WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1,351–1,400 of 1,456 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 28 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Beaver Themer Plugin Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 1.4.9 CVE-2023-6694 Wordfence
6.5 Medium Beaver Themer Plugin Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via shortcode ≤ 1.4.9 CVE-2023-6695 Wordfence
6.4 Medium Avada Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 7.11.6 CVE-2024-2311 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode ≤ 4.8.8 CVE-2024-3267 Wordfence
6.4 Medium Ecwid Ecommerce Shopping Cart Plugin Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 6.12.10 CVE-2024-2456 Wordfence
6.4 Medium Knight Lab Timeline Plugin Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.3.3 CVE-2024-2287 Wordfence
8.8 High Easy Property Listings Plugin easy-property-listings SQL Injection Authenticated(Contributor+) SQL Injection via Shortcode ≤ 3.5.2 CVE-2024-1893 Wordfence
6.4 Medium WordPress File Upload Plugin Arbitrary File Upload Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.24.5 CVE-2024-2847 Wordfence
6.4 Medium Media Library Assistant Plugin media-library-assistant SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 3.13 CVE-2024-2871 Wordfence
6.4 Medium Passster Plugin content-protector Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode ≤ 4.2.6.4 CVE-2024-2026 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.14 CVE-2024-3244 Wordfence
6.4 Medium Modal Window – create popup modal window Plugin modal-window Cross-Site Scripting create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 5.3.8 CVE-2024-2457 Wordfence
6.4 Medium GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in Plugin Cross-Site Scripting The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 6.9.0 CVE-2024-2783 Wordfence
8.8 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager SQL Injection Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode ≤ 5.3.1.0 CVE-2024-1990 Wordfence
6.4 Medium Lightweight Accordion Plugin lightweight-accordion Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.5.16 CVE-2024-2436 Wordfence
6.4 Medium UsersWP Plugin userswp Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.2.6 CVE-2024-2423 Wordfence
6.4 Medium BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg Plugin Cross-Site Scripting Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.4.2 CVE-2024-2845 Wordfence
8.8 High Pods Plugin pods SQL Injection Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode < 2.7.31, 2.8 – < 2.8.23.2, 3 – < 3.0.10.2 Fixed in 2.7.31 CVE-2023-6967 Wordfence
6.4 Medium Forminator – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode ≤ 1.29.2 CVE-2024-3053 Wordfence
8.8 High Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 1.6.7.7 CVE-2024-2342 Wordfence
6.4 Medium RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Plugin feedzy-rss-feeds Cross-Site Scripting Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message ≤ 4.3.3 CVE-2023-6877 Wordfence
6.4 Medium Powerkit – Supercharge your WordPress Site Plugin powerkit Cross-Site Scripting Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.9.1 CVE-2024-2458 Wordfence
6.4 Medium Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel Plugin wp-carousel-free Cross-Site Scripting Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode' ≤ 2.6.3 CVE-2024-2949 Wordfence
6.4 Medium Squelch Tabs and Accordions Shortcodes Plugin squelch-tabs-and-accordions-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via accordions Shortcode ≤ 0.4.3 CVE-2024-2499 Wordfence
8.8 High Modal Popup Box – Popup Builder, Show Offers And News in Popup Plugin modal-popup-box PHP Object Injection Popup Builder, Show Offers And News in Popup <= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode ≤ 1.5.2 CVE-2024-2008 Wordfence
6.4 Medium WordPress Tag and Category Manager – AI Autotagger Plugin simple-tags Cross-Site Scripting AI Autotagger <= 3.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.12.0 CVE-2024-2830 Wordfence
6.4 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Broken Access Control ≤ 2.15.7 Fixed in 2.15.8 CVE-2024-31099 Patchstack
7.1 High Add Shortcodes Actions And Filters Plugin add-actions-and-filters Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.10 CVE-2024-30558 Patchstack
6.5 Medium AI Twitter Feeds (Twitter widget & shortcode) Plugin ai-twitter-feeds Cross-Site Scripting ≤ 2.4 CVE-2024-31101 Patchstack
9.1 Critical Shortcode Addons Plugin shortcode-addons Arbitrary File Upload ≤ 3.2.5 CVE-2024-31114 Patchstack
6.4 Medium Favorites Plugin favorites Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.3.3 CVE-2024-2948 Wordfence
8.8 High Button Plugin button PHP Object Injection Authenticated (Contributor+) PHP Object Injection in button_shortcode ≤ 1.1.27 CVE-2024-1872 Wordfence
6.4 Medium Media Library Assistant Plugin media-library-assistant Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode ≤ 3.13 CVE-2024-2475 Wordfence
8.5 High Church Admin Plugin church-admin SQL Injection SQL Injection via shortcode ≤ 4.0.27 Fixed in 4.0.28 CVE-2024-30244 Patchstack
6.5 Medium Grid Shortcodes Plugin grid-shortcodes Cross-Site Scripting ≤ 1.1 Fixed in 1.1.1 CVE-2024-29797 Patchstack
6.4 Medium Easy Textillate Plugin easy-textillate Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.01 CVE-2024-2303 Wordfence
5.4 Medium Themify Shortcodes Plugin themify-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.8 CVE-2024-2732 Wordfence
6.4 Medium Animated Headline Plugin animated-headline Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.0 CVE-2024-2304 Wordfence
7.4 High UX Flat Plugin ux-flat Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4 CVE-2024-2459 Wordfence
6.4 Medium Standout Color Boxes and Buttons Plugin standout-color-boxes-and-buttons Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.7.0 CVE-2024-2474 Wordfence
8.8 High GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in Plugin SQL Injection The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode ≤ 6.8.6 CVE-2024-1799 Wordfence
6.4 Medium GamiPress – Button Plugin gamipress-button Cross-Site Scripting Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.7 CVE-2024-2460 Wordfence
4.3 Medium Builder for WooCommerce reviews shortcodes – ReviewShort Plugin woo-product-reviews-shortcode Cross-Site Request Forgery ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.01.3 Fixed in 1.01.4 CVE-2024-29093 Patchstack
4.8 Medium Profile Box Shortcode And Widget Plugin facebook-likebox-widget-and-shortcode Cross-Site Scripting Profile Box Shortcode And Widget < 1.2.1 Admin+ Stored XSS < 1.2.1 Fixed in 1.2.1 CVE-2024-1401 WPScan
4.8 Medium Advanced Social Feeds Widget & Shortcode Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.7 CVE-2024-0951 WPScan
6.1 Medium Buttons Shortcode and Widget Plugin Cross-Site Scripting Stored XSS via shortcode No login needed ≤ 1.16 CVE-2024-0711 WPScan
5.4 Medium Tabs Shortcode and Widget Plugin Cross-Site Scripting Contributor+ Stored Cross-Site Scripting ≤ 1.17 CVE-2024-0719 WPScan
5.4 Medium Grid Shortcodes Plugin grid-shortcodes Cross-Site Scripting Contributor+ Stored XSS < 1.1.1 Fixed in 1.1.1 CVE-2024-1658 WPScan
6.5 Medium SoundCloud Shortcode Plugin soundcloud-shortcode Cross-Site Scripting ≤ 4.0.1 Fixed in 4.0.2 CVE-2024-25936 Patchstack
6.4 Medium HUSKY – Products Filter for WooCommerce Professional Plugin woocommerce-products-filter Cross-Site Scripting Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.5.1 CVE-2024-1796 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only