WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 16,301–16,350 of 17,674 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 327 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Revslider Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 6.6.20 CVE-2024-2306 Wordfence
6.4 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget ≤ 3.10.3 CVE-2024-1498 Wordfence
6.5 Medium Classified Listing – Classified ads & Business Directory Plugin classified-listing Broken Access Control Classified ads & Business Directory Plugin <= 3.0.4 - Missing Authorization No login needed ≤ 3.0.4 CVE-2024-1352 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode ≤ 4.8.8 CVE-2024-3267 Wordfence
6.4 Medium Happy Addons for Elementor Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title HTML Tag ≤ 3.10.4 CVE-2024-2787 Wordfence
6.4 Medium Astra Theme astra Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name ≤ 4.6.8 CVE-2024-2347 Wordfence
6.5 Medium VK All in One Expansion Unit Plugin vk-all-in-one-expansion-unit Information Disclosure Information Exposure No login needed ≤ 9.95.0.1 CVE-2024-2093 Wordfence
5.3 Medium Relevanssi – A Better Search Plugin relevanssi Broken Access Control A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update No login needed ≤ 2.25.1, ≤ 4.22.1 CVE-2024-3213 Wordfence
6.4 Medium FooGallery Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 2.4.14 CVE-2024-2081 Wordfence
5.3 Medium Graphene Theme graphene Broken Access Control Missing Authorization No login needed ≤ 2.9.2 CVE-2024-1984 Wordfence
6.4 Medium Ecwid Ecommerce Shopping Cart Plugin Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 6.12.10 CVE-2024-2456 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Widget ≤ 8.3.4 CVE-2024-1458 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Text Separator' and 'Image Compare' Widget ≤ 1.13.2 CVE-2024-2792 Wordfence
6.4 Medium Stackable – Page Builder Gutenberg Blocks Plugin stackable-ultimate-gutenberg-blocks Cross-Site Scripting Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block ≤ 3.12.11 CVE-2024-2039 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 8.3.4 CVE-2024-1461 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget ≤ 2.8.4 CVE-2024-2946 Wordfence
6.4 Medium Global Elementor Buttons Plugin global-elementor-buttons Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via button link ≤ 1.1.0 CVE-2024-2327 Wordfence
6.4 Medium Spectra – WordPress Gutenberg Blocks Plugin Cross-Site Scripting WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS ≤ 2.10.3 CVE-2023-6486 Wordfence
6.4 Medium Sydney Toolbox Plugin sydney-toolbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery ≤ 1.28 CVE-2024-3208 Wordfence
6.8 Medium File Manager Plugin wp-file-manager Path Traversal Authenticated (Administrator+) Directory Traversal ≤ 7.2.5 CVE-2024-2654 Wordfence
6.4 Medium Elementor Website Builder – More than Just a Page Builder Plugin elementor Cross-Site Scripting More than Just a Page Builder <= 3.20.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Path Widget ≤ 3.20.2 CVE-2024-2117 Wordfence
6.4 Medium Page Builder: Pagelayer – Drag and Drop website builder Plugin pagelayer Cross-Site Scripting Drag and Drop website builder <= 1.8.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via custom attributes ≤ 1.8.4 CVE-2024-2504 Wordfence
4.3 Medium Pods Plugin pods Broken Access Control Custom Content Types and Fields - Missing Authorization < 2.7.31, 2.8 – < 2.8.23.2, 3 – < 3.0.10.2 Fixed in 2.7.31 CVE-2023-6965 Wordfence
6.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Cross-Site Scripting Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.5.1 CVE-2024-1424 Wordfence
6.4 Medium Watu Quiz Plugin watu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.4.1 CVE-2024-0873 Wordfence
4.3 Medium Advanced Classifieds & Directory Pro Plugin advanced-classifieds-and-directory-pro Broken Access Control Missing Authorization to Arbitrary Attachment Deletion ≤ 3.0.0 CVE-2024-2222 Wordfence
5.3 Medium Newsmatic Theme newsmatic Information Disclosure Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content No login needed ≤ 1.3.4 CVE-2024-1587 Wordfence
6.4 Medium Happy Addons for Elementor Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Calendy ≤ 3.10.4 CVE-2024-2789 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.11 CVE-2024-2623 Wordfence
6.1 Medium Link Library Plugin link-library Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 7.6.6 CVE-2024-2325 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget ≤ 3.2.25 CVE-2024-1999 Wordfence
6.4 Medium Knight Lab Timeline Plugin Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.3.3 CVE-2024-2287 Wordfence
4.3 Medium Happy Addons for Elementor Plugin happy-elementor-addons Broken Access Control Incorrect Authorization to Information Exposure ≤ 3.10.4 CVE-2024-1387 Wordfence
6.4 Medium Gum Elementor Addon Plugin gum-elementor-addon Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget ≤ 1.3.2 CVE-2024-2348 Wordfence
4.3 Medium Watu Quiz Plugin watu Information Disclosure Sensitive Information Disclosure ≤ 3.4.1 CVE-2024-0872 Wordfence
6.4 Medium Cards for Beaver Builder Plugin bb-bootstrap-cards Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link ≤ 1.1.2 CVE-2024-2305 Wordfence
4.4 Medium LearnPress Plugin learnpress Cross-Site Scripting Authenticated(LP Instructor+) Stored Cross-Site Scripting ≤ 4.2.6.3 CVE-2024-1463 Wordfence
6.4 Medium Ocean Extra Plugin ocean-extra Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.2.6 CVE-2024-3167 Wordfence
6.4 Medium JetWidgets For Elementor Plugin jetwidgets-for-elementor Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL ≤ 1.0.16 CVE-2024-2507 Wordfence
6.4 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via element link ≤ 1.3.0 CVE-2024-2289 Wordfence
6.4 Medium WordPress File Upload Plugin Arbitrary File Upload Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.24.5 CVE-2024-2847 Wordfence
6.4 Medium Elements Plus! Plugin elements-plus Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via widget links ≤ 2.16.2 CVE-2024-2335 Wordfence
6.4 Medium Media Library Assistant Plugin media-library-assistant SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 3.13 CVE-2024-2871 Wordfence
5.8 Medium Relevanssi – A Better Search Plugin relevanssi Content Injection A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection No login needed ≤ 2.25.1, ≤ 4.22.1 CVE-2024-3214 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Carousel Widget ≤ 8.3.4 CVE-2024-1465 Wordfence
4.4 Medium Gutenberg Blocks by Kadence Blocks Plugin Cross-Site Scripting Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings ≤ 3.2.17 CVE-2024-0598 Wordfence
5.3 Medium Avada Theme Information Disclosure Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing No login needed ≤ 7.11.6 CVE-2024-2340 Wordfence
6.4 Medium Passster Plugin content-protector Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via content_protector Shortcode ≤ 4.2.6.4 CVE-2024-2026 Wordfence
6.4 Medium Avada Theme Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action ≤ 7.11.6 CVE-2024-2343 Wordfence
4.9 Medium Ajax Load More Plugin ajax-load-more Path Traversal Authenticated (Admin+) Directory Traversal to Arbitrary File Read ≤ 7.0.1 CVE-2024-1790 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only