WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 13,151–13,200 of 17,733 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Monkee-Boy Essentials | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 1.1 |
CVE-2024-9116 |
Wordfence | |
| 6.4 Medium | Editor Custom Color Palette | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 3.3.7 |
CVE-2024-9642 |
Wordfence | |
| 6.4 Medium | WP show more | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode |
≤ 1.0.7 |
CVE-2024-9967 |
Wordfence | |
| 6.4 Medium | ID-SK Toolkit | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 1.7.2 |
CVE-2024-9853 |
Wordfence | |
| 4.3 Medium | Download Monitor | Broken Access Control Missing Authorization to API Key Manipulation |
≤ 5.0.12 |
CVE-2024-10092 |
Wordfence | |
| 6.4 Medium | WP Awesome Login | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 0.4.0 |
CVE-2024-9456 |
Wordfence | |
| 6.1 Medium | Forms for Mailchimp by Optin Cat – Grow Your MailChimp List | Cross-Site Scripting Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting No login needed |
≤ 2.5.6 |
CVE-2024-8870 |
Wordfence | |
| 6.1 Medium | FormFacade – WordPress plugin for Google Forms | Cross-Site Scripting WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting No login needed |
≤ 1.3.6 |
CVE-2024-9613 |
Wordfence | |
| 6.4 Medium | PriPre | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 0.4.11 |
CVE-2024-9454 |
Wordfence | |
| 6.4 Medium | ElementsKit Elementor addons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget |
≤ 3.2.9 |
CVE-2024-10091 |
Wordfence | |
| 5.5 Medium | Poll Maker – Versus Polls, Anonymous Polls, Image Polls | Cross-Site Scripting Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Poll Settings |
≤ 5.4.6 |
CVE-2024-9462 |
Wordfence | |
| 4.3 Medium | Editorial Assistant by Sovrn | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image |
≤ 1.3.3 |
CVE-2024-9626 |
Wordfence | |
| 4.9 Medium | Poll Maker – Versus Polls, Anonymous Polls, Image Polls | SQL Injection Versus Polls, Anonymous Polls, Image Polls <= 5.4.6 - Authenticated (Administrator+) SQL Injection via Order_by Parameter |
≤ 5.4.6 |
CVE-2024-9475 |
Wordfence | |
| 6.4 Medium | Image Map Pro | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 6.0.20 |
CVE-2024-9585 |
Wordfence | |
| 5.4 Medium | Image Map Pro | Broken Access Control Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete |
≤ 6.0.20 |
CVE-2024-9584 |
Wordfence | |
| 6.4 Medium | WP-Members | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode |
≤ 3.4.9.5 |
CVE-2024-10374 |
Wordfence | |
| 6.4 Medium | Simple News | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode |
≤ 2.8 |
CVE-2024-10112 |
Wordfence | |
| 6.4 Medium | Shoutcast Icecast HTML5 Radio Player | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.1.7 |
CVE-2024-8666 |
Wordfence | |
| 6.4 Medium | Beek Widget Extention | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 0.9.5 |
CVE-2024-10343 |
Wordfence | |
| 6.4 Medium | File Upload Types by WPForms | Arbitrary File Upload Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 1.4.0 |
CVE-2024-10016 |
Wordfence | |
| 5.4 Medium | WPS Telegram Chat | Broken Access Control Missing Authorization to Information Exposure |
≤ 4.6.0 |
CVE-2024-9630 |
Wordfence | |
| 6.3 Medium | WPS Telegram Chat | Broken Access Control Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API |
≤ 4.6.0 |
CVE-2024-9628 |
Wordfence | |
| 6.4 Medium | Bamazoo – Button Generator | Cross-Site Scripting Button Generator <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via dgs Shortcode |
≤ 1.0 |
CVE-2024-10150 |
Wordfence | |
| 6.4 Medium | League of Legends Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.1 |
CVE-2024-10342 |
Wordfence | |
| 6.5 Medium | League of Legends Shortcodes | SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode |
≤ 1.0.1 |
CVE-2024-10341 |
Wordfence | |
| 6.1 Medium | 10Web Social Post Feed | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.2.9 |
CVE-2024-9607 |
Wordfence | |
| 6.4 Medium | Awesome buttons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode |
≤ 1.0 |
CVE-2024-10148 |
Wordfence | |
| 4.3 Medium | UPS Live Rates and Access Points | Broken Access Control Missing Authorization to Plugin API key reset |
≤ 2.3.12 |
CVE-2024-9109 |
Wordfence | |
| 5.3 Medium | Order Notification for Telegram | Broken Access Control Missing Authorization to Unauthenticated Send Telegram Test Message No login needed |
≤ 1.0.1 |
CVE-2024-9686 |
Wordfence | |
| 6.5 Medium | Mega Elements | Cross-Site Scripting Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) |
≤ 1.2.6 Fixed in 1.2.7 |
CVE-2024-49693 |
Patchstack | |
| 6.5 Medium | WP Flow Plus | Cross-Site Scripting |
≤ 5.2.3 Fixed in 5.2.4 |
CVE-2024-49695 |
Patchstack | |
| 6.4 Medium | Contact Form 7 - Repeatable Fields | Cross-Site Scripting Repeatable Fields <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via field_group Shortcode |
≤ 2.0.1 |
CVE-2024-10180 |
Wordfence | |
| 5.9 Medium | Robo Gallery | Cross-Site Scripting |
≤ 3.2.21 Fixed in 3.2.22 |
CVE-2024-49696 |
Patchstack | |
| 6.5 Medium | myCred Elementor | Cross-Site Scripting |
≤ 1.2.6 Fixed in 1.2.7 |
CVE-2024-49702 |
Patchstack | |
| 6.5 Medium | WpEvently | Cross-Site Scripting |
≤ 4.2.5 Fixed in 4.2.6 |
CVE-2024-49703 |
Patchstack | |
| 5.3 Medium | Schema & Structured Data for WP & AMP | Information Disclosure Sensitive Data Exposure No login needed |
≤ 1.3.5 Fixed in 1.36 |
CVE-2024-49683 |
Patchstack | |
| 4.7 Medium | Simple Membership | Open Redirect No login needed |
≤ 4.5.3 Fixed in 4.5.4 |
CVE-2024-49682 |
Patchstack | |
| 6.4 Medium | WP Adminify – Best WordPress Custom Dashboard | Cross-Site Scripting Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 4.0.1.6 |
CVE-2024-8959 |
Wordfence | |
| 6.4 Medium | Compact WP Audio Player | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sc_embed_player Shortcode |
≤ 1.9.13 |
CVE-2024-10176 |
Wordfence | |
| 6.1 Medium | Extra Product Options Builder for WooCommerce | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.2.133 |
CVE-2024-9214 |
Wordfence | |
| 6.5 Medium | WP Recipe Maker | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' |
≤ 9.6.1 |
CVE-2024-9650 |
Wordfence | |
| 6.1 Medium | PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer – DearFlip | Cross-Site Scripting DearFlip <= 2.3.32 - Reflected Cross-Site Scripting No login needed |
≤ 2.3.32 |
CVE-2024-8717 |
Wordfence | |
| 4.3 Medium | Elementor Header & Footer Builder | Information Disclosure Authenticated (Contributor+) Information Disclosure via Shortcode |
≤ 1.6.43 |
CVE-2024-10050 |
Wordfence | |
| 6.3 Medium | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution | Cross-Site Request Forgery The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates No login needed |
≤ 4.2.4 |
CVE-2024-9943 |
Wordfence | |
| 4.3 Medium | HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce | Broken Access Control An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication |
≤ 2.10.0 |
CVE-2024-8667 |
Wordfence | |
| 4.3 Medium | MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution | Broken Access Control The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending |
≤ 4.2.4 |
CVE-2024-9531 |
Wordfence | |
| 6.1 Medium | EventPrime – Modern Events Calendar, Bookings and Tickets | Cross-Site Scripting Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 4.0.4.7 |
CVE-2024-9864 |
Wordfence | |
| 6.1 Medium | EventPrime – Modern Events Calendar, Bookings and Tickets | Cross-Site Scripting Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log No login needed |
≤ 4.0.4.7 |
CVE-2024-9865 |
Wordfence | |
| 6.1 Medium | Terms descriptions | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 3.4.6 |
CVE-2024-9374 |
Wordfence | |
| 6.6 Medium | Custom Icons for Elementor | Arbitrary File Upload |
≤ 0.3.3 Fixed in 0.3.4 |
CVE-2024-49676 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.