WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 14,151–14,200 of 17,733 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 284 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Breakdance Plugin Broken Access Control Missing Authorization ≤ 1.7.1 CVE-2024-5331 Wordfence
6.4 Medium Blog2Social: Social Media Auto Post & Scheduler Plugin blog2social Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via File Upload ≤ 7.5.4 CVE-2024-7302 Wordfence
6.4 Medium Breakdance Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.7.2 CVE-2024-5330 Wordfence
6.5 Medium Light Poll Plugin Cross-Site Request Forgery Polls Deletion via CSRF No login needed ≤ 1.0.0 CVE-2024-6496 WPScan
4.8 Medium My Sticky Bar Plugin mystickymenu Cross-Site Scripting Admin+ Stored XSS < 2.7.2 Fixed in 2.7.2 CVE-2024-4090 WPScan
4.8 Medium Swift Framework Plugin Cross-Site Scripting Contributor+ Stored XSS < 2024.04.30 Fixed in 2024.04.30 CVE-2024-2872 WPScan
6.5 Medium WooCommerce Customers Manager Plugin Cross-Site Request Forgery User Deletion via CSRF No login needed < 30.1 Fixed in 30.1 CVE-2024-2843 WPScan
6.5 Medium WooCommerce Customers Manager Plugin Cross-Site Scripting Subscriber+ Stored XSS < 30.2 Fixed in 30.2 CVE-2024-1747 WPScan
6.4 Medium Remote Content Shortcode Plugin remote-content-shortcode Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery ≤ 1.5 CVE-2024-2090 Wordfence
5.3 Medium CTT Expresso para WooCommerce Plugin ctt-expresso-para-woocommerce Information Disclosure Information Exposure via Unprotected Directory No login needed ≤ 3.2.12 CVE-2024-6687 Wordfence
6.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.97 CVE-2024-6208 Wordfence
6.5 Medium Tainacan Plugin tainacan Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read ≤ 0.21.7 CVE-2024-7135 Wordfence
4.9 Medium Formidable Forms Plugin formidable Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 6.11.1 CVE-2024-6725 Wordfence
5.3 Medium WP Mobile Menu Plugin mobile-menu Broken Access Control Missing Authorization to _mobmenu_icon Post Meta Modification No login needed ≤ 2.8.4.4 CVE-2024-2508 Wordfence
6.5 Medium HTML Forms – Simple WordPress Forms Plugin Cross-Site Request Forgery Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF No login needed < 1.3.34 Fixed in 1.3.34 CVE-2024-6412 WPScan
5.4 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Editor+ Stored XSS < 1.2.57 Fixed in 1.2.57 CVE-2024-6408 WPScan
6.1 Medium SpiderContacts Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.1.7 CVE-2024-6272 WPScan
4.8 Medium WANotifier Plugin notifier Cross-Site Scripting Admin+ Stored XSS < 2.6.1 Fixed in 2.6.1 CVE-2024-6165 WPScan
6.4 Medium SiteOrigin Widgets Bundle Plugin so-widgets-bundle Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget ≤ 1.62.2 CVE-2024-5901 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode ≤ 5.0.2 CVE-2024-7100 Wordfence
5.4 Medium Zephyr Project Manager Plugin zephyr-project-manager Cross-Site Scripting Editor+ XSS < 3.3.99 Fixed in 3.3.99 CVE-2024-6536 WPScan
6.5 Medium Pardakht Delkhah Plugin Cross-Site Request Forgery Form Fields Reset via CSRF No login needed ≤ 2.9.8 CVE-2024-6230 WPScan
6.1 Medium WpStickyBar Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 2.1.0 CVE-2024-6226 WPScan
5.9 Medium Send email only on Reply to My Comment Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 1.0.6 CVE-2024-6224 WPScan
6.1 Medium Send email only on Reply to My Comment Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.0.6 CVE-2024-6223 WPScan
6.8 Medium Donation Block for PayPal Plugin donations-block Cross-Site Scripting Unauthenticated Stored XSS ≤ 2.1.0 CVE-2024-6021 WPScan
6.1 Medium WP Ajax Contact Form Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.2.2 CVE-2024-5809 WPScan
4.3 Medium WP Ajax Contact Form Plugin Cross-Site Request Forgery Arbitrary Email Deletion via CSRF No login needed ≤ 2.2.2 CVE-2024-5808 WPScan
5.9 Medium Responsive Tabs Plugin responsive-tabs Cross-Site Scripting Contributor+ Stored XSS ≤ 4.0.8 CVE-2024-4096 WPScan
4.8 Medium SportsPress Plugin sportspress Cross-Site Scripting Admin+ Stored XSS < 2.7.22 Fixed in 2.7.22 CVE-2024-3986 WPScan
6.8 Medium Web Directory Free Plugin web-directory-free Cross-Site Scripting Reflected XSS < 1.7.2 Fixed in 1.7.2 CVE-2024-3669 WPScan
5.9 Medium FormFlow Plugin formflow-for-gohighlevel Cross-Site Scripting Admin+ Stored XSS < 2.12.2 Fixed in 2.12.2 CVE-2024-3113 WPScan
6.5 Medium Paid Memberships Pro - Member Directory Add On Plugin Information Disclosure Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi < 1.2.6 Fixed in 1.2.6 CVE-2024-1287 WPScan
4.9 Medium Paid Memberships Pro - Membership Maps Add On Plugin Information Disclosure Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure < 0.7 Fixed in 0.7 CVE-2024-1286 WPScan
5.9 Medium Inline Related Posts Plugin intelly-related-posts Cross-Site Scripting Admin+ Stored XSS < 3.8.0 Fixed in 3.8.0 CVE-2024-6487 WPScan
4.6 Medium Ultimate Blocks Plugin ultimate-blocks Cross-Site Scripting Contributor+ Stored XSS < 3.2.0 Fixed in 3.2.0 CVE-2024-6362 WPScan
4.7 Medium Ultimate Classified Listings Plugin ultimate-classified-listings Cross-Site Scripting Reflected XSS No login needed < 1.3 Fixed in 1.3 CVE-2024-5883 WPScan
5.5 Medium WP Affiliate Platform Plugin Cross-Site Request Forgery Affiliate Deletion via CSRF < 6.5.2 Fixed in 6.5.2 CVE-2024-5285 WPScan
5.4 Medium Email Encoder Plugin email-encoder-bundle Cross-Site Scripting Admin+ Stored XSS < 2.2.2 Fixed in 2.2.2 CVE-2024-4483 WPScan
4.9 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields ≤ 5.1.19 CVE-2024-6703 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6518 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6520 Wordfence
6.4 Medium aThemes Starter Sites Plugin athemes-starter-sites Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.53 CVE-2024-6897 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6521 Wordfence
6.4 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via PDF View Widget ≤ 3.11.2 CVE-2024-6627 Wordfence
5.3 Medium Piotnet Addons For Elementor Plugin piotnet-addons-for-elementor Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 2.4.29 CVE-2024-5614 Wordfence
6.4 Medium WooCommerce Product Table Lite Plugin wc-product-table-lite Broken Access Control Missing Authorization to (Subscriber+) Stored Cross-Site Scripting ≤ 3.5.1 CVE-2024-6458 Wordfence
5.3 Medium Campaign Monitor Plugin forms-for-campaign-monitor Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 2.8.15 CVE-2024-6569 Wordfence
5.3 Medium One Click Close Comments Plugin one-click-close-comments Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 2.7.1 CVE-2024-6546 Wordfence
4.4 Medium ParityPress Plugin paritypress Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.0.0 CVE-2024-6661 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only