WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 14,001–14,050 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 281 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) Plugin graphicsly Cross-Site Scripting The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.2 CVE-2024-9069 Wordfence
9.9 Critical WP Easy Gallery – WordPress Gallery Plugin wp-easy-gallery SQL Injection WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection ≤ 4.8.5 CVE-2024-8436 Wordfence
4.3 Medium WP Easy Gallery – WordPress Gallery Plugin wp-easy-gallery Broken Access Control WordPress Gallery Plugin <= 4.8.5 - Missing Authorization to Authenticated (Subscriber+) Gallery Manipulation ≤ 4.8.5 CVE-2024-8437 Wordfence
6.4 Medium Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Plugin radio-player Cross-Site Scripting Live Shoutcast, Icecast and Any Audio Stream Player for WordPress <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute ≤ 2.0.78 CVE-2024-8267 Wordfence
9.8 Critical Donation Forms by Charitable – Donations Plugin & Fundraising Platform Plugin charitable Broken Access Control Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation No login needed ≤ 1.8.1.14 CVE-2024-8791 Wordfence
3.7 Low Maintenance Redirect Plugin jf3-maintenance-mode Authentication Bypass IP Bypass No login needed ≤ 2.0.1 Fixed in 2.1.0 CVE-2024-45453 Patchstack
6.5 Medium Product Carousel Slider & Grid Ultimate for WooCommerce Plugin woo-product-carousel-slider-and-grid-ultimate Local File Inclusion Authenticated Local File Inclusion ≤ 1.9.10 Fixed in 1.10.0 CVE-2024-44048 Patchstack
6.5 Medium ElementsKit Pro Plugin Local File Inclusion ≤ 3.6.0 Fixed in 3.6.8 CVE-2024-43996 Patchstack
7.5 High Justified Image Grid Plugin justified-image-grid Server-Side Request Forgery Unauthenticated Server Side Request Forgery (SSRF) No login needed ≤ 4.6.1 Fixed in 4.7 CVE-2024-43989 Patchstack
4.4 Medium MailChimp Plugin mailchimp-for-wp Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 4.9.16 CVE-2024-8680 Wordfence
6.1 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Cross-Site Scripting Reflected Cross-Site Scripting No login needed 4.9.9 – 4.9.16 CVE-2024-8850 Wordfence
5.3 Medium WP Hardening – Fix Your WordPress Security Plugin wp-security-hardening Other Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration No login needed ≤ 1.2.6 CVE-2024-6641 Wordfence
7.1 High SureCart Plugin surecart Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.29.3 Fixed in 2.29.4 CVE-2024-43970 Patchstack
7.1 High Sunshine Photo Cart Plugin sunshine-photo-cart Cross-Site Scripting No login needed ≤ 3.2.5 Fixed in 3.2.6 CVE-2024-43971 Patchstack
5.9 Medium PageLayer Plugin pagelayer Cross-Site Scripting Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) ≤ 1.8.7 Fixed in 1.8.8 CVE-2024-43972 Patchstack
7.1 High Super Store Finder Plugin superstorefinder-wp Cross-Site Scripting No login needed ≤ 6.9.7 Fixed in 6.9.8 CVE-2024-43975 Patchstack
6.5 Medium Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Cross-Site Scripting ≤ 4.1.13 Fixed in 4.1.14 CVE-2024-43983 Patchstack
6.5 Medium Sliding Door Theme sliding-door Cross-Site Scripting ≤ 3.6 CVE-2024-43987 Patchstack
6.5 Medium Mystique Theme mystique Cross-Site Scripting ≤ 2.5.7 CVE-2024-43988 Patchstack
6.5 Medium Hotel Galaxy Theme hotel-galaxy Cross-Site Scripting ≤ 4.4.24 CVE-2024-43991 Patchstack
6.5 Medium LatePoint Plugin Cross-Site Scripting ≤ 4.9.91 CVE-2024-43992 Patchstack
6.5 Medium Liquido Theme liquido Cross-Site Scripting ≤ 1.0.1.2 CVE-2024-43993 Patchstack
6.5 Medium Kahuna Theme kahuna Cross-Site Scripting ≤ 1.7.0 CVE-2024-43994 Patchstack
6.5 Medium Posterity Theme posterity Cross-Site Scripting ≤ 3.6 CVE-2024-43995 Patchstack
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting ≤ 3.8.11 Fixed in 3.8.12 CVE-2024-43999 Patchstack
6.5 Medium Royal Elementor Addons Plugin royal-elementor-addons Cross-Site Scripting ≤ 1.3.982 Fixed in 1.3.985 CVE-2024-44001 Patchstack
7.1 High Team Showcase Plugin team Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.22.25 Fixed in 1.22.26 CVE-2024-44002 Patchstack
7.1 High Spice Starter Sites Plugin spice-starter-sites Cross-Site Scripting No login needed ≤ 1.2.5 CVE-2024-44003 Patchstack
6.5 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting ≤ 9.3.7 Fixed in 9.4 CVE-2024-44005 Patchstack
7.1 High SKT Templates – Elementor & Gutenberg templates Plugin skt-templates Cross-Site Scripting Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) No login needed ≤ 6.14 Fixed in 6.15 CVE-2024-44007 Patchstack
6.5 Medium Geo Mashup Plugin geo-mashup Cross-Site Scripting ≤ 1.13.12 Fixed in 1.13.13 CVE-2024-44008 Patchstack
7.1 High WCFM Marketplace Plugin wc-multivendor-marketplace Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.6.11 Fixed in 3.6.12 CVE-2024-44009 Patchstack
6.5 Medium IMPress for IDX Broker Plugin idx-broker-platinum Cross-Site Scripting ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-44047 Patchstack
6.5 Medium Gutenberg Blocks Plugin unlimited-blocks Cross-Site Scripting Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) ≤ 1.2.8 CVE-2024-44049 Patchstack
7.1 High Name Directory Plugin name-directory Cross-Site Scripting Reflected Cross Site Scripting (XSS) ≤ 1.29.0 Fixed in 1.29.1 CVE-2024-43938 Patchstack
5.9 Medium Bus Ticket Booking with Seat Reservation Plugin bus-ticket-booking-with-seat-reservation Cross-Site Scripting ≤ 5.3.5 Fixed in 5.3.6 CVE-2024-43985 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.6.2 Fixed in 5.6.3 CVE-2024-43977 Patchstack
7.1 High Like Button Rating Plugin likebtn-like-button Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.6.53 Fixed in 2.6.54 CVE-2024-44064 Patchstack
7.6 High Spiffy Calendar Plugin spiffy-calendar SQL Injection ≤ 4.9.12 Fixed in 4.9.13 CVE-2024-43969 Patchstack
9.3 Critical Super Store Finder Plugin superstorefinder-wp SQL Injection No login needed ≤ 6.9.7 Fixed in 6.9.8 CVE-2024-43976 Patchstack
9.3 Critical Super Store Finder Plugin superstorefinder-wp SQL Injection No login needed ≤ 6.9.8 Fixed in 6.9.8 CVE-2024-43978 Patchstack
9.3 Critical WPCargo Track & Trace Plugin wpcargo SQL Injection No login needed < 8.0.4 Fixed in 8.0.4 CVE-2024-44004 Patchstack
6.5 Medium Verbosa Plugin verbosa Cross-Site Scripting ≤ 1.2.3 CVE-2024-44050 Patchstack
6.5 Medium Content Blocks (Custom Post Widget) Plugin custom-post-widget Cross-Site Scripting ≤ 3.3.5 Fixed in 3.3.6 CVE-2024-44051 Patchstack
6.5 Medium Roseta Plugin roseta Cross-Site Scripting ≤ 1.3.0 CVE-2024-45451 Patchstack
6.5 Medium Septera Plugin septera Cross-Site Scripting ≤ 1.5.1 CVE-2024-45452 Patchstack
8.8 High Houzez Theme Privilege Escalation ≤ 3.2.4 Fixed in 3.3.0 CVE-2024-22303 Patchstack
8.8 High Houzez Login Register Plugin houzez-login-register Privilege Escalation ≤ 3.2.5 Fixed in 3.3.0 CVE-2024-21743 Patchstack
7.1 High Opor Ayam Theme opor-ayam Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.8 CVE-2024-44053 Patchstack
6.5 Medium Fluida Theme fluida Cross-Site Scripting ≤ 1.8.8 CVE-2024-44054 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only