Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,324 High 9,486 Medium 18,376 Low 376 Not scored 1

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.

Showing 14,251–14,300 of 17,574 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 286 of 352
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical 1-Click Login: Passwordless Authentication Plugin swoop-password-free-authentication Authentication Bypass Broken Authentication No login needed 1.4.5 CVE-2024-50478 Patchstack
9.8 Critical Meetup Plugin meetup Authentication Bypass Broken Authentication No login needed ≤ 0.1 CVE-2024-50483 Patchstack
8.8 High Token Login Plugin token-login Authentication Bypass Broken Authentication ≤ 1.0.3 CVE-2024-50488 Patchstack
8.8 High Namaste! LMS Plugin namaste-lms PHP Object Injection ≤ 2.6.3 Fixed in 2.6.4 CVE-2024-50408 Patchstack
8.8 High WPC Shop as a Customer for WooCommerce Plugin wpc-shop-as-customer PHP Object Injection ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-50416 Patchstack
7.3 High MDTF Plugin wp-meta-data-filter-and-taxonomy-filter Remote Code Execution Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability No login needed ≤ 1.3.3.4 Fixed in 1.3.3.5 CVE-2024-50450 Patchstack
8.3 High ScottCart Plugin scottcart Remote Code Execution No login needed ≤ 1.1 CVE-2024-50492 Patchstack
10.0 Critical WP Query Console Plugin wp-query-console Remote Code Execution No login needed ≤ 1.0 CVE-2024-50498 Patchstack
9.8 Critical Stacks Mobile App Builder Plugin stacks-mobile-app-builder Privilege Escalation Account Takeover No login needed ≤ 5.2.3 CVE-2024-50477 Patchstack
9.8 Critical Acnoo Flutter API Plugin acnoo-flutter-api Privilege Escalation Account Takeover No login needed ≤ 1.0.5 CVE-2024-50486 Patchstack
9.8 Critical MaanStore API Plugin maanstore-api Privilege Escalation Account Takeover No login needed ≤ 1.0.1 CVE-2024-50487 Patchstack
9.8 Critical Realty Workstation Plugin realty-workstation Privilege Escalation Account Takeover No login needed ≤ 1.0.45 CVE-2024-50489 Patchstack
6.5 Medium Royal Elementor Addons Plugin royal-elementor-addons XML External Entity ≤ 1.3.980 Fixed in 1.3.981 CVE-2024-50442 Patchstack
9.8 Critical Wp Social Login and Register Social Counter Plugin wp-social Authentication Bypass Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 3.0.7 CVE-2024-9501 Wordfence
7.2 High WordPress Post Grid Layouts with Pagination – Sogrid Plugin sogrid Local File Inclusion Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion ≤ 1.5.6 CVE-2024-8392 Wordfence
6.1 Medium FormFacade – WordPress plugin for Google Forms Plugin formfacade Cross-Site Scripting WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting No login needed ≤ 1.3.6 Fixed in 1.3.7 CVE-2024-9613 Wordfence
9.8 Critical Comments – wpDiscuz Plugin wpdiscuz Authentication Bypass wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 7.6.24 CVE-2024-9488 Wordfence
6.5 Medium Mega Elements Plugin mega-elements-addons-for-elementor Cross-Site Scripting Addons for Elementor plugin <= 1.2.6 - Cross Site Scripting (XSS) ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-49693 Patchstack
6.5 Medium WP Flow Plus Plugin wp-imageflow2 Cross-Site Scripting ≤ 5.2.3 Fixed in 5.2.4 CVE-2024-49695 Patchstack
5.9 Medium Robo Gallery Plugin robo-gallery Cross-Site Scripting ≤ 3.2.21 Fixed in 3.2.22 CVE-2024-49696 Patchstack
6.5 Medium myCred Elementor Plugin mycred-for-elementor Cross-Site Scripting ≤ 1.2.6 Fixed in 1.2.7 CVE-2024-49702 Patchstack
6.5 Medium WpEvently Plugin mage-eventpress Cross-Site Scripting ≤ 4.2.5 Fixed in 4.2.6 CVE-2024-49703 Patchstack
9.3 Critical WP Sessions Time Monitoring Full Automatic Plugin activitytime SQL Injection No login needed ≤ 1.0.9 Fixed in 1.1.0 CVE-2024-49681 Patchstack
7.6 High Product Filter by WBW Plugin woo-product-filter SQL Injection ≤ 2.7.0 Fixed in 2.7.1 CVE-2024-49691 Patchstack
5.3 Medium Schema & Structured Data for WP & AMP Plugin schema-and-structured-data-for-wp Information Disclosure Sensitive Data Exposure No login needed ≤ 1.3.5 Fixed in 1.36 CVE-2024-49683 Patchstack
4.7 Medium Simple Membership Plugin simple-membership Open Redirect No login needed ≤ 4.5.3 Fixed in 4.5.4 CVE-2024-49682 Patchstack
6.4 Medium WP Adminify – Best WordPress Custom Dashboard Plugin adminify Cross-Site Scripting Best WordPress Custom Dashboard Plugin <= 4.0.1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 4.0.1.6 CVE-2024-8959 Wordfence
4.3 Medium HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce Plugin hurrytimer Broken Access Control An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication ≤ 2.10.0 Fixed in 2.11.0 CVE-2024-8667 Wordfence
9.9 Critical 3D Work In Progress Plugin renee-work-in-progress Arbitrary File Upload ≤ 1.0.3 CVE-2024-49652 Patchstack
9.9 Critical Portfolleo Plugin portfolleo Arbitrary File Upload ≤ 1.2 CVE-2024-49653 Patchstack
9.9 Critical Woocommerce Custom Profile Picture Plugin woo-custom-profile-picture Arbitrary File Upload ≤ 1.0 CVE-2024-49658 Patchstack
10.0 Critical Verbalize WP Plugin verbalize-wp Arbitrary File Upload No login needed ≤ 1.0 CVE-2024-49668 Patchstack
9.9 Critical INK Official Plugin ink-official Arbitrary File Upload ≤ 4.1.2 CVE-2024-49669 Patchstack
9.9 Critical AI Image Generator for Your Content & Featured Images – AI Postpix Plugin ai-postpix Arbitrary File Upload ≤ 1.1.8 Fixed in 1.1.8.1 CVE-2024-49671 Patchstack
6.6 Medium Custom Icons for Elementor Plugin custom-icons-for-elementor Arbitrary File Upload ≤ 0.3.3 Fixed in 0.3.4 CVE-2024-49676 Patchstack
7.5 High Qi Blocks Plugin qi-blocks Local File Inclusion ≤ 1.3.2 Fixed in 1.3.3 CVE-2024-49690 Patchstack
7.5 High Mags Plugin mags Local File Inclusion No login needed ≤ 1.1.6 Fixed in 1.1.7 CVE-2024-49701 Patchstack
7.2 High Backup and Staging by WP Time Capsule Plugin wp-time-capsule PHP Object Injection ≤ 1.22.21 Fixed in 1.22.22 CVE-2024-49684 Patchstack
7.7 High 3D Work In Progress Plugin renee-work-in-progress Arbitrary File Deletion ≤ 1.0.3 CVE-2024-49657 Patchstack
8.8 High iBryl Switch User Plugin ibryl-switch-user Privilege Escalation Account Takeover ≤ 1.0.1 CVE-2024-49675 Patchstack
5.3 Medium Responsive Lightbox Plugin responsive-lightbox Broken Access Control No login needed ≤ 2.4.7 Fixed in 2.4.8 CVE-2024-43924 Patchstack
8.1 High ProfilePress - Pro Plugin Authentication Bypass Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 4.11.1 CVE-2024-9947 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery No login needed ≤ 5.9.3 Fixed in 5.9.3.1 CVE-2024-49273 Patchstack
4.3 Medium WP VR Plugin wpvr Broken Access Control ≤ 8.5.4 Fixed in 8.5.5 CVE-2024-49293 Patchstack
4.3 Medium Simple Custom Post Order Plugin simple-custom-post-order Broken Access Control ≤ 2.5.7 Fixed in 2.5.8 CVE-2024-49321 Patchstack
6.5 Medium LatePoint Plugin Cross-Site Request Forgery No login needed ≤ 4.9.91 CVE-2024-43945 Patchstack
7.6 High FunnelKit Automations Plugin wp-marketing-automations SQL Injection ≤ 3.1.2 Fixed in 3.2.0 CVE-2024-47328 Patchstack
9.8 Critical LiteSpeed Cache Plugin litespeed-cache Privilege Escalation Unauthenticated Account Takeover via Cookie Leak No login needed ≤ 6.5.0.1 Fixed in 6.5.0.1 CVE-2024-44000 Patchstack
4.3 Medium Photo Gallery Builder Plugin photo-gallery-builder Broken Access Control Broken Access Control to Notice Dismissal ≤ 3.0 CVE-2024-49325 Patchstack
5.4 Medium CartBounty – Save and recover abandoned carts for WooCommerce Plugin woo-save-abandoned-carts Cross-Site Request Forgery No login needed ≤ 8.2 Fixed in 8.2.1 CVE-2024-47634 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only