Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,324 High 9,486 Medium 18,376 Low 376 Not scored 1

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.

Showing 1,401–1,450 of 1,531 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 29 of 31
Severity Component Vulnerability Affected versions Published CVE Source
9.6 Critical Easy Digital Downloads – Recent Purchases Plugin edd-recent-purchases Local File Inclusion Recent Purchases plugin <= 1.0.2 - Remote File Inclusion No login needed ≤ 1.0.2 CVE-2024-35629 Patchstack
9.1 Critical Dextaz Ping Plugin dextaz-ping Remote Code Execution ≤ 0.65 CVE-2024-34792 Patchstack
9.0 Critical Stockholm Theme Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 9.6 Fixed in 9.7 CVE-2024-34551 Patchstack
9.0 Critical XStore Theme Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 9.3.8 Fixed in 9.3.9 CVE-2024-33560 Patchstack
10.0 Critical Bricks Builder Theme Remote Code Execution Unauthenticated Remote Code Execution (RCE) No login needed ≤ 1.9.6 Fixed in 1.9.6.1 CVE-2024-25600 Patchstack
9.1 Critical Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Arbitrary File Upload Unrestricted Zip Extraction ≤ 1.5.66 Fixed in 1.5.67 CVE-2023-33930 Patchstack
9.1 Critical WP STAGING WordPress Backup Plugin – Migration Backup Restore Plugin wp-staging Arbitrary File Upload Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload ≤ 3.4.3 Fixed in 3.5.0 CVE-2024-3412 Wordfence
9.8 Critical Business Directory Plugin – Easy Listing Directories Plugin business-directory-plugin SQL Injection Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter No login needed ≤ 6.4.2 CVE-2024-4443 Wordfence
10.0 Critical ActiveDEMAND Plugin activedemand Arbitrary File Upload No login needed ≤ 0.2.41 Fixed in 0.2.42 CVE-2024-32809 Patchstack
9.8 Critical Simple Registration for WooCommerce Plugin woocommerce-simple-registration Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.5.6 CVE-2024-32511 Patchstack
9.8 Critical Demo My Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.0.9.1 Fixed in 1.1.0 CVE-2024-31290 Patchstack
9.0 Critical Rehub Theme Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 19.6.1 Fixed in 19.6.2 CVE-2024-31231 Patchstack
9.8 Critical WholesaleX Plugin wholesalex Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2024-30542 Patchstack
9.3 Critical Automatic Plugin Path Traversal Unauthenticated Arbitrary File Download and SSRF No login needed ≤ 3.92.0 Fixed in 3.92.1 CVE-2024-27954 Patchstack
9.8 Critical Masteriyo - LMS Plugin learning-management-system Privilege Escalation No login needed ≤ 1.7.2 Fixed in 1.7.3 CVE-2024-24882 Patchstack
9.8 Critical SalesKing Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.6.15 Fixed in 1.6.30 CVE-2024-22157 Patchstack
9.8 Critical WP Frontend Profile Plugin wp-front-end-profile Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.3.1 Fixed in 1.3.2 CVE-2023-51483 Patchstack
9.8 Critical Local Delivery Drivers for WooCommerce Plugin local-delivery-drivers-for-woocommerce Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 1.9.0 Fixed in 1.9.1 CVE-2023-51481 Patchstack
9.8 Critical WP MLM Unilevel Plugin wp-mlm Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 4.0 CVE-2023-51476 Patchstack
9.8 Critical WebinarIgnition Plugin webinar-ignition Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 3.05.0 Fixed in 3.05.1 CVE-2023-51424 Patchstack
9.8 Critical XStore Core Plugin Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 5.3.8 Fixed in 5.3.9 CVE-2024-33552 Patchstack
9.8 Critical Barcode Scanner with Inventory & Order Manager Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2024-33567 Patchstack
9.9 Critical Customify Site Library Plugin customify-sites Remote Code Execution ≤ 0.0.9 CVE-2024-33644 Patchstack
9.8 Critical HT Mega Plugin ht-mega-for-elementor Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 2.2.0 Fixed in 2.2.1 CVE-2023-37999 Patchstack
9.0 Critical LWS Affiliation Plugin lws-affiliation Local File Inclusion No login needed ≤ 2.2.6 Fixed in 2.3 CVE-2023-32297 Patchstack
9.8 Critical Woodmart Core Plugin Privilege Escalation No login needed ≤ 1.0.36 Fixed in 1.0.37 CVE-2023-32244 Patchstack
9.8 Critical Houzez Theme Privilege Escalation No login needed ≤ 2.7.1 Fixed in 2.7.2 CVE-2023-26540 Patchstack
9.8 Critical Houzez Login Register Plugin Privilege Escalation No login needed ≤ 2.6.3 Fixed in 2.6.4 CVE-2023-26009 Patchstack
9.8 Critical WatchTowerHQ Plugin watchtowerhq Privilege Escalation No login needed ≤ 3.6.16 Fixed in 3.6.17 CVE-2023-25701 Patchstack
9.1 Critical JS Help Desk – Best Help Desk & Support Plugin js-support-ticket Arbitrary File Upload Best Help Desk & Support Plugin plugin <= 2.7.7 - Arbitrary File Upload ≤ 2.7.7 Fixed in 2.7.8 CVE-2023-25444 Patchstack
9.9 Critical MainWP Code Snippets Extension Plugin Remote Code Execution Subscriber+ Arbitrary PHP Code Injection/Execution ≤ 4.0.2 Fixed in 4.0.3 CVE-2023-23645 Patchstack
10.0 Critical Copymatic – AI Content Writer & Generator Plugin copymatic Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.6 Fixed in 1.7 CVE-2024-31351 Patchstack
10.0 Critical WP Photo Album Plus Plugin wp-photo-album-plus Arbitrary File Upload Unauth. Arbitrary File Upload No login needed ≤ 8.7.01.001 Fixed in 8.7.01.002 CVE-2024-31377 Patchstack
9.9 Critical canvasio3D Light Plugin canvasio3d-light Arbitrary File Upload ≤ 2.5.0 CVE-2024-34411 Patchstack
9.1 Critical Pk Favicon Manager Plugin phpsword-favicon-manager Arbitrary File Upload ≤ 2.1 CVE-2024-34416 Patchstack
9.1 Critical AI Engine: ChatGPT Chatbot Plugin ai-engine Arbitrary File Upload Auth. Arbitrary File Upload ≤ 2.2.63 Fixed in 2.2.70 CVE-2024-34440 Patchstack
9.1 Critical Z-Downloads Plugin z-downloads Arbitrary File Upload Auth. Arbitrary File Upload No login needed ≤ 1.11.3 Fixed in 1.11.4 CVE-2024-34555 Patchstack
10.0 Critical Kognetiks Chatbot Plugin chatbot-chatgpt Arbitrary File Upload No login needed ≤ 2.0.0 Fixed in 2.0.1 CVE-2024-32700 Patchstack
9.8 Critical Kognetiks Chatbot Plugin chatbot-chatgpt Arbitrary File Upload Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function No login needed ≤ 1.9.9 CVE-2024-4560 Wordfence
9.8 Critical LearnPress – WordPress LMS Plugin learnpress SQL Injection WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection No login needed ≤ 4.2.6.5 CVE-2024-4434 Wordfence
9.6 Critical Xserver Migrator Plugin xserver-migrator Cross-Site Request Forgery CSRF to Arbitrary File Upload No login needed ≤ 1.6.1 CVE-2024-33913 Patchstack
10.0 Critical OrderConvo Plugin admin-and-client-message-after-order-for-woocommerce Arbitrary File Upload Unauthenticated API Access to Arbitrary File Upload No login needed ≤ 12.4 Fixed in 12.5 CVE-2024-33566 Patchstack
9.0 Critical XStore Core Plugin PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 5.3.5 CVE-2024-33553 Patchstack
9.3 Critical WZone Plugin SQL Injection Unauthenticated SQL Injection No login needed ≤ 14.0.10 CVE-2024-33544 Patchstack
9.6 Critical WZone Plugin SQL Injection Arbitrary SQL Update Execution ≤ 14.0.10 CVE-2024-33546 Patchstack
9.3 Critical XStore Core Plugin SQL Injection Unauthenticated SQL Injection No login needed ≤ 5.3.5 CVE-2024-33551 Patchstack
9.3 Critical XStore Theme SQL Injection Unauthenticated SQL Injection No login needed ≤ 9.3.5 CVE-2024-33559 Patchstack
9.1 Critical Advanced Order Export For WooCommerce Plugin woo-order-export-lite Remote Code Execution ≤ 3.4.4 Fixed in 3.4.5 CVE-2024-31266 Patchstack
9.6 Critical DX-Watermark Plugin dx-watermark Cross-Site Request Forgery CSRF to Arbitrary File Upload and XSS No login needed ≤ 1.0.4 CVE-2024-30560 Patchstack
9.0 Critical Anti-Malware Security and Brute-Force Firewall Plugin gotmls Remote Code Execution Unauthenticated Predictable Nonce Brute-Force Leading to RCE No login needed ≤ 4.21.96 Fixed in 4.23.56 CVE-2024-22144 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only