WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 13,851–13,900 of 17,733 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 278 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.1 Medium MemberPress Plugin Cross-Site Scripting Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters No login needed ≤ 1.11.29 CVE-2024-5024 Wordfence
5.4 Medium WP Armour Extended Plugin Cross-Site Request Forgery No login needed ≤ 1.26 Fixed in 1.32 CVE-2024-43947 Patchstack
6.5 Medium Gutenverse Plugin gutenverse Cross-Site Scripting Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.9.4 - Cross Site Scripting (XSS) ≤ 1.9.4 Fixed in 2.0.0 CVE-2024-43920 Patchstack
6.5 Medium Collapsing Archives Plugin collapsing-archives Cross-Site Scripting ≤ 3.0.5 Fixed in 3.0.6 CVE-2024-43934 Patchstack
6.5 Medium Delicious Recipes – WordPress Recipe Plugin delicious-recipes Cross-Site Scripting Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin <= 1.6.7 - Cross Site Scripting (XSS) ≤ 1.6.7 Fixed in 1.6.8 CVE-2024-43935 Patchstack
6.5 Medium EmbedPress Plugin embedpress Cross-Site Scripting ≤ 4.0.8 Fixed in 4.0.9 CVE-2024-43936 Patchstack
6.5 Medium SKT Blocks – Gutenberg based Page Builder Plugin skt-blocks Cross-Site Scripting ≤ 1.5 CVE-2024-43946 Patchstack
6.5 Medium GHActivity Plugin Cross-Site Scripting ≤ 2.0.0-alpha CVE-2024-43949 Patchstack
6.5 Medium Tempera Theme tempera Cross-Site Scripting ≤ 1.8.2 CVE-2024-43951 Patchstack
6.5 Medium Esotera Theme esotera Cross-Site Scripting ≤ 1.2.5.1 CVE-2024-43952 Patchstack
6.5 Medium Classic Addons – WPBakery Page Builder Plugin classic-addons-wpbakery-page-builder-addons Cross-Site Scripting WPBakery Page Builder plugin <= 3.5 - Cross Site Scripting (XSS) ≤ 3.5 Fixed in 3.6 CVE-2024-43953 Patchstack
5.9 Medium Web and WooCommerce Addons for WPBakery Builder Plugin vc-addons-by-bit14 Cross-Site Scripting ≤ 1.4.6 CVE-2024-43960 Patchstack
6.5 Medium azurecurve Toggle Show/Hide Plugin azurecurve-toggle-showhide Cross-Site Scripting ≤ 2.1.3 CVE-2024-43961 Patchstack
6.5 Medium DSGVO All in one for WP Plugin dsgvo-all-in-one-for-wp Cross-Site Scripting ≤ 4.5 CVE-2024-43964 Patchstack
6.5 Medium Animated Number Counters Plugin animated-number-counters Local File Inclusion Editor+ Limited Local File Inclusion ≤ 1.9 CVE-2024-43957 Patchstack
6.3 Medium Droip Plugin Information Disclosure Subscriber+ Settings Change/Data Exposure ≤ 1.1.1 CVE-2024-43954 Patchstack
6.5 Medium Z Y N I T H Plugin Broken Access Control Unauthenticated Plugin Settings Change No login needed ≤ 7.4.9 CVE-2024-43940 Patchstack
6.5 Medium Z Y N I T H Plugin Broken Access Control Unauthenticated Arbitrary Option Deletion No login needed ≤ 7.4.9 CVE-2024-43939 Patchstack
4.8 Medium NitroPack Plugin nitropack Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.16.7 Fixed in 1.16.8 CVE-2024-43922 Patchstack
6.4 Medium Funnel Kit Funnel Builder PRO Plugin Cross-Site Scripting Funnel Kit Funnel Builder PRO <= 3.4.5 Authenticated(Contributor+) Stored Cross-Site Scripting via allow_iframe_tag_in_post ≤ 3.4.5 CVE-2024-1056 Wordfence
5.3 Medium Premium SEO Pack – WP SEO Plugin premium-seo-pack Information Disclosure WP SEO Plugin <= 1.6.002 - Unauthenticated Information Exposure No login needed ≤ 1.6.002 CVE-2024-3679 Wordfence
6.4 Medium Premium Portfolio Features for Phlox Plugin auxin-portfolio Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.3.4 CVE-2024-1384 Wordfence
5.3 Medium Popup Builder Plugin popup-builder Information Disclosure Sensitive Information Exposure via Imported Subscribers CSV File No login needed ≤ 4.3.6 CVE-2024-2541 Wordfence
6.4 Medium Beaver Builder (Lite Version) Plugin beaver-builder-lite-version Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter ≤ 2.8.3.5 CVE-2024-7895 Wordfence
5.3 Medium GiveWP Plugin give Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 3.15.1 CVE-2024-6551 Wordfence
5.9 Medium Taxi Booking Manager for WooCommerce Plugin ecab-taxi-booking-manager Cross-Site Scripting ≤ 1.0.9 Fixed in 1.1.0 CVE-2024-43986 Patchstack
4.8 Medium CoBlocks Plugin Cross-Site Scripting Editor+ Stored XSS < 3.1.13 Fixed in 3.1.13 CVE-2024-7132 WPScan
4.8 Medium Viral Signup Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 2.1 CVE-2024-6927 WPScan
5.4 Medium Gutentor Plugin gutentor Cross-Site Scripting Contributor+ Stored XSS < 3.3.6 Fixed in 3.3.6 CVE-2024-5417 WPScan
5.4 Medium WP Accessibility Helper Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Settings Update ≤ 0.6.2.8 CVE-2024-5987 Wordfence
4.4 Medium WP To Do Plugin wp-todo Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via Task Comments ≤ 1.3.0 CVE-2024-3944 Wordfence
6.4 Medium Front End Users Plugin front-end-only-users Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.28 CVE-2024-7606 Wordfence
4.3 Medium The Post Grid Plugin the-post-grid Information Disclosure Authenticated (Contributor+) Information Disclosure ≤ 7.7.11 CVE-2024-7418 Wordfence
5.3 Medium Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Plugin funnelforms-free Broken Access Control Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion No login needed ≤ 3.7.3.2 CVE-2024-5857 Wordfence
6.5 Medium Media Library Folders Plugin media-library-plus SQL Injection Authenticated (Subscriber+) Second-Order SQL Injection ≤ 8.2.2 CVE-2024-7857 Wordfence
5.3 Medium Permalink Manager Lite Plugin permalink-manager Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed ≤ 2.4.4 CVE-2024-8195 Wordfence
5.3 Medium Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Plugin funnelforms-free Broken Access Control Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload No login needed ≤ 3.7.3.2 CVE-2024-7447 Wordfence
6.5 Medium Funnelforms Free Plugin funnelforms-free Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion ≤ 3.7.3.2 CVE-2024-6312 Wordfence
5.3 Medium Mollie Payments for WooCommerce Plugin mollie-payments-for-woocommerce Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 7.7.0 CVE-2024-6448 Wordfence
5.3 Medium Relevanssi Live Ajax Search Plugin relevanssi-live-ajax-search Information Disclosure Unauthenticated WP_Query Argument Injection No login needed ≤ 2.4 CVE-2024-7573 Wordfence
4.3 Medium Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More Plugin reviews-feed Broken Access Control Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update ≤ 1.1.2 CVE-2024-8199 Wordfence
4.3 Medium Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More Plugin reviews-feed Cross-Site Request Forgery Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More <= 1.1.2 - Cross-Site Request Forgery No login needed ≤ 1.1.2 CVE-2024-8200 Wordfence
6.4 Medium 140+ Widgets | Xpro Addons For Elementor – FREE Plugin xpro-elementor-addons Cross-Site Scripting FREE <= 1.4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Grid Widget ≤ 1.4.4.3 CVE-2024-7791 Wordfence
6.4 Medium Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Plugin logo-showcase-ultimate Cross-Site Scripting Logo Carousel, Logo Slider & Logo Grid <= 1.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.4.1 CVE-2024-8046 Wordfence
6.4 Medium Ninja Tables – Easiest Data Table Builder Plugin ninja-tables Cross-Site Scripting Easiest Data Table Builder <= 5.0.12 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 5.0.12 CVE-2024-7304 Wordfence
6.4 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File ≤ 2.6.7 CVE-2024-6804 Wordfence
4.3 Medium Oxygen Builder Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stylesheet Update ≤ 4.8.3 CVE-2024-6688 Wordfence
5.4 Medium Ninja Forms Plugin ninja-forms Cross-Site Request Forgery No login needed ≤ 3.8.6 Fixed in 3.8.7 CVE-2024-39628 Patchstack
4.3 Medium LearnPress Plugin learnpress Cross-Site Request Forgery No login needed ≤ 4.2.6.8.2 Fixed in 4.2.6.9 CVE-2024-39641 Patchstack
5.4 Medium Tutor LMS Plugin tutor Cross-Site Request Forgery No login needed ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-39645 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only