WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 151–181 of 181 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 2.12.10 Fixed in 3.0 CVE-2024-32794 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) No login needed ≤ 5.7.8 Fixed in 5.7.9 CVE-2024-31362 Patchstack
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' ≤ 4.15.5 CVE-2024-3210 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 8.3.4 CVE-2024-1461 Wordfence
5.3 Medium s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin s2member Information Disclosure Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure No login needed ≤ 230815 CVE-2024-0899 Wordfence
6.4 Medium Beaver Builder Addons by WPZOOM Plugin wpzoom-addons-for-beaver-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 1.3.4 CVE-2024-2186 Wordfence
4.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 2.12.10 CVE-2024-0588 Wordfence
5.3 Medium Paid Memberships Pro – Mailchimp Add On Plugin pmpro-mailchimp Information Disclosure Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure No login needed ≤ 2.3.4 Fixed in 2.3.5 CVE-2024-30523 Patchstack
5.3 Medium Paid Memberships Pro – Payfast Gateway Add On Plugin pmpro-payfast Information Disclosure Payfast Gateway Add On plugin <= 1.4.1 - Sensitive Data Exposure via Log File No login needed ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-30514 Patchstack
5.9 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Scripting ≤ 4.0.23 Fixed in 4.0.24 CVE-2024-27995 Patchstack
6.1 Medium Team Members Plugin team-members Cross-Site Scripting Author+ Stored XSS No login needed < 5.3.2 Fixed in 5.3.2 CVE-2024-1331 WPScan
4.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Request Forgery No login needed ≤ 2.10.4 Fixed in 2.10.5 CVE-2023-51522 Patchstack
5.3 Medium Restrict User Access – Ultimate Membership & Content Protection Plugin restrict-user-access Information Disclosure Ultimate Membership & Content Protection <= 2.5 - Information Exposure No login needed ≤ 2.5 CVE-2024-0687 Wordfence
4.7 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored Self-Based Cross-Site Scripting No login needed ≤ 4.4.2 CVE-2024-1985 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets ≤ 4.10.21 CVE-2024-1680 Wordfence
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode ≤ 4.15.0 CVE-2024-1409 Wordfence
4.3 Medium Paid Memberships Pro Plugin Information Disclosure Contributor+ Arbitrary User Custom Field Disclosure < 2.12.9 Fixed in 2.12.9 CVE-2024-1279 WPScan
6.4 Medium WP-Members Membership Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.4.9.1 CVE-2024-1987 Wordfence
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return No login needed ≤ 2.11.1 CVE-2024-1389 Wordfence
6.5 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.14.4 CVE-2024-1519 Wordfence
4.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page ≤ 2.11.1 CVE-2024-1390 Wordfence
5.3 Medium ARMember Plugin armember-membership Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed ≤ 4.0.24 CVE-2024-0969 Wordfence
5.3 Medium UserPro Plugin Other Disabled Membership Registration Bypass No login needed ≤ 5.1.6 CVE-2024-0701 Wordfence
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.14.3 CVE-2024-1046 Wordfence
6.5 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles Plugin peepso-core Cross-Site Scripting WordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS) < 6.3.1.0 Fixed in 6.3.1.0 CVE-2024-22158 Patchstack
5.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery Cross-Site Request Forgery to Level Orders Update No login needed ≤ 2.12.7 CVE-2024-0624 Wordfence
6.6 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar PHP Object Injection WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection ≤ 4.3.2 Fixed in 4.4.0 CVE-2022-45083 Patchstack
6.1 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Reflected Cross-Site Scripting Vulnerability via environment_mode No login needed ≤ 4.3.8 CVE-2023-6882 Wordfence
5.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Broken Access Control Missing Authorization via API No login needed ≤ 2.12.5 CVE-2023-6855 Wordfence
6.3 Medium ProfileGrid – User Profiles, Memberships, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control WordPress ProfileGrid Plugin <= 5.0.3 is vulnerable to Broken Access Control ≤ 5.0.3 Fixed in 5.0.4 CVE-2022-36352 Patchstack
6.5 Medium WP-Members Membership Plugin Broken Access Control Missing Authorization to Sensitive Information Exposure ≤ 3.4.8 CVE-2023-6733 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only