WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 14,151–14,200 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 284 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Zephyr Project Manager Plugin zephyr-project-manager Broken Access Control Insecure Direct Object References (IDOR) ≤ 3.3.102 Fixed in 3.3.103 CVE-2024-43916 Patchstack
5.3 Medium myCred Plugin mycred Information Disclosure Sensitive Data Exposure No login needed ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-43214 Patchstack
5.3 Medium Shared Files Plugin shared-files Arbitrary File Upload Premium Download Manager & Secure File Sharing with Frontend File Upload plugin <= 1.7.28 - Sensitive Data Exposure No login needed ≤ 1.7.28 Fixed in 1.7.29 CVE-2024-43230 Patchstack
6.5 Medium Bit Form Pro Plugin Information Disclosure Authenticated Sensitive Data Exposure ≤ 2.6.4 CVE-2024-43251 Patchstack
6.5 Medium Leopard - WordPress offload media Plugin Information Disclosure Subscriber+ Sensitive Data Exposure ≤ 2.0.36 CVE-2024-43257 Patchstack
5.3 Medium Store Locator Plus Plugin store-locator-le Information Disclosure Sensitive Data Exposure No login needed ≤ 2311.17.01 CVE-2024-43258 Patchstack
5.3 Medium Order Export for WooCommerce Plugin order-export-and-more-for-woocommerce Information Disclosure Sensitive Data Exposure No login needed ≤ 3.23 Fixed in 3.24 CVE-2024-43259 Patchstack
5.3 Medium Create by Mediavine Plugin mediavine-create Information Disclosure Sensitive Data Exposure No login needed ≤ 1.9.8 Fixed in 1.9.9 CVE-2024-43264 Patchstack
5.3 Medium Contest Gallery Plugin contest-gallery Information Disclosure Unauthenticated Comment UserID And IP address Disclosure No login needed ≤ 23.1.2 Fixed in 23.1.3 CVE-2024-43283 Patchstack
7.5 High wpForo Forum Plugin wpforo Information Disclosure Unauthenticated Sensitive Data Exposure No login needed ≤ 2.3.4 Fixed in 2.3.5 CVE-2024-43289 Patchstack
4.3 Medium Flash & HTML5 Video Plugin html5-video-player Information Disclosure Sensitive Data Exposure ≤ 2.5.31 Fixed in 2.5.32 CVE-2024-43319 Patchstack
5.9 Medium WP Testimonial Widget Plugin wp-testimonial-widget Cross-Site Scripting ≤ 3.1 CVE-2024-43967 Patchstack
7.6 High WP Testimonial Widget Plugin wp-testimonial-widget SQL Injection ≤ 3.1 CVE-2024-43966 Patchstack
5.3 Medium WordPress Button Plugin MaxButtons Plugin maxbuttons Information Disclosure Full Path Disclosure No login needed ≤ 9.7.8 CVE-2024-6499 Wordfence
5.3 Medium WP SMS Plugin wp-sms Broken Access Control No login needed ≤ 6.9.3 Fixed in 6.9.4 CVE-2024-43331 Patchstack
9.8 Critical LiteSpeed Cache Plugin litespeed-cache Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 6.3.0.1 Fixed in 6.4 CVE-2024-28000 Patchstack
9.8 Critical myCred Plugin mycred PHP Object Injection No login needed ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-43354 Patchstack
7.5 High Landing Page Builder Plugin page-builder-add Local File Inclusion ≤ 1.5.2.0 Fixed in 1.5.2.1 CVE-2024-43345 Patchstack
8.3 High EmbedPress Plugin embedpress Local File Inclusion No login needed ≤ 4.0.9 Fixed in 4.0.10 CVE-2024-43328 Patchstack
5.4 Medium Plugin Notes Plus Plugin plugin-notes-plus Broken Access Control Arbitrary Content Deletion ≤ 1.2.7 Fixed in 1.2.8 CVE-2024-43326 Patchstack
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.1.0 Fixed in 6.0.1.1 CVE-2024-43317 Patchstack
9.8 Critical Login As Users Plugin login-as-users Authentication Bypass Broken Authentication No login needed ≤ 1.4.2 Fixed in 1.4.3 CVE-2024-43311 Patchstack
5.3 Medium Void Elementor Post Grid Addon for Elementor Page builder Plugin void-elementor-post-grid-addon-for-elementor-page-builder Local File Inclusion ≤ 2.3 Fixed in 2.4 CVE-2024-43281 Patchstack
4.7 Medium Salon booking system Plugin salon-booking-system Open Redirect No login needed ≤ 10.8.1 Fixed in 10.9 CVE-2024-43280 Patchstack
5.3 Medium Icegram Plugin icegram Authentication Bypass Unauthenticated Unpublished Campaign Viewer No login needed ≤ 3.1.24 Fixed in 3.1.25 CVE-2024-43272 Patchstack
8.5 High Woo Products Widgets For Elementor Plugin woo-products-widgets-for-elementor Local File Inclusion ≤ 2.0.0 CVE-2024-43271 Patchstack
9.6 Critical Compute Links Plugin compute-links Local File Inclusion Remote File Inclusion No login needed ≤ 1.2.1 CVE-2024-43261 Patchstack
7.1 High Leopard - WordPress offload media Plugin Broken Access Control Subscriber+ Plugin Settings Change ≤ 2.0.36 CVE-2024-43256 Patchstack
9.0 Critical Crew HRM Plugin hr-management PHP Object Injection No login needed ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-43252 Patchstack
7.1 High Bit Form Pro Plugin Broken Access Control Authenticated Plugin Settings Change ≤ 2.6.4 CVE-2024-43250 Patchstack
9.9 Critical Bit Form Pro Plugin Arbitrary File Upload Authenticated Arbitrary File Upload ≤ 2.6.4 CVE-2024-43249 Patchstack
8.6 High Bit Form Pro Plugin Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 2.6.4 CVE-2024-43248 Patchstack
8.8 High WHMpress Plugin Broken Access Control Subscriber+ Arbitrary Settings Change ≤ 6.2-revision-5 CVE-2024-43247 Patchstack
9.8 Critical JobSearch Plugin Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 2.3.4 CVE-2024-43245 Patchstack
9.0 Critical Ultimate Membership Pro Plugin indeed-membership-pro PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 12.7 Fixed in 12.8 CVE-2024-43242 Patchstack
9.4 Critical Ultimate Membership Pro Plugin indeed-membership-pro Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 12.7 Fixed in 12.8 CVE-2024-43240 Patchstack
4.7 Medium Easy PayPal Buy Now Button Plugin wp-ecommerce-paypal Open Redirect No login needed ≤ 1.9 Fixed in 1.9.1 CVE-2024-43236 Patchstack
8.5 High Timeline and History slider Plugin timeline-and-history-slider Local File Inclusion ≤ 2.3 Fixed in 2.4 CVE-2024-43232 Patchstack
8.5 High JetGridBuilder Plugin jetgridbuilder Local File Inclusion ≤ 1.1.2 Fixed in 1.1.3 CVE-2024-43221 Patchstack
10.0 Critical GiveWP Plugin give PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 3.14.1 Fixed in 3.14.2 CVE-2024-37099 Patchstack
9.8 Critical GEO my Plugin Remote Code Execution Unauthenticated RCE via LFI No login needed < 4.5.0.2 Fixed in 4.5.0.2 CVE-2024-6330 WPScan
5.3 Medium Sensei LMS Plugin sensei-lms Broken Access Control No login needed ≤ 4.23.1, ≤ 4.23.1.1.23.1 Fixed in 4.24.0 CVE-2024-35686 Patchstack
8.5 High GeoDirectory Plugin geodirectory SQL Injection ≤ 2.3.61 Fixed in 2.3.62 CVE-2024-43145 Patchstack
8.5 High Unite Gallery Lite Plugin unite-gallery-lite SQL Injection ≤ 1.7.62 CVE-2024-43207 Patchstack
7.6 High Tutor LMS Plugin tutor SQL Injection ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-43282 Patchstack
8.5 High SEO Plugin by Squirrly SEO Plugin squirrly-seo SQL Injection ≤ 12.3.19 Fixed in 12.3.20 CVE-2024-43286 Patchstack
4.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control Insecure Direct Object Reference (IDOR) ≤ 1.11.4 Fixed in 1.11.5 CVE-2024-43239 Patchstack
5.4 Medium WP Job Portal Plugin wp-job-portal Broken Access Control Insecure Direct Object References (IDOR) ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-43266 Patchstack
4.3 Medium wpForo Forum Plugin wpforo Broken Access Control Insecure Direct Object References (IDOR) ≤ 2.3.4 Fixed in 2.3.5 CVE-2024-43288 Patchstack
7.5 High Stripe Payments For WooCommerce by Checkout Plugin checkout-plugins-stripe-woo Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2024-43315 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only