WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 16,201–16,250 of 17,674 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 325 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium GiveWP Plugin give Cross-Site Scripting Cross Site Scripting (XSS) via render_dropdown ≤ 2.25.1 Fixed in 2.25.2 CVE-2022-40211 Patchstack
4.3 Medium WordPress Comments Import & Export Plugin comments-import-export-woocommerce Cross-Site Request Forgery No login needed ≤ 2.3.5 Fixed in 2.3.6 CVE-2024-31235 Patchstack
5.4 Medium Smart Online Order for Clover Plugin clover-online-orders Cross-Site Request Forgery No login needed ≤ 1.5.5 Fixed in 1.5.6 CVE-2024-31238 Patchstack
4.3 Medium Nudgify Social Proof, Sales Popup & FOMO Plugin nudgify Cross-Site Request Forgery No login needed ≤ 1.3.3 Fixed in 1.3.4 CVE-2024-31239 Patchstack
4.3 Medium WP Server Health Stats Plugin wp-server-stats Cross-Site Request Forgery No login needed ≤ 1.7.3 Fixed in 1.7.4 CVE-2024-31250 Patchstack
4.3 Medium Community by PeepSo Plugin peepso-core Cross-Site Request Forgery No login needed ≤ 6.3.1.1 Fixed in 6.3.1.2 CVE-2024-31251 Patchstack
5.4 Medium WooCommerce Checkout Field Editor (Checkout Manager) Plugin woo-checkout-regsiter-field-editor Cross-Site Request Forgery No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-31262 Patchstack
5.4 Medium Loan Repayment Calculator and Application Form Plugin quick-interest-slider Cross-Site Request Forgery No login needed ≤ 2.9.4 Fixed in 2.9.5 CVE-2024-31263 Patchstack
4.3 Medium Post Views Counter Plugin post-views-counter Cross-Site Request Forgery No login needed ≤ 1.4.4 Fixed in 1.4.5 CVE-2024-31264 Patchstack
4.3 Medium AppPresser Plugin apppresser Cross-Site Request Forgery No login needed ≤ 4.3.0 Fixed in 4.3.1 CVE-2024-31268 Patchstack
4.3 Medium Easy Google Maps Plugin google-maps-easy Cross-Site Request Forgery No login needed ≤ 1.11.11 Fixed in 1.11.12 CVE-2024-31269 Patchstack
4.3 Medium Ultimate Maps by Supsystic Plugin ultimate-maps-by-supsystic Cross-Site Request Forgery No login needed ≤ 1.2.16 Fixed in 1.2.17 CVE-2024-31271 Patchstack
6.3 Medium ARForms Form Builder Plugin arforms-form-builder Cross-Site Request Forgery No login needed ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-31272 Patchstack
5.4 Medium Generate Child Plugin generate-child-theme Cross-Site Request Forgery No login needed ≤ 2.0 Fixed in 2.0.1 CVE-2024-31279 Patchstack
4.3 Medium Hello Elementor Theme hello-elementor Cross-Site Request Forgery No login needed ≤ 3.0.0 Fixed in 3.0.1 CVE-2024-31289 Patchstack
4.3 Medium Easy Digital Downloads Plugin easy-digital-downloads Cross-Site Request Forgery No login needed ≤ 3.2.6 Fixed in 3.2.7 CVE-2024-31293 Patchstack
5.4 Medium Multiple Page Generator Plugin – MPG Plugin multiple-pages-generator-by-porthas Cross-Site Request Forgery MPG plugin <= 3.4.0 - Cross Site Request Forgery (CSRF) No login needed ≤ 3.4.0 Fixed in 3.4.1 CVE-2024-31301 Patchstack
4.3 Medium Sign-up Sheets Plugin sign-up-sheets Cross-Site Request Forgery No login needed ≤ 2.2.11.1 Fixed in 2.2.12 CVE-2024-31303 Patchstack
4.3 Medium Transcoder Plugin transcoder Cross-Site Request Forgery No login needed ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-31305 Patchstack
4.3 Medium Slideshow Gallery Plugin slideshow-gallery Cross-Site Request Forgery No login needed ≤ 1.7.8 CVE-2024-31354 Patchstack
4.3 Medium Benchmark Email Lite Plugin benchmark-email-lite Cross-Site Request Forgery No login needed ≤ 4.1 Fixed in 4.2 CVE-2024-31360 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) No login needed ≤ 5.7.8 Fixed in 5.7.9 CVE-2024-31362 Patchstack
4.3 Medium LifterLMS Plugin lifterlms Cross-Site Request Forgery No login needed ≤ 7.5.0 Fixed in 7.5.1 CVE-2024-31363 Patchstack
4.3 Medium ELEX WooCommerce Dynamic Pricing and Discounts Plugin elex-woocommerce-dynamic-pricing-and-discounts Cross-Site Request Forgery No login needed ≤ 2.1.2 Fixed in 2.1.3 CVE-2024-31364 Patchstack
4.3 Medium WP Event Aggregator Plugin wp-event-aggregator Cross-Site Request Forgery No login needed ≤ 1.7.6 Fixed in 1.7.7 CVE-2024-31371 Patchstack
4.3 Medium No-Bot Registration Plugin no-bot-registration Cross-Site Request Forgery No login needed ≤ 1.9.1 Fixed in 2.0 CVE-2024-31372 Patchstack
6.4 Medium Shopkeeper Extender Plugin shopkeeper-extender Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.6 CVE-2024-2801 Wordfence
6.4 Medium All-in-One Addons for Elementor – WidgetKit Plugin widgetkit-for-elementor Cross-Site Scripting WidgetKit <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Widgets ≤ 2.5.1 CVE-2024-2137 Wordfence
5.4 Medium Combo Blocks Plugin Broken Access Control Unauthenticated Password Protected Posts Access < 2.2.76 Fixed in 2.2.76 CVE-2024-0881 WPScan
4.3 Medium ELEX WooCommerce Dynamic Pricing and Discounts Plugin elex-woocommerce-dynamic-pricing-and-discounts Cross-Site Request Forgery No login needed ≤ 2.1.2 Fixed in 2.1.3 CVE-2024-32105 Patchstack
4.3 Medium WP Compress – Image Optimizer [All-In-One] Plugin wp-compress-image-optimizer Cross-Site Request Forgery No login needed ≤ 6.10.35 Fixed in 6.11.01 CVE-2024-32106 Patchstack
4.3 Medium Finale Lite Plugin finale-woocommerce-sales-countdown-timer-discount Cross-Site Request Forgery No login needed ≤ 2.18.0 Fixed in 2.18.1 CVE-2024-32107 Patchstack
4.3 Medium Convert Post Types Plugin convert-post-types Cross-Site Request Forgery No login needed ≤ 1.4 CVE-2024-32108 Patchstack
4.3 Medium WP Matterport Shortcode Plugin shortcode-gallery-for-matterport-showcase Cross-Site Request Forgery No login needed ≤ 2.1.9 Fixed in 2.2.0 CVE-2024-32109 Patchstack
5.9 Medium Easy Logo Plugin easylogo Cross-Site Scripting ≤ 1.9.3 CVE-2024-32083 Patchstack
5.9 Medium bunny.net Plugin bunnycdn Cross-Site Scripting ≤ 2.0.1 Fixed in 2.0.2 CVE-2024-31361 Patchstack
5.9 Medium Popup Like box Plugin ays-facebook-popup-likebox Cross-Site Scripting ≤ 3.7.2 Fixed in 3.7.3 CVE-2024-31387 Patchstack
5.9 Medium F4 Improvements Plugin f4-improvements Cross-Site Scripting ≤ 1.8.0 Fixed in 1.8.1 CVE-2024-31925 Patchstack
5.9 Medium Advanced Cron Manager – debug & control Plugin advanced-cron-manager Cross-Site Scripting debug & control plugin <= 2.5.2 - Cross Site Scripting (XSS) ≤ 2.5.2 Fixed in 2.5.3 CVE-2024-31926 Patchstack
5.9 Medium WP Login and Logout Redirect Plugin wp-login-and-logout-redirect Cross-Site Scripting ≤ 1.2 Fixed in 2.0 CVE-2024-31927 Patchstack
5.9 Medium Top Bar Plugin top-bar Cross-Site Scripting ≤ 3.0.5 Fixed in 3.0.6 CVE-2024-31928 Patchstack
5.9 Medium Intagrate Lite Plugin instagrate-to-wordpress Cross-Site Scripting ≤ 1.3.7 Fixed in 1.3.8 CVE-2024-31929 Patchstack
5.9 Medium Save as PDF plugin by Pdfcrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting ≤ 3.2.1 Fixed in 3.2.2 CVE-2024-31930 Patchstack
5.9 Medium Save as Image plugin by Pdfcrowd Plugin save-as-image-by-pdfcrowd Cross-Site Scripting ≤ 3.2.1 Fixed in 3.2.2 CVE-2024-31931 Patchstack
5.4 Medium Blocksy Companion Plugin blocksy-companion Cross-Site Request Forgery No login needed ≤ 2.0.28 Fixed in 2.0.29 CVE-2024-31932 Patchstack
4.3 Medium Link Whisper Free Plugin link-whisper Cross-Site Request Forgery No login needed ≤ 0.6.9 Fixed in 0.7.0 CVE-2024-31934 Patchstack
4.3 Medium Simple Post Notes Plugin simple-post-notes Cross-Site Request Forgery No login needed ≤ 1.7.6 Fixed in 1.7.7 CVE-2024-31935 Patchstack
5.4 Medium UsersWP Plugin userswp Cross-Site Request Forgery No login needed < 1.2.6 Fixed in 1.2.6 CVE-2024-31936 Patchstack
5.9 Medium TWIPLA (Visitor Analytics IO) Plugin visitor-analytics-io Cross-Site Scripting ≤ 1.2.0 Fixed in 1.3.0 CVE-2024-31937 Patchstack
4.3 Medium Leadinfo Plugin leadinfo Cross-Site Request Forgery No login needed ≤ 1.0 CVE-2024-32112 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only