WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 19,001–19,050 of 29,694 vulnerabilities

Known WordPress vulnerabilities, page 381 of 594
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Customer Email Verification for WooCommerce Plugin emails-verification-for-woocommerce Authentication Bypass Authentication Bypass via Shortcode ≤ 2.9.5 CVE-2024-13528 Wordfence
5.4 Medium Global Gallery - WordPress Responsive Gallery Plugin Arbitrary Shortcode Execution WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 9.1.5 CVE-2024-13814 Wordfence
7.5 High Export All Posts, Products, Orders, Refunds & Users Plugin wp-ultimate-exporter Information Disclosure Information Disclosure Through Unprotected Directory No login needed ≤ 2.9.3 CVE-2024-12315 Wordfence
5.3 Medium Hide My WP Ghost – Security & Firewall Plugin hide-my-wp Information Disclosure Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure No login needed ≤ 5.3.02 CVE-2024-13794 Wordfence
5.3 Medium WP Booking Calendar Plugin Broken Access Control Unauthenticated Post-Confirmation Booking Manipulation No login needed ≤ 10.10 CVE-2024-13821 Wordfence
8.8 High All-Images.ai – IA Image Bank and Custom Image creation Plugin all-images-ai Arbitrary File Upload IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload ≤ 1.0.4 CVE-2024-13714 Wordfence
4.3 Medium Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support Broken Access Control The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference ≤ 1.0.5 CVE-2024-13601 Wordfence
7.5 High Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin majestic-support Information Disclosure The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory No login needed ≤ 1.0.5 CVE-2024-13600 Wordfence
4.3 Medium WP Table Manager Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure ≤ 4.1.3 CVE-2024-13374 Wordfence
8.1 High ZoxPress - The All-In-One WordPress News Theme Broken Access Control The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion ≤ 2.12.0 CVE-2024-13654 Wordfence
6.4 Medium Admire Extra Plugin admire-extra Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6 CVE-2024-13665 Wordfence
6.4 Medium NGG Smart Image Search Plugin ngg-smart-image-search Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.1 CVE-2024-13658 Wordfence
8.1 High Click Mag - Viral WordPress News Magazine/Blog Theme Broken Access Control Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion ≤ 3.6.0 CVE-2024-13656 Wordfence
8.8 High ZoxPress - The All-In-One WordPress News Theme Broken Access Control The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update ≤ 2.12.0 CVE-2024-13653 Wordfence
9.8 Critical Real Estate 7 Theme Privilege Escalation Unauthenticated Privilege Escalation to Administrator No login needed ≤ 3.5.1 CVE-2024-13421 Wordfence
8.1 High Popup Plugin For WordPress - ConvertPlus Plugin Broken Access Control ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update ≤ 3.5.30 CVE-2024-13800 Wordfence
4.3 Medium WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon Plugin wpsyncsheets-wpforms Broken Access Control WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset ≤ 1.6 CVE-2024-12164 Wordfence
6.4 Medium Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin gs-woo-brands Cross-Site Scripting Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.2 CVE-2024-11746 Wordfence
6.4 Medium Puzzles | WP Magazine / Review with Store WordPress Theme + RTL Theme Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 4.2.4 CVE-2024-13769 Wordfence
4.3 Medium aDirectory – WordPress Directory Listing Plugin adirectory Broken Access Control WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion ≤ 2.3 CVE-2024-13541 Wordfence
6.1 Medium StaffList Plugin stafflist Cross-Site Request Forgery Cross-Site Request Forgery to Reflected Cross-Site Scripting No login needed ≤ 3.2.3 CVE-2024-13749 Wordfence
6.4 Medium Liveticker (by stklcode) Plugin stklcode-liveticker Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.2 CVE-2024-13701 Wordfence
4.3 Medium Houzez Property Feed Plugin houzez-property-feed Cross-Site Request Forgery Cross-Site Request Forgery to Property Feed Export Deletion No login needed ≤ 2.4.21 CVE-2025-0808 Wordfence
5.3 Medium AForms Eats Plugin aforms-eats Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 1.3.1 CVE-2024-13539 Wordfence
5.3 Medium The Ultimate WordPress Toolkit – WP Extended Plugin Broken Access Control WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation No login needed ≤ 3.0.13 CVE-2024-13554 Wordfence
9.8 Critical WPGateway Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 3.5 CVE-2022-3180 Wordfence
6.4 Medium GeoDirectory – WP Business Directory Plugin and Classified Listings Directory Plugin geodirectory Cross-Site Scripting WP Business Directory Plugin and Classified Listings Directory <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter ≤ 2.8.97 CVE-2024-13506 Wordfence
4.9 Medium SuperSaaS – online appointment scheduling Plugin supersaas-appointment-scheduling Cross-Site Scripting online appointment scheduling <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter ≤ 2.1.12 CVE-2025-0862 Wordfence
8.8 High Zox News Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Modification ≤ 3.17.0 CVE-2024-13643 Wordfence
9.8 Critical WP Foodbakery Plugin Authentication Bypass Authentication Bypass in foodbakery_parse_request No login needed ≤ 4.8 CVE-2025-0181 Wordfence
9.8 Critical WP Foodbakery Plugin Privilege Escalation Unauthenticated Privilege Escalation in foodbakery_registration_validation No login needed ≤ 4.7 CVE-2025-0180 Wordfence
6.1 Medium Stray Random Quotes Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.9.9 CVE-2024-13570 WPScan
4.8 Medium Zarinpal Paid Downloads Plugin Arbitrary File Upload Admin+ Arbitrary File Upload ≤ 2.3 CVE-2024-13544 WPScan
6.1 Medium Zarinpal Paid Downloads Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 2.3 CVE-2024-13543 WPScan
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Cross-Site Scripting Absolute Addons For Elementor <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 2.8.1 CVE-2024-12599 Wordfence
6.1 Medium WP Foodbakery Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 4.8 CVE-2024-13010 Wordfence
9.8 Critical WP Foodbakery Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 4.7 CVE-2024-13011 Wordfence
8.2 High Super Store Finder Plugin SQL Injection Unauthenticated SQL Injection to Stored Cross-Site Scripting No login needed ≤ 7.0 CVE-2024-13440 Wordfence
6.4 Medium DWT - Directory & Listing Theme Cross-Site Scripting Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.3.4 CVE-2025-0169 Wordfence
9.8 Critical WP Directorybox Manager Plugin Authentication Bypass No login needed ≤ 2.5 CVE-2025-0316 Wordfence
5.5 Medium Simple add pages or posts Plugin simple-add-pages-or-posts Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 2.0.0 CVE-2024-13850 Wordfence
6.8 Medium WP All Export Pro Plugin Broken Access Control Authenticated (ShopManager+) Arbtirary Options Update ≤ 1.9.1 CVE-2024-7425 Wordfence
4.3 Medium WP All Import Pro Plugin Cross-Site Request Forgery Cross-Site Request Forgery to Imported Content Deletion No login needed ≤ 4.9.7 CVE-2024-9661 Wordfence
8.3 High WP All Export Pro Plugin Remote Code Execution Unauthenticated Remote Code Execution via Custom Export Fields No login needed ≤ 1.9.1 CVE-2024-7419 Wordfence
7.2 High WP All Import Pro Plugin PHP Object Injection Authenticated (Administrator+) PHP Object Injection via Import File ≤ 4.9.7 CVE-2024-9664 Wordfence
8.2 High BookPress – For Book Authors Plugin book-press Broken Access Control For Book Authors Plugin <= 1.2.7 - Broken Access Control No login needed ≤ 1.2.7 CVE-2025-25167 Patchstack
7.1 High BookPress – For Book Authors Plugin book-press Cross-Site Request Forgery For Book Authors Plugin <= 1.2.7 - CSRF to Stored XSS No login needed ≤ 1.2.7 CVE-2025-25168 Patchstack
7.1 High InLocation Plugin inlocation Cross-Site Scripting No login needed ≤ 1.8 CVE-2025-25166 Patchstack
7.5 High Plugin A/B Image Optimizer Plugin images-optimizer Path Traversal Arbitrary File Download No login needed ≤ 3.3 CVE-2025-25163 Patchstack
7.5 High Music Sheet Viewer Plugin music-sheet-viewer Path Traversal Arbitrary File Read No login needed ≤ 4.1 CVE-2025-25155 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only