WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 16,051–16,100 of 16,788 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 322 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium WOOCS – WooCommerce Currency Switcher Plugin woocommerce-currency-switcher Cross-Site Request Forgery Currency Switcher Professional for WooCommerce plugin <= 1.4.1.7 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.4.1.7 Fixed in 1.4.1.8 CVE-2024-30458 Patchstack
6.5 Medium Sponsors Plugin wp-sponsors Cross-Site Scripting ≤ 3.5.1 CVE-2024-30483 Patchstack
7.1 High Mailster Plugin mailster Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.0.6 Fixed in 4.0.7 CVE-2024-30503 Patchstack
6.5 Medium Lordicon Animated Icons Plugin lordicon-interactive-icons Cross-Site Scripting ≤ 2.0.1 CVE-2024-30519 Patchstack
6.5 Medium Carousel Anything For WPBakery Page Builder Plugin carousel-anything Cross-Site Scripting ≤ 2.1 CVE-2024-30520 Patchstack
4.6 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Scripting The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 3.8.0 CVE-2024-2108 Wordfence
4.3 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Request Forgery The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export No login needed ≤ 3.8.0 CVE-2024-2113 Wordfence
6.5 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting ≤ 1.13.1 Fixed in 1.13.2 CVE-2024-30422 Patchstack
4.3 Medium Events Manager Plugin events-manager Cross-Site Request Forgery No login needed ≤ 6.4.7.1 Fixed in 6.4.7.2 CVE-2024-30421 Patchstack
6.1 Medium Image Map Pro Plugin Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) No login needed < 5.6.9 Fixed in 5.6.9 CVE-2022-45850 Patchstack
7.1 High Seriously Simple Podcasting Plugin seriously-simple-podcasting Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.0.2 Fixed in 3.1.0 CVE-2024-25599 Patchstack
7.1 High Preview E-mails for WooCommerce Plugin woo-preview-emails Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.2.1 Fixed in 2.2.2 CVE-2024-27999 Patchstack
7.1 High Favicon Rotator Plugin favicon-rotator Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.10 Fixed in 1.2.11 CVE-2024-28001 Patchstack
7.1 High Cornerstone Plugin cornerstone Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.8.0 Fixed in 0.8.1 CVE-2024-28002 Patchstack
8.5 High Fusion Builder Plugin SQL Injection Auth. SQL Injection ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39309 Patchstack
7.6 High WP Testimonials Plugin testimonial-widgets SQL Injection Auth. SQL Injection ≤ 1.4.3 Fixed in 1.4.4 CVE-2024-25924 Patchstack
6.5 Medium Booster Plus for WooCommerce Plugin Information Disclosure Auth. Sensitive Data Exposure < 7.1.2 Fixed in 7.1.2 CVE-2023-52231 Patchstack
6.5 Medium Booster Elite for WooCommerce Plugin Information Disclosure Auth. Sensitive Data Exposure < 7.1.2 Fixed in 7.1.2 CVE-2023-52234 Patchstack
5.5 Medium CMP – Coming Soon & Maintenance Plugin cmp-coming-soon-maintenance Server-Side Request Forgery Coming Soon & Maintenance Plugin by NiteoThemes plugin <= 4.1.10 - Server Side Request Forgery (SSRF) ≤ 4.1.10 Fixed in 4.1.11 CVE-2023-50374 Patchstack
5.3 Medium Seraphinite Accelerator Plugin seraphinite-accelerator Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 2.20.47 Fixed in 2.20.48 CVE-2024-22138 Patchstack
5.3 Medium Community by PeepSo Plugin peepso-core Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 6.2.7.0 Fixed in 6.2.7.1 CVE-2024-25923 Patchstack
9.1 Critical Tumult Hype Animations Plugin tumult-hype-animations Arbitrary File Upload ≤ 1.9.12 Fixed in 1.9.13 CVE-2024-2890 Patchstack
8.1 High MainWP Links Manager Extension Plugin PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 2.1 CVE-2023-23649 Patchstack
7.1 High Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Server-Side Request Forgery Server Side Request Forgery (SSRF) vulnerability in Starter Templates plugins ≤ 3.2.4 Fixed in 3.2.5 CVE-2023-34370 Patchstack
7.1 High Spectra Plugin ultimate-addons-for-gutenberg Server-Side Request Forgery ≤ 2.6.6 Fixed in 2.6.7 CVE-2023-36679 Patchstack
7.7 High Avada Theme Server-Side Request Forgery Authenticated Server Side Request Forgery (SSRF) ≤ 7.11.1 Fixed in 7.11.2 CVE-2023-39313 Patchstack
7.7 High Gutenberg Blocks by Kadence Blocks Plugin kadence-blocks Server-Side Request Forgery ≤ 3.2.19 Fixed in 3.2.20 CVE-2024-23500 Patchstack
5.4 Medium Max Mega Menu Plugin megamenu Broken Access Control ≤ 3.3 Fixed in 3.3.1 CVE-2024-28003 Patchstack
5.4 Medium Colibri Page Builder Plugin colibri-page-builder Broken Access Control ≤ 1.0.248 Fixed in 1.0.249 CVE-2024-28004 Patchstack
6.8 Medium AI Engine: ChatGPT Chatbot Plugin ai-engine Server-Side Request Forgery ≤ 2.1.4 Fixed in 2.1.5 CVE-2024-29090 Patchstack
9.1 Critical AI Engine: ChatGPT Chatbot Plugin ai-engine Arbitrary File Upload ≤ 2.1.4 Fixed in 2.1.5 CVE-2024-29100 Patchstack
7.1 High BEAR Plugin woo-bulk-editor Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.1.4.2 Fixed in 1.1.4.3 CVE-2024-30200 Patchstack
5.4 Medium Sunshine Photo Cart Plugin sunshine-photo-cart PHP Object Injection No login needed ≤ 3.1.1 Fixed in 3.1.2 CVE-2024-30221 Patchstack
8.5 High ARMember Plugin armember-membership PHP Object Injection ≤ 4.0.26 Fixed in 4.0.27 CVE-2024-30222 Patchstack
9.0 Critical ARMember Plugin armember-membership PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 4.0.26 Fixed in 4.0.27 CVE-2024-30223 Patchstack
10.0 Critical WholesaleX Plugin wholesalex PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2024-30224 Patchstack
10.0 Critical WP Migrate Plugin PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 2.6.10 Fixed in 2.6.11 CVE-2024-30225 Patchstack
9.0 Critical BetterDocs Plugin betterdocs PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 3.3.3 Fixed in 3.3.4 CVE-2024-30226 Patchstack
9.0 Critical Geo Controller Plugin cf-geoplugin PHP Object Injection No login needed ≤ 8.6.4 Fixed in 8.6.5 CVE-2024-30227 Patchstack
9.9 Critical Hercules Core Plugin PHP Object Injection Auth. PHP Object Injection ≤ 6.4 Fixed in 6.5 CVE-2024-30228 Patchstack
8.0 High GiveWP Plugin give PHP Object Injection ≤ 3.4.2 Fixed in 3.5.0 CVE-2024-30229 Patchstack
8.2 High PDF Invoices and Packing Slips For WooCommerce Plugin pdf-invoices-and-packing-slips-for-woocommerce PHP Object Injection ≤ 1.3.7 Fixed in 1.3.8 CVE-2024-30230 Patchstack
8.5 High Contest Gallery Plugin contest-gallery SQL Injection ≤ 21.3.4 Fixed in 21.3.5 CVE-2024-30236 Patchstack
7.6 High Slider by Supsystic Plugin slider-by-supsystic SQL Injection ≤ 1.8.10 Fixed in 1.8.11 CVE-2024-30237 Patchstack
8.5 High Zoho Campaigns Plugin zoho-campaigns SQL Injection ≤ 2.0.6 Fixed in 2.0.7 CVE-2024-30239 Patchstack
8.5 High Calendarista Plugin SQL Injection ≤ 15.5.7 Fixed in 15.5.9 CVE-2024-30240 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection ≤ 5.7.1 Fixed in 5.7.2 CVE-2024-30241 Patchstack
8.5 High Contact Form to Any API Plugin contact-form-to-any-api SQL Injection Auth. SQL Injection ≤ 1.1.8 Fixed in 1.1.9 CVE-2024-30242 Patchstack
8.5 High WordPress Tooltips Plugin wordpress-tooltips SQL Injection Auth. SQL Injection < 9.4.5 Fixed in 9.4.5 CVE-2024-30243 Patchstack
8.5 High Church Admin Plugin church-admin SQL Injection SQL Injection via shortcode ≤ 4.0.27 Fixed in 4.0.28 CVE-2024-30244 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only