WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,301–1,350 of 1,616 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 27 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium 140+ Widgets | Best Addons For Elementor – FREE Plugin xpro-elementor-addons Cross-Site Scripting FREE <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.4.3 CVE-2024-4440 Wordfence
6.5 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Cross-Site Scripting ≤ 1.4.8 Fixed in 1.4.9 CVE-2024-35167 Patchstack
5.3 Medium ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-34812 Patchstack
6.4 Medium Thim Elementor Kit Plugin thim-elementor-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 1.1.9 CVE-2024-4329 Wordfence
6.4 Medium Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.1 CVE-2024-4630 Wordfence
6.4 Medium Graphina – Elementor Charts and Graphs Plugin graphina-elementor-charts-and-graphs Cross-Site Scripting Elementor Charts and Graphs <= 1.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.8.9 CVE-2024-4574 Wordfence
8.8 High Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor SQL Injection Authenticated (Contributor+) SQL Injection ≤ 1.5.102 CVE-2024-3055 Wordfence
4.3 Medium Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin integration-for-contact-form-7-and-pipedrive Cross-Site Request Forgery No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2024-34817 Patchstack
6.1 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.5.102 CVE-2024-3547 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Interactive Circles' ≤ 5.9.19 CVE-2024-4275 Wordfence
7.2 High Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Remote Code Execution Authenticated (Admin+) Command Injection ≤ 1.5.102 CVE-2024-2662 Wordfence
6.4 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Several Widgets ≤ 5.9.19 CVE-2024-4449 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' ≤ 5.9.19 CVE-2024-4448 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Age Gate ≤ 5.4.2 CVE-2024-2785 Wordfence
4.3 Medium Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery ≤ 4.1.6 CVE-2024-1467 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.4.2 CVE-2024-0445 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Cross-Site Scripting Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip & Popover Widget ≤ 2.5.0 CVE-2024-3990 Wordfence
6.4 Medium Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Text Effect Widget ≤ 1.1.37 CVE-2024-2923 Wordfence
6.4 Medium Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Plugin Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.14.3 CVE-2024-4339 Wordfence
6.4 Medium Enter Addons – Ultimate Template Builder for Elementor Plugin enteraddons Cross-Site Scripting Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading widget ≤ 2.1.5 CVE-2024-3831 Wordfence
6.4 Medium Image Hover Effects - Elementor Addon Plugin Cross-Site Scripting Elementor Addon <= 1.4.1 - Authenticated(Contributor+) DOM-based Stored Cross-Site Scripting via Image Hover Effects Widget ≤ 1.4.1 CVE-2024-1166 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 3.9.16 CVE-2024-4316 Wordfence
6.4 Medium Enter Addons – Ultimate Template Builder for Elementor Plugin enteraddons Cross-Site Scripting Ultimate Template Builder for Elementor <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animation Title widget img tag ≤ 2.1.5 CVE-2024-3680 Wordfence
6.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 3.21.0 CVE-2024-4107 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin Cross-Site Scripting Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify ≤ 2.5.0 CVE-2024-3989 Wordfence
5.4 Medium Ultimate Store Kit Elementor Addons Plugin ultimate-store-kit PHP Object Injection No login needed ≤ 2.0.3 Fixed in 2.0.4 CVE-2024-4606 Patchstack
6.5 Medium Thim Elementor Kit Plugin thim-elementor-kit Cross-Site Scripting ≤ 1.1.8 Fixed in 1.1.9 CVE-2024-34415 Patchstack
6.5 Medium BlogLentor Plugin bloglentor-for-elementor Cross-Site Scripting Blog Designer Pack for Elementor plugin <= 1.0.8 - Cross Site Scripting (XSS) ≤ 1.0.8 CVE-2024-34421 Patchstack
6.5 Medium Better Elementor Addons Plugin better-elementor-addons Cross-Site Scripting ≤ 1.4.4 Fixed in 1.4.5 CVE-2024-34432 Patchstack
6.5 Medium SKT Addons for Elementor Plugin skt-addons-for-elementor Cross-Site Scripting ≤ 1.8 Fixed in 1.9 CVE-2024-34436 Patchstack
6.5 Medium SKT Addons for Elementor Plugin skt-addons-for-elementor Cross-Site Scripting ≤ 1.8 Fixed in 1.9 CVE-2024-34445 Patchstack
4.3 Medium Happy Addons for Elementor Plugin happy-elementor-addons Broken Access Control Broken Access Control on Post Clone ≤ 3.10.1 Fixed in 3.10.2 CVE-2024-24833 Patchstack
6.5 Medium Magical Addons For Elementor Plugin magical-addons-for-elementor Cross-Site Scripting ≤ 1.1.34 Fixed in 1.1.35 CVE-2024-34547 Patchstack
6.5 Medium WidgetKit Plugin widgetkit-for-elementor Cross-Site Scripting WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) ≤ 2.4.8 Fixed in 2.5.0 CVE-2024-34548 Patchstack
6.5 Medium Move Addons for Elementor Plugin move-addons Cross-Site Scripting ≤ 1.3.0 Fixed in 1.3.1 CVE-2024-34562 Patchstack
6.5 Medium Gold Addons for Elementor Plugin gold-addons-for-elementor Cross-Site Scripting ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-34563 Patchstack
5.9 Medium Xpro Elementor Addons Plugin xpro-elementor-addons Cross-Site Scripting ≤ 1.4.3 CVE-2024-34570 Patchstack
6.5 Medium Fancy Elementor Flipbox Plugin fancy-elementor-flipbox Cross-Site Scripting ≤ 2.4.2 CVE-2024-34572 Patchstack
9.1 Critical Startklar Elementor Addons Plugin startklar-elmentor-forms-extwidgets Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 1.7.13 CVE-2024-4346 Wordfence
9.8 Critical Startklar Elementor Addons Plugin startklar-elmentor-forms-extwidgets Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.7.13 CVE-2024-4345 Wordfence
5.3 Medium WidgetKit Plugin widgetkit-for-elementor Broken Access Control No login needed ≤ 2.5.0 CVE-2024-33908 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.4.2 Fixed in 5.5.0 CVE-2024-34373 Patchstack
6.5 Medium ElementsReady Addons for Elementor Plugin element-ready-lite Cross-Site Scripting ≤ 5.8.0 Fixed in 5.9.0 CVE-2024-34374 Patchstack
4.3 Medium Exclusive Addons Elementor Plugin exclusive-addons-for-elementor Broken Access Control Broken Access Control on Post Duplication ≤ 2.6.9.1 Fixed in 2.6.9.2 CVE-2024-33914 Patchstack
6.5 Medium RomethemeKit For Elementor Plugin rometheme-for-elementor Broken Access Control No login needed ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-33919 Patchstack
6.5 Medium Eleblog – Elementor Blog And Magazine Addons Plugin ele-blog Cross-Site Scripting Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) ≤ 1.8 CVE-2024-33945 Patchstack
4.3 Medium The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Plugin the-post-grid Broken Access Control Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization ≤ 7.6.1 CVE-2024-3936 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.3 CVE-2024-3743 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox ≤ 2.6.9.2 CVE-2024-2751 Wordfence
7.2 High EleForms – All In One Form Integration including DB for Elementor Plugin Cross-Site Scripting All In One Form Integration including DB for Elementor <= 2.9.9.7 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 2.9.9.7 CVE-2024-2082 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only