WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1,251–1,279 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 26 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Page scroll to id Plugin page-scroll-to-id Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.7.8 CVE-2024-1445 Wordfence
6.4 Medium Email Encoder – Protect Email Addresses and Phone Numbers Plugin email-encoder-bundle Cross-Site Scripting Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.2.0 CVE-2024-1282 Wordfence
6.4 Medium ProfilePress Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode ≤ 4.14.4 CVE-2024-1408 Wordfence
6.4 Medium EmbedPress Plugin embedpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.8 CVE-2024-1349 Wordfence
6.4 Medium ProfilePress Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.14.4 CVE-2024-1570 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 7.0.1 CVE-2024-0792 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode ≤ 7.0.2 CVE-2024-1510 Wordfence
6.5 Medium Buttons Shortcode and Widget Plugin buttons-shortcode-and-widget Cross-Site Scripting WordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS) ≤ 1.16 CVE-2024-24930 Patchstack
6.4 Medium Payment Forms for Paystack Plugin payment-forms-for-paystack Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.4.1 CVE-2023-5665 Wordfence
6.4 Medium WordPress Button Plugin MaxButtons Plugin maxbuttons Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 9.7.6 CVE-2023-7029 Wordfence
6.4 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 1.0.93 CVE-2023-6808 Wordfence
6.4 Medium Plugin for Google Reviews Plugin widget-google-reviews Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 3.1 CVE-2023-6884 Wordfence
6.4 Medium Display custom fields in the frontend – Post and User Profile Fields Plugin shortcode-to-display-post-and-user-data Cross-Site Scripting Post and User Profile Fields <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg_display_data ≤ 1.2.1 CVE-2023-6982 Wordfence
4.3 Medium Display custom fields in the frontend – Post and User Profile Fields Plugin shortcode-to-display-post-and-user-data Broken Access Control Post and User Profile Fields <= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure ≤ 1.2.1 CVE-2023-6983 Wordfence
6.4 Medium UserPro - Community and User Profile Plugin Cross-Site Scripting The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, 5.1.5 due to insufficient input sanitiz… 5.1.5 CVE-2023-2439 Wordfence
5.4 Medium TJ Shortcodes Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcodes ≤ 0.1.3 CVE-2023-6530 WPScan
6.4 Medium WP Recipe Maker Plugin wp-recipe-maker Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 9.1.0 CVE-2023-6958 Wordfence
5.4 Medium Lana Shortcodes Plugin lana-shortcodes Cross-Site Scripting Contributor+ Stored XSS < 1.2.0 Fixed in 1.2.0 CVE-2023-3372 WPScan
6.4 Medium WCFM Marketplace Plugin wc-multivendor-marketplace Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.6.2 CVE-2023-4960 Wordfence
4.3 Medium Profile Builder Plugin profile-builder Broken Access Control Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcode ≤ 3.10.6 CVE-2023-6504 Wordfence
6.4 Medium AMP for WP – Accelerated Mobile Pages Plugin accelerated-mobile-pages Cross-Site Scripting Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode ≤ 1.0.92 CVE-2023-6782 Wordfence
6.4 Medium Limit Login Attempts Reloaded Plugin limit-login-attempts-reloaded Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.25.26 CVE-2023-6934 Wordfence
6.4 Medium List category posts Plugin list-category-posts Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.89.3 CVE-2023-6994 Wordfence
6.4 Medium Video PopUp Plugin video-popup Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.3 CVE-2023-4962 Wordfence
4.9 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ≤ 1.24.3 CVE-2023-6624 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.239 CVE-2023-6988 Wordfence
6.4 Medium LiteSpeed Cache Plugin litespeed-cache Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 5.6 CVE-2023-4372 Wordfence
6.4 Medium Ibtana – WordPress Website Builder Plugin ibtana-visual-editor Cross-Site Scripting WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.2.2 CVE-2023-6684 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode < 3.9.5 Fixed in 3.9.5 CVE-2023-6986 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only