WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 13,601–13,650 of 16,945 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 273 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium PDF Generator Addon for Elementor Page Builder Plugin pdf-generator-addon-for-elementor-page-builder Cross-Site Scripting ≤ 1.7.4 Fixed in 1.7.5 CVE-2024-50449 Patchstack
6.5 Medium MDTF Plugin wp-meta-data-filter-and-taxonomy-filter Cross-Site Scripting Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Cross Site Scripting (XSS) ≤ 1.3.3.4 Fixed in 1.3.3.5 CVE-2024-50451 Patchstack
6.5 Medium Advanced Sermons Plugin advanced-sermons Cross-Site Scripting ≤ 3.4 Fixed in 3.5 CVE-2024-50458 Patchstack
5.9 Medium Firelight Lightbox Plugin easy-fancybox Cross-Site Scripting ≤ 2.3.3 Fixed in 2.3.4 CVE-2024-50460 Patchstack
6.5 Medium EmbedPress Plugin embedpress Cross-Site Scripting ≤ 4.0.14 Fixed in 4.1.0 CVE-2024-50461 Patchstack
6.5 Medium Interactive World Map Plugin interactive-world-map Cross-Site Scripting ≤ 3.4.4 Fixed in 3.4.8 CVE-2024-50462 Patchstack
6.5 Medium Kodex Posts likes Plugin kodex-posts-likes Cross-Site Scripting ≤ 2.5.0 CVE-2024-50464 Patchstack
6.5 Medium Scrollbar by webxapp – Best vertical/horizontal scrollbars Plugin scrollbar-by-webxapp Cross-Site Scripting ≤ 1.3.0 CVE-2024-50467 Patchstack
6.5 Medium Raptor Editor Plugin wp-raptor Cross-Site Scripting ≤ 1.0.20 CVE-2024-50468 Patchstack
6.5 Medium Textboxes Plugin textboxes Cross-Site Scripting ≤ 0.1.3.1 CVE-2024-50469 Patchstack
6.5 Medium PostX Plugin ultimate-post Cross-Site Scripting ≤ 4.1.12 Fixed in 4.1.13 CVE-2024-50443 Patchstack
6.5 Medium Themes4WP YouTube External Subtitles Plugin themes4wp-youtube-external-subtitles Cross-Site Scripting ≤ 1.0 CVE-2024-50470 Patchstack
6.5 Medium Trip Plan Plugin tripplan Cross-Site Scripting ≤ 1.0.10 Fixed in 2.0.0 CVE-2024-50471 Patchstack
6.5 Medium Amilia Store Plugin amilia-store Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 2.9.8 CVE-2024-50472 Patchstack
6.5 Medium Kata Plus Plugin kata-plus Cross-Site Scripting ≤ 1.4.7 Fixed in 1.5.0 CVE-2024-50501 Patchstack
6.5 Medium Cozy Blocks Plugin cozy-addons Cross-Site Scripting ≤ 2.0.18 Fixed in 2.0.19 CVE-2024-50502 Patchstack
8.5 High Premium SEO Pack Plugin premium-seo-pack SQL Injection ≤ 1.6.001 CVE-2024-50465 Patchstack
9.3 Critical Woocommerce Quote Calculator Plugin woo-quote-calculator-order SQL Injection No login needed ≤ 1.1 CVE-2024-50479 Patchstack
9.3 Critical RSVP ME Plugin rsvp-me SQL Injection No login needed ≤ 1.9.9 CVE-2024-50491 Patchstack
8.1 High Advanced Online Ordering and Delivery Platform Plugin advanced-online-ordering-and-delivery-platform Local File Inclusion No login needed ≤ 2.0.0 CVE-2024-50497 Patchstack
4.7 Medium Sunshine Photo Cart Plugin sunshine-photo-cart Open Redirect No login needed ≤ 3.2.9 Fixed in 3.2.11 CVE-2024-50463 Patchstack
9.8 Critical 1-Click Login: Passwordless Authentication Plugin swoop-password-free-authentication Authentication Bypass Broken Authentication No login needed 1.4.5 CVE-2024-50478 Patchstack
9.8 Critical Meetup Plugin meetup Authentication Bypass Broken Authentication No login needed ≤ 0.1 CVE-2024-50483 Patchstack
8.8 High Token Login Plugin token-login Authentication Bypass Broken Authentication ≤ 1.0.3 CVE-2024-50488 Patchstack
8.8 High Namaste! LMS Plugin namaste-lms PHP Object Injection ≤ 2.6.3 Fixed in 2.6.4 CVE-2024-50408 Patchstack
8.8 High WPC Shop as a Customer for WooCommerce Plugin wpc-shop-as-customer PHP Object Injection ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-50416 Patchstack
7.3 High MDTF Plugin wp-meta-data-filter-and-taxonomy-filter Remote Code Execution Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability No login needed ≤ 1.3.3.4 Fixed in 1.3.3.5 CVE-2024-50450 Patchstack
8.3 High ScottCart Plugin scottcart Remote Code Execution No login needed ≤ 1.1 CVE-2024-50492 Patchstack
10.0 Critical WP Query Console Plugin wp-query-console Remote Code Execution No login needed ≤ 1.0 CVE-2024-50498 Patchstack
9.8 Critical Stacks Mobile App Builder Plugin stacks-mobile-app-builder Privilege Escalation Account Takeover No login needed ≤ 5.2.3 CVE-2024-50477 Patchstack
9.8 Critical Acnoo Flutter API Plugin acnoo-flutter-api Privilege Escalation Account Takeover No login needed ≤ 1.0.5 CVE-2024-50486 Patchstack
9.8 Critical MaanStore API Plugin maanstore-api Privilege Escalation Account Takeover No login needed ≤ 1.0.1 CVE-2024-50487 Patchstack
9.8 Critical Realty Workstation Plugin realty-workstation Privilege Escalation Account Takeover No login needed ≤ 1.0.45 CVE-2024-50489 Patchstack
6.5 Medium Royal Elementor Addons Plugin royal-elementor-addons XML External Entity ≤ 1.3.980 Fixed in 1.3.981 CVE-2024-50442 Patchstack
9.8 Critical Wp Social Login and Register Social Counter Plugin wp-social Authentication Bypass Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 3.0.7 CVE-2024-9501 Wordfence
7.2 High WordPress Post Grid Layouts with Pagination – Sogrid Plugin sogrid Local File Inclusion Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion ≤ 1.5.6 CVE-2024-8392 Wordfence
6.1 Medium FormFacade – WordPress plugin for Google Forms Plugin formfacade Cross-Site Scripting WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting No login needed ≤ 1.3.6 CVE-2024-9613 Wordfence
9.8 Critical Comments – wpDiscuz Plugin wpdiscuz Authentication Bypass wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 7.6.24 CVE-2024-9488 Wordfence
6.5 Medium Mega Elements Plugin mega-elements-addons-for-elementor Cross-Site Scripting Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-49693 Patchstack
6.5 Medium WP Flow Plus Plugin wp-imageflow2 Cross-Site Scripting ≤ 5.2.3 Fixed in 5.2.4 CVE-2024-49695 Patchstack
5.9 Medium Robo Gallery Plugin robo-gallery Cross-Site Scripting ≤ 3.2.21 Fixed in 3.2.22 CVE-2024-49696 Patchstack
6.5 Medium myCred Elementor Plugin mycred-for-elementor Cross-Site Scripting ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-49702 Patchstack
6.5 Medium WpEvently Plugin mage-eventpress Cross-Site Scripting ≤ 4.2.5 Fixed in 4.2.6 CVE-2024-49703 Patchstack
9.3 Critical WP Sessions Time Monitoring Full Automatic Plugin activitytime SQL Injection No login needed ≤ 1.0.9 Fixed in 1.1.0 CVE-2024-49681 Patchstack
7.6 High Product Filter by WBW Plugin woo-product-filter SQL Injection ≤ 2.7.0 Fixed in 2.7.1 CVE-2024-49691 Patchstack
5.3 Medium Schema & Structured Data for WP & AMP Plugin schema-and-structured-data-for-wp Information Disclosure Sensitive Data Exposure No login needed ≤ 1.3.5 Fixed in 1.36 CVE-2024-49683 Patchstack
4.7 Medium Simple Membership Plugin simple-membership Open Redirect No login needed ≤ 4.5.3 Fixed in 4.5.4 CVE-2024-49682 Patchstack
6.4 Medium WP Adminify – Best WordPress Custom Dashboard Plugin adminify Cross-Site Scripting Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 4.0.1.6 CVE-2024-8959 Wordfence
4.3 Medium HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce Plugin hurrytimer Broken Access Control An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication ≤ 2.10.0 CVE-2024-8667 Wordfence
9.9 Critical 3D Work In Progress Plugin renee-work-in-progress Arbitrary File Upload ≤ 1.0.3 CVE-2024-49652 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only