WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 13,201–13,250 of 17,733 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.1 Medium | Nioland | Cross-Site Scripting Reflected Cross-Site Scripting via s No login needed |
≤ 1.2.6 |
CVE-2024-10250 |
Wordfence | |
| 5.4 Medium | WP Shortcodes Plugin — Shortcodes Ultimate | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 7.2.2 |
CVE-2024-8500 |
Wordfence | |
| 4.3 Medium | Qi Addons For Elementor | Information Disclosure Sensitive Information Exposure |
≤ 1.8.0 |
CVE-2024-9530 |
Wordfence | |
| 4.3 Medium | Transients Manager | Cross-Site Request Forgery No login needed |
≤ 2.0.6 |
CVE-2024-10045 |
Wordfence | |
| 5.3 Medium | Responsive Lightbox | Broken Access Control No login needed |
≤ 2.4.7 Fixed in 2.4.8 |
CVE-2024-43924 |
Patchstack | |
| 4.3 Medium | RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging | Broken Access Control RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization |
≤ 4.23.12 |
CVE-2024-9583 |
Wordfence | |
| 6.5 Medium | Download | Broken Access Control Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download |
≤ 2.2.0 |
CVE-2024-9829 |
Wordfence | |
| 6.4 Medium | Anchor Episodes Index (Spotify for Podcasters) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via anchor_episodes Shortcode |
≤ 2.1.10 |
CVE-2024-10189 |
Wordfence | |
| 6.1 Medium | WP-Members Membership | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 3.4.9.5 |
CVE-2024-9231 |
Wordfence | |
| 4.3 Medium | News Kit Elementor Addons | Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template |
≤ 1.2.1 |
CVE-2024-9541 |
Wordfence | |
| 5.5 Medium | Category and Taxonomy Image | Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting |
≤ 1.0.0 |
CVE-2024-9591 |
Wordfence | |
| 5.5 Medium | Category and Taxonomy Meta Fields | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting |
≤ 1.0.0 |
CVE-2024-9589 |
Wordfence | |
| 5.5 Medium | Category and Taxonomy Meta Fields | Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting |
≤ 1.0.0 |
CVE-2024-9590 |
Wordfence | |
| 5.4 Medium | Category and Taxonomy Meta Fields | Cross-Site Request Forgery Cross-Site Request Forgery to Taxonomy Meta Add/Delete No login needed |
≤ 1.0.0 |
CVE-2024-9588 |
Wordfence | |
| 5.3 Medium | All-in-One WP Migration and Backup | Information Disclosure Unauthenticated Information Disclosure via Error Logs No login needed |
≤ 7.86 |
CVE-2024-8852 |
Wordfence | |
| 6.3 Medium | Rover IDX | Broken Access Control Authenticated (Subscriber+) Missing Authorization via Multiple Functions |
≤ 3.0.0.2903 |
CVE-2024-10003 |
Wordfence | |
| 4.3 Medium | ProfileGrid | Cross-Site Request Forgery No login needed |
≤ 5.9.3 Fixed in 5.9.3.1 |
CVE-2024-49273 |
Patchstack | |
| 4.3 Medium | WP VR | Broken Access Control |
≤ 8.5.4 Fixed in 8.5.5 |
CVE-2024-49293 |
Patchstack | |
| 4.3 Medium | Simple Custom Post Order | Broken Access Control |
≤ 2.5.7 Fixed in 2.5.8 |
CVE-2024-49321 |
Patchstack | |
| 6.5 Medium | LatePoint | Cross-Site Request Forgery No login needed |
≤ 4.9.91 |
CVE-2024-43945 |
Patchstack | |
| 4.3 Medium | Photo Gallery Builder | Broken Access Control Broken Access Control to Notice Dismissal |
≤ 3.0 |
CVE-2024-49325 |
Patchstack | |
| 5.4 Medium | CartBounty – Save and recover abandoned carts for WooCommerce | Cross-Site Request Forgery No login needed |
≤ 8.2 Fixed in 8.2.1 |
CVE-2024-47634 |
Patchstack | |
| 4.3 Medium | Table of Contents Plus | Cross-Site Request Forgery No login needed |
≤ 2408 Fixed in 2411 |
CVE-2024-49250 |
Patchstack | |
| 4.3 Medium | Social Auto Poster | Cross-Site Request Forgery No login needed |
≤ 5.3.15 Fixed in 5.3.16 |
CVE-2024-49272 |
Patchstack | |
| 5.4 Medium | VOD Infomaniak | Cross-Site Request Forgery No login needed |
≤ 1.5.7 Fixed in 1.5.8 |
CVE-2024-49274 |
Patchstack | |
| 4.3 Medium | IdeaPush | Cross-Site Request Forgery No login needed |
≤ 8.69 Fixed in 8.71 |
CVE-2024-49275 |
Patchstack | |
| 4.3 Medium | Cooked Pro | Cross-Site Request Forgery No login needed |
< 1.8.0 Fixed in 1.8.0 |
CVE-2024-49290 |
Patchstack | |
| 4.3 Medium | WP Content Copy Protection & No Right Click | Cross-Site Request Forgery No login needed |
≤ 3.5.9 Fixed in 3.6.1 |
CVE-2024-49306 |
Patchstack | |
| 4.3 Medium | WordPress Image SEO | Cross-Site Request Forgery No login needed |
≤ 1.1.4 |
CVE-2024-49627 |
Patchstack | |
| 4.3 Medium | Most And Least Read Posts Widget | Cross-Site Request Forgery No login needed |
≤ 2.5.18 Fixed in 2.5.19 |
CVE-2024-49628 |
Patchstack | |
| 6.5 Medium | Mighty Builder | Cross-Site Scripting |
≤ 1.0.2 |
CVE-2024-48049 |
Patchstack | |
| 6.5 Medium | WP Education | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.2.8 Fixed in 1.2.9 |
CVE-2024-49630 |
Patchstack | |
| 6.5 Medium | Easy Addons for Elementor | Cross-Site Scripting |
≤ 1.5.0 |
CVE-2024-49631 |
Patchstack | |
| 6.4 Medium | StreamWeasels Twitch Integration | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sw-twitch-embed Shortcode |
≤ 1.8.6 |
CVE-2024-9897 |
Wordfence | |
| 4.3 Medium | ElementInvader Addons for Elementor | Information Disclosure Authenticated (Contributor+) Information Exposure |
≤ 1.2.9 |
CVE-2024-9889 |
Wordfence | |
| 4.3 Medium | EventON PRO - WordPress Virtual Event Calendar | Cross-Site Request Forgery WordPress Virtual Event Calendar Plugin <= 4.6.8 - Cross-Site Request Forgery via admin_test_email No login needed |
≤ 4.6.8 |
CVE-2023-6243 |
Wordfence | |
| 4.9 Medium | Photo Gallery Slideshow & Masonry Tiled Gallery | SQL Injection Authenticated (Admin+) SQL Injection |
≤ 1.0.3 |
CVE-2019-25218 |
Wordfence | |
| 6.1 Medium | WordPress Social Share Buttons | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.19 |
CVE-2024-9219 |
Wordfence | |
| 6.4 Medium | Debrandify · Remove or Replace WordPress Branding | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 1.1.2 |
CVE-2024-9674 |
Wordfence | |
| 5.9 Medium | Movie Database | Cross-Site Scripting |
≤ 1.0.11 |
CVE-2024-43300 |
Patchstack | |
| 6.5 Medium | wpPricing Builder | Cross-Site Scripting |
≤ 1.5.0 |
CVE-2024-49225 |
Patchstack | |
| 6.5 Medium | bVerse Convert | Cross-Site Scripting |
≤ 1.3.7.1 |
CVE-2024-49228 |
Patchstack | |
| 6.5 Medium | Ajax Custom CSS/JS | Cross-Site Scripting Reflected Cross Site Scripting (XSS) |
≤ 2.0.4 |
CVE-2024-49230 |
Patchstack | |
| 6.5 Medium | WordPress Video | Cross-Site Scripting |
≤ 1.0 |
CVE-2024-49231 |
Patchstack | |
| 6.5 Medium | El mejor Cluster | Cross-Site Scripting |
≤ 1.1.15 Fixed in 1.1.16 |
CVE-2024-49232 |
Patchstack | |
| 6.5 Medium | MAS Elementor | Cross-Site Scripting |
≤ 1.1.6 Fixed in 1.1.7 |
CVE-2024-49233 |
Patchstack | |
| 6.5 Medium | Plexx Elementor Extension | Cross-Site Scripting |
≤ 1.3.6 Fixed in 1.3.7 |
CVE-2024-49234 |
Patchstack | |
| 6.5 Medium | Crazy Call To Action Box | Cross-Site Scripting |
≤ 1.0.5 |
CVE-2024-49236 |
Patchstack | |
| 6.5 Medium | Tito | Cross-Site Scripting |
≤ 2.3 |
CVE-2024-49241 |
Patchstack | |
| 6.4 Medium | Advanced Category and Custom Taxonomy Image | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via ad_tax_image Shortcode |
≤ 1.0.9 |
CVE-2024-9425 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.