WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 14,451–14,500 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 290 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Duplicator Plugin duplicator Information Disclosure Full Path Disclosure No login needed ≤ 1.5.9 CVE-2024-6210 Wordfence
5.3 Medium affiliate-toolkit Plugin affiliate-toolkit-starter Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 3.4.4 Fixed in 3.4.5 CVE-2024-37205 Patchstack
5.3 Medium TrustedLogin Vendor Plugin Information Disclosure Sensitive Data Exposure No login needed < 1.1.1 Fixed in 1.1.1 CVE-2024-37270 Patchstack
5.3 Medium Table & Contact Form 7 Database – Tablesome Plugin tablesome Information Disclosure Sensitive Data Exposure via API No login needed ≤ 1.0.33 Fixed in 1.0.34 CVE-2024-37498 Patchstack
5.3 Medium FileBird Document Library Plugin filebird-document-library Information Disclosure Sensitive Data Exposure No login needed ≤ 2.0.6 Fixed in 2.0.8.1 CVE-2024-37504 Patchstack
5.3 Medium SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer Plugin Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 3.10.8 CVE-2024-6556 Wordfence
6.4 Medium MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin mp3-music-player-by-sonaar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode ≤ 5.5 CVE-2024-5664 Wordfence
6.1 Medium Login by Auth0 Plugin auth0 Cross-Site Scripting Reflected Cross-Site Scripting via wle No login needed ≤ 4.6.0 CVE-2023-6813 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference ≤ 5.8.9 CVE-2024-6410 Wordfence
5.3 Medium Gravity Forms: Multiple Form Instances Plugin gravity-forms-multiple-form-instances Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 1.1.1 CVE-2024-6550 Wordfence
4.3 Medium Featured Image Generator Plugin featured-image-generator Broken Access Control Missing Authorization to Authenticated (Subscriber+) Images Upload ≤ 1.3.1 CVE-2024-5677 Wordfence
6.4 Medium UltraAddons for Elementor Plugin ultraaddons-elementor-lite Cross-Site Scripting Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.1.6 CVE-2024-4866 Wordfence
5.4 Medium Ninja Forms Plugin ninja-forms Arbitrary Shortcode Execution Subscriber+ Arbitrary Shortcode Execution ≤ 3.8.4 Fixed in 3.8.5 CVE-2024-37934 Patchstack
6.5 Medium ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Local File Inclusion Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion ≤ 2.1.12 Fixed in 2.1.13 CVE-2024-37520 Patchstack
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Local File Inclusion ≤ 4.4.2 Fixed in 4.4.3 CVE-2024-37499 Patchstack
4.9 Medium Beaver Builder Addons by WPZOOM Plugin wpzoom-addons-for-beaver-builder Local File Inclusion ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-37464 Patchstack
6.4 Medium oik Plugin oik Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode ≤ 4.10.3 CVE-2024-6391 Wordfence
6.4 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.5 CVE-2024-4862 Wordfence
6.4 Medium Squelch Tabs and Accordions Shortcodes Plugin squelch-tabs-and-accordions-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via tab Shortcode ≤ 0.4.8 CVE-2024-5946 Wordfence
6.5 Medium AWSM Team Plugin awsm-team Local File Inclusion Team Showcase Plugin plugin <= 1.3.1 - Local File Inclusion ≤ 1.3.1 Fixed in 1.3.2 CVE-2024-37454 Patchstack
5.5 Medium Elementor Website Builder Plugin elementor Cross-Site Scripting Arbitrary SVG File Download ≤ 3.22.1 Fixed in 3.22.2 CVE-2024-37437 Patchstack
5.3 Medium Patreon Plugin patreon-connect Authentication Bypass Image Protection Bypass No login needed ≤ 1.9.0 Fixed in 1.9.1 CVE-2024-37430 Patchstack
4.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Local File Inclusion ≤ 1.3.0.3 Fixed in 1.3.0.4 CVE-2024-37410 Patchstack
4.9 Medium Tutor LMS Plugin tutor Path Traversal ≤ 2.7.1 Fixed in 2.7.2 CVE-2024-37266 Patchstack
5.4 Medium WooCommerce Social Login Plugin woo-social-login PHP Object Injection No login needed ≤ 2.6.3 Fixed in 2.7.0 CVE-2024-37502 Patchstack
6.4 Medium Genesis Blocks Plugin genesis-blocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Sharing Block Attributes ≤ 3.1.3 CVE-2024-3563 Wordfence
6.4 Medium XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] Plugin faq-for-woocommerce Broken Access Control WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 1.7.0 CVE-2024-5669 Wordfence
6.5 Medium Cliengo - Chatbot Plugin Broken Access Control Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update No login needed ≤ 3.0.2 CVE-2024-5992 Wordfence
5.4 Medium Pricing Table Plugin elfsight-pricing-table Broken Access Control Missing Authorization ≤ 2.0.1 CVE-2024-4102 Wordfence
4.3 Medium Just Custom Fields Plugin just-custom-fields Cross-Site Request Forgery Cross-Site Request Forgery via AJAX actions No login needed ≤ 3.3.2 CVE-2024-6168 Wordfence
6.4 Medium Simple Alert Boxes Plugin simple-alert-boxes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode ≤ 1.4.0 CVE-2024-5937 Wordfence
6.4 Medium Panda Video Plugin pandavideo Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.0 CVE-2024-5457 Wordfence
6.4 Medium OSM – OpenStreetMap Plugin osm Cross-Site Scripting OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 6.0.3 CVE-2024-3603 Wordfence
5.3 Medium Social Sharing Plugin – Kiwi Plugin kiwi-social-share Information Disclosure Kiwi <= 2.1.7 - Information Disclosure No login needed ≤ 2.1.7 CVE-2024-3228 Wordfence
4.3 Medium Comment Images Reloaded Plugin comment-images-reloaded Broken Access Control Authenticated (Subscriber+) Arbitrary Media Deletion ≤ 2.2.1 CVE-2024-5856 Wordfence
5.4 Medium LearnDash LMS - Reports Free Plugin wisdm-reports-for-learndash Broken Access Control Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update ≤ 1.8.2.1 CVE-2024-5648 Wordfence
6.4 Medium Extensions for Elementor Plugin extensions-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via EE Events and EE Flipbox Widget ≤ 2.0.32 CVE-2024-4868 Wordfence
5.3 Medium Pricing Table Plugin elfsight-pricing-table Cross-Site Request Forgery Cross-Site Request Forgery via ajax() No login needed ≤ 2.0.1 CVE-2024-4100 Wordfence
5.4 Medium Happy SCSS Compiler - Compile SCSS to CSS automatically Plugin happy-scss-compiler Broken Access Control Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 1.3.10 CVE-2024-5600 Wordfence
5.3 Medium Product Designer Plugin product-designer Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed ≤ 1.0.33 CVE-2024-3608 Wordfence
5.3 Medium WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 Plugin wp2speed Broken Access Control Optimize PageSpeed Insights Score 90-100 <= 1.0.1 - Improper Authorization due to use of Hardcoded Credentials No login needed ≤ 1.0.1 CVE-2024-5810 Wordfence
4.3 Medium XPlainer – WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] Plugin faq-for-woocommerce Broken Access Control WooCommerce Product FAQ [WooCommerce Accordion FAQ Plugin] <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 1.7.0 CVE-2024-5704 Wordfence
4.3 Medium Just Custom Fields Plugin just-custom-fields Broken Access Control Missing Authorization via AJAX actions ≤ 3.3.2 CVE-2024-6167 Wordfence
5.4 Medium Cliengo - Chatbot Plugin Broken Access Control Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update ≤ 3.0.2 CVE-2024-5993 Wordfence
6.4 Medium Webico Slider Flatsome Addons Plugin webico-slider-flatsome-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wbc_image Shortcode ≤ 2.0.1 CVE-2024-5881 Wordfence
5.4 Medium Cliengo – Chatbot Plugin cliengo Cross-Site Request Forgery Chatbot plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) No login needed ≤ 3.0.4 Fixed in 3.0.5 CVE-2024-37923 Patchstack
6.1 Medium Easy Table of Contents Plugin easy-table-of-contents Cross-Site Scripting Editor+ Stored XSS No login needed < 2.0.67.1 Fixed in 2.0.67.1 CVE-2024-6334 WPScan
6.1 Medium URL Shortener by MyThemeShop Plugin Cross-Site Scripting Admin+ Stored XSS No login needed ≤ 1.0.17 CVE-2024-5802 WPScan
4.3 Medium DN Footer Contacts Plugin Cross-Site Scripting Admin+ Stored XSS < 1.6.3 Fixed in 1.6.3 CVE-2024-3410 WPScan
6.4 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'username' ≤ 1.5.112 CVE-2024-6169 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only