WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 101–128 of 128 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Rate My Post – Star Rating Plugin by FeedbackWP Plugin rate-my-post Broken Access Control Star Rating Plugin by FeedbackWP <= 4.2.4 - Unauthenticated Voting On Scheduled Posts No login needed ≤ 4.2.4 CVE-2024-12309 Wordfence
5.4 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 4.5.1 CVE-2024-9872 Wordfence
6.4 Medium Contact Form Builder Plugin contact-form-with-a-meeting-scheduler-by-vcita Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode ≤ 4.10.4 CVE-2024-10056 Wordfence
4.3 Medium PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Plugin revisionary Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure ≤ 3.5.15 CVE-2024-11154 Wordfence
7.3 High Timetable and Event Schedule by MotoPress Plugin mp-timetable Broken Access Control Missing Authorization No login needed ≤ 2.3.8 CVE-2020-36840 Wordfence
6.1 Medium PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Plugin revisionary Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.5.14 CVE-2024-9436 Wordfence
7.1 High Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.4.6 Fixed in 4.5 CVE-2024-47638 Patchstack
6.1 Medium Store Hours for WooCommerce Plugin order-hours-scheduler-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 4.3.20 CVE-2024-8872 Wordfence
5.5 Medium Timetable and Event Schedule Plugin mp-timetable PHP Object Injection ≤ 2.4.13 CVE-2024-39630 Patchstack
6.4 Medium Blog2Social: Social Media Auto Post & Scheduler Plugin blog2social Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via File Upload ≤ 7.5.4 CVE-2024-7302 Wordfence
7.1 High Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.4.2 Fixed in 4.4.3 CVE-2024-37262 Patchstack
5.3 Medium SchedulePress Plugin wp-scheduled-posts Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 5.1.3 CVE-2024-6557 Wordfence
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Local File Inclusion ≤ 4.4.2 Fixed in 4.4.3 CVE-2024-37499 Patchstack
7.2 High Appointment Booking and Online Scheduling Plugin meeting-scheduler-by-vcita Broken Access Control Missing Authorization to Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.4.2 CVE-2024-5791 Wordfence
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting ≤ 4.4.0 Fixed in 4.4.1 CVE-2024-35761 Patchstack
9.9 Critical Blog2Social: Social Media Auto Post & Scheduler Plugin blog2social SQL Injection Authenticated (Subscriber+) SQL Injection ≤ 7.4.1 CVE-2024-3549 Wordfence
6.4 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.7.14 CVE-2024-4288 Wordfence
5.4 Medium WPCal.io – Easy Meeting Scheduler Plugin wpcal Cross-Site Request Forgery No login needed ≤ 0.9.5.8 Fixed in 0.9.5.9 CVE-2024-34816 Patchstack
6.5 Medium SchedulePress Plugin wp-scheduled-posts Broken Access Control ≤ 5.0.8 Fixed in 5.0.9 CVE-2024-32717 Patchstack
9.9 Critical Timetable and Event Schedule by MotoPress Plugin mp-timetable SQL Injection Authenticated (Contributor+) SQL Injection ≤ 2.4.11 CVE-2024-3342 Wordfence
5.3 Medium Blog2Social: Social Media Auto Post & Scheduler Plugin blog2social Information Disclosure Information Exposure No login needed ≤ 7.4.2 CVE-2024-3678 Wordfence
4.3 Medium WPCal.io – Easy Meeting Scheduler Plugin wpcal Cross-Site Request Forgery No login needed ≤ 0.9.5.8 Fixed in 0.9.5.9 CVE-2024-32795 Patchstack
6.5 Medium Yoga Schedule Momoyoga Plugin momoyoga-integration Cross-Site Scripting ≤ 2.7.0 CVE-2024-32529 Patchstack
8.8 High Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection Authenticated (Subscriber+) SQL Injection ≤ 1.6.7.7 CVE-2024-2341 Wordfence
8.8 High Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 1.6.7.7 CVE-2024-2342 Wordfence
7.1 High Weekly Class Schedule Plugin weekly-class-schedule Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.19 CVE-2024-31084 Patchstack
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.6.20 Fixed in 1.6.6.24 CVE-2024-22311 Patchstack
4.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Data Reset No login needed ≤ 1.6.6.20 CVE-2024-1760 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only