WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 151–189 of 189 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Tutor LMS Plugin tutor Cross-Site Request Forgery Cross-Site Request Forgery via 'addon_enable_disable' No login needed ≤ 2.7.4 CVE-2023-2919 Wordfence
5.4 Medium Tutor LMS Plugin tutor Cross-Site Request Forgery No login needed ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-39645 Patchstack
6.4 Medium Tutor LMS Elementor Addons Plugin tutor-lms-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget ≤ 2.1.4 CVE-2024-5576 Wordfence
5.3 Medium Sensei LMS Plugin sensei-lms Broken Access Control No login needed ≤ 4.23.1, ≤ 4.23.1.1.23.1 Fixed in 4.24.0 CVE-2024-35686 Patchstack
4.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control Insecure Direct Object Reference (IDOR) ≤ 1.11.4 Fixed in 1.11.5 CVE-2024-43239 Patchstack
6.5 Medium Tutor LMS Plugin tutor Cross-Site Scripting ≤ 2.7.3 Fixed in 2.7.4 CVE-2024-43231 Patchstack
4.3 Medium Tutor LMS – Migration Tool Plugin tutor-lms-migration-tool Broken Access Control Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml ≤ 2.2.0 CVE-2024-1804 Wordfence
5.3 Medium Tutor LMS – Migration Tool Plugin tutor-lms-migration-tool Broken Access Control Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml No login needed ≤ 2.2.0 CVE-2024-1798 Wordfence
4.3 Medium Academy LMS Plugin academy Broken Access Control ≤ 2.0.4 Fixed in 2.0.5 CVE-2024-38701 Patchstack
5.9 Medium Tutor LMS Plugin tutor Cross-Site Scripting ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-37947 Patchstack
4.9 Medium Tutor LMS Plugin tutor Path Traversal ≤ 2.7.1 Fixed in 2.7.2 CVE-2024-37266 Patchstack
5.4 Medium LearnDash LMS - Reports Free Plugin wisdm-reports-for-learndash Broken Access Control Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update ≤ 1.8.2.1 CVE-2024-5648 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Other WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration No login needed ≤ 4.2.6.8.1 CVE-2024-6099 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Broken Access Control WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass No login needed ≤ 4.2.6.8.1 CVE-2024-6088 Wordfence
4.3 Medium Academy LMS Plugin academy Broken Access Control ≤ 1.9.16 Fixed in 1.9.17 CVE-2024-32714 Patchstack
4.3 Medium Tutor LMS – eLearning and online course solution Plugin tutor Broken Access Control eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion ≤ 2.7.1 CVE-2024-5438 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Information Disclosure WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API No login needed ≤ 4.2.6.8 CVE-2024-5483 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin learnpress Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 4.2.6.6 CVE-2024-4971 Wordfence
6.5 Medium Tutor LMS – eLearning and online course solution Plugin tutor Broken Access Control eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion ≤ 2.7.0 CVE-2024-4279 Wordfence
5.3 Medium Academy LMS Plugin academy Information Disclosure Sensitive Data Exposure No login needed ≤ 1.9.25 Fixed in 1.9.26 CVE-2024-35171 Patchstack
6.4 Medium LearnPress – WordPress LMS Plugin learnpress Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter ≤ 4.2.6.5 CVE-2024-4277 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Other WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration No login needed ≤ 4.2.6.5 CVE-2024-4444 Wordfence
6.5 Medium Tutor LMS Plugin tutor Broken Access Control Missing Authorization to Unauthenticated Limited Options Update No login needed ≤ 2.6.2 CVE-2024-3553 Wordfence
6.3 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.3.8 - Missing Authorization ≤ 3.3.8 CVE-2024-3942 Wordfence
5.4 Medium Tutor LMS – eLearning and online course solution Plugin tutor Cross-Site Scripting eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode ≤ 2.6.2 CVE-2024-3994 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.6.4 CVE-2024-3560 Wordfence
4.3 Medium LifterLMS Plugin lifterlms Cross-Site Request Forgery No login needed ≤ 7.5.0 Fixed in 7.5.1 CVE-2024-31363 Patchstack
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control Missing Authorization to Sensitive Information Exposure in search_posts ≤ 3.2.13 CVE-2024-1904 Wordfence
6.5 Medium Tutor LMS Elementor Addons Plugin tutor-lms-elementor-addons Cross-Site Scripting ≤ 2.1.3 Fixed in 2.1.4 CVE-2024-29913 Patchstack
5.3 Medium LifterLMS – WordPress LMS Plugin for eLearning Plugin lifterlms Broken Access Control WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review No login needed ≤ 7.5.1 CVE-2024-0377 Wordfence
5.3 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Information Disclosure for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route No login needed ≤ 3.2.10 CVE-2024-2106 Wordfence
5.4 Medium Tutor LMS – eLearning and online course solution Plugin tutor Broken Access Control eLearning and online course solution <= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion ≤ 2.6.1 CVE-2024-1502 Wordfence
4.3 Medium Tutor LMS – eLearning and online course solution Plugin tutor Cross-Site Request Forgery eLearning and online course solution <= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase No login needed ≤ 2.6.1 CVE-2024-1503 Wordfence
4.3 Medium Tutor LMS Plugin tutor Broken Access Control Missing Authorization ≤ 2.6.0 CVE-2024-1133 Wordfence
5.4 Medium Tutor LMS Plugin tutor Content Injection Authenticated(Student+) HTML Injection via Q&A ≤ 2.6.0 CVE-2024-1128 Wordfence
6.5 Medium Sensei LMS – Online Courses, Quizzes, & Learning Plugin sensei-lms Cross-Site Scripting WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS) ≤ 4.17.0 Fixed in 4.18.0 CVE-2023-50875 Patchstack
5.3 Medium LearnDash LMS Plugin Information Disclosure Sensitive Information Exposure via API No login needed ≤ 4.10.2 CVE-2024-1208 Wordfence
5.3 Medium LearnDash LMS Plugin Information Disclosure Sensitive Information Exposure via assignments No login needed ≤ 4.10.1 CVE-2024-1209 Wordfence
5.3 Medium LearnDash LMS Plugin Information Disclosure Sensitive Information Exposure via API No login needed ≤ 4.10.1 CVE-2024-1210 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only