WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 14,101–14,150 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 283 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium NextGEN Gallery Plugin nextgen-gallery Cross-Site Scripting NextGEN Gallery plugin <= 3.59.3 - Cross Site Scripting (XSS) ≤ 3.59.3 Fixed in 3.59.4 CVE-2024-39627 Patchstack
5.9 Medium Himalayas Theme himalayas Cross-Site Scripting ≤ 1.3.2 CVE-2024-39629 Patchstack
5.8 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.0.1 Fixed in 6.0.0.2 CVE-2024-39643 Patchstack
6.5 Medium Black Widgets For Elementor Plugin black-widgets Cross-Site Scripting ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-39644 Patchstack
5.9 Medium Eventin Plugin wp-event-solution Cross-Site Scripting ≤ 4.0.5 Fixed in 4.0.6 CVE-2024-39648 Patchstack
6.5 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting ≤ 5.9.26 Fixed in 5.9.27 CVE-2024-39649 Patchstack
6.5 Medium LiquidPoll – Advanced Polls for Creators and Brands Plugin wp-poll Cross-Site Scripting Unauthenticated Cross Site Scripting (XSS) No login needed ≤ 3.3.77 Fixed in 3.3.78 CVE-2024-39655 Patchstack
6.5 Medium WP-PostRatings Plugin wp-postratings Cross-Site Scripting ≤ 1.91.1 Fixed in 1.91.2 CVE-2024-39659 Patchstack
5.9 Medium Photo Engine Plugin wplr-sync Cross-Site Scripting ≤ 6.3.1 Fixed in 6.3.2 CVE-2024-39660 Patchstack
6.5 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Authenticated Cross Site Scripting (XSS) ≤ 2.2.4 Fixed in 2.2.5 CVE-2024-39661 Patchstack
6.5 Medium Black Widgets For Elementor Plugin black-widgets Cross-Site Scripting ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-39662 Patchstack
6.5 Medium Filter & Grids Plugin ymc-smart-filter Cross-Site Scripting ≤ 2.9.2 Fixed in 2.9.3 CVE-2024-39665 Patchstack
6.5 Medium Element Pack Elementor Addons Plugin bdthemes-element-pack-lite Cross-Site Scripting ≤ 5.6.11 Fixed in 5.6.12 CVE-2024-39667 Patchstack
6.5 Medium Extensions for Elementor Plugin extensions-for-elementor Cross-Site Scripting ≤ 2.0.31 Fixed in 2.0.32 CVE-2024-39668 Patchstack
5.4 Medium Edubin Plugin edubin Server-Side Request Forgery No login needed ≤ 9.2.0 CVE-2024-39637 Patchstack
4.3 Medium The Pack Elementor addons Plugin the-pack-addon Local File Inclusion ≤ 2.0.8.6 Fixed in 2.0.8.7 CVE-2024-38768 Patchstack
6.5 Medium JetWidgets for Elementor and WooCommerce Plugin jetwoo-widgets-for-elementor Local File Inclusion Contributor+ Limited Local File Inclusion ≤ 1.1.7 Fixed in 1.1.8 CVE-2024-38772 Patchstack
4.9 Medium AI Engine: ChatGPT Chatbot Plugin ai-engine Server-Side Request Forgery ≤ 2.4.7 Fixed in 2.4.8 CVE-2024-38791 Patchstack
5.5 Medium Timetable and Event Schedule Plugin mp-timetable PHP Object Injection ≤ 2.4.13 CVE-2024-39630 Patchstack
6.4 Medium Element Pack - Addon for Elementor Page Builder Plugin Cross-Site Scripting Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL ≤ 7.9.0 CVE-2024-2455 Wordfence
6.4 Medium Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks Plugin post-grid Cross-Site Scripting Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget ≤ 2.2.85 CVE-2024-6346 Wordfence
4.3 Medium Breakdance Plugin Broken Access Control Missing Authorization ≤ 1.7.1 CVE-2024-5331 Wordfence
6.4 Medium Blog2Social: Social Media Auto Post & Scheduler Plugin blog2social Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via File Upload ≤ 7.5.4 CVE-2024-7302 Wordfence
6.4 Medium Breakdance Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.7.2 CVE-2024-5330 Wordfence
6.5 Medium Light Poll Plugin Cross-Site Request Forgery Polls Deletion via CSRF No login needed ≤ 1.0.0 CVE-2024-6496 WPScan
4.8 Medium My Sticky Bar Plugin mystickymenu Cross-Site Scripting Admin+ Stored XSS < 2.7.2 Fixed in 2.7.2 CVE-2024-4090 WPScan
4.8 Medium Swift Framework Plugin Cross-Site Scripting Contributor+ Stored XSS < 2024.04.30 Fixed in 2024.04.30 CVE-2024-2872 WPScan
6.5 Medium WooCommerce Customers Manager Plugin Cross-Site Request Forgery User Deletion via CSRF No login needed < 30.1 Fixed in 30.1 CVE-2024-2843 WPScan
6.5 Medium WooCommerce Customers Manager Plugin Cross-Site Scripting Subscriber+ Stored XSS < 30.2 Fixed in 30.2 CVE-2024-1747 WPScan
6.4 Medium Remote Content Shortcode Plugin remote-content-shortcode Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery ≤ 1.5 CVE-2024-2090 Wordfence
5.3 Medium CTT Expresso para WooCommerce Plugin ctt-expresso-para-woocommerce Information Disclosure Information Exposure via Unprotected Directory No login needed ≤ 3.2.12 CVE-2024-6687 Wordfence
6.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.97 CVE-2024-6208 Wordfence
6.5 Medium Tainacan Plugin tainacan Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read ≤ 0.21.7 CVE-2024-7135 Wordfence
4.9 Medium Formidable Forms Plugin formidable Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 6.11.1 CVE-2024-6725 Wordfence
5.3 Medium WP Mobile Menu Plugin mobile-menu Broken Access Control Missing Authorization to _mobmenu_icon Post Meta Modification No login needed ≤ 2.8.4.4 CVE-2024-2508 Wordfence
6.5 Medium HTML Forms – Simple WordPress Forms Plugin Cross-Site Request Forgery Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF No login needed < 1.3.34 Fixed in 1.3.34 CVE-2024-6412 WPScan
5.4 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Editor+ Stored XSS < 1.2.57 Fixed in 1.2.57 CVE-2024-6408 WPScan
6.1 Medium SpiderContacts Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.1.7 CVE-2024-6272 WPScan
4.8 Medium WANotifier Plugin notifier Cross-Site Scripting Admin+ Stored XSS < 2.6.1 Fixed in 2.6.1 CVE-2024-6165 WPScan
6.4 Medium SiteOrigin Widgets Bundle Plugin so-widgets-bundle Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget ≤ 1.62.2 CVE-2024-5901 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode ≤ 5.0.2 CVE-2024-7100 Wordfence
5.4 Medium Zephyr Project Manager Plugin zephyr-project-manager Cross-Site Scripting Editor+ XSS < 3.3.99 Fixed in 3.3.99 CVE-2024-6536 WPScan
6.5 Medium Pardakht Delkhah Plugin Cross-Site Request Forgery Form Fields Reset via CSRF No login needed ≤ 2.9.8 CVE-2024-6230 WPScan
6.1 Medium WpStickyBar Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 2.1.0 CVE-2024-6226 WPScan
5.9 Medium Send email only on Reply to My Comment Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 1.0.6 CVE-2024-6224 WPScan
6.1 Medium Send email only on Reply to My Comment Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.0.6 CVE-2024-6223 WPScan
6.8 Medium Donation Block for PayPal Plugin donations-block Cross-Site Scripting Unauthenticated Stored XSS ≤ 2.1.0 CVE-2024-6021 WPScan
6.1 Medium WP Ajax Contact Form Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.2.2 CVE-2024-5809 WPScan
4.3 Medium WP Ajax Contact Form Plugin Cross-Site Request Forgery Arbitrary Email Deletion via CSRF No login needed ≤ 2.2.2 CVE-2024-5808 WPScan
5.9 Medium Responsive Tabs Plugin responsive-tabs Cross-Site Scripting Contributor+ Stored XSS ≤ 4.0.8 CVE-2024-4096 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only