WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 101–150 of 158 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Userpro Plugin userpro Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.1.9 CVE-2024-56210 Patchstack
8.5 High Userpro Plugin userpro SQL Injection ≤ 5.1.9 CVE-2024-56212 Patchstack
8.8 High Userpro Plugin userpro Broken Access Control Authenticated Arbitrary User Meta Update ≤ 5.1.9 CVE-2024-56211 Patchstack
8.3 High Userpro Plugin userpro Local File Inclusion No login needed ≤ 5.1.9 CVE-2024-56214 Patchstack
6.1 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting Reflected Cross-Site Scripting via Navigate Parameter No login needed ≤ 1.3.0.5 CVE-2024-12239 Wordfence
8.8 High Minterpress Plugin minterpress Privilege Escalation Arbitrary Option Update to Privilege Escalation ≤ 1.0.5 CVE-2024-54379 Patchstack
7.1 High CarDealerPress Plugin cardealerpress Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 6.6.2410.02 Fixed in 6.7.2411.00 CVE-2024-54325 Patchstack
4.3 Medium Slider Pro Plugin sliderpro Broken Access Control ≤ 4.8.6 Fixed in 4.8.7 CVE-2023-41865 Patchstack
4.3 Medium PowerPack Elementor Addons (Free Widgets, Extensions and Templates) Plugin powerpack-lite-for-elementor Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 2.8.1 CVE-2024-10692 Wordfence
9.8 Critical UserPlus Plugin userplus Privilege Escalation No login needed ≤ 2.0 CVE-2024-52442 Patchstack
6.5 Medium Memberpress Plugin Broken Access Control No login needed ≤ 1.11.34 Fixed in 1.11.35 CVE-2024-43956 Patchstack
7.1 High WP ERP Plugin erp Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.13.2 Fixed in 1.13.3 CVE-2024-47640 Patchstack
6.4 Medium Powerpress Plugin powerpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode ≤ 11.9.18 CVE-2024-9543 Wordfence
6.3 Medium UserPlus Plugin userplus Broken Access Control Missing Authorization via Multiple Functions ≤ 2.0 CVE-2024-9520 Wordfence
9.8 Critical UserPlus Plugin userplus Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 2.0 CVE-2024-9518 Wordfence
7.2 High UserPlus Plugin userplus Privilege Escalation Authenticated (Editor+) Registration Form Update to Privilege Escalation ≤ 2.0 CVE-2024-9519 Wordfence
6.1 Medium MemberPress Plugin Cross-Site Scripting Reflected Cross-Site Scripting via mepr_screenname and mepr_key Parameters No login needed ≤ 1.11.29 CVE-2024-5024 Wordfence
7.1 High PowerPack for Beaver Builder Plugin bbpowerpack Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed < 2.37.4 Fixed in 2.37.4 CVE-2024-43330 Patchstack
8.8 High PowerPack for Beaver Builder Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.33.0 Fixed in 2.33.1 CVE-2024-39633 Patchstack
8.8 High PowerPack Pro for Elementor Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.10.14 Fixed in 2.10.15 CVE-2024-39634 Patchstack
5.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting ≤ 1.3.0.4 Fixed in 1.3.0.5 CVE-2024-37409 Patchstack
7.1 High Counterpoint Theme counterpoint Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.8.1 CVE-2024-37559 Patchstack
6.4 Medium Cooked Plugin cooked Content Injection Authenticated (Contributor+) HTML Injection via Recipe Excerpt < 1.8.0 CVE-2024-39682 GitHub_M
6.4 Medium PowerPress Podcasting plugin by Blubrry Plugin powerpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via media_url Parameter ≤ 11.9.10 CVE-2024-6588 Wordfence
8.8 High WP ERP Plugin erp SQL Injection Authenticated (Accounting Manager+) SQL Injection via vendor_id ≤ 1.13.0 CVE-2024-6666 Wordfence
4.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Local File Inclusion ≤ 1.3.0.3 Fixed in 1.3.0.4 CVE-2024-37410 Patchstack
6.4 Medium PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Link Effects Widget ≤ 2.7.20 CVE-2024-5787 Wordfence
8.8 High PowerPack Pro for Elementor Plugin Privilege Escalation Authenticated (Contributor+) Privilege Escalation ≤ 2.10.17 CVE-2024-3668 Wordfence
9.8 Critical Userpro Plugin userpro Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 5.1.8 Fixed in 5.1.9 CVE-2024-35700 Patchstack
6.4 Medium PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.7.19 CVE-2024-5327 Wordfence
6.4 Medium MemberPress Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via arglist Parameter ≤ 1.11.29 CVE-2024-5025 Wordfence
8.5 High MemberPress Plugin Server-Side Request Forgery Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode ≤ 1.11.29 CVE-2024-5031 Wordfence
6.1 Medium LetterPress Plugin Cross-Site Request Forgery Subscriber Deletion via CSRF No login needed ≤ 1.2.2 CVE-2024-3590 WPScan
5.9 Medium LetterPress Plugin letterpress Cross-Site Scripting ≤ 1.2.1 CVE-2024-34568 Patchstack
7.2 High WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Plugin erp SQL Injection Authenticated (AccountingManager+) SQL Injection ≤ 1.13.1 CVE-2024-1173 Wordfence
5.3 Medium Easy Custom Auto Excerpt Plugin easy-custom-auto-excerpt Information Disclosure Sensitive Information Exposure No login needed ≤ 2.4.12 CVE-2024-3312 Wordfence
4.3 Medium WP Matterport Shortcode Plugin shortcode-gallery-for-matterport-showcase Cross-Site Request Forgery No login needed ≤ 2.1.9 Fixed in 2.2.0 CVE-2024-32109 Patchstack
6.1 Medium Memberpress Plugin Cross-Site Scripting Reflected Cross-Site Scripting via message and error No login needed ≤ 1.11.26 CVE-2024-1412 Wordfence
7.2 High WP ERP Plugin erp SQL Injection Authenticated (Accounting Manager+) SQL Injection via id ≤ 1.12.9 CVE-2024-0952 Wordfence
6.4 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via element link ≤ 1.3.0 CVE-2024-2289 Wordfence
6.4 Medium PowerPack Addons for Elementor Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget ≤ 2.7.18 CVE-2024-2492 Wordfence
6.4 Medium PowerPack Addons for Elementor Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag* ≤ 2.7.17 CVE-2024-2491 Wordfence
4.9 Medium WP ERP Plugin erp SQL Injection Authenticated (AccountingManager+) SQL Injection ≤ 1.13.0 CVE-2024-0956 Wordfence
7.2 High WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Plugin erp Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.13.1 CVE-2024-0609 Wordfence
6.5 Medium WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Plugin erp SQL Injection Authenticated (Subscriber+) SQL Injection ≤ 1.13.1 CVE-2024-0608 Wordfence
7.2 High WP ERP Plugin erp SQL Injection Authenticated (Accounting Manager+) SQL Injection ≤ 1.13.0 CVE-2024-0913 Wordfence
4.3 Medium Categorify Plugin categorify Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition No login needed ≤ 1.0.7.4 CVE-2024-1912 Wordfence
4.3 Medium Categorify Plugin categorify Broken Access Control Missing Authorization in categorifyAjaxUpdateFolderPosition ≤ 1.0.7.4 CVE-2024-1653 Wordfence
7.1 High PowerPack Pro for Elementor Plugin Cross-Site Request Forgery WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF) No login needed < 2.10.8 Fixed in 2.10.8 CVE-2024-24843 Patchstack
6.4 Medium PowerPack Addons for Elementor Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget ≤ 2.7.15 CVE-2024-1411 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only