Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,324 High 9,486 Medium 18,376 Low 376 Not scored 1

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.

Showing 1,251–1,300 of 1,531 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 26 of 31
Severity Component Vulnerability Affected versions Published CVE Source
9.9 Critical WP donimedia carousel Plugin wp-donimedia-carousel Arbitrary File Upload ≤ 1.0.1 CVE-2024-50511 Patchstack
9.8 Critical DS.DownloadList Plugin dsdownloadlist PHP Object Injection No login needed ≤ 1.3 CVE-2024-50507 Patchstack
9.8 Critical User Toolkit Plugin user-toolkit Privilege Escalation Account Takeover No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2024-50503 Patchstack
9.8 Critical Signup Page Plugin signup-page Privilege Escalation Arbitrary Option Update to Privilege Escalation No login needed ≤ 1.0 CVE-2024-50475 Patchstack
9.8 Critical GRÜN spendino Spendenformular Plugin spendino Privilege Escalation Arbitrary Option Update to Privilege Escalation No login needed ≤ 1.0.1 CVE-2024-50476 Patchstack
9.8 Critical Exam Matrix Plugin exam-matrix Privilege Escalation No login needed ≤ 1.5 CVE-2024-50485 Patchstack
9.8 Critical PegaPoll Plugin pegapoll Privilege Escalation Arbitrary Option Update to Privilege Escalation No login needed ≤ 1.0.2 CVE-2024-50490 Patchstack
10.0 Critical aDirectory Plugin adirectory Arbitrary File Upload No login needed ≤ 1.3 Fixed in 1.3.1 CVE-2024-50420 Patchstack
9.9 Critical SurveyJS Plugin surveyjs Arbitrary File Upload ≤ 1.9.136 Fixed in 1.12.4 CVE-2024-50427 Patchstack
10.0 Critical Ajar in5 Embed Plugin ajar-productions-in5-embed Arbitrary File Upload No login needed ≤ 3.1.3 Fixed in 3.1.4 CVE-2024-50473 Patchstack
9.9 Critical Marketing Automation by AZEXO Plugin marketing-automation-by-azexo Arbitrary File Upload ≤ 1.27.80 CVE-2024-50480 Patchstack
10.0 Critical Woocommerce Product Design Plugin woo-product-design Arbitrary File Upload No login needed ≤ 1.0.0 CVE-2024-50482 Patchstack
10.0 Critical Multi Purpose Mail Form Plugin multi-purpose-mail-form Arbitrary File Upload No login needed ≤ 1.0.2 CVE-2024-50484 Patchstack
10.0 Critical Automatic Translation Plugin automatic-translation Arbitrary File Upload No login needed ≤ 1.0.4 CVE-2024-50493 Patchstack
10.0 Critical Sudan Payment Gateway for WooCommerce Plugin wc-sudan-payment-gateway Arbitrary File Upload No login needed ≤ 1.2.2 CVE-2024-50494 Patchstack
10.0 Critical Plugin Propagator Plugin wp-propagator Arbitrary File Upload No login needed ≤ 0.1 CVE-2024-50495 Patchstack
10.0 Critical AR Plugin ar-for-wordpress Arbitrary File Upload No login needed ≤ 6.6 Fixed in 7.0 CVE-2024-50496 Patchstack
9.3 Critical Woocommerce Quote Calculator Plugin woo-quote-calculator-order SQL Injection No login needed ≤ 1.1 CVE-2024-50479 Patchstack
9.3 Critical RSVP ME Plugin rsvp-me SQL Injection No login needed ≤ 1.9.9 CVE-2024-50491 Patchstack
9.8 Critical 1-Click Login: Passwordless Authentication Plugin swoop-password-free-authentication Authentication Bypass Broken Authentication No login needed 1.4.5 CVE-2024-50478 Patchstack
9.8 Critical Meetup Plugin meetup Authentication Bypass Broken Authentication No login needed ≤ 0.1 CVE-2024-50483 Patchstack
10.0 Critical WP Query Console Plugin wp-query-console Remote Code Execution No login needed ≤ 1.0 CVE-2024-50498 Patchstack
9.8 Critical Stacks Mobile App Builder Plugin stacks-mobile-app-builder Privilege Escalation Account Takeover No login needed ≤ 5.2.3 CVE-2024-50477 Patchstack
9.8 Critical Acnoo Flutter API Plugin acnoo-flutter-api Privilege Escalation Account Takeover No login needed ≤ 1.0.5 CVE-2024-50486 Patchstack
9.8 Critical MaanStore API Plugin maanstore-api Privilege Escalation Account Takeover No login needed ≤ 1.0.1 CVE-2024-50487 Patchstack
9.8 Critical Realty Workstation Plugin realty-workstation Privilege Escalation Account Takeover No login needed ≤ 1.0.45 CVE-2024-50489 Patchstack
9.8 Critical Wp Social Login and Register Social Counter Plugin wp-social Authentication Bypass Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 3.0.7 CVE-2024-9501 Wordfence
9.8 Critical Comments – wpDiscuz Plugin wpdiscuz Authentication Bypass wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 7.6.24 CVE-2024-9488 Wordfence
9.3 Critical WP Sessions Time Monitoring Full Automatic Plugin activitytime SQL Injection No login needed ≤ 1.0.9 Fixed in 1.1.0 CVE-2024-49681 Patchstack
9.9 Critical 3D Work In Progress Plugin renee-work-in-progress Arbitrary File Upload ≤ 1.0.3 CVE-2024-49652 Patchstack
9.9 Critical Portfolleo Plugin portfolleo Arbitrary File Upload ≤ 1.2 CVE-2024-49653 Patchstack
9.9 Critical Woocommerce Custom Profile Picture Plugin woo-custom-profile-picture Arbitrary File Upload ≤ 1.0 CVE-2024-49658 Patchstack
10.0 Critical Verbalize WP Plugin verbalize-wp Arbitrary File Upload No login needed ≤ 1.0 CVE-2024-49668 Patchstack
9.9 Critical INK Official Plugin ink-official Arbitrary File Upload ≤ 4.1.2 CVE-2024-49669 Patchstack
9.9 Critical AI Image Generator for Your Content & Featured Images – AI Postpix Plugin ai-postpix Arbitrary File Upload ≤ 1.1.8 Fixed in 1.1.8.1 CVE-2024-49671 Patchstack
9.8 Critical LiteSpeed Cache Plugin litespeed-cache Privilege Escalation Unauthenticated Account Takeover via Cookie Leak No login needed ≤ 6.5.0.1 Fixed in 6.5.0.1 CVE-2024-44000 Patchstack
10.0 Critical Sovratec Case Management Plugin sovratec-case-management Arbitrary File Upload No login needed ≤ 1.0.0 CVE-2024-49324 Patchstack
10.0 Critical Affiliator Plugin affiliator-lite Arbitrary File Upload No login needed ≤ 2.1.3 CVE-2024-49326 Patchstack
10.0 Critical Woostagram Connect Plugin woostagram-connect Arbitrary File Upload No login needed ≤ 1.0.2 CVE-2024-49327 Patchstack
10.0 Critical WP REST API FNS Plugin rest-api-fns Arbitrary File Upload No login needed ≤ 1.0.0 CVE-2024-49329 Patchstack
10.0 Critical Nice Backgrounds Plugin nicebackgrounds Arbitrary File Upload No login needed ≤ 1.0 CVE-2024-49330 Patchstack
9.9 Critical Property Lot Management System Plugin plms Arbitrary File Upload ≤ 4.2.38 CVE-2024-49331 Patchstack
10.0 Critical WP Dropbox Dropins Plugin wp-dropbox-dropins Arbitrary File Upload No login needed ≤ 1.0 CVE-2024-49607 Patchstack
10.0 Critical photokit Plugin photokit Arbitrary File Upload No login needed ≤ 1.0 CVE-2024-49610 Patchstack
9.8 Critical Giveaway Boost Plugin giveaway-boost PHP Object Injection No login needed ≤ 2.1.4 CVE-2024-49332 Patchstack
9.8 Critical Advanced Advertising System Plugin advanced-advertising-system PHP Object Injection No login needed ≤ 1.3.1 CVE-2024-49624 Patchstack
9.8 Critical SiteBuilder Dynamic Components Plugin sitebuilder-dynamic-components PHP Object Injection No login needed ≤ 1.0 CVE-2024-49625 Patchstack
9.8 Critical Shipyaari Shipping Management Plugin shipyaari-shipping-managment PHP Object Injection No login needed ≤ 1.2 CVE-2024-49626 Patchstack
9.6 Critical SSV Events Plugin ssv-events Local File Inclusion Local File Inclusion to RCE No login needed ≤ 3.2.7 CVE-2024-49286 Patchstack
10.0 Critical Product Website Showcase Plugin product-websites-showcase Arbitrary File Upload No login needed ≤ 1.0 CVE-2024-49611 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only