WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 17,201–17,250 of 17,674 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 345 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Featured Image from URL (FIFU) Plugin featured-image-from-url Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url ≤ 4.6.2 CVE-2024-1496 Wordfence
6.4 Medium Email Encoder – Protect Email Addresses and Phone Numbers Plugin email-encoder-bundle Cross-Site Scripting Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.2.0 CVE-2024-1282 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.3.2 CVE-2024-1235 Wordfence
5.3 Medium WP Maintenance Plugin wp-maintenance Information Disclosure Information Exposure No login needed ≤ 6.1.6 CVE-2024-1472 Wordfence
6.4 Medium ProfilePress Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode ≤ 4.14.4 CVE-2024-1408 Wordfence
6.4 Medium PowerPack Addons for Elementor Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget ≤ 2.7.15 CVE-2024-1411 Wordfence
6.4 Medium EmbedPress Plugin embedpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.8 CVE-2024-1349 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update in stopOptimizeAll No login needed ≤ 3.1.13 CVE-2024-1338 Wordfence
6.4 Medium Ocean Extra Plugin ocean-extra Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.2.4 CVE-2024-1277 Wordfence
6.4 Medium ProfilePress Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.14.4 CVE-2024-1570 Wordfence
6.5 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.14.4 CVE-2024-1519 Wordfence
6.4 Medium EmbedPress Plugin embedpress Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link ≤ 3.9.8 CVE-2024-1425 Wordfence
5.3 Medium WPify Woo Czech Plugin Broken Access Control Missing Authorization No login needed ≤ 4.0.8 CVE-2024-1492 Wordfence
5.3 Medium Coming Soon Maintenance Mode Plugin coming-soon-maintenance-mode Information Disclosure Information Exposure No login needed ≤ 1.0.5 CVE-2024-1475 Wordfence
5.3 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Broken Access Control Improper Authorization via submit_review No login needed ≤ 5.38.12 CVE-2024-1044 Wordfence
6.4 Medium Elementor Website Builder – More than Just a Page Builder Plugin elementor Cross-Site Scripting More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt ≤ 3.18.3 CVE-2024-0506 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.8 CVE-2024-1236 Wordfence
5.3 Medium PPWP – Password Protect Pages Plugin password-protect-page Information Disclosure Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass No login needed ≤ 1.8.9 CVE-2024-0620 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Broken Access Control Missing Authorization to Plugin Data Removal in reinitialize ≤ 3.1.13 CVE-2024-1091 Wordfence
4.3 Medium Royal Elementor Addons and Templates Plugin Cross-Site Request Forgery Cross-Site Request Forgery via remove_from_wishlist No login needed ≤ 1.3.87 CVE-2024-0513 Wordfence
5.4 Medium Login Lockdown – Protect Login Form Plugin login-lockdown Broken Access Control Protect Login Form <= 2.08 - Missing Authorization ≤ 2.08 CVE-2024-1340 Wordfence
4.3 Medium SKT Page Builder Plugin skt-builder Broken Access Control Missing Authorization to Authenticated(Subscriber+) Content Injection ≤ 4.1 CVE-2024-1337 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Data Removal in reinitialize No login needed ≤ 3.1.13 CVE-2024-1339 Wordfence
6.1 Medium Matomo Plugin Cross-Site Scripting Reflected Cross-Site Scripting via idsite No login needed ≤ 4.15.3 CVE-2023-6923 Wordfence
5.9 Medium InfiniteWP Client Plugin iwp-client Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 1.12.3 CVE-2023-6565 Wordfence
6.4 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.10.1 CVE-2024-0438 Wordfence
4.3 Medium Custom Twitter Feeds – A Tweets Widget or X Feed Widget Plugin custom-twitter-feeds Cross-Site Request Forgery A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update No login needed ≤ 2.2.1 CVE-2024-0379 Wordfence
5.4 Medium Tutor LMS Plugin tutor Content Injection Authenticated(Student+) HTML Injection via Q&A ≤ 2.6.0 CVE-2024-1128 Wordfence
6.4 Medium Royal Elementor Addons and Templates Plugin royal-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.87 CVE-2024-0442 Wordfence
6.4 Medium Sassy Social Share Plugin sassy-social-share Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.3.56 CVE-2024-1448 Wordfence
6.5 Medium RSS Aggregator by Feedzy Plugin feedzy-rss-feeds Broken Access Control Missing Authorization to Arbitrary Page Creation and Publication ≤ 4.4.2 CVE-2024-1318 Wordfence
6.4 Medium Starbox Plugin starbox Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settings ≤ 3.4.8 CVE-2023-6806 Wordfence
6.4 Medium Sydney Toolbox Plugin sydney-toolbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.25 CVE-2024-1447 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Broken Access Control Missing Authorization to Settings Update in enableOptimization ≤ 3.1.13 CVE-2024-0983 Wordfence
4.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page ≤ 2.11.1 CVE-2024-1390 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.10.18 CVE-2024-1242 Wordfence
4.4 Medium Yet Another Related Posts Plugin (YARPP) Plugin yet-another-related-posts-plugin Cross-Site Scripting Authenticated(Administrator+) Stored Cross-Site Scripting via settings ≤ 5.30.9 CVE-2024-0602 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update in enableOptimization No login needed ≤ 3.1.13 CVE-2024-1334 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 7.0.1 CVE-2024-0792 Wordfence
5.3 Medium Passster – Password Protect Pages and Content Plugin content-protector Broken Access Control Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure No login needed ≤ 4.2.6.2 CVE-2024-0616 Wordfence
6.5 Medium Link Library Plugin link-library Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 7.6 CVE-2024-1559 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcode ≤ 7.0.2 CVE-2024-1510 Wordfence
5.3 Medium Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages Plugin landing-page-cat Information Disclosure Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposure No login needed ≤ 1.7.2 CVE-2024-0708 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content ≤ 4.8.0 CVE-2024-1159 Wordfence
5.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link ≤ 4.8.0 CVE-2024-1160 Wordfence
5.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL ≤ 4.8.0 CVE-2024-1157 Wordfence
4.3 Medium SMTP Mail Plugin smtp-mail Cross-Site Request Forgery WordPress SMTP Mail Plugin <= 1.3.20 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.3.20 CVE-2024-25914 Patchstack
5.4 Medium Chart.js Plugin Cross-Site Scripting Editor+ Stored Cross-Site Scripting in New Chart 2023.2 – 2023.2 CVE-2023-6081 WPScan
4.8 Medium Popup Box Pro Plugin Cross-Site Scripting Admin+ Stored XSS 20.8.7 – < 20.9.0 Fixed in 20.9.0 CVE-2023-6591 WPScan
5.4 Medium Chart.js Plugin Cross-Site Scripting Editor+ Stored Cross-Site Scripting 2023.2 – 2023.2 CVE-2023-6082 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only