WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 16,351–16,400 of 17,674 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Rank Math SEO with AI SEO Tools | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes |
≤ 1.0.214 |
CVE-2024-2536 |
Wordfence | |
| 5.3 Medium | s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions | Information Disclosure Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure No login needed |
≤ 230815 |
CVE-2024-0899 |
Wordfence | |
| 6.4 Medium | Elementor Addons by Livemesh | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Slider Widget |
≤ 8.3.4 |
CVE-2024-1464 |
Wordfence | |
| 5.3 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Information Disclosure Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure No login needed |
≤ 5.9.13 |
CVE-2024-2974 |
Wordfence | |
| 6.4 Medium | Beaver Builder Addons by WPZOOM | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget |
≤ 1.3.4 |
CVE-2024-2183 |
Wordfence | |
| 6.4 Medium | EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more | Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.9.14 |
CVE-2024-3244 |
Wordfence | |
| 5.3 Medium | WordPress Gallery Plugin – NextGEN Gallery | Broken Access Control NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure No login needed |
≤ 3.59 |
CVE-2024-3097 |
Wordfence | |
| 4.3 Medium | Plugin Permalink | Broken Access Control Missing Authorization via get_uri_editor |
≤ 2.4.3.1 |
CVE-2024-2543 |
Wordfence | |
| 6.4 Medium | Modal Window – create popup modal window | Cross-Site Scripting create popup modal window <= 5.3.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 5.3.8 |
CVE-2024-2457 |
Wordfence | |
| 6.4 Medium | Beaver Builder Addons by WPZOOM | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget |
≤ 1.3.4 |
CVE-2024-2186 |
Wordfence | |
| 6.4 Medium | Happy Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title HTML Tag |
≤ 3.10.4 |
CVE-2024-2788 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.9.11 |
CVE-2024-2650 |
Wordfence | |
| 6.4 Medium | GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in | Cross-Site Scripting The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 6.9.0 |
CVE-2024-2783 |
Wordfence | |
| 6.1 Medium | Permalink Manager Lite and Permalink Manager Pro | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 2.4.3.1 |
CVE-2024-2738 |
Wordfence | |
| 6.4 Medium | Getwid – Gutenberg Blocks | Cross-Site Scripting Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content |
≤ 2.0.5 |
CVE-2024-1948 |
Wordfence | |
| 4.4 Medium | WP Recipe Maker | Cross-Site Scripting Authenticated Stored Cross-Site Scripting via Video Embed |
≤ 9.2.1 |
CVE-2024-1571 |
Wordfence | |
| 4.3 Medium | Paid Memberships Pro | Cross-Site Request Forgery No login needed |
≤ 2.12.10 |
CVE-2024-0588 |
Wordfence | |
| 6.4 Medium | Beaver Builder Addons by WPZOOM | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget |
≤ 1.3.4 |
CVE-2024-2181 |
Wordfence | |
| 5.9 Medium | WP Reset | Information Disclosure Sensitive Information Exposure due to Insufficient Randomness No login needed |
≤ 2.0 |
CVE-2023-6799 |
Wordfence | |
| 6.4 Medium | Real Media Library: Media Library Folder & File Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.22.7 |
CVE-2024-2027 |
Wordfence | |
| 6.4 Medium | Template Kit – Import | Cross-Site Scripting Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload |
≤ 1.0.14 |
CVE-2024-2334 |
Wordfence | |
| 6.4 Medium | Elementor Addons by Livemesh | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Multislider Widget |
≤ 8.3.4 |
CVE-2024-1466 |
Wordfence | |
| 6.1 Medium | Contact Form by BestWebSoft | Cross-Site Scripting Reflected Cross-Site Scripting via cntctfrm_contact_address No login needed |
≤ 4.2.8 |
CVE-2024-2198 |
Wordfence | |
| 5.3 Medium | WooCommerce Clover Payment Gateway | Broken Access Control Missing Authorization via callback_handler No login needed |
≤ 1.3.1 |
CVE-2024-0626 |
Wordfence | |
| 5.9 Medium | Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder | Information Disclosure Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.22 - Sensitive Information Exposure No login needed |
≤ 1.15.22 |
CVE-2024-2112 |
Wordfence | |
| 4.4 Medium | FancyBox | Cross-Site Scripting The FancyBox for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions 3.0.2 to 3.3.3 due to insufficient input sanitization a… |
3.0.2 – 3.3.3 |
CVE-2024-0662 |
Wordfence | |
| 6.4 Medium | Lightweight Accordion | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.5.16 |
CVE-2024-2436 |
Wordfence | |
| 6.4 Medium | SEOPress – On-site SEO | Cross-Site Scripting On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting |
≤ 7.5.2.1 |
CVE-2024-2165 |
Wordfence | |
| 5.3 Medium | WP Go Maps (formerly WP Google Maps) | Information Disclosure Information Exposure to Potential Denial of Service No login needed |
≤ 9.0.34 |
CVE-2023-6777 |
Wordfence | |
| 5.4 Medium | Happy Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via title_tag |
≤ 3.10.4 |
CVE-2024-2786 |
Wordfence | |
| 6.3 Medium | AI Post Generator | AutoWriter | Broken Access Control Missing Authorization |
≤ 3.3 |
CVE-2024-1850 |
Wordfence | |
| 6.4 Medium | Popup Maker – Popup for opt-ins, lead gen, & more | Cross-Site Scripting Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.18.2 |
CVE-2024-2336 |
Wordfence | |
| 6.4 Medium | Qi Addons For Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.6.7 |
CVE-2024-0826 |
Wordfence | |
| 6.4 Medium | WP Chat App | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute |
≤ 3.6.2 |
CVE-2024-2513 |
Wordfence | |
| 6.4 Medium | ShopLentor | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Banner Link |
≤ 2.8.1 |
CVE-2024-1960 |
Wordfence | |
| 6.4 Medium | UsersWP | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.2.6 |
CVE-2024-2423 |
Wordfence | |
| 4.3 Medium | Event Tickets and Registration | Information Disclosure Improper Authorization to Information Disclosure |
≤ 5.8.2 |
CVE-2024-2261 |
Wordfence | |
| 6.4 Medium | BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg | Cross-Site Scripting Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.4.2 |
CVE-2024-2845 |
Wordfence | |
| 6.1 Medium | Contact Form by BestWebSoft | Cross-Site Scripting Reflected Cross-Site Scripting via cntctfrm_contact_subject No login needed |
≤ 4.2.8 |
CVE-2024-2200 |
Wordfence | |
| 6.4 Medium | Custom post types, Custom Fields & more | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.0.4 |
CVE-2023-6993 |
Wordfence | |
| 6.4 Medium | Bold Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute |
≤ 4.8.8 |
CVE-2024-3266 |
Wordfence | |
| 6.4 Medium | Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE | Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.6.4 |
CVE-2024-2226 |
Wordfence | |
| 4.3 Medium | MasterStudy LMS | Broken Access Control Missing Authorization to Sensitive Information Exposure in search_posts |
≤ 3.2.13 |
CVE-2024-1904 |
Wordfence | |
| 4.3 Medium | 360 Javascript Viewer | Broken Access Control Missing Authorization to Plugin Settings Update |
≤ 1.7.12 |
CVE-2024-1637 |
Wordfence | |
| 6.4 Medium | Elementor Addons, Widgets and Enhancements – Stax | Cross-Site Scripting Stax <= 1.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.4.4.1 |
CVE-2024-3064 |
Wordfence | |
| 6.4 Medium | Forminator – Contact Form, Payment Form & Custom Form Builder | Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode |
≤ 1.29.2 |
CVE-2024-3053 |
Wordfence | |
| 6.4 Medium | PowerPack Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Tweet Widget |
≤ 2.7.18 |
CVE-2024-2492 |
Wordfence | |
| 6.4 Medium | Premium Addons for Elementor | Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link Widget |
≤ 4.10.16 |
CVE-2024-0376 |
Wordfence | |
| 5.4 Medium | Accordion | Broken Access Control Missing Authorization to Authenticated(Contributor+) Post Duplication |
≤ 2.2.96 |
CVE-2024-1641 |
Wordfence | |
| 6.5 Medium | LearnPress | Broken Access Control Insecure Direct Object Reference No login needed |
≤ 4.2.6.3 |
CVE-2024-1289 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.