WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 16,501–16,550 of 16,788 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 331 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.2 High Icons Font Loader Plugin icons-font-loader Arbitrary File Upload WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload ≤ 1.1.4 Fixed in 1.1.5 CVE-2024-24714 Patchstack
9.9 Critical WP Media folder Plugin Arbitrary File Upload WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload ≤ 5.7.2 Fixed in 5.7.3 CVE-2024-25909 Patchstack
10.0 Critical MoveTo Plugin Arbitrary File Upload WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload No login needed ≤ 6.2 CVE-2024-25913 Patchstack
10.0 Critical WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin Arbitrary File Upload WordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin <= 3.5.12 is vulnerable to Arbitrary File Upload No login needed ≤ 3.5.12 Fixed in 3.5.13 CVE-2024-25925 Patchstack
7.1 High Sitepact Plugin sitepact-klaviyo-contact-form-7 SQL Injection WordPress Sitepact's Contact Form 7 Extension For Klaviyo Plugin <= 1.0.5 is vulnerable to SQL Injection No login needed ≤ 1.0.5 Fixed in 3.0.0 CVE-2024-25928 Patchstack
4.9 Medium Pexels: Free Stock Photos Plugin wp-pexels-free-stock-photos Server-Side Request Forgery WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF) ≤ 1.2.2 CVE-2024-25915 Patchstack
6.8 Medium All In One Favicon Plugin all-in-one-favicon Arbitrary File Deletion WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion ≤ 4.7 Fixed in 4.8 CVE-2023-24416 Patchstack
4.3 Medium Debug Plugin debug Cross-Site Request Forgery WordPress Debug Plugin <= 1.10 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.10 CVE-2024-24798 Patchstack
4.3 Medium JTRT Responsive Tables Plugin jtrt-responsive-tables Cross-Site Request Forgery WordPress JTRT Responsive Tables Plugin <= 4.1.9 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 4.1.9 CVE-2024-24802 Patchstack
4.3 Medium FG PrestaShop to WooCommerce Plugin fg-prestashop-to-woocommerce Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress plugins No login needed ≤ 4.44.3, ≤ 3.67.0, ≤ 4.15.0 Fixed in 4.45.0 CVE-2024-24837 Patchstack
7.1 High PowerPack Pro for Elementor Plugin Cross-Site Request Forgery WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF) No login needed < 2.10.8 Fixed in 2.10.8 CVE-2024-24843 Patchstack
4.3 Medium Quicksand Post Filter jQuery Plugin quicksand-jquery-post-filter Cross-Site Request Forgery WordPress Quicksand Post Filter jQuery Plugin Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 3.1.1 CVE-2024-24849 Patchstack
4.3 Medium Themify Builder Plugin themify-builder Cross-Site Request Forgery WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 7.0.5 Fixed in 7.0.6 CVE-2024-24872 Patchstack
4.3 Medium Admin Menu Editor Plugin admin-menu-editor Cross-Site Request Forgery WordPress Admin Menu Editor Plugin <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.12 Fixed in 1.12.1 CVE-2024-24876 Patchstack
4.3 Medium TinyMCE and TinyMCE Advanced Professsional Formats and Styles Plugin tinymce-and-tinymce-advanced-professsional-formats-and-styles Cross-Site Request Forgery WordPress TinyMCE Professional Formats and Styles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.1.2 CVE-2024-25904 Patchstack
6.4 Medium 3D FlipBook – PDF Flipbook Plugin Cross-Site Scripting PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks ≤ 1.15.3 CVE-2024-1081 Wordfence
5.4 Medium Multi Step Form Plugin multi-step-form Cross-Site Request Forgery WordPress Multi Step Form Plugin <= 1.7.18 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.7.18 CVE-2024-25905 Patchstack
4.7 Medium Database Reset Plugin wordpress-database-reset Cross-Site Request Forgery Cross-Site Request Forgery to WP Reset Plugin Installation No login needed ≤ 3.22 CVE-2024-1501 Wordfence
4.3 Medium Contact Form builder with drag & drop for WordPress – Kali Forms Plugin kali-forms Broken Access Control Kali Forms <= 2.3.41 - Missing Authorization ≤ 2.3.41 CVE-2024-1218 Wordfence
4.4 Medium Best WordPress Gallery Plugin – FooGallery Plugin foogallery Cross-Site Scripting FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings ≤ 2.4.7 CVE-2024-0604 Wordfence
7.6 High Contact Form builder with drag & drop for WordPress – Kali Forms Plugin kali-forms Broken Access Control Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation ≤ 2.3.41 CVE-2024-1217 Wordfence
9.8 Critical MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system SQL Injection for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection No login needed ≤ 3.2.5 CVE-2024-1512 Wordfence
4.3 Medium SMTP Mail Plugin smtp-mail Cross-Site Request Forgery WordPress SMTP Mail Plugin <= 1.3.20 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.3.20 CVE-2024-25914 Patchstack
5.4 Medium Chart.js Plugin Cross-Site Scripting Editor+ Stored Cross-Site Scripting in New Chart 2023.2 – 2023.2 CVE-2023-6081 WPScan
5.4 Medium Chart.js Plugin Cross-Site Scripting Editor+ Stored Cross-Site Scripting 2023.2 – 2023.2 CVE-2023-6082 WPScan
6.1 Medium MapPress Maps Plugin Cross-Site Scripting Contributor+ Stored XSS No login needed < 2.88.15 Fixed in 2.88.15 CVE-2024-0420 WPScan
5.3 Medium MapPress Maps Plugin Information Disclosure Unauthenticated Arbitrary Private/Draft Post Disclosure No login needed < 2.88.16 Fixed in 2.88.16 CVE-2024-0421 WPScan
4.3 Medium Link Library Plugin link-library Cross-Site Request Forgery WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 7.5.13 Fixed in 7.6 CVE-2024-24875 Patchstack
4.3 Medium Contact Form 7 Connector Plugin ari-cf7-connector Cross-Site Request Forgery WordPress Contact Form 7 Connector Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.2.2 Fixed in 1.2.3 CVE-2024-24884 Patchstack
5.4 Medium Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Plugin contest-gallery Cross-Site Request Forgery WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 21.2.8.4 Fixed in 21.2.9 CVE-2024-24887 Patchstack
4.3 Medium WP Contact Form Plugin wp-contact-form Cross-Site Request Forgery WordPress WP Contact Form Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.6 CVE-2024-24929 Patchstack
4.3 Medium Basic Log Viewer Plugin wpsimpletools-log-viewer Cross-Site Request Forgery WordPress Basic Log Viewer Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.0.4 CVE-2024-24935 Patchstack
5.4 Medium KD Coming Soon Plugin kd-coming-soon PHP Object Injection WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection No login needed ≤ 1.7 CVE-2023-46615 Patchstack
8.7 High ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks Plugin product-blocks PHP Object Injection Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection No login needed ≤ 3.1.4 Fixed in 3.1.5 CVE-2024-23512 Patchstack
8.7 High PropertyHive Plugin propertyhive PHP Object Injection WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection No login needed ≤ 2.0.5 Fixed in 2.0.6 CVE-2024-23513 Patchstack
8.2 High Event Manager and Tickets Selling Plugin for WooCommerce – WpEvently – Plugin mage-eventpress PHP Object Injection WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection ≤ 4.1.1 Fixed in 4.1.2 CVE-2024-24796 Patchstack
9.8 Critical ERE Recently Viewed – Essential Real Estate Add-On Plugin ere-recently-viewed PHP Object Injection WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection No login needed ≤ 1.3 CVE-2024-24797 Patchstack
7.5 High Brooklyn | Creative Multi-Purpose Responsive Theme PHP Object Injection WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection ≤ 4.9.7.6 CVE-2024-24926 Patchstack
10.0 Critical Coupon Referral Program Plugin coupon-referral-program PHP Object Injection Unauthenticated PHP Object Injection No login needed < 1.8.4 Fixed in 1.8.4 CVE-2024-25100 Patchstack
5.9 Medium Chartify – WordPress Chart Plugin chart-builder Cross-Site Scripting WordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS) ≤ 2.0.6 Fixed in 2.0.7 CVE-2023-47526 Patchstack
6.5 Medium Sensei LMS – Online Courses, Quizzes, & Learning Plugin sensei-lms Cross-Site Scripting WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS) ≤ 4.17.0 Fixed in 4.18.0 CVE-2023-50875 Patchstack
5.9 Medium WP Chat App Plugin wp-whatsapp Cross-Site Scripting WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS) ≤ 3.4.4 Fixed in 3.4.5 CVE-2023-51370 Patchstack
6.5 Medium Restaurant Reservations Plugin nd-restaurant-reservations Cross-Site Scripting WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS) ≤ 1.8 Fixed in 1.9 CVE-2023-51403 Patchstack
6.1 Medium All 404 Pages Redirect to Homepage Plugin all-404-pages-redirect-to-homepage Cross-Site Scripting WordPress All 404 Pages Redirect to Homepage Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 1.9 Fixed in 2.0 CVE-2024-24889 Patchstack
7.1 High Brooklyn | Creative Multi-Purpose Responsive Theme Cross-Site Scripting WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 4.9.7.6 CVE-2024-24927 Patchstack
6.5 Medium Content Cards Plugin content-cards Cross-Site Scripting WordPress Content Cards Plugin <= 0.9.7 is vulnerable to Cross Site Scripting (XSS) ≤ 0.9.7 CVE-2024-24928 Patchstack
6.5 Medium Buttons Shortcode and Widget Plugin buttons-shortcode-and-widget Cross-Site Scripting WordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS) ≤ 1.16 CVE-2024-24930 Patchstack
6.5 Medium Before After Image Slider WP Plugin before-after-image-slider Cross-Site Scripting WordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) ≤ 2.2 CVE-2024-24931 Patchstack
7.1 High VK Poster Group Plugin vk-poster-group Cross-Site Scripting WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 2.0.3 CVE-2024-24932 Patchstack
7.1 High Honeypot for WP Comment Plugin honeypot-for-wp-comment Cross-Site Scripting WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 2.2.3 CVE-2024-24933 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only