WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 12,501–12,550 of 17,806 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 251 of 357
Severity Component Vulnerability Affected versions Published CVE Source
6.1 Medium Easiest Funnel Builder For WordPress & WooCommerce by WPFunnels Plugin wpfunnels Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.5.5 CVE-2024-10792 Wordfence
6.1 Medium affiliate-toolkit Plugin affiliate-toolkit-starter Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.6.7 CVE-2024-10675 Wordfence
6.1 Medium Theater Plugin theatre Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 0.18.6.2 CVE-2024-11371 Wordfence
6.1 Medium Run Contests, Raffles, and Giveaways with ContestsWP Plugin contest-code-checker Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.0.3 CVE-2024-11456 Wordfence
6.1 Medium WPAdverts – Classifieds Plugin wpadverts Cross-Site Scripting Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting No login needed ≤ 2.1.7 CVE-2024-10890 Wordfence
5.3 Medium Tutor LMS Plugin tutor Broken Access Control User Registration Setting Bypass to Unauthorized User Registration No login needed ≤ 2.7.6 CVE-2024-10393 Wordfence
4.1 Medium Taskbuilder Plugin taskbuilder SQL Injection Admin+ SQL Injection < 3.0.5 Fixed in 3.0.5 CVE-2024-9828 WPScan
4.8 Medium Formidable Forms Plugin formidable Cross-Site Scripting Admin+ Stored XSS < 6.14.1 Fixed in 6.14.1 CVE-2024-9768 WPScan
4.8 Medium Ditty Plugin ditty-news-ticker Cross-Site Scripting Author+ Stored XSS < 3.1.47 Fixed in 3.1.47 CVE-2024-9600 WPScan
4.3 Medium Alphabetical List Plugin Cross-Site Request Forgery Settings Update via CSRF No login needed ≤ 1.0.3 CVE-2024-8157 WPScan
4.8 Medium CM Table Of Contents – WordPress TOC Plugin Cross-Site Scripting WordPress TOC Plugin < 1.2.4 - Stored XSS via CSRF < 1.2.4 Fixed in 1.2.4 CVE-2024-5029 WPScan
5.4 Medium Media Library Tools Plugin media-library-tools Cross-Site Scripting Author+ Stored XSS via SVG < 1.5.0 Fixed in 1.5.0 CVE-2024-10482 WPScan
4.3 Medium Button Block – Get fully customizable & multi-functional buttons Plugin button-block Information Disclosure Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure ≤ 1.1.4 CVE-2024-10671 Wordfence
4.3 Medium My Contador lesr Plugin my-contador-wp Broken Access Control Missing Authorization to Unauthenticated User Registration CSV Export ≤ 2.0 CVE-2024-11334 Wordfence
6.4 Medium StreamWeasels Online Status Bar Plugin stream-status-for-twitch Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.1.9 CVE-2024-11438 Wordfence
4.3 Medium Theme Builder For Elementor Plugin Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 1.2.2 CVE-2024-10782 Wordfence
4.3 Medium Ultimate Member Plugin ultimate-member Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update ≤ 2.8.9 CVE-2024-10528 Wordfence
6.1 Medium Branda – White Label & Branding, Custom Login Page Customizer Plugin branda-white-labeling Cross-Site Scripting White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting No login needed ≤ 3.4.21 CVE-2024-9371 Wordfence
4.3 Medium If-So Dynamic Content Personalization Plugin if-so Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 1.9.2.1 CVE-2024-10796 Wordfence
6.1 Medium ForumEngine Theme Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.8 CVE-2024-10623 Wordfence
6.4 Medium Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin Cross-Site Scripting Page Builder Features <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.3.3 CVE-2024-10785 Wordfence
6.4 Medium Grey Owl Lightbox Plugin grey-owl-lightbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.1 CVE-2024-11440 Wordfence
6.4 Medium Beds24 Online Booking Plugin beds24-online-booking Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via beds24-link Shortcode ≤ 2.0.27 CVE-2024-10177 Wordfence
6.1 Medium Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes Plugin security-force Cross-Site Scripting Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting No login needed ≤ 1.1.6 CVE-2024-11365 Wordfence
6.1 Medium WIP Incoming Lite Plugin wip-incoming-lite Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 1.1.1 CVE-2024-11416 Wordfence
6.4 Medium WPBakery Visual Composer WHMCS Elements Plugin void-visual-whmcs-element Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via void_wbwhmcse_laouts_search Shortcode ≤ 1.0.4 CVE-2024-10172 Wordfence
6.4 Medium Pure CSS Circle Progress bar Plugin pure-css-circle-progress-bar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2 CVE-2024-11385 Wordfence
6.4 Medium F4 Improvements Plugin element-ready-lite Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.9.0 CVE-2024-9442 Wordfence
6.4 Medium Dino Game – Embed Google Chrome Dinosaur Game in Plugin dino-game Cross-Site Scripting Embed Google Chrome Dinosaur Game in WordPress <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.0 CVE-2024-11388 Wordfence
6.4 Medium Slick Sitemap Plugin slick-sitemap Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.0 CVE-2024-11424 Wordfence
6.1 Medium Page Parts Plugin page-parts Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.4.3 CVE-2024-11360 Wordfence
4.3 Medium UltraAddons for Elementor Plugin ultraaddons-elementor-lite Broken Access Control Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.8 - Insecure Direct Object Reference to Sensitive Information Exposure via UA_Template Shortcode ≤ 1.1.8 CVE-2024-10696 Wordfence
6.1 Medium Co-marquage service-public.fr Plugin co-marquage-service-public Cross-Site Scripting Reflected Cross-Site Scripting via add_query_arg Parameter No login needed ≤ 0.5.76 CVE-2024-10522 Wordfence
4.2 Medium Lock User Account Plugin lock-user-account Other User Lock Bypass ≤ 1.0.5 CVE-2024-11197 Wordfence
6.1 Medium salavat counter Plugin salavat-counter Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 0.9.4 CVE-2024-11435 Wordfence
6.4 Medium Shine PDF Embeder Plugin shine-pdf Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0 CVE-2024-11412 Wordfence
6.4 Medium SuevaFree Essential Kit Plugin suevafree-essential-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.3 CVE-2024-11432 Wordfence
6.4 Medium Lazy load videos and sticky control Plugin lazy-load-videos-and-sticky-control Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.0.0 CVE-2024-11428 Wordfence
4.3 Medium Ultimate YouTube Video & Shorts Player With Vimeo Plugin ultimate-youtube-video-player Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion ≤ 3.3 CVE-2024-11354 Wordfence
6.1 Medium Friendly Functions for Welcart Plugin friendly-functions-for-welcart Cross-Site Request Forgery Cross-Site Request Forgery to Reflected Cross-Site Scripting No login needed ≤ 1.2.4 CVE-2024-10726 Wordfence
6.1 Medium Subaccounts for WooCommerce Plugin subaccounts-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.0 CVE-2024-11370 Wordfence
6.4 Medium Include Mastodon Feed Plugin include-mastodon-feed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.9.4 CVE-2024-11455 Wordfence
6.4 Medium Product Designer Plugin product-designer Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.36 CVE-2024-9111 Wordfence
4.3 Medium Bard Extra Plugin bard-extra Broken Access Control Missing Authorization to Authenticated (Subscriber+) Demo Import ≤ 1.2.7 CVE-2024-10532 Wordfence
6.4 Medium RecipePress Reloaded Plugin recipepress-reloaded Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.12.0 CVE-2024-11414 Wordfence
6.4 Medium Premium Packages - Sell Digital Products Securely Plugin wpdm-premium-packages Cross-Site Scripting Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode ≤ 5.9.3 CVE-2024-10164 Wordfence
6.1 Medium Bulletin Announcements Plugin bulletin-announcements Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.11.7 CVE-2024-10682 Wordfence
6.4 Medium LSX Tour Operator Plugin tour-operator Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.4.9 CVE-2024-9851 Wordfence
6.1 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App Plugin peepso-core Cross-Site Scripting Social Network, Membership, Registration, User Profiles, Premium – Mobile App <=7.0.3.0 - Reflected Cross-Site Scripting No login needed ≤ 7.0.3.0 CVE-2024-11447 Wordfence
4.3 Medium PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Plugin revisionary Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure ≤ 3.5.15 CVE-2024-11154 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only