WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 15,601–15,650 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 313 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.2 High Checkout Mestres WP Plugin checkout-mestres-wp Authentication Bypass Unauthenticated Arbitrary Options Update No login needed ≤ 7.1.9.7 Fixed in 7.1.9.8 CVE-2023-51471 Patchstack
9.8 Critical Rencontre – Dating Site Plugin rencontre Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 3.10.1 Fixed in 3.11 CVE-2023-51425 Patchstack
8.2 High BookingPress Plugin bookingpress-appointment-booking Price Manipulation Booking Price Manipulation No login needed ≤ 1.0.74 Fixed in 1.0.75 CVE-2023-51405 Patchstack
5.3 Medium JetFormBuilder Plugin jetformbuilder Content Injection No login needed ≤ 3.1.4 Fixed in 3.1.5 CVE-2023-48763 Patchstack
5.4 Medium Jetpack Plugin jetpack Other Auth. Iframe Injection < 12.7 Fixed in 12.7 CVE-2023-47774 Patchstack
6.5 Medium Elementor Website Builder Plugin elementor Authentication Bypass Auth. Arbitrary Attachment Read ≤ 3.16.4 Fixed in 3.16.5 CVE-2023-47504 Patchstack
5.3 Medium Multi Rating Plugin multi-rating Broken Access Control Unauth Arbitrary rating value change No login needed ≤ 5.0.6 CVE-2023-32127 Patchstack
9.9 Critical Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Arbitrary File Upload Unrestricted Zip Extraction ≤ 1.5.60 Fixed in 1.5.61 CVE-2023-31090 Patchstack
5.3 Medium WoodMart Theme Authentication Bypass Unauth Arbitrary Shortcodes Injection No login needed ≤ 7.0.4 Fixed in 7.1.1 CVE-2023-25790 Patchstack
4.1 Medium FV Flowplayer Video Player Plugin fv-wordpress-flowplayer Open Redirect Unvalidated Redirects and Forwards ≤ 7.5.44.7212 Fixed in 7.5.45.7212 CVE-2024-32078 Patchstack
4.3 Medium Ovic Addon Toolkit Plugin ovic-addon-toolkit Broken Access Control ≤ 2.6.1 CVE-2024-32432 Patchstack
6.5 Medium Order Limit for WooCommerce Plugin wc-order-limit-lite Broken Access Control No login needed ≤ 2.0.0 Fixed in 2.0.1 CVE-2024-32675 Patchstack
6.5 Medium LoginPress Pro Plugin Broken Access Control Unauth. License Activation/Deactivation No login needed < 3.0.0 Fixed in 3.0.0 CVE-2024-32677 Patchstack
5.3 Medium TrackShip for WooCommerce Plugin trackship-for-woocommerce Broken Access Control No login needed ≤ 1.7.5 Fixed in 1.7.6 CVE-2024-32678 Patchstack
4.3 Medium YITH WooCommerce Compare Plugin yith-woocommerce-compare Cross-Site Request Forgery No login needed ≤ 2.37.0 Fixed in 2.38.0 CVE-2024-32699 Patchstack
4.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Request Forgery No login needed ≤ 2.11.0 Fixed in 2.11.1 CVE-2024-32728 Patchstack
4.3 Medium Royal Elementor Kit Theme royal-elementor-kit Cross-Site Request Forgery No login needed ≤ 1.0.116 Fixed in 1.0.117 CVE-2024-32773 Patchstack
5.4 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 2.12.10 Fixed in 3.0 CVE-2024-32793 Patchstack
4.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 2.12.10 Fixed in 3.0 CVE-2024-32794 Patchstack
4.3 Medium WPCal.io – Easy Meeting Scheduler Plugin wpcal Cross-Site Request Forgery No login needed ≤ 0.9.5.8 Fixed in 0.9.5.9 CVE-2024-32795 Patchstack
4.3 Medium Headline Analyzer Plugin headline-analyzer Cross-Site Request Forgery No login needed ≤ 1.3.3 Fixed in 1.3.4 CVE-2024-32806 Patchstack
4.3 Medium WP ADA Compliance Check Basic Plugin wp-ada-compliance-check-basic Cross-Site Request Forgery No login needed ≤ 3.1.3 Fixed in 3.1.4 CVE-2024-32947 Patchstack
7.1 High Slash Admin Plugin slash-admin Cross-Site Request Forgery CSRF to XSS No login needed ≤ 3.8.1 Fixed in 3.8.2 CVE-2024-32958 Patchstack
5.3 Medium WP Post Rating Plugin wp-post-comment-rating Broken Access Control Vote Manipulation No login needed ≤ 2.5 CVE-2023-25785 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Content Injection No login needed ≤ 5.1.9.2 Fixed in 5.1.9.3 CVE-2023-23989 Patchstack
3.7 Low Quiz Maker Plugin quiz-maker Content Injection Content Spoofing No login needed ≤ 6.3.9.4 Fixed in 6.3.9.5 CVE-2023-23985 Patchstack
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Arbitrary Price Change No login needed ≤ 5.1.9.2 Fixed in 5.1.9.3 CVE-2023-23976 Patchstack
6.5 Medium WP-FormAssembly Plugin formassembly-web-forms Path Traversal Auth. Arbitrary File Read ≤ 2.0.5 Fixed in 2.0.6 CVE-2022-45852 Patchstack
9.1 Critical Newsletters Plugin newsletters-lite Arbitrary File Upload ≤ 4.9.5 Fixed in 4.9.6 CVE-2024-32954 Patchstack
7.1 High The Pack Elementor addons Plugin the-pack-addon Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to XSS No login needed ≤ 2.0.8.3 Fixed in 2.0.8.4 CVE-2024-32785 Patchstack
7.1 High Seers Plugin seers-cookie-consent-banner-privacy-policy Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to XSS No login needed ≤ 8.1.0 Fixed in 8.1.1 CVE-2024-32789 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Insecure Direct Object References (IDOR) ≤ 5.7.9 Fixed in 5.8.0 CVE-2024-32772 Patchstack
5.4 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Insecure Direct Object Reference (IDOR) ≤ 5.7.9 Fixed in 5.8.0 CVE-2024-32808 Patchstack
5.3 Medium Rate my Post – WP Rating System Plugin rate-my-post Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.4.4 Fixed in 3.4.5 CVE-2024-32823 Patchstack
7.1 High ARForms Plugin arforms Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 6.4 Fixed in 6.4.1 CVE-2024-32702 Patchstack
5.9 Medium Image Slider Widget Plugin image-slider-widget Cross-Site Scripting ≤ 1.1.125 Fixed in 1.1.127 CVE-2024-32707 Patchstack
6.5 Medium myCred Plugin mycred Cross-Site Scripting ≤ 2.6.3 Fixed in 2.6.4 CVE-2024-32711 Patchstack
6.5 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting ≤ 2.6.3 Fixed in 2.6.4 CVE-2024-32721 Patchstack
5.9 Medium Coupon & Discount Code Reveal Button Plugin coupon-reveal-button Cross-Site Scripting ≤ 1.2.5 Fixed in 1.2.6 CVE-2024-32722 Patchstack
5.9 Medium Advanced Floating Content Plugin advanced-floating-content-lite Cross-Site Scripting ≤ 1.2.5 Fixed in 1.2.6 CVE-2024-32723 Patchstack
6.5 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting ≤ 4.10.25 Fixed in 4.10.26 CVE-2024-32791 Patchstack
5.9 Medium Widget Post Slider Plugin widget-post-slider Cross-Site Scripting ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-32801 Patchstack
5.9 Medium All-in-one Like Widget Plugin all-in-one-facebook-like-widget Cross-Site Scripting ≤ 2.2.7 Fixed in 2.2.8 CVE-2024-32815 Patchstack
5.9 Medium List Custom Taxonomy Widget Plugin list-custom-taxonomy-widget Cross-Site Scripting ≤ 4.1 Fixed in 4.2 CVE-2024-32833 Patchstack
5.9 Medium WooCommerce Shipping Label Plugin shipping-labels-for-woo Cross-Site Scripting ≤ 2.3.8 Fixed in 2.3.9 CVE-2024-32834 Patchstack
7.1 High WP Media Category Management Plugin wp-media-category-management Cross-Site Scripting No login needed ≤ 2.2 Fixed in 2.3.0 CVE-2024-32950 Patchstack
7.1 High Max Addons Pro for Bricks Plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-32952 Patchstack
6.5 Medium RTMKit Plugin rometheme-for-elementor Cross-Site Scripting ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-32956 Patchstack
8.5 High ARForms Plugin arforms SQL Injection Subscriber+ SQL Injection ≤ 6.4 Fixed in 6.4.1 CVE-2024-32706 Patchstack
9.3 Critical WP-Recall Plugin wp-recall SQL Injection No login needed ≤ 16.26.5 Fixed in 16.26.6 CVE-2024-32709 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only