WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 101–112 of 112 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Orbit Fox by ThemeIsle | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets |
≤ 2.10.34 |
CVE-2024-2484 |
Wordfence | |
| 3.7 Low | Solid Security | Denial of Service IP Spoofing Leading to Denial of Service No login needed |
≤ 9.3.1 Fixed in 9.3.2 |
CVE-2022-44593 |
Patchstack | |
| 6.5 Medium | Scheduling Plugin – Online Booking | Broken Access Control Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection No login needed |
≤ 3.5.10 |
CVE-2024-1634 |
Wordfence | |
| 5.3 Medium | WP Go Maps (formerly WP Google Maps) | Information Disclosure Information Exposure to Potential Denial of Service No login needed |
≤ 9.0.34 |
CVE-2023-6777 |
Wordfence | |
| 6.5 Medium | OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) | Cross-Site Scripting |
≤ 1.1.1 Fixed in 1.1.2 |
CVE-2024-30450 |
Patchstack | |
| 7.1 High | Co-marquage service-public.fr | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.5.72 Fixed in 0.5.73 |
CVE-2024-29758 |
Patchstack | |
| 6.5 Medium | Co-marquage service-public.fr | Cross-Site Scripting |
≤ 0.5.71 Fixed in 0.5.72 |
CVE-2024-29908 |
Patchstack | |
| 6.5 Medium | Code Embed | Denial of Service Denial of Service Attack |
≤ 2.3.6 Fixed in 2.3.7 |
CVE-2023-49837 |
Patchstack | |
| 6.5 Medium | Plugin Groups | Broken Access Control Missing Authorization to Unauthenticated Denial of Service No login needed |
≤ 2.0.6 |
CVE-2024-1108 |
Wordfence | |
| 7.5 High | Backuply - Backup, Restore, Migrate and Clone | Denial of Service Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service No login needed |
≤ 1.2.6 |
CVE-2024-0842 |
Wordfence | |
| 6.5 Medium | Quiz Maker | Denial of Service Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a Denial of Service (DoS) attack against… |
prior to 6.5.0.6 |
CVE-2024-22027 |
jpcert | |
| 6.5 Medium | Essential Real Estate | Denial of Service Subscriber+ Denial of Service via Arbitrary Option Update |
< 4.4.0 Fixed in 4.4.0 |
CVE-2023-6139 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.