WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 15,001–15,050 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 301 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium Stellissimo Text Box Plugin stellissimo-text-box Cross-Site Scripting ≤ 1.1.4 CVE-2024-35752 Patchstack
6.5 Medium TemplatesNext OnePager Plugin templatesnext-onepager Cross-Site Scripting ≤ 1.3.3 CVE-2024-35753 Patchstack
6.5 Medium Weather Widget Pro Plugin weather-in-any-city-widget Cross-Site Scripting ≤ 1.1.40 CVE-2024-35755 Patchstack
5.9 Medium Tooltip CK Plugin tooltip-ck Cross-Site Scripting ≤ 2.2.15 CVE-2024-35756 Patchstack
9.9 Critical Quiz And Survey Master – Best Quiz, Exam and Survey Plugin quiz-master-next SQL Injection Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection ≤ 9.0.1 CVE-2024-3592 Wordfence
6.4 Medium TablePress – Tables in WordPress made easy Plugin tablepress Server-Side Request Forgery Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind ≤ 2.3.1 CVE-2024-4354 Wordfence
6.5 Medium Music Store - WordPress eCommerce Plugin music-store SQL Injection WordPress eCommerce versions prior to 1.1.14 allows a remote authenticated attacker with an administrative privilege to execute arbitr… prior to 1.1.14 CVE-2024-36082 jpcert
6.4 Medium WordPress prettyPhoto Plugin prettyphoto Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter ≤ 1.2.3 CVE-2024-5162 Wordfence
4.3 Medium WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing Plugin wp-dark-mode Broken Access Control WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization ≤ 5.0.4 CVE-2024-5449 Wordfence
4.3 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Broken Access Control ≤ 1.5.109 Fixed in 1.5.110 CVE-2024-35674 Patchstack
4.3 Medium Pure Chat Plugin pure-chat Cross-Site Request Forgery No login needed ≤ 2.22 Fixed in 2.3 CVE-2024-35673 Patchstack
8.8 High LifterLMS – WordPress LMS Plugin for eLearning Plugin SQL Injection WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode ≤ 7.6.2 CVE-2024-4743 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Information Disclosure WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API No login needed ≤ 4.2.6.8 CVE-2024-5483 Wordfence
5.3 Medium Move Addons for Elementor Plugin move-addons Broken Access Control No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-30525 Patchstack
5.4 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control ≤ 4.9.10 Fixed in 4.9.11 CVE-2024-30528 Patchstack
4.3 Medium RT Easy Builder – Advanced addons for Elementor Plugin rt-easy-builder-advanced-addons-for-elementor Broken Access Control ≤ 2.0 Fixed in 2.1 CVE-2024-30484 Patchstack
5.3 Medium Integrate Google Drive Plugin integrate-google-drive Broken Access Control No login needed ≤ 1.3.93 Fixed in 1.3.94 CVE-2024-35670 Patchstack
6.5 Medium Picture Gallery Plugin picture-gallery Cross-Site Scripting ≤ 1.5.11 Fixed in 1.5.12 CVE-2024-34759 Patchstack
7.5 High Netgsm Plugin netgsm Broken Access Control No login needed ≤ 2.9.19 Fixed in 2.9.20 CVE-2024-35672 Patchstack
7.5 High Easy Forms for Mailchimp Plugin yikes-inc-easy-mailchimp-extender Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 6.9.0 CVE-2024-25095 Patchstack
3.5 Low Insert or Embed Articulate Content into Plugin Other Iframe Injection ≤ 4.3000000023 CVE-2024-0756 WPScan
6.5 Medium Save as PDF plugin by Pdfcrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting ≤ 3.2.3 Fixed in 3.3.0 CVE-2024-35649 Patchstack
6.5 Medium WP Flow Plus Plugin wp-imageflow2 Cross-Site Scripting ≤ 5.2.2 Fixed in 5.2.3 CVE-2024-35651 Patchstack
7.1 High Event Tickets with Ticket Scanner Plugin event-tickets-with-ticket-scanner Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2024-35652 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.8.0 Fixed in 45.9.0 CVE-2024-35653 Patchstack
6.5 Medium Responsive Theme responsive Cross-Site Scripting ≤ 5.0.3 Fixed in 5.0.3.1 CVE-2024-35654 Patchstack
5.9 Medium Brave Plugin brave-popup-builder Cross-Site Scripting Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) ≤ 0.6.9 Fixed in 0.7.0 CVE-2024-35655 Patchstack
7.1 High WPvivid Backup for MainWP Plugin wpvivid-backup-mainwp Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.9.32 Fixed in 0.9.33 CVE-2024-35664 Patchstack
6.5 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting ≤ 2.1.2 CVE-2024-35666 Patchstack
7.1 High Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin mailin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.1.77 Fixed in 3.1.78 CVE-2024-35668 Patchstack
6.5 Medium Cowidgets – Elementor Addons Plugin cowidgets-elementor-addons Cross-Site Scripting Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) ≤ 1.1.1 CVE-2024-35782 Patchstack
9.8 Critical Userpro Plugin userpro Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 5.1.8 Fixed in 5.1.9 CVE-2024-35700 Patchstack
9.6 Critical Easy Digital Downloads – Recent Purchases Plugin edd-recent-purchases Local File Inclusion Recent Purchases plugin <= 1.0.2 - Remote File Inclusion No login needed ≤ 1.0.2 CVE-2024-35629 Patchstack
9.1 Critical Dextaz Ping Plugin dextaz-ping Remote Code Execution ≤ 0.65 CVE-2024-34792 Patchstack
8.5 High Stockholm Core Plugin Local File Inclusion ≤ 2.4.1 Fixed in 2.4.2 CVE-2024-34554 Patchstack
8.5 High Stockholm Theme Local File Inclusion ≤ 9.6 Fixed in 9.7 CVE-2024-34552 Patchstack
9.0 Critical Stockholm Theme Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 9.6 Fixed in 9.7 CVE-2024-34551 Patchstack
6.5 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Local File Inclusion ≤ 3.5.1 Fixed in 3.5.2 CVE-2024-34384 Patchstack
8.8 High XforWooCommerce Plugin Local File Inclusion Authenticated Local File Inclusion ≤ 2.0.2 CVE-2024-33628 Patchstack
8.5 High Element Pack Pro Plugin Path Traversal Arbitrary File Read and Phar Deserialization < 7.19.3 Fixed in 7.19.3 CVE-2024-33568 Patchstack
9.0 Critical XStore Theme Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 9.3.8 Fixed in 9.3.9 CVE-2024-33560 Patchstack
8.5 High XStore Core Plugin Local File Inclusion ≤ 5.3.8 Fixed in 5.3.9 CVE-2024-33557 Patchstack
6.5 Medium Better Elementor Addons Plugin better-elementor-addons Local File Inclusion ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-33541 Patchstack
10.0 Critical Bricks Builder Theme Remote Code Execution Unauthenticated Remote Code Execution (RCE) No login needed ≤ 1.9.6 Fixed in 1.9.6.1 CVE-2024-25600 Patchstack
5.3 Medium Malware Scanner Plugin miniorange-malware-protection Authentication Bypass IP Restriction Bypass No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2023-52176 Patchstack
3.7 Low All In One WP Security & Firewall Plugin all-in-one-wp-security-and-firewall Information Disclosure Secret Login Page Location Disclosure on Multisites No login needed ≤ 5.2.4 Fixed in 5.2.5 CVE-2023-52147 Patchstack
5.3 Medium Rate my Post – WP Rating System Plugin rate-my-post Broken Access Control WP Rating System plugin <= 3.4.2 - Broken Access Control No login needed ≤ 3.4.2 Fixed in 3.4.3 CVE-2023-51667 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Form Submission Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51544 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass IP Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51543 Patchstack
5.3 Medium Branda Plugin branda-white-labeling Authentication Bypass IP Restriction Bypass No login needed ≤ 3.4.14 Fixed in 3.4.15 CVE-2023-51542 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only