WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 17,101–17,150 of 17,674 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | Under Construction / Maintenance Mode from Acurax | Information Disclosure Information Exposure No login needed |
≤ 2.6 |
CVE-2024-1476 |
Wordfence | |
| 5.3 Medium | Coming Soon Page & Maintenance Mode | Broken Access Control Maintenance Mode Bypass No login needed |
≤ 2.2.1 |
CVE-2024-1136 |
Wordfence | |
| 4.3 Medium | Envo's Elementor Templates & Widgets for WooCommerce | Cross-Site Request Forgery Cross-Site Request Forgery via ajax_plugin_activation No login needed |
≤ 1.4.4 |
CVE-2024-0767 |
Wordfence | |
| 5.3 Medium | Page Duplicator | Broken Access Control Missing Authorization to Unauthenticated Post/Page Duplication No login needed |
≤ 0.1.1 |
CVE-2024-1368 |
Wordfence | |
| 5.3 Medium | WP eCommerce | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Creation No login needed |
≤ 3.15.1 |
CVE-2024-1516 |
Wordfence | |
| 4.3 Medium | Envo's Elementor Templates & Widgets for WooCommerce | Broken Access Control Missing Authorization via templates_ajax_request |
≤ 1.4.4 |
CVE-2024-0766 |
Wordfence | |
| 6.3 Medium | Oliver POS – A WooCommerce Point of Sale (POS) | Cross-Site Request Forgery A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgery No login needed |
≤ 2.4.1.8 |
CVE-2024-1954 |
Wordfence | |
| 4.3 Medium | Gestpay for WooCommerce | Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) via ajax_set_default_card No login needed |
≤ 20221130 |
CVE-2024-0431 |
Wordfence | |
| 6.5 Medium | Redirects | Broken Access Control Missing Authorization via save No login needed |
≤ 1.2.1 |
CVE-2024-1566 |
Wordfence | |
| 4.3 Medium | Gestpay for WooCommerce | Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) via ajax_delete_card No login needed |
≤ 20221130 |
CVE-2024-0432 |
Wordfence | |
| 4.3 Medium | Envo's Elementor Templates & Widgets for WooCommerce | Cross-Site Request Forgery Cross-Site Request Forgery via ajax_theme_activation No login needed |
≤ 1.4.4 |
CVE-2024-0768 |
Wordfence | |
| 5.3 Medium | Page Restrict | Information Disclosure Protection Mechanism Bypass No login needed |
≤ 2.5.5 |
CVE-2024-0682 |
Wordfence | |
| 6.4 Medium | CodeMirror Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.2.4 |
CVE-2024-1791 |
Wordfence | |
| 4.3 Medium | Gestpay for WooCommerce | Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) via ajax_unset_default_card No login needed |
≤ 20221130 |
CVE-2024-0433 |
Wordfence | |
| 5.3 Medium | WordPress Access Control | Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed |
≤ 4.0.13 |
CVE-2024-0975 |
Wordfence | |
| 5.3 Medium | WP Private Content Plus | Information Disclosure Protection Mechanism Bypass No login needed |
≤ 3.6 |
CVE-2024-0680 |
Wordfence | |
| 4.3 Medium | Under Construction / Maintenance Mode from Acurax | Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure |
≤ 2.6 |
CVE-2023-6922 |
Wordfence | |
| 4.3 Medium | Yuki | Cross-Site Request Forgery Cross-Site Request Forgery to Theme Setting Reset No login needed |
≤ 1.3.14 |
CVE-2024-1943 |
Wordfence | |
| 6.4 Medium | Seraphinite Accelerator | Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck |
≤ 2.20.52 |
CVE-2024-1568 |
Wordfence | |
| 4.3 Medium | Yuki | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset |
≤ 1.3.13 |
CVE-2024-1388 |
Wordfence | |
| 4.3 Medium | Categorify | Broken Access Control Missing Authorization in categorifyAjaxRenameCategory |
≤ 1.0.7.4 |
CVE-2024-1650 |
Wordfence | |
| 4.3 Medium | Categorify | Broken Access Control Missing Authorization in categorifyAjaxDeleteCategory |
≤ 1.0.7.4 |
CVE-2024-1649 |
Wordfence | |
| 4.3 Medium | Categorify | Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxClearCategory No login needed |
≤ 1.0.7.4 |
CVE-2024-1910 |
Wordfence | |
| 4.3 Medium | Categorify | Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxAddCategory No login needed |
≤ 1.0.7.4 |
CVE-2024-1906 |
Wordfence | |
| 4.3 Medium | Categorify | Broken Access Control Missing Authorization in categorifyAjaxClearCategory |
≤ 1.0.7.4 |
CVE-2024-1652 |
Wordfence | |
| 4.3 Medium | Categorify | Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition No login needed |
≤ 1.0.7.4 |
CVE-2024-1912 |
Wordfence | |
| 4.3 Medium | Categorify | Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxRenameCategory No login needed |
≤ 1.0.7.4 |
CVE-2024-1909 |
Wordfence | |
| 4.3 Medium | Categorify | Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxDeleteCategory No login needed |
≤ 1.0.7.4 |
CVE-2024-1907 |
Wordfence | |
| 4.3 Medium | Categorify | Broken Access Control Missing Authorization in categorifyAjaxUpdateFolderPosition |
≤ 1.0.7.4 |
CVE-2024-1653 |
Wordfence | |
| 6.1 Medium | Shariff Wrapper | Cross-Site Scripting Admin+ Stored XSS No login needed |
< 4.6.10 Fixed in 4.6.10 |
CVE-2024-1106 |
WPScan | |
| 5.3 Medium | Spiffy Calendar | Broken Access Control No login needed |
< 4.9.9 Fixed in 4.9.9 |
CVE-2024-0855 |
WPScan | |
| 4.8 Medium | PageLayer | Cross-Site Scripting Admin+ Stored XSS |
< 1.8.1 Fixed in 1.8.1 |
CVE-2023-7115 |
WPScan | |
| 4.3 Medium | WPDashboardNotes | Broken Access Control Unauthorised Deletion of Private Notes |
< 1.0.11 Fixed in 1.0.11 |
CVE-2023-7198 |
WPScan | |
| 6.1 Medium | Smart Forms | Broken Access Control Subscriber+ Arbitrary Entry Deletion No login needed |
< 2.6.87 Fixed in 2.6.87 |
CVE-2023-7203 |
WPScan | |
| 6.1 Medium | Persian Fonts | Cross-Site Scripting Admin+ Stored XSS No login needed |
≤ 1.6 |
CVE-2023-7167 |
WPScan | |
| 6.1 Medium | Fatal Error Notify | Cross-Site Request Forgery Subscriber+ Test Error Email Sending No login needed |
< 1.5.3 Fixed in 1.5.3 |
CVE-2023-7202 |
WPScan | |
| 5.4 Medium | Thank You Page Customizer for WooCommerce – Increase Your Sales | Broken Access Control Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution |
≤ 1.1.2 |
CVE-2024-1687 |
Wordfence | |
| 4.3 Medium | Thank You Page Customizer for WooCommerce – Increase Your Sales | Broken Access Control Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export |
≤ 1.1.2 |
CVE-2024-1686 |
Wordfence | |
| 6.4 Medium | Orbit Fox by ThemeIsle | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.10.31 |
CVE-2024-1323 |
Wordfence | |
| 5.3 Medium | WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit | Information Disclosure WordPress WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit Plugin <= 1.0.9 is vulnerable to Sensitive Data Exposure No login needed |
≤ 1.0.9 |
CVE-2024-1436 |
Patchstack | |
| 4.3 Medium | Brizy – Page Builder | Path Traversal Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory Traversal |
≤ 2.4.40 |
CVE-2024-1165 |
Wordfence | |
| 5.4 Medium | SuperFaktura WooCommerce | Server-Side Request Forgery Authenticated (Subscriber+) Blind Server-Side Request Forgery |
≤ 1.40.3 |
CVE-2024-1758 |
Wordfence | |
| 6.1 Medium | Archivist – Custom Archive Templates | Cross-Site Scripting Custom Archive Templates <= 1.7.5 - Reflected Cross-Site Scripting No login needed |
≤ 1.7.5 |
CVE-2024-1810 |
Wordfence | |
| 4.9 Medium | Pexels: Free Stock Photos | Server-Side Request Forgery WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF) |
≤ 1.2.2 |
CVE-2024-25915 |
Patchstack | |
| 6.8 Medium | All In One Favicon | Arbitrary File Deletion WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File Deletion |
≤ 4.7 Fixed in 4.8 |
CVE-2023-24416 |
Patchstack | |
| 4.3 Medium | Colibri Page Builder | Cross-Site Request Forgery Cross-Site Request Fogery via cp_shortcode_refresh No login needed |
≤ 1.0.253 |
CVE-2024-1362 |
Wordfence | |
| 4.3 Medium | Colibri WP | Cross-Site Request Forgery Cross-Site Request Forgery to Limited Plugin Installation No login needed |
≤ 1.0.94 |
CVE-2024-1360 |
Wordfence | |
| 4.3 Medium | Colibri Page Builder | Cross-Site Request Forgery Cross-Site Request Fogery via extend_builder No login needed |
≤ 1.0.253 |
CVE-2024-1361 |
Wordfence | |
| 4.6 Medium | Page Builder: Pagelayer – Drag and Drop website builder | Cross-Site Scripting Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button |
≤ 1.8.2 |
CVE-2024-1590 |
Wordfence | |
| 6.1 Medium | Socialdriver | Cross-Site Scripting Prototype Pollution to XSS No login needed |
< 2024 Fixed in 2024 |
CVE-2023-4826 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.