WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 14,351–14,400 of 17,704 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Cooked | Content Injection Authenticated (Contributor+) HTML Injection via Recipe Excerpt |
< 1.8.0 |
CVE-2024-39682 |
GitHub_M | |
| 5.4 Medium | Cooked | Cross-Site Request Forgery Cross-Site Request Forgery to Apply Template to All Recipes No login needed |
< 1.8.0 |
CVE-2024-39681 |
GitHub_M | |
| 5.4 Medium | Cooked | Cross-Site Request Forgery Cross-Site Request Forgery to Default Recipe Template Save No login needed |
< 1.8.0 |
CVE-2024-39680 |
GitHub_M | |
| 4.3 Medium | Cooked | Cross-Site Request Forgery Cross-Site Request Forgery to Recipe Template Reset No login needed |
< 1.8.0 |
CVE-2024-39679 |
GitHub_M | |
| 4.3 Medium | Cooked | Cross-Site Request Forgery Cross-Site Request Forgery to Get Recipe IDs No login needed |
< 1.8.0 |
CVE-2024-39678 |
GitHub_M | |
| 6.4 Medium | Schema & Structured Data for WP & AMP | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute |
≤ 1.33 |
CVE-2024-5582 |
Wordfence | |
| 4.3 Medium | Icegram Express - Email Subscribers, Newsletters and Marketing Automation | Broken Access Control Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization |
≤ 5.7.26 |
CVE-2024-5703 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5251 |
Wordfence | |
| 5.5 Medium | AI ChatBot for WordPress – WPBot | Cross-Site Scripting WPBot <= 5.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting |
≤ 5.5.7 |
CVE-2024-6669 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5253 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5252 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5255 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for WPBakery Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.19.20 |
CVE-2024-5254 |
Wordfence | |
| 4.3 Medium | Event Manager, Events Calendar, Tickets, Registrations – Eventin | Broken Access Control Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import |
≤ 4.0.4 |
CVE-2024-6033 |
Wordfence | |
| 4.3 Medium | WP RSS Aggregator | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Feed State Update |
≤ 4.23.11 |
CVE-2024-6621 |
Wordfence | |
| 4.3 Medium | Web and WooCommerce Addons for WPBakery Builder | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification |
≤ 1.4.5 |
CVE-2024-6579 |
Wordfence | |
| 5.3 Medium | AForms | Information Disclosure Unauthenticated Full Path Disclosure No login needed |
≤ 2.2.6 |
CVE-2024-6565 |
Wordfence | |
| 6.4 Medium | Premium Portfolio Features for Phlox | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios' |
≤ 2.3.2 |
CVE-2024-3587 |
Wordfence | |
| 5.3 Medium | Glossary | Information Disclosure Unauthenticated Full Path Disclosure No login needed |
≤ 2.2.26 |
CVE-2024-6570 |
Wordfence | |
| 4.3 Medium | WordPress File Upload | Arbitrary File Upload Authenticated (Contributor+) Directory Traversal |
≤ 4.24.7 |
CVE-2024-5852 |
Wordfence | |
| 6.4 Medium | WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce | Cross-Site Scripting Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode |
≤ 3.1.43 |
CVE-2024-2691 |
Wordfence | |
| 6.4 Medium | Image Hover Effects – Elementor Addon | Cross-Site Scripting Elementor Addon <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via eihe_link Parameter |
≤ 1.4.3 |
CVE-2024-4780 |
Wordfence | |
| 5.3 Medium | XCloner | Information Disclosure Unauthenticated Full Path Disclosure No login needed |
≤ 4.7.3 |
CVE-2024-6559 |
Wordfence | |
| 5.3 Medium | SchedulePress | Information Disclosure Unauthenticated Full Path Disclosure No login needed |
≤ 5.1.3 |
CVE-2024-6557 |
Wordfence | |
| 6.1 Medium | WPS Hide Login | Information Disclosure Hidden Login Page Disclosure No login needed |
< 1.9.16.4 Fixed in 1.9.16.4 |
CVE-2024-6289 |
WPScan | |
| 6.1 Medium | WP eStore | Cross-Site Scripting Reflected XSS in Category Editing No login needed |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6076 |
WPScan | |
| 5.4 Medium | WP eStore | Cross-Site Scripting Reflected XSS in Customer Editing |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6074 |
WPScan | |
| 4.7 Medium | WP eStore | Cross-Site Scripting Reflected XSS in Discount Editing No login needed |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6073 |
WPScan | |
| 6.1 Medium | WP eStore | Cross-Site Scripting Reflected XSS via $_SERVER['REQUEST_URI'] No login needed |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6072 |
WPScan | |
| 4.3 Medium | WP Links Page | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Image Update |
≤ 4.9.5 |
CVE-2024-6465 |
Wordfence | |
| 4.8 Medium | if-so | Cross-Site Scripting Admin+ Stored XSS |
< 1.8.0.4 Fixed in 1.8.0.4 |
CVE-2024-6070 |
WPScan | |
| 6.8 Medium | WP eMember | Cross-Site Scripting Reflected XSS |
< 10.6.7 Fixed in 10.6.7 |
CVE-2024-5744 |
WPScan | |
| 5.4 Medium | if-so | Cross-Site Scripting Reflected XSS |
< 1.8.0.4 Fixed in 1.8.0.4 |
CVE-2024-5713 |
WPScan | |
| 5.4 Medium | WordPress Plugin Tournamatch | Cross-Site Scripting Admin+ Stored XSS via Ladders |
< 4.6.1 Fixed in 4.6.1 |
CVE-2024-5644 |
WPScan | |
| 5.4 Medium | WordPress Plugin Tournamatch | Cross-Site Scripting Subscriber+ Stored XSS |
< 4.6.1 Fixed in 4.6.1 |
CVE-2024-5627 |
WPScan | |
| 4.7 Medium | Ditty | Cross-Site Scripting Author+ Stored XSS No login needed |
< 3.1.43 Fixed in 3.1.43 |
CVE-2024-5575 |
WPScan | |
| 5.9 Medium | NextGEN Gallery | Cross-Site Scripting Admin+ Stored XSS |
< 3.59.3 Fixed in 3.59.3 |
CVE-2024-5442 |
WPScan | |
| 4.8 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Banner Editing |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5286 |
WPScan | |
| 6.8 Medium | WP Affiliate Platform | Cross-Site Scripting Stored XSS via CSRF |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5284 |
WPScan | |
| 6.1 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Lead Editing No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5283 |
WPScan | |
| 6.1 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Registration Form No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5282 |
WPScan | |
| 6.1 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Affiliate Editing No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5281 |
WPScan | |
| 4.7 Medium | WP Affiliate Platform | Cross-Site Scripting POST Reflected XSS No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5280 |
WPScan | |
| 6.1 Medium | WP eMember | Cross-Site Scripting Unauthenticated Stored XSS via Member Registration No login needed |
< 10.6.7 Fixed in 10.6.7 |
CVE-2024-5079 |
WPScan | |
| 6.8 Medium | WP eMember | Cross-Site Scripting Stored XSS in Blacklist via CSRF |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5077 |
WPScan | |
| 5.9 Medium | WP eMember | Cross-Site Scripting Reflected XSS |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5075 |
WPScan | |
| 5.4 Medium | WP eMember | Cross-Site Scripting Reflected XSS |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5074 |
WPScan | |
| 5.9 Medium | SULly | Cross-Site Scripting Admin+ Stored XSS via CSRF |
< 4.3.1 Fixed in 4.3.1 |
CVE-2024-5033 |
WPScan | |
| 4.7 Medium | SULly | Cross-Site Scripting Reflected XSS No login needed |
< 4.3.1 Fixed in 4.3.1 |
CVE-2024-5032 |
WPScan | |
| 6.5 Medium | CM WordPress Search And Replace | Cross-Site Request Forgery Plugin Reset via CSRF |
< 1.3.9 Fixed in 1.3.9 |
CVE-2024-5028 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.