WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 16,101–16,150 of 16,788 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 323 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.6 High DecaLog Plugin decalog SQL Injection ≤ 3.9.0 Fixed in 3.9.1 CVE-2024-30245 Patchstack
6.1 Medium WordPress Countdown Widget Plugin wordpress-countdown-widget Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) No login needed ≤ 3.1.9.1 Fixed in 3.1.9.3 CVE-2022-45847 Patchstack
8.5 High Contest Gallery Plugin contest-gallery SQL Injection ≤ 21.3.2 Fixed in 21.3.2.1 CVE-2024-30238 Patchstack
4.3 Medium Don't Muck My Markup Plugin dont-muck-my-markup Cross-Site Request Forgery No login needed ≤ 1.8 CVE-2024-23510 Patchstack
5.4 Medium Post Video Players Plugin video-playlist-and-gallery-plugin Cross-Site Request Forgery No login needed ≤ 1.159 Fixed in 1.160 CVE-2024-23515 Patchstack
7.1 High Fusion Builder Plugin fusion-builder Cross-Site Request Forgery No login needed ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39311 Patchstack
5.4 Medium WooCommerce Stripe Payment Gateway Plugin woocommerce-gateway-stripe Cross-Site Request Forgery No login needed ≤ 7.6.0 Fixed in 7.6.1 CVE-2023-44999 Patchstack
4.7 Medium Uncanny Toolkit for LearnDash Plugin uncanny-learndash-toolkit Open Redirect No login needed ≤ 3.6.4.3 Fixed in 3.6.4.4 CVE-2023-34020 Patchstack
7.1 High BizPrint Plugin print-google-cloud-print-gcp-woocommerce Cross-Site Request Forgery CSRF to XSS No login needed ≤ 4.5.5 Fixed in 4.5.6 CVE-2024-29773 Patchstack
7.1 High Co-marquage service-public.fr Plugin co-marquage-service-public Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.5.72 Fixed in 0.5.73 CVE-2024-29758 Patchstack
7.1 High Calculated Fields Form Plugin calculated-fields-form Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.54 Fixed in 1.2.55 CVE-2024-29759 Patchstack
7.1 High Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 7.1.7 Fixed in 7.1.8 CVE-2024-29760 Patchstack
6.5 Medium WP Post Disclaimer Plugin wp-post-disclaimer Cross-Site Scripting ≤ 1.0.3 Fixed in 1.0.4 CVE-2024-29761 Patchstack
6.5 Medium Off-Canvas Sidebars & Menus (Slidebars) Plugin off-canvas-sidebars Cross-Site Scripting ≤ 0.5.8.1 Fixed in 0.5.8.2 CVE-2024-29762 Patchstack
7.1 High WordPress Meta Data and Taxonomies Filter (MDTF) Plugin wp-meta-data-filter-and-taxonomy-filter Cross-Site Scripting Meta Data and Taxonomies Filter plugin <= 1.3.3 - Cross Site Scripting (XSS) No login needed ≤ 1.3.3 Fixed in 1.3.3.1 CVE-2024-29763 Patchstack
6.5 Medium Molongui Plugin molongui-authorship Cross-Site Scripting ≤ 4.7.7 Fixed in 4.7.8 CVE-2024-29764 Patchstack
6.5 Medium Aparat Plugin wp-aparat Cross-Site Scripting ≤ 2.2.0 Fixed in 2.2.1 CVE-2024-29765 Patchstack
6.5 Medium StreamWeasels Twitch Integration Plugin streamweasels-twitch-integration Cross-Site Scripting ≤ 1.7.5 Fixed in 1.7.6 CVE-2024-29766 Patchstack
7.1 High Doneren met Mollie Plugin doneren-met-mollie Cross-Site Scripting No login needed ≤ 2.10.2 Fixed in 2.10.3 CVE-2024-29767 Patchstack
5.9 Medium Astra Theme astra Cross-Site Scripting ≤ 4.6.4 Fixed in 4.6.5 CVE-2024-29768 Patchstack
6.5 Medium Portfolio Gallery – Image Gallery Plugin portfolio-filter-gallery Cross-Site Scripting ≤ 1.5.6 Fixed in 1.5.7 CVE-2024-29769 Patchstack
7.1 High Forminator Plugin forminator Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.29.0 Fixed in 1.29.1 CVE-2024-29777 Patchstack
7.1 High Shortlinks by Pretty Links Plugin pretty-link Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.6.2 Fixed in 3.6.3 CVE-2024-29770 Patchstack
6.5 Medium Dracula Dark Mode - The Revolutionary Dark Mode Plugin dracula-dark-mode Cross-Site Scripting ≤ 1.0.8 Fixed in 1.0.9 CVE-2024-29771 Patchstack
6.5 Medium MyBookTable Bookstore Plugin mybooktable Cross-Site Scripting ≤ 3.3.7 Fixed in 3.3.8 CVE-2024-29772 Patchstack
7.1 High WP Directory Kit Plugin wpdirectorykit Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-29774 Patchstack
6.5 Medium Frontend Dashboard Plugin frontend-dashboard Cross-Site Scripting ≤ 2.2.1 Fixed in 2.2.2 CVE-2024-29775 Patchstack
7.1 High Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.5.93 Fixed in 1.5.94 CVE-2024-29792 Patchstack
7.1 High SEO Plugin by Squirrly SEO Plugin squirrly-seo Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 12.3.16 Fixed in 12.3.17 CVE-2024-29790 Patchstack
5.9 Medium EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting ≤ 3.3.9 Fixed in 3.4.0 CVE-2024-29776 Patchstack
6.5 Medium Podlove Web Player Plugin podlove-web-player Cross-Site Scripting ≤ 5.7.1 Fixed in 5.7.3 CVE-2024-29788 Patchstack
6.5 Medium OneClick Chat to Order Plugin oneclick-whatsapp-order Cross-Site Scripting ≤ 1.0.5 Fixed in 1.0.6 CVE-2024-29789 Patchstack
7.1 High Bulk NoIndex & NoFollow Toolkit Plugin bulk-noindex-nofollow-toolkit-by-mad-fish Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.01 Fixed in 2.10 CVE-2024-29791 Patchstack
6.5 Medium MailChimp Forms by MailMunch Plugin mailchimp-forms-by-mailmunch Cross-Site Scripting ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-29793 Patchstack
7.1 High Conversios.io Plugin enhanced-e-commerce-for-woocommerce-store Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 6.9.1 Fixed in 7.0.0 CVE-2024-29794 Patchstack
6.5 Medium Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more Plugin ilab-media-tools Cross-Site Scripting ≤ 4.5.24 Fixed in 4.5.25 CVE-2024-29795 Patchstack
6.5 Medium Hot Random Image Plugin hot-random-image Cross-Site Scripting ≤ 1.8.1 Fixed in 1.8.2 CVE-2024-29796 Patchstack
6.5 Medium Grid Shortcodes Plugin grid-shortcodes Cross-Site Scripting ≤ 1.1 Fixed in 1.1.1 CVE-2024-29797 Patchstack
6.5 Medium Gratisfaction Plugin gratisfaction-all-in-one-loyalty-contests-referral-program-for-woocommerce Cross-Site Scripting ≤ 4.3.4 Fixed in 4.3.5 CVE-2024-29798 Patchstack
6.5 Medium WP Fast Total Search Plugin fulltext-search Cross-Site Scripting ≤ 1.59.211 Fixed in 1.60.213 CVE-2024-29799 Patchstack
6.5 Medium Fullscreen Galleria Plugin fullscreen-galleria Cross-Site Scripting ≤ 1.6.11 Fixed in 1.6.12 CVE-2024-29801 Patchstack
6.5 Medium Football Pool Plugin football-pool Cross-Site Scripting ≤ 2.11.3 Fixed in 2.11.4 CVE-2024-29802 Patchstack
6.5 Medium FlatPM Plugin flatpm-wp Cross-Site Scripting < 3.1.05 Fixed in 3.1.05 CVE-2024-29803 Patchstack
6.5 Medium Fancy Comments Plugin fancy-facebook-comments Cross-Site Scripting ≤ 1.2.14 Fixed in 1.2.15 CVE-2024-29804 Patchstack
7.1 High Shipping with Venipak for WooCommerce Plugin wc-venipak-shipping Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.19.5 Fixed in 1.19.6 CVE-2024-29805 Patchstack
7.1 High ReDi Restaurant Reservation Plugin redi-restaurant-reservation Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 24.0128 Fixed in 24.0303 CVE-2024-29806 Patchstack
6.5 Medium DearFlip Plugin 3d-flipbook-dflip-lite Cross-Site Scripting ≤ 2.2.26 Fixed in 2.2.27 CVE-2024-29807 Patchstack
6.5 Medium Radio Player Plugin radio-player Cross-Site Scripting ≤ 2.0.73 Fixed in 2.0.74 CVE-2024-29811 Patchstack
6.5 Medium ReviewX Plugin reviewx Cross-Site Scripting ≤ 1.6.22 Fixed in 1.6.23 CVE-2024-29812 Patchstack
5.9 Medium Funnel Builder by CartFlows Plugin cartflows Cross-Site Scripting ≤ 2.0.1 Fixed in 2.0.2 CVE-2024-29813 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only