WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 13,651–13,700 of 17,733 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 274 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Happy Addons for Elementor Plugin happy-elementor-addons Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure ≤ 3.12.2 CVE-2024-8801 Wordfence
4.3 Medium WP Easy Gallery – WordPress Gallery Plugin wp-easy-gallery Broken Access Control WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation ≤ 4.8.5 CVE-2024-8437 Wordfence
6.4 Medium WP Category Dropdown Plugin wp-category-dropdown Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter ≤ 1.8 CVE-2024-8103 Wordfence
6.4 Medium Confetti Fall Animation Plugin confetti-fall-animation Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via confetti-fall-animation Shortcode ≤ 1.3.1 CVE-2024-8919 Wordfence
6.4 Medium Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Plugin radio-player Cross-Site Scripting Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute ≤ 2.0.78 CVE-2024-8267 Wordfence
6.4 Medium AnWP Football Leagues Plugin football-leagues-by-anwppro Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 0.16.7 CVE-2024-8917 Wordfence
5.4 Medium Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin Plugin mailoptin Cross-Site Scripting MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.70.3 CVE-2024-8628 Wordfence
5.3 Medium BA Book Everything Plugin ba-book-everything Privilege Escalation Unauthenticated Arbitrary User Password Reset No login needed ≤ 1.6.20 CVE-2024-8794 Wordfence
6.1 Medium Seriously Simple Stats Plugin seriously-simple-stats Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.0 CVE-2024-8738 Wordfence
6.1 Medium Pixel Cat – Conversion Pixel Manager Plugin facebook-conversion-pixel Cross-Site Scripting Conversion Pixel Manager <= 3.0.5 - Reflected Cross-Site Scripting No login needed ≤ 3.0.5 CVE-2024-8544 Wordfence
6.1 Medium Koko Analytics Plugin koko-analytics Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.3.12 CVE-2024-8662 Wordfence
6.1 Medium XT Ajax Add To Cart for WooCommerce Plugin xt-woo-ajax-add-to-cart Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.1.2 CVE-2024-8716 Wordfence
6.4 Medium Garden Gnome Package Plugin garden-gnome-package Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.2.9 CVE-2024-8657 Wordfence
4.3 Medium Appointment & Event Booking Calendar Plugin – Webba Booking Plugin webba-booking-lite Broken Access Control Webba Booking <= 5.0.48 - Missing Authorization to Authenticated (Subscriber+) CSS Settings Update ≤ 5.0.48 CVE-2024-8432 Wordfence
4.8 Medium Quiz and Survey Master (QSM) Plugin quiz-master-next Cross-Site Scripting Author+ Stored XSS < 9.1.3 Fixed in 9.1.3 CVE-2024-8758 WPScan
6.5 Medium Product Carousel Slider & Grid Ultimate for WooCommerce Plugin woo-product-carousel-slider-and-grid-ultimate Local File Inclusion Authenticated Local File Inclusion ≤ 1.9.10 Fixed in 1.10.0 CVE-2024-44048 Patchstack
6.5 Medium ElementsKit Pro Plugin Local File Inclusion ≤ 3.6.0 Fixed in 3.6.8 CVE-2024-43996 Patchstack
4.4 Medium MailChimp Plugin mailchimp-for-wp Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 4.9.16 CVE-2024-8680 Wordfence
6.4 Medium WP Custom Fields Search Plugin wp-custom-fields-search Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcode ≤ 1.2.35 CVE-2024-8364 Wordfence
5.3 Medium Limit Login Attempts Plus Plugin limit-login-attempts-plus Other IP Address Spoofing to Protection Mechanism Bypass No login needed ≤ 1.1.0 CVE-2022-4533 Wordfence
6.1 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Cross-Site Scripting Reflected Cross-Site Scripting No login needed 4.9.9 – 4.9.16 CVE-2024-8850 Wordfence
5.3 Medium WP Hardening – Fix Your WordPress Security Plugin wp-security-hardening Other Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration No login needed ≤ 1.2.6 CVE-2024-6641 Wordfence
5.9 Medium PageLayer Plugin pagelayer Cross-Site Scripting Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) ≤ 1.8.7 Fixed in 1.8.8 CVE-2024-43972 Patchstack
6.5 Medium Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Cross-Site Scripting ≤ 4.1.13 Fixed in 4.1.14 CVE-2024-43983 Patchstack
6.5 Medium Sliding Door Theme sliding-door Cross-Site Scripting ≤ 3.6 CVE-2024-43987 Patchstack
6.5 Medium Mystique Theme mystique Cross-Site Scripting ≤ 2.5.7 CVE-2024-43988 Patchstack
6.5 Medium Hotel Galaxy Theme hotel-galaxy Cross-Site Scripting ≤ 4.4.24 CVE-2024-43991 Patchstack
6.5 Medium LatePoint Plugin Cross-Site Scripting ≤ 4.9.91 CVE-2024-43992 Patchstack
6.5 Medium Liquido Theme liquido Cross-Site Scripting ≤ 1.0.1.2 CVE-2024-43993 Patchstack
6.5 Medium Kahuna Theme kahuna Cross-Site Scripting ≤ 1.7.0 CVE-2024-43994 Patchstack
6.5 Medium Posterity Theme posterity Cross-Site Scripting ≤ 3.6 CVE-2024-43995 Patchstack
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting ≤ 3.8.11 Fixed in 3.8.12 CVE-2024-43999 Patchstack
6.5 Medium Royal Elementor Addons Plugin royal-elementor-addons Cross-Site Scripting ≤ 1.3.982 Fixed in 1.3.985 CVE-2024-44001 Patchstack
6.5 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting ≤ 9.3.7 Fixed in 9.4 CVE-2024-44005 Patchstack
6.5 Medium Geo Mashup Plugin geo-mashup Cross-Site Scripting ≤ 1.13.12 Fixed in 1.13.13 CVE-2024-44008 Patchstack
6.5 Medium IMPress for IDX Broker Plugin idx-broker-platinum Cross-Site Scripting ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-44047 Patchstack
6.5 Medium Gutenberg Blocks Plugin unlimited-blocks Cross-Site Scripting Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) ≤ 1.2.8 CVE-2024-44049 Patchstack
5.9 Medium Bus Ticket Booking with Seat Reservation Plugin bus-ticket-booking-with-seat-reservation Cross-Site Scripting ≤ 5.3.5 Fixed in 5.3.6 CVE-2024-43985 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.6.2 Fixed in 5.6.3 CVE-2024-43977 Patchstack
6.5 Medium Verbosa Plugin verbosa Cross-Site Scripting ≤ 1.2.3 CVE-2024-44050 Patchstack
6.5 Medium Content Blocks (Custom Post Widget) Plugin custom-post-widget Cross-Site Scripting ≤ 3.3.5 Fixed in 3.3.6 CVE-2024-44051 Patchstack
6.5 Medium Roseta Plugin roseta Cross-Site Scripting ≤ 1.3.0 CVE-2024-45451 Patchstack
6.5 Medium Septera Plugin septera Cross-Site Scripting ≤ 1.5.1 CVE-2024-45452 Patchstack
4.8 Medium Posts reminder Plugin Cross-Site Request Forgery Settings Update via CSRF ≤ 0.20 CVE-2024-8093 WPScan
5.4 Medium Accordion Image Menu Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 3.1.3 CVE-2024-8092 WPScan
4.8 Medium Enhanced Search Box Plugin Cross-Site Request Forgery Settings Update via CSRF ≤ 0.6.1 CVE-2024-8091 WPScan
4.8 Medium Review Ratings Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 1.6 CVE-2024-8052 WPScan
5.7 Medium Special Feed Items Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 1.0.1 CVE-2024-8051 WPScan
5.7 Medium Visual Sound (old) Plugin Cross-Site Request Forgery Settings Update via CSRF ≤ 1.06 CVE-2024-8047 WPScan
5.7 Medium infolinks Ad Wrap Plugin Cross-Site Request Forgery Settings Update via CSRF ≤ 1.0.2 CVE-2024-8044 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only