WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 1,201–1,250 of 1,279 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Passster | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode |
≤ 4.2.6.4 |
CVE-2024-2026 |
Wordfence | |
| 6.4 Medium | EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more | Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.9.14 |
CVE-2024-3244 |
Wordfence | |
| 6.4 Medium | Modal Window – create popup modal window | Cross-Site Scripting create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 5.3.8 |
CVE-2024-2457 |
Wordfence | |
| 6.4 Medium | GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in | Cross-Site Scripting The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 6.9.0 |
CVE-2024-2783 |
Wordfence | |
| 6.4 Medium | Lightweight Accordion | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.5.16 |
CVE-2024-2436 |
Wordfence | |
| 6.4 Medium | UsersWP | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.2.6 |
CVE-2024-2423 |
Wordfence | |
| 6.4 Medium | BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg | Cross-Site Scripting Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.4.2 |
CVE-2024-2845 |
Wordfence | |
| 6.4 Medium | Forminator – Contact Form, Payment Form & Custom Form Builder | Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode |
≤ 1.29.2 |
CVE-2024-3053 |
Wordfence | |
| 6.4 Medium | RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator | Cross-Site Scripting Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message |
≤ 4.3.3 |
CVE-2023-6877 |
Wordfence | |
| 6.4 Medium | Powerkit – Supercharge your WordPress Site | Cross-Site Scripting Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.9.1 |
CVE-2024-2458 |
Wordfence | |
| 6.4 Medium | Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | Cross-Site Scripting Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode' |
≤ 2.6.3 |
CVE-2024-2949 |
Wordfence | |
| 6.4 Medium | Squelch Tabs and Accordions Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via accordions Shortcode |
≤ 0.4.3 |
CVE-2024-2499 |
Wordfence | |
| 6.4 Medium | WordPress Tag and Category Manager – AI Autotagger | Cross-Site Scripting AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.12.0 |
CVE-2024-2830 |
Wordfence | |
| 6.4 Medium | Shortcodes and extra features for Phlox | Broken Access Control |
≤ 2.15.7 Fixed in 2.15.8 |
CVE-2024-31099 |
Patchstack | |
| 6.5 Medium | AI Twitter Feeds (Twitter widget & shortcode) | Cross-Site Scripting |
≤ 2.4 |
CVE-2024-31101 |
Patchstack | |
| 6.4 Medium | Favorites | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.3.3 |
CVE-2024-2948 |
Wordfence | |
| 6.4 Medium | Media Library Assistant | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode |
≤ 3.13 |
CVE-2024-2475 |
Wordfence | |
| 6.5 Medium | Grid Shortcodes | Cross-Site Scripting |
≤ 1.1 Fixed in 1.1.1 |
CVE-2024-29797 |
Patchstack | |
| 6.4 Medium | Easy Textillate | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.01 |
CVE-2024-2303 |
Wordfence | |
| 5.4 Medium | Themify Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.0.8 |
CVE-2024-2732 |
Wordfence | |
| 6.4 Medium | Animated Headline | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.0 |
CVE-2024-2304 |
Wordfence | |
| 6.4 Medium | Standout Color Boxes and Buttons | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 0.7.0 |
CVE-2024-2474 |
Wordfence | |
| 6.4 Medium | GamiPress – Button | Cross-Site Scripting Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.7 |
CVE-2024-2460 |
Wordfence | |
| 4.3 Medium | Builder for WooCommerce reviews shortcodes – ReviewShort | Cross-Site Request Forgery ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) No login needed |
≤ 1.01.3 Fixed in 1.01.4 |
CVE-2024-29093 |
Patchstack | |
| 4.8 Medium | Profile Box Shortcode And Widget | Cross-Site Scripting Profile Box Shortcode And Widget < 1.2.1 Admin+ Stored XSS |
< 1.2.1 Fixed in 1.2.1 |
CVE-2024-1401 |
WPScan | |
| 4.8 Medium | Advanced Social Feeds Widget & Shortcode | Cross-Site Scripting Admin+ Stored XSS |
≤ 1.7 |
CVE-2024-0951 |
WPScan | |
| 6.1 Medium | Buttons Shortcode and Widget | Cross-Site Scripting Stored XSS via shortcode No login needed |
≤ 1.16 |
CVE-2024-0711 |
WPScan | |
| 5.4 Medium | Tabs Shortcode and Widget | Cross-Site Scripting Contributor+ Stored Cross-Site Scripting |
≤ 1.17 |
CVE-2024-0719 |
WPScan | |
| 5.4 Medium | Grid Shortcodes | Cross-Site Scripting Contributor+ Stored XSS |
< 1.1.1 Fixed in 1.1.1 |
CVE-2024-1658 |
WPScan | |
| 6.5 Medium | SoundCloud Shortcode | Cross-Site Scripting |
≤ 4.0.1 Fixed in 4.0.2 |
CVE-2024-25936 |
Patchstack | |
| 6.4 Medium | HUSKY – Products Filter for WooCommerce Professional | Cross-Site Scripting Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.3.5.1 |
CVE-2024-1796 |
Wordfence | |
| 6.4 Medium | oik | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.10.0 |
CVE-2024-2256 |
Wordfence | |
| 6.4 Medium | WPBakery Page Builder Addons by Livemesh | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.8.1 |
CVE-2024-2079 |
Wordfence | |
| 6.4 Medium | ProfilePress | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode |
≤ 4.15.1 |
CVE-2024-1806 |
Wordfence | |
| 6.4 Medium | Database for Contact Form 7, WPforms, Elementor forms | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode |
≤ 1.3.3 |
CVE-2024-2030 |
Wordfence | |
| 6.4 Medium | Custom fields shortcode | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode |
≤ 0.1 |
CVE-2023-6809 |
Wordfence | |
| 4.3 Medium | User Shortcodes Plus | Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode |
≤ 2.0.2 |
CVE-2023-6969 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.2.85 |
CVE-2023-6954 |
Wordfence | |
| 6.4 Medium | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | Cross-Site Scripting ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode |
≤ 4.15.0 |
CVE-2024-1409 |
Wordfence | |
| 6.4 Medium | ProfilePress | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.15.2 |
CVE-2024-1535 |
Wordfence | |
| 6.4 Medium | Metform Elementor Contact Form Builder | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.8.3 |
CVE-2024-1585 |
Wordfence | |
| 6.4 Medium | WP Go Maps (formerly WP Google Maps) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 9.0.32 |
CVE-2024-1582 |
Wordfence | |
| 6.4 Medium | Easy Social Feed – Social Photos Gallery – Post Feed – Like Box | Cross-Site Scripting Social Photos Gallery – Post Feed – Like Box <= 6.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 6.5.4 |
CVE-2024-1278 |
Wordfence | |
| 6.4 Medium | Shariff Wrapper | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.6.9 |
CVE-2023-6500 |
Wordfence | |
| 6.4 Medium | Video Conferencing with Zoom | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.4.4 |
CVE-2024-2031 |
Wordfence | |
| 6.4 Medium | WP-Members Membership | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.4.9.1 |
CVE-2024-1987 |
Wordfence | |
| 6.4 Medium | Social Sharing Plugin – Sassy Social Share | Cross-Site Scripting Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.3.58 |
CVE-2024-1989 |
Wordfence | |
| 6.4 Medium | WP Shortcodes Plugin — Shortcodes Ultimate | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode |
≤ 7.0.3 |
CVE-2024-1808 |
Wordfence | |
| 5.4 Medium | Thank You Page Customizer for WooCommerce – Increase Your Sales | Broken Access Control Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution |
≤ 1.1.2 |
CVE-2024-1687 |
Wordfence | |
| 4.3 Medium | Colibri Page Builder | Cross-Site Request Forgery Cross-Site Request Fogery via cp_shortcode_refresh No login needed |
≤ 1.0.253 |
CVE-2024-1362 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.