WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 1,301–1,350 of 1,456 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Simple Membership | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.4.5 |
CVE-2024-4383 |
Wordfence | |
| 5.4 Medium | WP Latest Posts | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution |
≤ 5.0.7 |
CVE-2024-4135 |
Wordfence | |
| 6.4 Medium | Link Library | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode |
≤ 7.6.11 |
CVE-2024-4281 |
Wordfence | |
| 6.4 Medium | Mesmerize Companion | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode |
≤ 1.6.148 |
CVE-2024-3494 |
Wordfence | |
| 5.4 Medium | Colibri Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri-gallery-slideshow' Shortcode |
≤ 1.0.272 |
CVE-2024-3340 |
Wordfence | |
| 4.3 Medium | The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid | Broken Access Control Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization |
≤ 7.6.1 |
CVE-2024-3936 |
Wordfence | |
| 7.5 High | Shortcodes and extra features for Phlox | PHP Object Injection Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer |
≤ 2.17.5 |
CVE-2023-7064 |
Wordfence | |
| 6.4 Medium | Collapse-O-Matic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.8.5.5 |
CVE-2023-7030 |
Wordfence | |
| 8.8 High | WP ULike – Most Advanced WordPress Marketing Toolkit | SQL Injection Most Advanced WordPress Marketing Toolkit <= 4.6.9 - Authenticated (Contributor+) SQL Injection via Shortcodes |
≤ 4.6.9 |
CVE-2024-1797 |
Wordfence | |
| 6.4 Medium | WordPress Header Builder Plugin – Pearl | Cross-Site Scripting Pearl <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.3.6 |
CVE-2024-4000 |
Wordfence | |
| 6.4 Medium | WP Shortcodes Plugin — Shortcodes Ultimate | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 7.1.2 |
CVE-2024-3550 |
Wordfence | |
| 6.4 Medium | Colibri Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'colibri_breadcrumb_element' Shortcode |
≤ 1.0.272 |
CVE-2024-3337 |
Wordfence | |
| 6.4 Medium | Shortcodes and extra features for Phlox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Widget |
≤ 2.15.5 |
CVE-2024-3517 |
Wordfence | |
| 6.4 Medium | Jotform Online Forms | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.3.1 |
CVE-2024-2542 |
Wordfence | |
| 5.3 Medium | Booster Extension | Information Disclosure Basic Information Exposure via booster_extension_authorbox_shortcode_display No login needed |
≤ 1.2.0 |
CVE-2024-2109 |
Wordfence | |
| 6.4 Medium | Shortcodes and extra features for Phlox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.15.7 |
CVE-2024-1533 |
Wordfence | |
| 6.4 Medium | MailerLite – Signup forms (official) | Cross-Site Scripting Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions 1.5.0 to 1.7.6 due to insuffic… |
1.5.0 – 1.7.6 |
CVE-2024-1386 |
Wordfence | |
| 6.4 Medium | Icon Widget | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode |
≤ 1.3.0 |
CVE-2024-1993 |
Wordfence | |
| 6.4 Medium | Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.12.8 |
CVE-2024-3670 |
Wordfence | |
| 6.4 Medium | Shortcodes and extra features for Phlox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title_tag' |
≤ 2.15.7 |
CVE-2024-1396 |
Wordfence | |
| 6.4 Medium | Inline Google Spreadsheet Viewer | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 0.13.2 |
CVE-2024-3674 |
Wordfence | |
| 6.4 Medium | WP ULike | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.6.9 |
CVE-2024-1572 |
Wordfence | |
| 6.5 Medium | FOX – Currency Switcher Professional for WooCommerce | Arbitrary Shortcode Execution Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.4.1.8 |
CVE-2024-3734 |
Wordfence | |
| 7.5 High | Grid Gallery – Photo Image Grid Gallery | PHP Object Injection Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode |
≤ 1.4.3 |
CVE-2024-1897 |
Wordfence | |
| 6.4 Medium | Shortcodes and extra features for Phlox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_gmaps' Shortcode |
≤ 2.15.7 |
CVE-2024-3341 |
Wordfence | |
| 6.4 Medium | All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic | Cross-Site Scripting Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.6.0 |
CVE-2024-3554 |
Wordfence | |
| 6.5 Medium | Booster for WooCommerce | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 7.1.8 |
CVE-2024-3957 |
Wordfence | |
| 7.5 High | Photo Gallery | PHP Object Injection Authenticated(Contributor+) PHP Object Injection via Shortcode |
≤ 1.4.2 |
CVE-2024-1896 |
Wordfence | |
| 6.4 Medium | Social Sharing Plugin – Social Warfare | Cross-Site Scripting Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.4.6.1 |
CVE-2024-1959 |
Wordfence | |
| 6.4 Medium | Shortcodes and extra features for Phlox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS |
≤ 2.15.7 |
CVE-2024-1348 |
Wordfence | |
| 8.8 High | Calendar | SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode |
≤ 1.3.14 |
CVE-2024-2831 |
Wordfence | |
| 6.4 Medium | Follow Us Badges | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode |
≤ 3.1.10 |
CVE-2024-3280 |
Wordfence | |
| 6.4 Medium | WP Recipe Maker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode |
≤ 9.3.1 |
CVE-2024-3490 |
Wordfence | |
| 6.3 Medium | Shortcodes Ultimate | Cross-Site Scripting Contributor+ Stored XSS No login needed |
< 7.1.0 Fixed in 7.1.0 |
CVE-2024-3188 |
WPScan | |
| 5.4 Medium | Simple Membership | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 4.4.3 |
CVE-2024-3730 |
Wordfence | |
| 5.4 Medium | Tutor LMS – eLearning and online course solution | Cross-Site Scripting eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode |
≤ 2.6.2 |
CVE-2024-3994 |
Wordfence | |
| 6.4 Medium | Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) | Cross-Site Scripting Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay |
≤ 3.7.0 |
CVE-2024-3929 |
Wordfence | |
| 5.3 Medium | WoodMart | Authentication Bypass Unauth Arbitrary Shortcodes Injection No login needed |
≤ 7.0.4 Fixed in 7.1.1 |
CVE-2023-25790 |
Patchstack | |
| 6.4 Medium | GeoDirectory – WordPress Business Directory Plugin, or Classified Directory | Cross-Site Scripting WordPress Business Directory Plugin, or Classified Directory <= 2.3.48 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gd_single_tabs' Shortcode |
≤ 2.3.48 |
CVE-2024-3732 |
Wordfence | |
| 8.8 High | rtMedia for WordPress, BuddyPress and bbPress | SQL Injection Authenticated (Contributor+) SQL Injection via rtmedia_gallery Shortcode |
≤ 4.6.18 |
CVE-2024-3293 |
Wordfence | |
| 6.4 Medium | hCaptcha | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode |
≤ 4.0.0 |
CVE-2024-4014 |
Wordfence | |
| 6.4 Medium | EAN for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode |
≤ 4.9.2 |
CVE-2023-6892 |
Wordfence | |
| 4.3 Medium | EAN for WooCommerce | Broken Access Control Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode |
≤ 4.9.2 |
CVE-2023-6897 |
Wordfence | |
| 6.4 Medium | BA Book Everything | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.6.8 |
CVE-2024-3672 |
Wordfence | |
| 6.4 Medium | Shortcodes and extra features for Phlox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_timeline' Shortcode |
≤ 2.15.7 |
CVE-2024-1357 |
Wordfence | |
| 8.7 High | Advance Search | Cross-Site Request Forgery Shortcode Deletion via CSRF |
≤ 1.1.6 |
CVE-2024-2739 |
WPScan | |
| 5.4 Medium | Shortcodes Ultimate | Cross-Site Scripting Contributor+ Stored XSS |
< 7.0.5 Fixed in 7.0.5 |
CVE-2024-2583 |
WPScan | |
| 6.4 Medium | GiveWP – Donation Plugin and Fundraising Platform | Cross-Site Scripting Donation Plugin and Fundraising Platform <= 3.6.1 -- Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.6.1 |
CVE-2024-1957 |
Wordfence | |
| 4.3 Medium | WP Matterport Shortcode | Cross-Site Request Forgery No login needed |
≤ 2.1.9 Fixed in 2.2.0 |
CVE-2024-32109 |
Patchstack | |
| 6.4 Medium | Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows | Cross-Site Scripting Responsive WordPress Slideshows <= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider Shortcode |
≤ 3.70.0 |
CVE-2024-3285 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.