WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 16,801–16,850 of 17,674 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 337 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Five Star Restaurant Menu Plugin food-and-drink-menu Cross-Site Scripting ≤ 2.4.14 Fixed in 2.4.15 CVE-2024-29089 Patchstack
4.3 Medium Builder for WooCommerce reviews shortcodes – ReviewShort Plugin woo-product-reviews-shortcode Cross-Site Request Forgery ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.01.3 Fixed in 1.01.4 CVE-2024-29093 Patchstack
5.9 Medium Site Reviews Plugin site-reviews Cross-Site Scripting ≤ 6.11.6 Fixed in 6.11.7 CVE-2024-29095 Patchstack
6.5 Medium MJM Clinic Plugin mjm-clinic Cross-Site Scripting ≤ 1.1.22 Fixed in 1.1.23 CVE-2024-29096 Patchstack
6.3 Medium User profile Plugin user-profile Cross-Site Scripting Subscriber+ Stored Cross Site Scripting (XSS) ≤ 2.0.20 Fixed in 2.0.21 CVE-2024-29097 Patchstack
6.5 Medium WP Calameo Plugin wp-calameo Cross-Site Scripting ≤ 2.1.7 Fixed in 2.1.8 CVE-2024-29098 Patchstack
6.5 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting ≤ 2.6.2 Fixed in 2.6.3 CVE-2024-29101 Patchstack
6.5 Medium Ticket Tailor Plugin ticket-tailor Cross-Site Scripting ≤ 1.10 Fixed in 1.12 CVE-2024-29104 Patchstack
5.9 Medium WP Popups Plugin wp-popups-lite Cross-Site Scripting WordPress Popup builder plugin <= 2.1.5.5 - Cross Site Scripting (XSS) ≤ 2.1.5.5 Fixed in 2.1.5.6 CVE-2024-29105 Patchstack
6.5 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting ≤ 4.10.16 Fixed in 4.10.17 CVE-2024-29106 Patchstack
6.5 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting ≤ 1.12.10 Fixed in 1.12.11 CVE-2024-29107 Patchstack
6.5 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting ≤ 3.10.1 Fixed in 3.10.2 CVE-2024-29108 Patchstack
6.5 Medium Shariff Wrapper Plugin shariff Cross-Site Scripting Contributor+ Cross Site Scripting (XSS) ≤ 4.6.10 Fixed in 4.6.11 CVE-2024-29109 Patchstack
6.5 Medium Sitekit Plugin sitekit Cross-Site Scripting ≤ 1.6 Fixed in 1.7 CVE-2024-29111 Patchstack
5.9 Medium WooCommerce Google Feed Manager Plugin wp-product-feed-manager Cross-Site Scripting ≤ 2.2.0 Fixed in 2.3.0 CVE-2024-29112 Patchstack
6.5 Medium Download Manager Plugin download-manager Cross-Site Scripting ≤ 3.2.84 Fixed in 3.2.85 CVE-2024-29114 Patchstack
6.5 Medium Smart Online Order for Clover Plugin clover-online-orders Cross-Site Scripting ≤ 1.5.5 Fixed in 1.5.6 CVE-2024-29115 Patchstack
6.5 Medium Scrollsequence Plugin scrollsequence Cross-Site Scripting ≤ 1.5.4 Fixed in 1.5.5 CVE-2024-29118 Patchstack
6.5 Medium FV Flowplayer Video Player Plugin fv-wordpress-flowplayer Cross-Site Scripting ≤ 7.5.41.7212 Fixed in 7.5.44.7212 CVE-2024-29122 Patchstack
4.8 Medium Profile Box Shortcode And Widget Plugin facebook-likebox-widget-and-shortcode Cross-Site Scripting Profile Box Shortcode And Widget < 1.2.1 Admin+ Stored XSS < 1.2.1 Fixed in 1.2.1 CVE-2024-1401 WPScan
5.9 Medium Advanced Access Manager Plugin advanced-access-manager Cross-Site Scripting ≤ 6.9.20 Fixed in 6.9.21 CVE-2024-29124 Patchstack
6.5 Medium Tourfic Plugin tourfic Cross-Site Scripting ≤ 2.11.8 Fixed in 2.11.9 CVE-2024-29134 Patchstack
5.9 Medium MJM Clinic Plugin mjm-clinic Cross-Site Scripting ≤ 1.1.22 Fixed in 1.1.23 CVE-2024-29140 Patchstack
5.5 Medium PDF Embedder Plugin pdf-embedder Cross-Site Scripting ≤ 4.6.4 Fixed in 4.7.1 CVE-2024-29141 Patchstack
6.5 Medium Passwordless Login Plugin passwordless-login Cross-Site Scripting ≤ 1.1.2 Fixed in 1.1.3 CVE-2024-29143 Patchstack
4.7 Medium Backup Bolt Plugin backup-bolt Information Disclosure Sensitive Data Exposure No login needed ≤ 1.3.0 CVE-2023-7236 WPScan
4.8 Medium Advanced Social Feeds Widget & Shortcode Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.7 CVE-2024-0951 WPScan
6.1 Medium Buttons Shortcode and Widget Plugin Cross-Site Scripting Stored XSS via shortcode No login needed ≤ 1.16 CVE-2024-0711 WPScan
5.4 Medium Scalable Vector Graphics (SVG) Plugin Cross-Site Scripting Author+ Stored XSS via SVG ≤ 3.4 CVE-2023-7085 WPScan
6.5 Medium Error Log Viewer Plugin error-log-viewer Information Disclosure Directory Listing to Sensitive Data Exposure < 1.1.3 Fixed in 1.1.3 CVE-2023-6821 WPScan
6.1 Medium Widget for Social Page Feeds Plugin Cross-Site Scripting Admin+ Stored XSS No login needed < 6.4 Fixed in 6.4 CVE-2024-0973 WPScan
5.4 Medium Jobs Plugin Cross-Site Scripting Contributor+ Stored XSS < 2.7.4 Fixed in 2.7.4 CVE-2024-0820 WPScan
5.4 Medium Tabs Shortcode and Widget Plugin Cross-Site Scripting Contributor+ Stored Cross-Site Scripting ≤ 1.17 CVE-2024-0719 WPScan
6.5 Medium Fancy Product Designer Plugin SQL Injection Admin+ SQL Injection < 6.1.5 Fixed in 6.1.5 CVE-2024-0365 WPScan
5.4 Medium Grid Shortcodes Plugin grid-shortcodes Cross-Site Scripting Contributor+ Stored XSS < 1.1.1 Fixed in 1.1.1 CVE-2024-1658 WPScan
5.4 Medium Responsive Pricing Table Plugin dk-pricr-responsive-pricing-table Cross-Site Scripting Author+ Stored XSS < 5.1.11 Fixed in 5.1.11 CVE-2024-1333 WPScan
6.1 Medium Team Members Plugin team-members Cross-Site Scripting Author+ Stored XSS No login needed < 5.3.2 Fixed in 5.3.2 CVE-2024-1331 WPScan
5.3 Medium Frontend File Manager Plugin nmedia-user-file-uploader Information Disclosure Sensitive Data Exposure No login needed ≤ 22.7 Fixed in 22.8 CVE-2024-25903 Patchstack
5.3 Medium WP Editor Plugin wp-editor Information Disclosure Sensitive Data Exposure No login needed ≤ 1.2.7 Fixed in 1.2.8 CVE-2024-25591 Patchstack
5.3 Medium WP Visitor Statistics (Real Time Traffic) Plugin wp-stats-manager Information Disclosure Sensitive Data Exposure No login needed ≤ 6.9.4 Fixed in 6.9.5 CVE-2024-24867 Patchstack
5.3 Medium PeproDev Ultimate Invoice Plugin pepro-ultimate-invoice Information Disclosure Sensitive Data Exposure No login needed ≤ 1.9.7 CVE-2024-25933 Patchstack
5.3 Medium Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates Plugin Broken Access Control Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure No login needed ≤ 2.6.6 CVE-2024-1857 Wordfence
5.3 Medium Word Replacer Pro Plugin word-replacer-ultra Broken Access Control Missing Authorization to Unauthenticated Arbitrary Content Update No login needed ≤ 1.0 CVE-2024-1733 Wordfence
5.3 Medium Post Thumbnail Editor Plugin post-thumbnail-editor Information Disclosure Unauthenticated Sensitive Data Exposure No login needed ≤ 2.4.8 CVE-2024-24845 Patchstack
6.5 Medium Elementor Pro Plugin Information Disclosure Contributor+ Arbitrary User Meta Data Retrieval ≤ 3.19.2 Fixed in 3.19.3 CVE-2024-23523 Patchstack
5.5 Medium ElementsKit Elementor addons Plugin elementskit-lite Cross-Site Scripting Authenticated(Editor+) Stored Cross-Site Scripting ≤ 3.0.3 CVE-2023-6525 Wordfence
6.4 Medium ElementsKit Elementor addons Plugin elementskit-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget ≤ 3.0.5 CVE-2024-2042 Wordfence
6.4 Medium ElementsKit Elementor addons Plugin elementskit-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.0.4 CVE-2024-1239 Wordfence
4.9 Medium Backuply – Backup, Restore, Migrate and Clone Plugin backuply Path Traversal Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal ≤ 1.2.7 CVE-2024-2294 Wordfence
6.4 Medium ElementInvader Addons for Elementor Plugin elementinvader-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.2 CVE-2024-2308 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only