WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,551–1,600 of 2,150 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 32 of 1
Severity Component Vulnerability Affected versions Published CVE Source
10.0 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.9.9 Fixed in 1.9.9.1 CVE-2024-56046 Patchstack
9.8 Critical Simple Dashboard Plugin simple-dashboard Privilege Escalation No login needed ≤ 2.0 CVE-2024-56071 Patchstack
9.8 Critical AI Magic Plugin newsletter-page-redirects Privilege Escalation SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation No login needed ≤ 1.0.4 Fixed in 1.0.6 CVE-2024-56205 Patchstack
9.8 Critical SSL Wireless SMS Notification Plugin ssl-wireless-sms-notification Privilege Escalation No login needed ≤ 3.6.0 Fixed in 3.7.0 CVE-2024-56220 Patchstack
9.8 Critical Hunk Companion Plugin hunk-companion Broken Access Control Unauthenticated Plugin Installation No login needed < 1.9.0 Fixed in 1.9.0 CVE-2024-11972 WPScan
9.8 Critical WooCommerce Point of Sale Plugin Broken Access Control Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change No login needed ≤ 6.1.0 CVE-2024-11281 Wordfence
9.8 Critical AdForest Theme Authentication Bypass No login needed ≤ 5.1.6 CVE-2024-11349 Wordfence
9.8 Critical Store Locator Plugin store-locator Local File Inclusion Unauthenticated Local File Inclusion No login needed 3.98.9 CVE-2024-12571 Wordfence
9.6 Critical AutomatorWP Plugin automatorwp Cross-Site Scripting Reflected Cross-Site Scripting via a-0-o-search_field_value No login needed ≤ 5.0.9 CVE-2024-12626 Wordfence
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Subscriber+ Arbitrary File Upload ≤ 1.9.9.5.3 Fixed in 1.9.9.5.3 CVE-2024-56050 Patchstack
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Student+ Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56052 Patchstack
9.1 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Instructor+ Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56054 Patchstack
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56057 Patchstack
9.8 Critical WooCommerce PDF Vouchers Plugin woocommerce-pdf-vouchers Authentication Bypass PDF Vouchers plugin < 4.9.9 - Broken Authentication No login needed ≤ 4.9.9 Fixed in 4.9.9 CVE-2024-54383 Patchstack
9.8 Critical VRPConnector Plugin vrpconnector PHP Object Injection No login needed ≤ 2.0.1 CVE-2024-56058 Patchstack
9.8 Critical Partners Plugin partners PHP Object Injection No login needed ≤ 0.2.0 CVE-2024-56059 Patchstack
9.8 Critical Biagiotti Membership Plugin Authentication Bypass Authentication Bypass via biagiotti_membership_check_facebook_user No login needed ≤ 1.0.2 CVE-2024-12287 Wordfence
9.1 Critical SeedProd Pro Plugin seedprod-coming-soon-pro-5 Remote Code Execution ≤ 6.18.10 CVE-2024-54285 Patchstack
9.3 Critical WPBookit Plugin wpbookit SQL Injection No login needed ≤ 1.6.0 CVE-2024-54280 Patchstack
9.8 Critical Woffice Plugin woffice Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 5.4.14 Fixed in 5.4.15 CVE-2024-43234 Patchstack
9.8 Critical SV100 Companion Plugin sv100-companion Privilege Escalation No login needed ≤ 2.0.02 CVE-2024-54229 Patchstack
9.3 Critical Instant Appointment Plugin instant-appointment SQL Injection No login needed ≤ 1.2 CVE-2024-54361 Patchstack
9.8 Critical Wp NssUser Register Plugin wp-nssuser-register Privilege Escalation No login needed ≤ 1.0.0 CVE-2024-54363 Patchstack
9.6 Critical GitSync Plugin git-sync Cross-Site Request Forgery CSRF to Remote Code Execution No login needed ≤ 1.1.0 CVE-2024-54368 Patchstack
9.8 Critical ForumWP Plugin forumwp PHP Object Injection No login needed ≤ 2.1.0 Fixed in 2.1.1 CVE-2024-54367 Patchstack
9.9 Critical Video & Photo Gallery for Ultimate Member Plugin gallery-for-ultimate-member Arbitrary File Upload ≤ 1.1.0 Fixed in 1.1.1 CVE-2024-54370 Patchstack
9.1 Critical Zita Site Builder Plugin ai-site-builder Broken Access Control Arbitrary Plugin Installation and Activation No login needed ≤ 1.0.2 CVE-2024-54369 Patchstack
9.3 Critical eTemplates Plugin etemplates SQL Injection No login needed ≤ 0.2.1 CVE-2024-55972 Patchstack
9.3 Critical LaunchPage.app Importer Plugin launchpage-app-importer SQL Injection No login needed ≤ 1.1 CVE-2024-55977 Patchstack
9.3 Critical Critical Site Intel Plugin critical-site-intel-stats SQL Injection No login needed ≤ 1.0 CVE-2024-55976 Patchstack
9.3 Critical Code Generator Pro Plugin code-generator-pro SQL Injection No login needed ≤ 1.2 CVE-2024-55978 Patchstack
9.3 Critical Wr Age Verification Plugin wr-age-verification SQL Injection No login needed ≤ 2.0.0 CVE-2024-55980 Patchstack
9.3 Critical Share Buttons – Social Media Plugin rich-web-share-button SQL Injection Social Media plugin <= 1.0.2 - SQL Injection No login needed ≤ 1.0.2 CVE-2024-55982 Patchstack
9.3 Critical Nabz Image Gallery Plugin nabz-image-gallery SQL Injection No login needed ≤ v1.00 CVE-2024-55981 Patchstack
9.3 Critical Navayan CSV Export Plugin navayan-csv-export SQL Injection No login needed ≤ 1.0.9 CVE-2024-55988 Patchstack
9.6 Critical Insertify Plugin insertify Cross-Site Request Forgery CSRF to Remote Code Execution No login needed ≤ 1.1.4 CVE-2024-54372 Patchstack
9.8 Critical Flash News / Post (Responsive) Plugin flashnews-fading-effect-pearlbells Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 4.1 CVE-2024-56012 Patchstack
9.8 Critical vBSSO-lite Plugin vbsso-lite Privilege Escalation Account Takeover No login needed ≤ 1.4.3 CVE-2024-54297 Patchstack
9.8 Critical CoSchool LMS Plugin coschool Privilege Escalation Account Takeover No login needed ≤ 1.4.3 CVE-2024-54296 Patchstack
9.8 Critical ListApp Mobile Manager Plugin listapp-mobile-manager Privilege Escalation Account Takeover No login needed ≤ 1.7.7 CVE-2024-54295 Patchstack
9.8 Critical Firebase OTP Authentication Plugin authentication-via-otp-using-firebase Privilege Escalation Account Takeover No login needed ≤ 1.0.1 CVE-2024-54294 Patchstack
9.8 Critical CE21 Suite Plugin ce21-suite Privilege Escalation No login needed ≤ 2.2.0 Fixed in 2.2.1 CVE-2024-54293 Patchstack
9.3 Critical Appsplate Plugin appsplate SQL Injection No login needed ≤ 2.1.3 CVE-2024-54292 Patchstack
9.8 Critical Mail Picker Plugin mail-picker PHP Object Injection No login needed ≤ 1.0.14 Fixed in 1.0.15 CVE-2024-54273 Patchstack
9.9 Critical Import Export For WooCommerce Plugin import-export-for-woocommerce Arbitrary File Upload ≤ 1.6.2 CVE-2024-54262 Patchstack
10.0 Critical TAX SERVICE Electronic HDM Plugin virtual-hdm-for-taxservice-am SQL Injection No login needed ≤ 1.2.2 Fixed in 1.2.3 CVE-2024-54261 Patchstack
9.8 Critical Eyewear prescription form Plugin eyewear-prescription-form Privilege Escalation Arbitrary Option Update to Privilege Escalation No login needed ≤ 4.0.18 Fixed in 4.0.19 CVE-2024-54239 Patchstack
9.3 Critical Limit Login Attempts Plugin wp-limit-failed-login-attempts SQL Injection No login needed ≤ 5.5 Fixed in 5.6 CVE-2024-54234 Patchstack
9.1 Critical JS Help Desk – Best Help Desk & Support Plugin js-support-ticket Broken Access Control Unauthenticated Settings Change No login needed ≤ 2.7.1 Fixed in 2.7.2 CVE-2022-46838 Patchstack
9.8 Critical Super Backup & Clone - Migrate Plugin Arbitrary File Upload Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload No login needed ≤ 2.3.3 CVE-2024-9290 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only