WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 13,801–13,850 of 17,733 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | Frontend Post Submission Manager Lite – Frontend Posting | Broken Access Control Frontend Posting WordPress Plugin <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
≤ 1.2.2 |
CVE-2024-8427 |
Wordfence | |
| 6.4 Medium | WP AdCenter – Ad Manager & Adsense Ads | Cross-Site Scripting Ad Manager & Adsense Ads <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ad_alignment Attribute |
≤ 2.5.6 |
CVE-2024-8317 |
Wordfence | |
| 5.3 Medium | Remember Me Controls | Information Disclosure Unauthenticated Full Path Disclosure No login needed |
≤ 2.0.1 |
CVE-2024-7415 |
Wordfence | |
| 5.3 Medium | Geo Controller | Broken Access Control Missing Authorization to Unauthenticated Shortcode Execution No login needed |
≤ 8.6.9 |
CVE-2024-7381 |
Wordfence | |
| 5.3 Medium | Security, Antivirus, Firewall – S.A.F | Other S.A.F <= 2.3.5 - IP Address Spoofing to Protection Mechanism Bypass No login needed |
≤ 2.3.5 |
CVE-2022-4529 |
Wordfence | |
| 4.3 Medium | Geo Controller | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion |
≤ 8.7.3 |
CVE-2024-7380 |
Wordfence | |
| 4.4 Medium | Cab fare calculator | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 1.1.6 |
CVE-2022-3556 |
Wordfence | |
| 4.3 Medium | HelloAsso | Broken Access Control Missing Authorization to Authenticated (Contributor+) Limited Options Update |
≤ 1.1.10 |
CVE-2024-7605 |
Wordfence | |
| 6.4 Medium | Dynamic Featured Image | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dfiFeatured Parameter |
≤ 3.7.0 |
CVE-2024-6929 |
Wordfence | |
| 6.4 Medium | RD Station | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.3.2 |
CVE-2024-6894 |
Wordfence | |
| 6.5 Medium | Booking for Appointments and Events Calendar – Amelia Premium | Broken Access Control Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure No login needed |
≤ 1.2.4, ≤ 7.7 |
CVE-2024-6332 |
Wordfence | |
| 6.4 Medium | Share This Image | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode |
≤ 2.02 |
CVE-2024-8363 |
Wordfence | |
| 5.4 Medium | Form Vibes – Database Manager for Forms | Broken Access Control Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions |
≤ 1.4.12 |
CVE-2024-5309 |
Wordfence | |
| 5.3 Medium | Ivory Search – WordPress Search | Information Disclosure WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form No login needed |
≤ 5.5.6 |
CVE-2024-6835 |
Wordfence | |
| 5.3 Medium | SmartSearchWP | Broken Access Control Unauthenticated Log Purge No login needed |
< 2.4.5 Fixed in 2.4.5 |
CVE-2024-6846 |
WPScan | |
| 6.1 Medium | Advanced Custom Fields | Cross-Site Scripting Cross-site scripting vulnerability exists in Advanced Custom Fields versions 6.3.5 and earlier and Advanced Custom Fields Pro versions 6.3.5 and earlier. If an attacker with the '… No login needed |
6.3.5 and earlier |
CVE-2024-45429 |
jpcert | |
| 6.5 Medium | PixelYourSite – Your smart PIXEL (TAG) & API Manager | Information Disclosure Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion No login needed |
≤ 9.7.1, ≤ 10.4.2 |
CVE-2024-7870 |
Wordfence | |
| 6.4 Medium | Attributes for Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via attributesForBlocks Parameter |
≤ 1.0.6 |
CVE-2024-8318 |
Wordfence | |
| 5.4 Medium | The Ultimate WordPress Toolkit – WP Extended | Broken Access Control WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change |
≤ 3.0.8 |
CVE-2024-8121 |
Wordfence | |
| 5.4 Medium | The Ultimate WordPress Toolkit – WP Extended | Broken Access Control WP Extended <= 3.0.8 - Insecure Direct Object Reference |
≤ 3.0.8 |
CVE-2024-8123 |
Wordfence | |
| 6.1 Medium | The Ultimate WordPress Toolkit – WP Extended | Cross-Site Scripting WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page No login needed |
≤ 3.0.8 |
CVE-2024-8119 |
Wordfence | |
| 6.5 Medium | The Ultimate WordPress Toolkit – WP Extended | Information Disclosure WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure |
≤ 3.0.8 |
CVE-2024-8106 |
Wordfence | |
| 6.1 Medium | The Ultimate WordPress Toolkit – WP Extended | Cross-Site Scripting WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option No login needed |
≤ 3.0.8 |
CVE-2024-8117 |
Wordfence | |
| 4.8 Medium | Secure Copy Content Protection and Content Locking | Cross-Site Scripting Admin+ Stored XSS |
< 4.1.7 Fixed in 4.1.7 |
CVE-2024-6889 |
WPScan | |
| 4.8 Medium | Secure Copy Content Protection and Content Locking | Cross-Site Scripting Admin+ Stored XSS |
< 4.1.7 Fixed in 4.1.7 |
CVE-2024-6888 |
WPScan | |
| 4.8 Medium | Chatbot Support AI | Cross-Site Scripting Admin+ Stored XSS |
≤ 1.0.2 |
CVE-2024-6722 |
WPScan | |
| 6.1 Medium | Sign-up Sheets | Cross-Site Scripting Reflected XSS No login needed |
< 2.2.13 Fixed in 2.2.13 |
CVE-2024-6020 |
WPScan | |
| 6.4 Medium | Gutenberg Page Builder Blocks & Ready-Made Patterns Library | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 3.2.4 |
CVE-2024-8325 |
Wordfence | |
| 6.1 Medium | Flaming Forms | Cross-Site Scripting Reflected XSS No login needed |
≤ 1.0.1 |
CVE-2024-7692 |
WPScan | |
| 5.4 Medium | Flaming Forms | Cross-Site Scripting Unauthenticated Stored XSS |
≤ 1.0.1 |
CVE-2024-7691 |
WPScan | |
| 5.4 Medium | DN Popup | Cross-Site Request Forgery Settings Update via CSRF No login needed |
≤ 1.2.2 |
CVE-2024-7690 |
WPScan | |
| 6.1 Medium | Ninja Forms | Cross-Site Scripting Reflected XSS No login needed |
3.8.6 – < 3.8.11 Fixed in 3.8.11 |
CVE-2024-7354 |
WPScan | |
| 4.3 Medium | Carousel Slider | Cross-Site Request Forgery WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Hero image selection feature. While logged in to the WordPress s… No login needed |
prior to 2.2.4 |
CVE-2024-45270 |
jpcert | |
| 4.3 Medium | Carousel Slider | Cross-Site Request Forgery WordPress plugin "Carousel Slider" provided by Sayful Islam contains a cross-site request forgery vulnerability on Carousel image selection feature. While logged in to the WordPre… No login needed |
prior to 2.0 |
CVE-2024-45269 |
jpcert | |
| 4.2 Medium | Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification |
≤ 5.1.18 |
CVE-2024-5053 |
Wordfence | |
| 5.3 Medium | Web Application Firewall | Other IP Address Spoofing to Protection Mechanism Bypass No login needed |
≤ 2.1.2 |
CVE-2022-4539 |
Wordfence | |
| 5.3 Medium | IP Vault – WP Firewall | Other WP Firewall <= 1.1 - IP Address Spoofing to Protection Mechanism Bypass No login needed |
≤ 1.1 |
CVE-2022-4536 |
Wordfence | |
| 6.4 Medium | Share This Image | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter |
≤ 2.01 |
CVE-2024-8108 |
Wordfence | |
| 5.3 Medium | WP Cerber Security | Other IP Protection Bypass No login needed |
≤ 9.4 |
CVE-2022-4100 |
Wordfence | |
| 6.4 Medium | WPZOOM Portfolio Lite – Filterable Portfolio | Cross-Site Scripting Filterable Portfolio Plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute |
≤ 1.4.4 |
CVE-2024-8276 |
Wordfence | |
| 6.1 Medium | tagDiv Composer | Cross-Site Scripting Reflected Cross-Site Scripting via envato_code[] No login needed |
≤ 5.0 |
CVE-2024-5212 |
Wordfence | |
| 6.1 Medium | tagDiv Composer | Cross-Site Scripting Reflected Cross-Site Scripting via envato_code[] No login needed |
≤ 5.0 |
CVE-2024-3886 |
Wordfence | |
| 6.3 Medium | Media Library Folders | Broken Access Control Missing Authorization on Various Functions |
≤ 8.2.3 |
CVE-2024-7858 |
Wordfence | |
| 6.1 Medium | WP Booking Calendar | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 10.5 |
CVE-2024-8274 |
Wordfence | |
| 6.4 Medium | Elementor Addon Elements | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 1.13.6 |
CVE-2024-7122 |
Wordfence | |
| 4.3 Medium | Tourfic | Cross-Site Request Forgery Cross-Site Request Forgery in Multiple Functions No login needed |
≤ 2.11.20 |
CVE-2024-8319 |
Wordfence | |
| 6.4 Medium | HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics | Cross-Site Scripting CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget |
≤ 11.1.22 |
CVE-2024-5879 |
Wordfence | |
| 6.4 Medium | Betheme | Responsive Multipurpose WordPress & WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 27.5.6 |
CVE-2024-3998 |
Wordfence | |
| 6.4 Medium | Elementor Addon Elements | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id and eae_slider_animation Parameters |
≤ 1.13.5 |
CVE-2024-4401 |
Wordfence | |
| 6.4 Medium | Enfold | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class Parameters |
≤ 6.0.3 |
CVE-2024-5061 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.