WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 101–150 of 181 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license) ≤ 1.3.3 CVE-2024-13370 Wordfence
4.3 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update ≤ 1.3.4 CVE-2024-13368 Wordfence
4.3 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs Plugin youzify Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion ≤ 1.3.2 CVE-2024-12113 Wordfence
5.3 Medium Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member Information Disclosure User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.9.1 - Information Exposure No login needed ≤ 2.9.1 CVE-2025-0318 Wordfence
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Information Disclosure Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 2.13.4 CVE-2024-11291 Wordfence
6.5 Medium YourMembership Single Sign On Plugin login-with-yourmembership Broken Access Control No login needed ≤ 1.1.3 Fixed in 1.1.4 CVE-2023-37987 Patchstack
5.3 Medium Restrict – membership, site, content and user access restrictions Plugin restricted-content Information Disclosure membership, site, content and user access restrictions for WordPress <= 2.2.8 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 2.2.8 CVE-2024-11351 Wordfence
5.3 Medium Members Plugin members Information Disclosure Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 3.2.10 CVE-2024-11008 Wordfence
6.3 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Arbitrary Shortcode Execution Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 4.0.51 CVE-2024-10681 Wordfence
4.3 Medium WP User Manager – User Profile Builder & Membership Plugin wp-user-manager Broken Access Control User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Authenticated (Subscriber+) User Meta Key Enumeration ≤ 2.9.11 CVE-2024-10537 Wordfence
4.3 Medium WP User Manager – User Profile Builder & Membership Plugin wp-user-manager Broken Access Control User Profile Builder & Membership <= 2.9.11 - Missing Authorization to Carbon Fields Custom Sidebar Addition/Removal ≤ 2.9.11 CVE-2024-10216 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Information Disclosure Exposure of Private Personal Information to an Unauthorized Actor No login needed ≤ 4.5.5 CVE-2024-11088 Wordfence
6.1 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App Plugin peepso-core Cross-Site Scripting Social Network, Membership, Registration, User Profiles, Premium – Mobile App <=7.0.3.0 - Reflected Cross-Site Scripting No login needed ≤ 7.0.3.0 CVE-2024-11447 Wordfence
5.4 Medium ARMember Plugin armember-membership Cross-Site Request Forgery No login needed ≤ 4.0.5, < 6.7.1 Fixed in 4.0.6 CVE-2022-47424 Patchstack
6.4 Medium WP-Members Plugin wp-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_loginout Shortcode ≤ 3.4.9.5 CVE-2024-10374 Wordfence
4.7 Medium Simple Membership Plugin simple-membership Open Redirect No login needed ≤ 4.5.3 Fixed in 4.5.4 CVE-2024-49682 Patchstack
6.1 Medium WP-Members Membership Plugin wp-members Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.4.9.5 CVE-2024-9231 Wordfence
6.3 Medium Indeed Membership Pro Plugin Broken Access Control Missing Authorization Checks 7.3 – 8.6 CVE-2020-36833 Wordfence
4.7 Medium Simple Membership After Login Redirection Plugin simple-membership-after-login-redirection Open Redirect No login needed ≤ 1.6 Fixed in 1.7 CVE-2024-47354 Patchstack
4.3 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion ≤ 1.3.0 CVE-2024-9067 Wordfence
6.4 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Cross-Site Scripting BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode ≤ 1.3.0 CVE-2024-8987 Wordfence
6.4 Medium Memberful – Membership Plugin memberful-wp Cross-Site Scripting Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting ≤ 1.73.7 CVE-2024-9242 Wordfence
5.3 Medium Ultimate Member Plugin ultimate-member Cross-Site Request Forgery Cross-Site Request Forgery to Membership Status Change No login needed ≤ 2.8.6 CVE-2024-8520 Wordfence
6.1 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Cross-Site Scripting Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting No login needed ≤ 2.12.8 CVE-2024-9222 Wordfence
5.3 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles Plugin peepso-core Information Disclosure Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path Disclosure No login needed ≤ 6.4.6.0 CVE-2024-7426 Wordfence
4.4 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles Plugin peepso-core Cross-Site Scripting Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter ≤ 6.4.5.0 CVE-2024-7618 Wordfence
4.4 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles Plugin peepso-core Cross-Site Scripting Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 6.4.5.0 CVE-2024-7655 Wordfence
4.3 Medium WP User Manager Plugin wp-user-manager Cross-Site Request Forgery User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) No login needed ≤ 2.9.10 Fixed in 2.9.11 CVE-2024-43336 Patchstack
6.4 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Scripting Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload ≤ 4.0.37 CVE-2024-7703 Wordfence
6.1 Medium Opal Membership Plugin opal-membership Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.2.4 CVE-2024-7649 Wordfence
4.3 Medium Opal Membership Plugin opal-membership Information Disclosure Authenticated (Subscriber+) Information Disclosure ≤ 1.2.4 CVE-2024-7648 Wordfence
6.5 Medium Paid Memberships Pro - Member Directory Add On Plugin Information Disclosure Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi < 1.2.6 Fixed in 1.2.6 CVE-2024-1287 WPScan
4.9 Medium Paid Memberships Pro - Membership Maps Add On Plugin Information Disclosure Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure < 0.7 Fixed in 0.7 CVE-2024-1286 WPScan
6.5 Medium Team Members Plugin team-members Cross-Site Scripting ≤ 5.3.3 Fixed in 5.3.4 CVE-2024-38670 Patchstack
6.4 Medium WPZOOM Addons for Elementor (Templates, Widgets) Plugin wpzoom-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 1.1.38 CVE-2024-5686 Wordfence
6.5 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify SQL Injection BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection ≤ 1.2.5 CVE-2024-4742 Wordfence
5.4 Medium Paid Memberships Pro Plugin Broken Access Control ≤ 1.2.3 Fixed in 1.2.4 CVE-2023-39990 Patchstack
5.4 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery Cross-Site Request Forgery to Membership Modification No login needed ≤ 2.12.10 CVE-2024-1407 Wordfence
5.3 Medium BuddyPress Members Only Plugin buddypress-members-only Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed ≤ 3.4.8 CVE-2024-0972 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode ≤ 7.1.5 CVE-2024-4553 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Other Group Members Limit Bypass ≤ 5.8.2 Fixed in 5.8.3 CVE-2024-32774 Patchstack
6.4 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.5 CVE-2024-4383 Wordfence
4.3 Medium ProfileGrid – User Profiles, Memberships, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization ≤ 5.8.3 CVE-2024-3606 Wordfence
5.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 3.0.1 CVE-2024-3215 Wordfence
6.1 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin Open Redirect Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect No login needed ≤ 4.0.30 CVE-2024-4133 Wordfence
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.15.4 CVE-2024-2867 Wordfence
5.3 Medium WP-Members Membership Plugin Information Disclosure Unprotected Storage of Potentially Sensitive Files No login needed ≤ 3.4.9.3 CVE-2024-2920 Wordfence
5.4 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.3 CVE-2024-3730 Wordfence
4.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Request Forgery No login needed ≤ 2.11.0 Fixed in 2.11.1 CVE-2024-32728 Patchstack
5.4 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 2.12.10 Fixed in 3.0 CVE-2024-32793 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only