WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 13,551–13,600 of 17,733 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 272 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium PWA — easy way to Progressive Web App Plugin iworks-pwa Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.6.3 CVE-2024-8967 Wordfence
5.4 Medium Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Plugin email-subscribers Arbitrary Shortcode Execution Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 5.7.34 CVE-2024-8254 Wordfence
6.4 Medium QS Dark Mode Plugin qs-dark-mode Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.9 CVE-2024-9118 Wordfence
6.4 Medium AVIF & SVG Uploader Plugin avif-support Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 1.1.0 CVE-2024-9060 Wordfence
5.3 Medium Spice Starter Sites Plugin spice-starter-sites Broken Access Control Missing Authorization to Unauthenticated Demo Content Import No login needed ≤ 1.2.5 CVE-2024-8430 Wordfence
6.1 Medium Auto Featured Image from Title Plugin auto-featured-image-from-title Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.3 CVE-2024-8786 Wordfence
6.4 Medium XO Slider Plugin xo-liteslider Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.8.6 CVE-2024-8324 Wordfence
6.1 Medium LH Copy Media File Plugin lh-copy-media-file Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.08 CVE-2024-9220 Wordfence
6.1 Medium Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More Plugin woocommerce-exporter Cross-Site Scripting Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scripting No login needed ≤ 2.7.2.1 CVE-2024-8793 Wordfence
6.4 Medium Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg Plugin guten-post-layout Cross-Site Scripting An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute ≤ 1.2.4 CVE-2024-8288 Wordfence
6.1 Medium Loggedin – Limit Active Logins Plugin loggedin Cross-Site Scripting Limit Active Logins <= 1.3.1 - Reflected Cross-Site Scripting No login needed ≤ 1.3.1 CVE-2024-9228 Wordfence
6.1 Medium Custom Banners Plugin custom-banners Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.3 CVE-2024-8799 Wordfence
6.5 Medium Hello World Plugin hello-world Path Traversal Authenticated (Subscriber+) Arbitrary File Read ≤ 2.1.1 CVE-2024-9224 Wordfence
6.1 Medium WP Search Analytics Plugin search-analytics Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.4.10 CVE-2024-9209 Wordfence
6.1 Medium PDF Image Generator Plugin pdf-image-generator Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.5.6 CVE-2024-9241 Wordfence
6.1 Medium Easy Load More Plugin easy-load-more Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.0.3 CVE-2024-8728 Wordfence
6.1 Medium DK PDF Plugin dk-pdf Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.9.6 CVE-2024-8727 Wordfence
6.1 Medium Easy WordPress Subscribe – Optin Hound Plugin opt-in-hound Cross-Site Scripting Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter No login needed ≤ 1.4.3 CVE-2024-9267 Wordfence
6.4 Medium Stars Testimonials Plugin stars-testimonials-with-slider-and-masonry-grid Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode ≤ 3.3.1 CVE-2024-8989 Wordfence
6.4 Medium LocateAndFilter Plugin locateandfilter Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.6.14 CVE-2024-9304 Wordfence
4.3 Medium Soumettre.fr Plugin soumettre-fr Broken Access Control Missing Authorization ≤ 2.1.3 CVE-2024-8675 Wordfence
6.4 Medium Geo Mashup Plugin geo-mashup Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via geo_mashup_visible_posts_list Shortcode ≤ 1.13.13 CVE-2024-8990 Wordfence
6.5 Medium KB Support – WordPress Help Desk and Knowledge Base Plugin Broken Access Control WordPress Help Desk and Knowledge Base <= 1.6.6 - Missing Authorization to Unauthenticated Ticket Reply Exposure No login needed ≤ 1.6.6 CVE-2024-8632 Wordfence
6.4 Medium R Animated Icon Plugin r-animated-icon Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0 CVE-2024-9272 Wordfence
6.4 Medium RumbleTalk Live Group Chat – HTML5 Plugin rumbletalk-chat-a-chat-with-themes Cross-Site Scripting HTML5 <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.3.0 CVE-2024-8720 Wordfence
6.1 Medium Gravity Forms Toolbar Plugin gravity-forms-toolbar Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.7.0 CVE-2024-8718 Wordfence
6.4 Medium Elastik Page Builder Plugin elastik-page-builder Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 0.27.4 CVE-2024-9274 Wordfence
6.4 Medium Relogo Plugin relogo Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 0.4.2 CVE-2024-9269 Wordfence
6.4 Medium SVG Complete Plugin svg-complete Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.2 CVE-2024-9119 Wordfence
6.4 Medium Slider Revolution Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 6.7.18 CVE-2024-8107 Wordfence
6.5 Medium Move Addons for Elementor Plugin move-addons Cross-Site Scripting ≤ 1.3.3 Fixed in 1.3.4 CVE-2024-47396 Patchstack
6.5 Medium Confetti Fall Animation Plugin confetti-fall-animation Cross-Site Scripting ≤ 1.3.0 Fixed in 1.3.1 CVE-2024-47641 Patchstack
5.4 Medium Ultimate Blocks Plugin ultimate-blocks Cross-Site Scripting Contributor+ Stored XSS < 3.2.2 Fixed in 3.2.2 CVE-2024-8536 WPScan
4.8 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Admin+ Stored XSS < 1.2.59 Fixed in 1.2.59 CVE-2024-8283 WPScan
5.4 Medium Starbox Plugin starbox Cross-Site Scripting Contributor+ Stored XSS < 3.5.3 Fixed in 3.5.3 CVE-2024-8239 WPScan
4.8 Medium The Post Grid Plugin the-post-grid Cross-Site Scripting Editor+ Stored XSS via Grid Creation < 7.5.0 Fixed in 7.5.0 CVE-2024-3635 WPScan
4.4 Medium WP MultiTasking - WP Utilities Plugin wp-multitasking Cross-Site Scripting WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 0.1.17 CVE-2024-8189 Wordfence
6.1 Medium GTM Server Side Plugin gtm-server-side Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.1.19 CVE-2024-8712 Wordfence
6.1 Medium Simple LDAP Login Plugin simple-ldap-login Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.0 CVE-2024-8715 Wordfence
5.3 Medium EU/UK VAT Manager for WooCommerce Plugin eu-vat-for-woocommerce Broken Access Control Missing Authorization No login needed ≤ 2.12.12 CVE-2024-9189 Wordfence
6.4 Medium WP-WebAuthn Plugin wp-webauthn Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode ≤ 1.3.3 CVE-2024-9023 Wordfence
6.1 Medium EU/UK VAT Manager for WooCommerce Plugin eu-vat-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.12.12 CVE-2024-8788 Wordfence
6.4 Medium Simple Popup Plugin simple-popup-plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5 CVE-2024-8547 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget ≤ 4.10.52 CVE-2024-8681 Wordfence
6.4 Medium OSM Plugin osm Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes ≤ 6.1.0 CVE-2024-8991 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module ≤ 2.8.3.6 CVE-2024-9049 Wordfence
6.5 Medium AI Assistant with ChatGPT by AYS Plugin Broken Access Control Unauthenticated AJAX Calls No login needed < 2.1.0 Fixed in 2.1.0 CVE-2024-7714 WPScan
6.4 Medium Absolute Reviews Plugin absolute-reviews Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name ≤ 1.1.3 CVE-2024-8965 Wordfence
4.3 Medium Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Plugin email-subscribers Broken Access Control Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure ≤ 5.7.34 CVE-2024-8771 Wordfence
6.4 Medium Themedy Toolbox Plugin themedy-toolbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 1.0.15 CVE-2024-9177 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only