WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 14,751–14,800 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 296 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	Simple Org Chart Plugin `simple-org-chart`	Broken Access Control No login needed	`≤ 2.3.4`	Jun 12, 2024	`CVE-2023-40603`	Patchstack
5.3 Medium	Pricing Deals for WooCommerce Plugin `pricing-deals-for-woocommerce`	Broken Access Control No login needed	`≤ 2.0.3.2`	Jun 12, 2024	`CVE-2023-41240`	Patchstack
4.3 Medium	WP GPX Map Plugin `wp-gpx-maps`	Broken Access Control	`≤ 1.7.08`	Jun 12, 2024	`CVE-2023-44234`	Patchstack
4.3 Medium	Buy Me a Coffee Plugin `buymeacoffee`	Broken Access Control No login needed	`≤ 3.7` Fixed in `3.8`	Jun 12, 2024	`CVE-2023-25030`	Patchstack
5.4 Medium	WP Clone Menu Plugin `clone-menu`	Broken Access Control	`≤ 1.0.1`	Jun 12, 2024	`CVE-2023-38395`	Patchstack
5.4 Medium	Sticky Social Media Icons Plugin `sticky-social-media-icons`	Broken Access Control	`≤ 2.1`	Jun 12, 2024	`CVE-2023-40672`	Patchstack
4.3 Medium	Grab & Save Plugin `save-grab`	Cross-Site Request Forgery No login needed	`≤ 1.0.4`	Jun 12, 2024	`CVE-2023-47845`	Patchstack
7.5 High	Consensu.io Plugin `consensu-io`	Broken Access Control No login needed	`≤ 1.0.1`	Jun 12, 2024	`CVE-2023-48280`	Patchstack
5.3 Medium	Piotnet Forms Plugin `piotnetforms`	Broken Access Control No login needed	`≤ 1.0.29` Fixed in `1.0.30`	Jun 12, 2024	`CVE-2023-51413`	Patchstack
4.3 Medium	wpMandrill Plugin `wpmandrill`	Broken Access Control	`≤ 1.33`	Jun 12, 2024	`CVE-2023-47828`	Patchstack
4.3 Medium	weForms Plugin `weforms`	Broken Access Control	`≤ 1.6.18` Fixed in `1.6.19`	Jun 12, 2024	`CVE-2023-51524`	Patchstack
4.3 Medium	Simple Staff List Plugin `simple-staff-list`	Broken Access Control	`≤ 2.2.4` Fixed in `2.2.5`	Jun 12, 2024	`CVE-2023-51526`	Patchstack
5.3 Medium	Awesome Support Plugin `awesome-support`	Broken Access Control No login needed	`≤ 6.1.5` Fixed in `6.1.6`	Jun 12, 2024	`CVE-2023-51537`	Patchstack
4.3 Medium	FunnelKit Checkout Plugin	Broken Access Control Authenticated Arbitrary Plugin Activation	`≤ 3.10.3` Fixed in `3.11.0`	Jun 12, 2024	`CVE-2023-51670`	Patchstack
5.4 Medium	FunnelKit Checkout Plugin	Broken Access Control Authenticated Plugin Settings Change	`≤ 3.10.3` Fixed in `3.11.0`	Jun 12, 2024	`CVE-2023-51671`	Patchstack
5.4 Medium	BulkGate SMS Plugin for WooCommerce Plugin `woosms-sms-module-for-woocommerce`	Broken Access Control	`≤ 3.0.2` Fixed in `3.0.3`	Jun 12, 2024	`CVE-2023-51679`	Patchstack
4.3 Medium	Quotes for WooCommerce Plugin `quotes-for-woocommerce`	Broken Access Control	`≤ 2.0.1` Fixed in `2.0.2`	Jun 12, 2024	`CVE-2023-51680`	Patchstack
4.3 Medium	ProfileGrid Plugin `profilegrid-user-profiles-groups-and-communities`	Broken Access Control	`≤ 5.6.6` Fixed in `5.6.7`	Jun 12, 2024	`CVE-2023-52117`	Patchstack
5.4 Medium	Integrate Google Drive Plugin `integrate-google-drive`	Broken Access Control	`≤ 1.3.3` Fixed in `1.3.4`	Jun 12, 2024	`CVE-2023-52177`	Patchstack
6.5 Medium	WordPress Header Builder Plugin – Pearl Plugin `pearl-header-builder`	Broken Access Control Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion No login needed	`≤ 1.3.7`	Jun 12, 2024	`CVE-2024-5468`	Wordfence
4.3 Medium	ACF Photo Gallery Field Plugin `navz-photo-gallery`	Broken Access Control	`≤ 2.6` Fixed in `2.7`	Jun 11, 2024	`CVE-2024-23518`	Patchstack
4.3 Medium	Podlove Podcast Publisher Plugin `podlove-podcasting-plugin-for-wordpress`	Broken Access Control	`≤ 4.1.0` Fixed in `4.1.1`	Jun 11, 2024	`CVE-2024-32143`	Patchstack
4.3 Medium	Aspose.Words Exporter Plugin `aspose-doc-exporter`	Broken Access Control Import and Export word documents plugin <= 6.3.1 - Broken Access Control	`≤ 6.3.1`	Jun 11, 2024	`CVE-2024-32146`	Patchstack
5.3 Medium	Builder for WooCommerce reviews shortcodes – ReviewShort Plugin `woo-product-reviews-shortcode`	Broken Access Control ReviewShort plugin <= 1.01.5 - Broken Access Control No login needed	`≤ 1.01.5` Fixed in `1.01.6`	Jun 11, 2024	`CVE-2024-34763`	Patchstack
5.3 Medium	Fastly Plugin `fastly`	Broken Access Control No login needed	`≤ 1.2.25` Fixed in `1.2.26`	Jun 11, 2024	`CVE-2024-34768`	Patchstack
6.5 Medium	BookingPress Plugin `bookingpress-appointment-booking`	Broken Access Control Appointment Duration Manipulation No login needed	`≤ 1.0.82` Fixed in `1.0.83`	Jun 11, 2024	`CVE-2024-34799`	Patchstack
5.3 Medium	Preloader for Website Plugin `preloader-for-website`	Broken Access Control Unauthenticated Broken Access Control No login needed	`≤ 1.2.2` Fixed in `1.3`	Jun 11, 2024	`CVE-2023-48273`	Patchstack
4.3 Medium	MailerLite – WooCommerce integration Plugin `woo-mailerlite`	Broken Access Control WooCommerce integration plugin <= 2.0.8 - Broken Access Control	`≤ 2.0.8` Fixed in `2.0.9`	Jun 11, 2024	`CVE-2023-52227`	Patchstack
5.4 Medium	Tagembed Plugin `tagembed-widget`	Broken Access Control	`≤ 5.8` Fixed in `5.9`	Jun 11, 2024	`CVE-2024-34804`	Patchstack
5.4 Medium	Import and export users and customers Plugin `import-users-from-csv-with-meta`	Broken Access Control	`≤ 1.26.5` Fixed in `1.26.6`	Jun 11, 2024	`CVE-2024-34815`	Patchstack
4.3 Medium	Revolut Gateway for WooCommerce Plugin `revolut-gateway-for-woocommerce`	Broken Access Control	`≤ 4.9.7` Fixed in `4.9.8`	Jun 11, 2024	`CVE-2023-52224`	Patchstack
5.3 Medium	WP Fundraising Donation and Crowdfunding Platform Plugin `wp-fundraising-donation`	Broken Access Control Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control No login needed	`≤ 1.6.4` Fixed in `1.7.0`	Jun 11, 2024	`CVE-2024-34758`	Patchstack
5.3 Medium	MC Woocommerce Wishlist Plugin `smart-wishlist-for-more-convert`	Broken Access Control No login needed	`≤ 1.7.2` Fixed in `1.7.3`	Jun 11, 2024	`CVE-2024-34819`	Patchstack
4.3 Medium	Ninja Tables Plugin `ninja-tables`	Broken Access Control	`≤ 5.0.6` Fixed in `5.0.7`	Jun 11, 2024	`CVE-2024-23503`	Patchstack
8.6 High	Post SMTP Mailer/Email Log Plugin `post-smtp`	Broken Access Control Broken Access Control on API No login needed	`≤ 2.8.6` Fixed in `2.8.7`	Jun 11, 2024	`CVE-2023-52233`	Patchstack
5.3 Medium	Contact List Plugin `contact-list`	Broken Access Control No login needed	`≤ 2.9.87` Fixed in `2.9.88`	Jun 11, 2024	`CVE-2024-34821`	Patchstack
5.3 Medium	Radio Player Plugin `radio-player`	Broken Access Control No login needed	`≤ 2.0.73` Fixed in `2.0.74`	Jun 11, 2024	`CVE-2024-34753`	Patchstack
4.3 Medium	Slider by Soliloquy Plugin `soliloquy-lite`	Broken Access Control Responsive Image Slider for WordPress plugin <= 2.7.2 - Broken Access Control	`≤ 2.7.2` Fixed in `2.7.3`	Jun 11, 2024	`CVE-2023-51519`	Patchstack
5.4 Medium	Welcart e-Commerce Plugin `usc-e-shop`	Broken Access Control	`≤ 2.9.14` Fixed in `2.10.0`	Jun 11, 2024	`CVE-2024-32144`	Patchstack
5.3 Medium	Happyforms Plugin `happyforms`	Broken Access Control No login needed	`≤ 1.25.10` Fixed in `1.25.11`	Jun 11, 2024	`CVE-2024-23521`	Patchstack
5.3 Medium	MC4WP Plugin `mailchimp-for-wp`	Broken Access Control No login needed	`≤ 4.9.9` Fixed in `4.9.10`	Jun 11, 2024	`CVE-2023-51682`	Patchstack
5.3 Medium	weMail Plugin `wemail`	Broken Access Control No login needed	`≤ 1.14.2` Fixed in `1.14.3`	Jun 11, 2024	`CVE-2024-34822`	Patchstack
6.3 Medium	CF7 WOW Styler Plugin `cf7-styler`	Broken Access Control	`≤ 1.6.4` Fixed in `1.6.5`	Jun 11, 2024	`CVE-2024-34826`	Patchstack
6.5 Medium	If-So Dynamic Content Personalization Plugin `if-so`	Broken Access Control No login needed	`≤ 1.7.1` Fixed in `1.7.1.1`	Jun 11, 2024	`CVE-2024-34820`	Patchstack
8.6 High	WC Marketplace Plugin `dc-woocommerce-multi-vendor`	Broken Access Control No login needed	`≤ 4.0.25` Fixed in `4.0.26`	Jun 11, 2024	`CVE-2024-24703`	Patchstack
4.3 Medium	Pardot Plugin `pardot`	Broken Access Control	`≤ 2.1.0` Fixed in `2.1.1`	Jun 11, 2024	`CVE-2024-32148`	Patchstack
4.3 Medium	WP Discourse Plugin `wp-discourse`	Broken Access Control	`≤ 2.5.1` Fixed in `2.5.2`	Jun 11, 2024	`CVE-2024-35168`	Patchstack
5.3 Medium	WooCommerce Canada Post Shipping Plugin	Broken Access Control No login needed	`≤ 2.8.3` Fixed in `2.8.4`	Jun 11, 2024	`CVE-2023-51498`	Patchstack
4.3 Medium	Photo Gallery by 10Web Plugin `photo-gallery`	Broken Access Control	`≤ 1.8.25` Fixed in `1.8.26`	Jun 11, 2024	`CVE-2024-35628`	Patchstack
5.4 Medium	WP Translate Plugin `wp-translate`	Broken Access Control	`≤ 5.3.0`	Jun 11, 2024	`CVE-2024-35663`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.