WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 15,301–15,350 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 307 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium Sticky banner Plugin sticky-banner Cross-Site Scripting ≤ 1.2.0 Fixed in 1.3.0 CVE-2024-35170 Patchstack
7.1 High Propovoice CRM Plugin propovoice Cross-Site Scripting No login needed ≤ 1.7.6.2 CVE-2024-4747 Patchstack
5.3 Medium Easy Digital Downloads Plugin easy-digital-downloads Information Disclosure Sensitive Data Exposure No login needed ≤ 3.2.11 Fixed in 3.2.12 CVE-2024-32100 Patchstack
5.3 Medium ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-34812 Patchstack
5.3 Medium Gutenify Plugin gutenify Information Disclosure Sensitive Data Exposure via API No login needed ≤ 1.4.0 Fixed in 1.4.1 CVE-2024-35165 Patchstack
5.3 Medium Filebird Plugin filebird Information Disclosure WordPress Media Library Folders & File Manager plugin <= 5.6.3 - Sensitive Data Exposure No login needed ≤ 5.6.3 Fixed in 5.6.4 CVE-2024-35166 Patchstack
5.3 Medium Academy LMS Plugin academy Information Disclosure Sensitive Data Exposure No login needed ≤ 1.9.25 Fixed in 1.9.26 CVE-2024-35171 Patchstack
10.0 Critical WP Photo Album Plus Plugin wp-photo-album-plus Arbitrary File Upload Unauth. Arbitrary File Upload No login needed ≤ 8.7.01.001 Fixed in 8.7.01.002 CVE-2024-31377 Patchstack
9.9 Critical canvasio3D Light Plugin canvasio3d-light Arbitrary File Upload ≤ 2.5.0 CVE-2024-34411 Patchstack
9.1 Critical Pk Favicon Manager Plugin phpsword-favicon-manager Arbitrary File Upload ≤ 2.1 CVE-2024-34416 Patchstack
9.1 Critical AI Engine: ChatGPT Chatbot Plugin ai-engine Arbitrary File Upload Auth. Arbitrary File Upload ≤ 2.2.63 Fixed in 2.2.70 CVE-2024-34440 Patchstack
9.1 Critical Z-Downloads Plugin z-downloads Arbitrary File Upload Auth. Arbitrary File Upload No login needed ≤ 1.11.3 Fixed in 1.11.4 CVE-2024-34555 Patchstack
4.4 Medium ShortPixel Adaptive Images Plugin shortpixel-adaptive-images Server-Side Request Forgery ≤ 3.8.3 Fixed in 3.8.4 CVE-2024-35172 Patchstack
5.9 Medium WP SMS Plugin wp-sms Cross-Site Scripting ≤ 6.5.1 Fixed in 6.5.2 CVE-2024-34811 Patchstack
10.0 Critical Kognetiks Chatbot Plugin chatbot-chatgpt Arbitrary File Upload No login needed ≤ 2.0.0 Fixed in 2.0.1 CVE-2024-32700 Patchstack
9.8 Critical Kognetiks Chatbot Plugin chatbot-chatgpt Arbitrary File Upload Unauthenticated Arbitrary File Upload via chatbot_chatgpt_upload_file_to_assistant Function No login needed ≤ 1.9.9 CVE-2024-4560 Wordfence
6.4 Medium Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.1 CVE-2024-4630 Wordfence
4.4 Medium Falang multilanguage Plugin falang Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.3.49 CVE-2024-4417 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin learnpress Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter ≤ 4.2.6.5 CVE-2024-4277 Wordfence
6.5 Medium AppPresser Plugin apppresser Broken Access Control No login needed ≤ 4.3.0 Fixed in 4.3.1 CVE-2024-32776 Patchstack
7.1 High WebinarPress Plugin wp-webinarsystem Cross-Site Request Forgery No login needed ≤ 1.33.17 CVE-2024-34818 Patchstack
5.4 Medium Unyson Plugin unyson Cross-Site Request Forgery No login needed ≤ 2.7.29 Fixed in 2.7.31 CVE-2024-34814 Patchstack
5.4 Medium WPCal.io – Easy Meeting Scheduler Plugin wpcal Cross-Site Request Forgery No login needed ≤ 0.9.5.8 Fixed in 0.9.5.9 CVE-2024-34816 Patchstack
4.3 Medium Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin integration-for-contact-form-7-and-pipedrive Cross-Site Request Forgery No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2024-34817 Patchstack
4.3 Medium Easy Digital Downloads Plugin easy-digital-downloads Cross-Site Request Forgery No login needed ≤ 3.2.11 Fixed in 3.2.12 CVE-2024-31113 Patchstack
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Other WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration No login needed ≤ 4.2.6.5 CVE-2024-4444 Wordfence
9.8 Critical LearnPress – WordPress LMS Plugin learnpress SQL Injection WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection No login needed ≤ 4.2.6.5 CVE-2024-4434 Wordfence
4.3 Medium ShortPixel Adaptive Images Plugin shortpixel-adaptive-images Cross-Site Request Forgery No login needed ≤ 3.8.3 Fixed in 3.8.4 CVE-2024-4689 Patchstack
4.3 Medium Arigato Autoresponder and Newsletter Plugin bft-autoresponder Cross-Site Request Forgery No login needed ≤ 2.7.2.3 Fixed in 2.7.2.4 CVE-2024-34823 Patchstack
4.3 Medium Social Warfare Plugin social-warfare Cross-Site Request Forgery No login needed ≤ 4.4.5.1 Fixed in 4.4.6 CVE-2024-34825 Patchstack
4.3 Medium TranslatePress Plugin translatepress-multilingual Cross-Site Request Forgery TranslatePress plugin <= 2.7.5 - Cross Site Request Forgery (CSRF) No login needed ≤ 2.7.5 Fixed in 2.7.6 CVE-2024-34827 Patchstack
4.3 Medium Church Admin Plugin church-admin Cross-Site Request Forgery No login needed ≤ 4.1.32 Fixed in 4.2.0 CVE-2024-34828 Patchstack
6.4 Medium HTML5 Audio Player- Best WordPress Audio Player Plugin html5-audio-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.2.19 CVE-2024-4398 Wordfence
8.8 High LearnPress – WordPress LMS Plugin learnpress Arbitrary File Upload WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload ≤ 4.2.6.5 CVE-2024-4397 Wordfence
4.3 Medium Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery ≤ 4.1.6 CVE-2024-1467 Wordfence
4.3 Medium Joli FAQ SEO – WordPress FAQ Plugin Cross-Site Request Forgery WordPress FAQ Plugin <= 1.3.2 - Cross-Site Request Forgery No login needed ≤ 1.3.2 CVE-2024-4082 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.1.1 CVE-2024-3923 Wordfence
4.3 Medium Soccer Engine – Soccer Plugin Cross-Site Request Forgery Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery No login needed ≤ 1.12 CVE-2024-4312 Wordfence
6.1 Medium Yoast SEO Plugin wordpress-seo Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 22.5 CVE-2024-4041 Wordfence
7.5 High Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Broken Access Control No login needed ≤ 4.0.14 Fixed in 4.0.15 CVE-2024-32712 Patchstack
6.5 Medium SchedulePress Plugin wp-scheduled-posts Broken Access Control ≤ 5.0.8 Fixed in 5.0.9 CVE-2024-32717 Patchstack
5.3 Medium WP Club Manager Plugin wp-club-manager Broken Access Control No login needed ≤ 2.2.11 Fixed in 2.2.12 CVE-2024-32719 Patchstack
7.5 High Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy Plugin woo-aliexpress-dropshipping Broken Access Control Arbitrary Content Deletion No login needed ≤ 2.1.1 Fixed in 2.1.2 CVE-2024-32724 Patchstack
5.3 Medium WP Job Manager Plugin wp-job-manager Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2.2 Fixed in 2.3.0 CVE-2024-34549 Patchstack
5.3 Medium Dynamics 365 Integration Plugin integration-dynamics Information Disclosure Sensitive Data Exposure No login needed ≤ 1.3.17 Fixed in 1.3.18 CVE-2024-34550 Patchstack
5.3 Medium Barcode Scanner with Inventory & Order Manager Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders Information Disclosure Sensitive Data Exposure via Exported File No login needed ≤ 1.5.4 Fixed in 1.5.5 CVE-2024-34556 Patchstack
7.5 High Ghost Plugin ghost Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 1.4.0 Fixed in 1.5.0 CVE-2024-34559 Patchstack
4.4 Medium One Click Demo Import Plugin one-click-demo-import PHP Object Injection ≤ 3.2.0 Fixed in 3.2.1 CVE-2024-34433 Patchstack
5.4 Medium Ultimate Store Kit Elementor Addons Plugin ultimate-store-kit PHP Object Injection No login needed ≤ 2.0.3 Fixed in 2.0.4 CVE-2024-4606 Patchstack
4.3 Medium DS Site Message Plugin ds-site-message Cross-Site Request Forgery No login needed ≤ 1.14.4 CVE-2024-34439 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only