WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 15,101–15,150 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 303 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes ≤ 2.4.43 CVE-2024-1161 Wordfence
6.5 Medium BuddyForms Plugin buddyforms Other Email Verification Bypass due to Insufficient Randomness No login needed ≤ 2.8.9 CVE-2024-5149 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Information Disclosure WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API No login needed ≤ 4.2.6.8 CVE-2024-5483 Wordfence
6.4 Medium Newsletter Plugin newsletter Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via np1 ≤ 8.3.4 CVE-2024-5317 Wordfence
5.3 Medium Move Addons for Elementor Plugin move-addons Broken Access Control No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-30525 Patchstack
5.4 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control ≤ 4.9.10 Fixed in 4.9.11 CVE-2024-30528 Patchstack
4.3 Medium RT Easy Builder – Advanced addons for Elementor Plugin rt-easy-builder-advanced-addons-for-elementor Broken Access Control ≤ 2.0 Fixed in 2.1 CVE-2024-30484 Patchstack
5.3 Medium Integrate Google Drive Plugin integrate-google-drive Broken Access Control No login needed ≤ 1.3.93 Fixed in 1.3.94 CVE-2024-35670 Patchstack
6.5 Medium Picture Gallery Plugin picture-gallery Cross-Site Scripting ≤ 1.5.11 Fixed in 1.5.12 CVE-2024-34759 Patchstack
6.5 Medium Save as PDF plugin by Pdfcrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting ≤ 3.2.3 Fixed in 3.3.0 CVE-2024-35649 Patchstack
6.5 Medium WP Flow Plus Plugin wp-imageflow2 Cross-Site Scripting ≤ 5.2.2 Fixed in 5.2.3 CVE-2024-35651 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.8.0 Fixed in 45.9.0 CVE-2024-35653 Patchstack
6.5 Medium Responsive Theme responsive Cross-Site Scripting ≤ 5.0.3 Fixed in 5.0.3.1 CVE-2024-35654 Patchstack
5.9 Medium Brave Plugin brave-popup-builder Cross-Site Scripting Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) ≤ 0.6.9 Fixed in 0.7.0 CVE-2024-35655 Patchstack
6.5 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting ≤ 2.1.2 CVE-2024-35666 Patchstack
6.5 Medium Cowidgets – Elementor Addons Plugin cowidgets-elementor-addons Cross-Site Scripting Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) ≤ 1.1.1 CVE-2024-35782 Patchstack
4.9 Medium Woocommerce – Recent Purchases Plugin woo-recent-purchases Local File Inclusion Recent Purchases plugin <= 1.0.1 - File Inclusion ≤ 1.0.1 CVE-2024-35634 Patchstack
6.5 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Local File Inclusion ≤ 3.5.1 Fixed in 3.5.2 CVE-2024-34384 Patchstack
6.5 Medium Better Elementor Addons Plugin better-elementor-addons Local File Inclusion ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-33541 Patchstack
5.3 Medium Malware Scanner Plugin miniorange-malware-protection Authentication Bypass IP Restriction Bypass No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2023-52176 Patchstack
5.3 Medium Rate my Post – WP Rating System Plugin rate-my-post Broken Access Control WP Rating System plugin <= 3.4.2 - Broken Access Control No login needed ≤ 3.4.2 Fixed in 3.4.3 CVE-2023-51667 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Form Submission Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51544 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass IP Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51543 Patchstack
5.3 Medium Branda Plugin branda-white-labeling Authentication Bypass IP Restriction Bypass No login needed ≤ 3.4.14 Fixed in 3.4.15 CVE-2023-51542 Patchstack
6.5 Medium Booster Elite for WooCommerce Plugin Authentication Bypass Authenticated Production Creation/Modification < 7.1.3 Fixed in 7.1.3 CVE-2023-51511 Patchstack
6.5 Medium Responsive Slick Slider Plugin responsive-slick-slider Content Injection No login needed ≤ 1.4 CVE-2023-49852 Patchstack
5.3 Medium WP Photo Album Plus Plugin wp-photo-album-plus Information Disclosure IP Bypass No login needed ≤ 8.5.02.005 Fixed in 8.6.01.005 CVE-2023-49774 Patchstack
5.3 Medium Restricted Site Access Plugin restricted-site-access Authentication Bypass IP Restriction Bypass No login needed ≤ 7.4.1 Fixed in 7.5.0 CVE-2023-48753 Patchstack
6.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Authentication Bypass Authenticated Production Creation/Modification ≤ 7.1.2 Fixed in 7.1.3 CVE-2023-48747 Patchstack
5.3 Medium Captcha Code Plugin captcha-code-authentication Authentication Bypass Captcha Bypass No login needed ≤ 2.9 Fixed in 3.0 CVE-2023-48745 Patchstack
5.3 Medium Contact Form Email Plugin contact-form-to-email Authentication Bypass Captcha Bypass No login needed ≤ 1.3.41 Fixed in 1.3.42 CVE-2023-48318 Patchstack
5.3 Medium Form Maker by 10Web Plugin form-maker Authentication Bypass Captcha Bypass Vulnerability No login needed ≤ 1.15.20 Fixed in 1.15.21 CVE-2023-48290 Patchstack
5.3 Medium Stripe Payments Plugin stripe-payments Content Injection No login needed ≤ 2.0.79 Fixed in 2.0.80 CVE-2023-48285 Patchstack
5.3 Medium WP Forms Puzzle Captcha Plugin wp-forms-puzzle-captcha Authentication Bypass Captcha Bypass No login needed ≤ 4.1 CVE-2023-48276 Patchstack
5.3 Medium Maspik – Spam blacklist Plugin contact-forms-anti-spam Authentication Bypass Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass No login needed ≤ 0.10.3 Fixed in 0.10.4 CVE-2023-48271 Patchstack
5.4 Medium ARI Stream Quiz Plugin ari-stream-quiz Content Injection WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection ≤ 1.3.2 Fixed in 1.3.3 CVE-2023-47513 Patchstack
6.4 Medium Slider Revolution Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex ≤ 6.7.10 CVE-2024-4637 Wordfence
5.3 Medium Defender Security Plugin defender-security Authentication Bypass Masked Login Area View Bypass No login needed ≤ 4.2.0 Fixed in 4.2.1 CVE-2023-47189 Patchstack
5.3 Medium wpDiscuz Plugin wpdiscuz Content Injection No login needed ≤ 7.6.10 Fixed in 7.6.11 CVE-2023-46310 Patchstack
5.4 Medium Responsive Tabs Plugin responsive-tabs Content Injection HTML Content Injection < 4.0.6 Fixed in 4.0.6 CVE-2023-45635 Patchstack
4.3 Medium WP Content Pilot – Autoblogging & Affiliate Marketing Plugin wp-content-pilot Content Injection HTML Injection ≤ 1.3.3 Fixed in 1.3.4 CVE-2023-45053 Patchstack
5.3 Medium Captcha/Honeypot for Contact Form 7 Plugin captcha-for-contact-form-7 Other Capcha Bypass No login needed ≤ 1.11.3 Fixed in 1.11.4 CVE-2023-45009 Patchstack
6.4 Medium Slider Revolution Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes ≤ 6.7.10 CVE-2024-4581 Wordfence
5.3 Medium WP Captcha Plugin wp-captcha Authentication Bypass Captcha Bypass No login needed ≤ 2.0.0 CVE-2023-44235 Patchstack
5.3 Medium Antispam Bee Plugin antispam-bee Authentication Bypass Country IP Restriction Bypass No login needed ≤ 2.11.3 Fixed in 2.11.4 CVE-2023-41134 Patchstack
6.5 Medium Cartpauj Register Captcha Plugin cartpauj-register-captcha Authentication Bypass Captcha Bypass No login needed ≤ 1.0.02 Fixed in 2.0.0 CVE-2023-40673 Patchstack
5.4 Medium Tabs & Accordion Plugin tabs Content Injection ≤ 1.3.10 CVE-2023-40557 Patchstack
5.3 Medium WP-PostRatings Plugin wp-postratings Other Rating limit Bypass No login needed ≤ 1.91 Fixed in 1.91.1 CVE-2023-40332 Patchstack
5.4 Medium Discussion Board Plugin wp-discussion-board Content Injection ≤ 2.4.8 Fixed in 2.4.9 CVE-2023-39161 Patchstack
6.5 Medium Pinpoint Booking System Plugin booking-system Other Parameter Tampering No login needed ≤ 2.9.9.3.4 Fixed in 2.9.9.3.5 CVE-2023-38520 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only