WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 17,001–17,050 of 17,051 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 341 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.6 High pTypeConverter Plugin ptypeconverter SQL Injection WordPress pTypeConverter Plugin <= 0.2.8.1 is vulnerable to SQL Injection ≤ 0.2.8.1 CVE-2023-52201 Patchstack
5.9 Medium cformsII Plugin cforms2 Cross-Site Scripting WordPress CformsII Plugin <= 15.0.5 is vulnerable to Cross Site Scripting (XSS) ≤ 15.0.5 CVE-2023-52203 Patchstack
8.5 High Randomize Plugin randomize SQL Injection WordPress Randomize Plugin <= 1.4.3 is vulnerable to SQL Injection ≤ 1.4.3 CVE-2023-52204 Patchstack
7.7 High Page Builder: Live Composer Plugin live-composer-page-builder PHP Object Injection WordPress Page Builder: Live Composer Plugin <= 1.5.25 is vulnerable to PHP Object Injection ≤ 1.5.25 CVE-2023-52206 Patchstack
7.1 High Rate Star Review – AJAX Reviews for Content, with Star Ratings Plugin rate-star-review Cross-Site Scripting WordPress Rate Star Review Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 1.5.1 Fixed in 1.5.2 CVE-2023-52213 Patchstack
4.3 Medium JS & CSS Script Optimizer Plugin js-css-script-optimizer Cross-Site Request Forgery WordPress JS & CSS Script Optimizer Plugin <= 0.3.3 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 0.3.3 CVE-2023-52216 Patchstack
9.6 Critical ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Request Forgery WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection No login needed ≤ 4.0.22 Fixed in 4.0.23 CVE-2023-52200 Patchstack
9.1 Critical HTML5 SoundCloud Player with Playlist Free Plugin html5-soundcloud-player-with-playlist PHP Object Injection WordPress HTML5 SoundCloud Player Plugin <= 2.8.0 is vulnerable to PHP Object Injection ≤ 2.8.0 CVE-2023-52205 Patchstack
9.1 Critical HTML5 MP3 Player with Playlist Free Plugin html5-mp3-player-with-playlist PHP Object Injection WordPress HTML5 MP3 Player with Playlist Free Plugin <= 3.0.0 is vulnerable to PHP Object Injection ≤ 3.0.0 CVE-2023-52207 Patchstack
7.5 High Coupon Referral Program Plugin Information Disclosure WordPress Coupon Referral Program Plugin <= 1.7.2 is vulnerable to Sensitive Data Exposure No login needed ≤ 1.7.2 CVE-2023-52190 Patchstack
5.3 Medium Constant Contact Forms Plugin constant-contact-forms Information Disclosure WordPress Constant Contact Forms Plugin <= 2.4.2 is vulnerable to Sensitive Data Exposure No login needed ≤ 2.4.2 CVE-2023-52208 Patchstack
4.3 Medium WooCommerce Plugin woocommerce Cross-Site Request Forgery WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 8.2.2 Fixed in 8.3.0 CVE-2023-52222 Patchstack
9.3 Critical Simple Inventory Management – just scan barcode to manage products and orders. For WooCommerce Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders SQL Injection WordPress Barcode Scanner with Inventory & Order Manager Plugin <=1.5.1 is vulnerable to SQL Injection No login needed ≤ 1.5.1 Fixed in 1.5.2 CVE-2023-52215 Patchstack
10.0 Critical Woocommerce Tranzila Payment Gateway Plugin woo-tranzila-gateway PHP Object Injection WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection No login needed ≤ 1.0.8 CVE-2023-52218 Patchstack
9.9 Critical Gecka Terms Thumbnails Plugin gecka-terms-thumbnails PHP Object Injection WordPress Gecka Terms Thumbnails Plugin <= 1.1 is vulnerable to PHP Object Injection ≤ 1.1 CVE-2023-52219 Patchstack
10.0 Critical Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics Plugin taggbox-widget PHP Object Injection WordPress Taggbox Plugin <= 3.1 is vulnerable to PHP Object Injection No login needed ≤ 3.1 CVE-2023-52225 Patchstack
6.5 Medium Mapster WP Maps Plugin mapster-wp-maps Cross-Site Scripting WordPress Mapster WP Maps Plugin <= 1.2.38 is vulnerable to Cross Site Scripting (XSS) ≤ 1.2.38 CVE-2024-21744 Patchstack
6.5 Medium Laybuy Payment Extension for WooCommerce Plugin laybuy-gateway-for-woocommerce Cross-Site Scripting WordPress Laybuy Payment Extension for WooCommerce Plugin <= 5.3.9 is vulnerable to Cross Site Scripting (XSS) ≤ 5.3.9 CVE-2024-21745 Patchstack
7.6 High WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting Plugin erp SQL Injection WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection ≤ 1.12.8 Fixed in 1.12.9 CVE-2024-21747 Patchstack
6.5 Medium WP Tabs – Responsive Tabs Plugin wp-expand-tabs-free Cross-Site Scripting WordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS) ≤ 2.2.0 Fixed in 2.2.1 CVE-2023-52124 Patchstack
6.5 Medium iframe Plugin iframe Cross-Site Scripting WordPress iFrame Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS) ≤ 4.8 Fixed in 4.9 CVE-2023-52125 Patchstack
5.3 Medium Send Users Email Plugin send-users-email Information Disclosure WordPress Send Users Email Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure No login needed ≤ 1.4.3 Fixed in 1.4.4 CVE-2023-52126 Patchstack
7.5 High WP Stripe Checkout Plugin wp-stripe-checkout Information Disclosure WordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data Exposure No login needed ≤ 1.2.2.37 Fixed in 1.2.2.38 CVE-2023-52143 Patchstack
5.3 Medium 404 Solution Plugin 404-solution Information Disclosure WordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data Exposure No login needed ≤ 2.33.0 Fixed in 2.33.1 CVE-2023-52146 Patchstack
5.3 Medium Affiliates Manager Plugin affiliates-manager Information Disclosure WordPress Affiliates Manager Plugin <= 2.9.30 is vulnerable to Sensitive Data Exposure No login needed ≤ 2.9.30 Fixed in 2.9.31 CVE-2023-52148 Patchstack
5.3 Medium Uncanny Automator – Automate everything with the #1 no-code automation and integration Plugin uncanny-automator Information Disclosure WordPress Uncanny Automator Plugin <= 5.1.0.2 is vulnerable to Sensitive Data Exposure No login needed ≤ 5.1.0.2 Fixed in 5.1.0.3 CVE-2023-52151 Patchstack
10.0 Critical JS Help Desk – Best Help Desk & Support Plugin js-support-ticket Arbitrary File Upload Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File Upload No login needed ≤ 2.7.1 Fixed in 2.7.2 CVE-2022-46839 Patchstack
4.3 Medium Doofinder WP & WooCommerce Search Plugin doofinder-for-woocommerce Broken Access Control WordPress Doofinder for WooCommerce Plugin <= 2.0.33 is vulnerable to Broken Access Control ≤ 2.0.33 Fixed in 2.1.1 CVE-2023-51678 Patchstack
4.3 Medium Spam protection, Anti-Spam, FireWall by CleanTalk Plugin cleantalk-spam-protect Cross-Site Request Forgery WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 6.20 Fixed in 6.21 CVE-2023-51535 Patchstack
5.4 Medium Stylish Price List – Price Table Builder & QR Code Restaurant Menu Plugin stylish-price-list Broken Access Control WordPress Stylish Price List Plugin <= 7.0.17 is vulnerable to Broken Access Control ≤ 7.0.17 Fixed in 7.0.18 CVE-2023-51673 Patchstack
4.3 Medium Inline Image Upload for BBPress Plugin image-upload-for-bbpress Cross-Site Request Forgery WordPress Inline Image Upload for BBPress Plugin <= 1.1.18 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.1.18 Fixed in 1.1.19 CVE-2023-51668 Patchstack
4.3 Medium Awesome Support – WordPress HelpDesk & Support Plugin awesome-support Cross-Site Request Forgery WordPress Awesome Support Plugin <= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 6.1.5 Fixed in 6.1.6 CVE-2023-51538 Patchstack
5.4 Medium Apollo13 Framework Extensions Plugin apollo13-framework-extensions Cross-Site Request Forgery WordPress Apollo13 Framework Extensions Plugin <= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2023-51539 Patchstack
4.3 Medium Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building Plugin icegram Cross-Site Request Forgery WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 3.1.18 Fixed in 3.1.19 CVE-2023-52119 Patchstack
5.4 Medium NEX-Forms – Ultimate Form Builder – Contact forms and much more Plugin nex-forms-express-wp-form-builder Cross-Site Request Forgery Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 8.5.2 Fixed in 8.5.5 CVE-2023-52120 Patchstack
5.4 Medium NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images Plugin nitropack Cross-Site Request Forgery WordPress NitroPack Plugin <= 1.10.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.10.2 Fixed in 1.10.3 CVE-2023-52121 Patchstack
4.3 Medium Simple Job Board Plugin simple-job-board Cross-Site Request Forgery WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 2.10.6 Fixed in 2.10.7 CVE-2023-52122 Patchstack
4.3 Medium Strong Testimonials Plugin strong-testimonials Cross-Site Request Forgery WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 3.1.10 Fixed in 3.1.11 CVE-2023-52123 Patchstack
4.3 Medium WPC Product Bundles for WooCommerce Plugin woo-product-bundle Cross-Site Request Forgery WordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 7.3.1 Fixed in 7.3.2 CVE-2023-52127 Patchstack
4.3 Medium White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard Plugin white-label Cross-Site Request Forgery WordPress White Label Plugin <= 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 2.9.0 Fixed in 2.9.1 CVE-2023-52128 Patchstack
6.3 Medium teachPress Plugin teachpress Cross-Site Request Forgery WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 9.0.4 Fixed in 9.0.5 CVE-2023-52129 Patchstack
4.3 Medium Affiliates Manager Plugin affiliates-manager Cross-Site Request Forgery WordPress Affiliates Manager Plugin <= 2.9.31 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 2.9.31 Fixed in 2.9.32 CVE-2023-52130 Patchstack
4.3 Medium Custom Twitter Feeds – A Tweets Widget or X Feed Widget Plugin custom-twitter-feeds Cross-Site Request Forgery WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 2.1.2 Fixed in 2.2 CVE-2023-52136 Patchstack
4.3 Medium Republish Old Posts Plugin republish-old-posts Cross-Site Request Forgery WordPress Republish Old Posts Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.21 Fixed in 1.27 CVE-2023-52145 Patchstack
5.4 Medium Floating Button Plugin floating-button Cross-Site Request Forgery WordPress Floating Button Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 6.0 Fixed in 6.0.1 CVE-2023-52149 Patchstack
8.8 High Dynamic Content for Elementor Plugin Cross-Site Request Forgery WordPress Dynamic Content for Elementor Plugin < 2.12.5 is vulnerable to Cross Site Request Forgery (CSRF) No login needed < 2.12.5 Fixed in 2.12.5 CVE-2023-52150 Patchstack
4.3 Medium WP Job Portal – A Complete Job Board Plugin wp-job-portal Cross-Site Request Forgery WordPress WP Job Portal Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 2.0.6 Fixed in 2.0.7 CVE-2023-52184 Patchstack
7.5 High WooCommerce Stripe Payment Gateway Plugin woocommerce-gateway-stripe Broken Access Control WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) No login needed ≤ 7.6.1 Fixed in 7.6.2 CVE-2023-51502 Patchstack
6.5 Medium WP Affiliate Disclosure Plugin wp-affiliate-disclosure Information Disclosure WordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS) ≤ 1.2.7 Fixed in 1.2.8 CVE-2023-52178 Patchstack
6.4 Medium MapPress Maps Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.88.13 CVE-2023-6524 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only