master Slider – Responsive Touch Slider | Cross-Site Scripting Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode |
≤ 3.9.10 |
CVE-2024-4375 |
Wordfence | |
| 6.4 Medium | Collapse-O-Matic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.8.5.8 |
CVE-2024-4095 |
Wordfence | |
| 6.4 Medium | Video Gallery – YouTube Playlist, Channel Gallery by YotuWP | Local File Inclusion YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode |
≤ 1.3.13 |
CVE-2024-4551 |
Wordfence | |
| 6.4 Medium | Shariff Wrapper | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.6.13 |
CVE-2024-2695 |
Wordfence | |
| 6.4 Medium | Restaurant Menu and Food Ordering | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.4.0 |
CVE-2024-1399 |
Wordfence | |
| 8.8 High | tagDiv Composer | Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode |
≤ 4.8 |
CVE-2024-3813 |
Wordfence | |
| 5.4 Medium | WordPress Jitsi Shortcode | Cross-Site Scripting Contributor+ Stored XSS via Shortcode No login needed |
≤ 0.1 |
CVE-2024-3978 |
WPScan | |
| 5.1 Medium | WordPress Jitsi Shortcode | Cross-Site Scripting Admin+ Stored XSS |
≤ 0.1 |
CVE-2024-3977 |
WPScan | |
| 6.4 Medium | Events Manager – Calendar, Bookings, Tickets, and more! | Cross-Site Scripting Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes |
≤ 6.4.7.3 |
CVE-2024-3492 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 3.2.92 |
CVE-2024-5266 |
Wordfence | |
| 5.3 Medium | Builder for WooCommerce reviews shortcodes – ReviewShort | Broken Access Control ReviewShort plugin <= 1.01.5 - Broken Access Control No login needed |
≤ 1.01.5 Fixed in 1.01.6 |
CVE-2024-34763 |
Patchstack | |
| 6.4 Medium | Custom Field Template | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode |
≤ 2.6.1 |
CVE-2023-6745 |
Wordfence | |
| 6.4 Medium | One Page Express Companion | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via one_page_express_contact_form Shortcode |
≤ 1.6.37 |
CVE-2024-4703 |
Wordfence | |
| 6.4 Medium | Colibri Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode |
≤ 1.0.276 |
CVE-2024-4451 |
Wordfence | |
| 6.4 Medium | Colibri Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.276 |
CVE-2024-5038 |
Wordfence | |
| 6.4 Medium | Rotating Tweets (Twitter widget and shortcode) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.9.10 |
CVE-2024-5141 |
Wordfence | |
| 6.4 Medium | Materialis Companion | Cross-Site Scripting Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode |
≤ 1.3.41 |
CVE-2024-4707 |
Wordfence | |
| 6.4 Medium | Testimonials Widget | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode |
≤ 4.0.4 |
CVE-2024-4705 |
Wordfence | |
| 6.4 Medium | Easy Social Like Box – Popup – Sidebar Widget | Cross-Site Scripting Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.0 |
CVE-2024-5224 |
Wordfence | |
| 6.5 Medium | Album and Image Gallery plus Lightbox | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 2.0 |
CVE-2024-4194 |
Wordfence | |
| 6.4 Medium | Simple Image Popup Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2024-5342 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode |
≤ 3.2.93 |
CVE-2024-4001 |
Wordfence | |
| 6.4 Medium | WP Shortcodes Plugin — Shortcodes Ultimate | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode |
≤ 7.1.6 |
CVE-2024-4821 |
Wordfence | |
| 8.8 High | LifterLMS – WordPress LMS Plugin for eLearning | SQL Injection WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode |
≤ 7.6.2 |
CVE-2024-4743 |
Wordfence | |
| 6.4 Medium | Weaver Xtreme Theme Support | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode |
≤ 6.4 |
CVE-2024-4939 |
Wordfence | |
| 6.4 Medium | SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! | Cross-Site Scripting Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode |
≤ 1.0.47 |
CVE-2024-5485 |
Wordfence | |
| 6.4 Medium | Essential Real Estate | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.4.2 |
CVE-2024-4273 |
Wordfence | |
| 6.4 Medium | tagDiv Composer | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode |
≤ 4.8 |
CVE-2024-3888 |
Wordfence | |
| 8.8 High | Content Blocks (Custom Post Widget) | Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode |
≤ 3.3.0 |
CVE-2024-3564 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.