WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 151–200 of 226 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Stripe Donation Plugin bin-stripe-donation Cross-Site Scripting ≤ 1.2.5 CVE-2024-53752 Patchstack
6.1 Medium Kudos Donations – Easy donations and payments with Mollie Plugin kudos-donations Cross-Site Scripting Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting No login needed ≤ 3.2.9 CVE-2024-11684 Wordfence
6.1 Medium Kudos Donations – Easy donations and payments with Mollie Plugin kudos-donations Cross-Site Scripting Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg' No login needed ≤ 3.2.9 CVE-2024-11685 Wordfence
6.1 Medium Additional Order Filters for WooCommerce Plugin additional-order-filters-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.21 CVE-2024-11418 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Information Disclosure Exposure of Private Personal Information to an Unauthorized Actor No login needed ≤ 4.5.5 CVE-2024-11088 Wordfence
4.3 Medium Button Block – Get fully customizable & multi-functional buttons Plugin button-block Information Disclosure Get fully customizable & multi-functional buttons <= 1.1.4 - Authenticated (Contributor+) Post Disclosure ≤ 1.1.4 CVE-2024-10671 Wordfence
4.3 Medium If-So Dynamic Content Personalization Plugin if-so Information Disclosure Authenticated (Contributor+) Post Disclosure ≤ 1.9.2.1 CVE-2024-10796 Wordfence
4.3 Medium PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Plugin revisionary Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure ≤ 3.5.15 CVE-2024-11154 Wordfence
6.4 Medium MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Plugin mp3-music-player-by-sonaar Cross-Site Scripting Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode ≤ 5.8 CVE-2024-10268 Wordfence
6.1 Medium Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Plugin charitable Cross-Site Scripting Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting No login needed ≤ 1.8.3 CVE-2024-10876 Wordfence
4.3 Medium Content Slider Block – Create fully functional slider with Gutenberg block Plugin content-slider-block Information Disclosure Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure ≤ 3.1.5 CVE-2024-10667 Wordfence
6.5 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37510 Patchstack
5.3 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37506 Patchstack
5.3 Medium AidWP Plugin wp-stripe-donation Broken Access Control No login needed ≤ 3.2.3 Fixed in 3.2.4 CVE-2024-50459 Patchstack
5.9 Medium Conditional Fields for Contact Form 7 Plugin cf7-conditional-fields Cross-Site Scripting ≤ 2.4.15 Fixed in 2.5 CVE-2024-50412 Patchstack
6.4 Medium Masteriyo LMS – eLearning and Online Course Builder Plugin learning-management-system Cross-Site Scripting eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality ≤ 1.13.3 CVE-2024-10000 Wordfence
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode ≤ 2.1.11 CVE-2024-10117 Wordfence
6.1 Medium Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.2.133 CVE-2024-9214 Wordfence
4.3 Medium wp-Monalisa Plugin wp-monalisa Cross-Site Request Forgery No login needed ≤ 6.4 Fixed in 6.5 CVE-2024-48038 Patchstack
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_mollie_account_details' ≤ 4.3.7 CVE-2023-7293 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_notice_dismiss' ≤ 4.3.7 CVE-2023-7292 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_for_verified_profiles' ≤ 4.3.7 CVE-2023-7290 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_sw_save_api_keys' ≤ 4.3.7 CVE-2023-7289 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'update_profile_preference' ≤ 4.3.7 CVE-2023-7288 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'pt_cancel_subscription' ≤ 4.3.7 CVE-2023-7287 Wordfence
6.1 Medium PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Plugin revisionary Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.5.14 CVE-2024-9436 Wordfence
5.3 Medium Sight – Professional Image Gallery and Portfolio Plugin sight Broken Access Control Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title No login needed ≤ 1.1.2 CVE-2024-9025 Wordfence
5.4 Medium GiveWP Plugin give Cross-Site Request Forgery Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) No login needed ≤ 3.15.1 Fixed in 3.16.0 CVE-2024-47315 Patchstack
5.3 Medium HUSKY – Products Filter Professional for WooCommerce Plugin Broken Access Control Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe No login needed ≤ 1.3.6.1 CVE-2024-7491 Wordfence
6.5 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update No login needed ≤ 3.13.0 CVE-2024-5940 Wordfence
5.3 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure No login needed ≤ 3.13.0 CVE-2024-5939 Wordfence
5.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion ≤ 3.14.1 CVE-2024-5941 Wordfence
6.8 Medium Donation Block for PayPal Plugin donations-block Cross-Site Scripting Unauthenticated Stored XSS ≤ 2.1.0 CVE-2024-6021 WPScan
4.3 Medium Conditional Fields for Contact Form 7 Plugin cf7-conditional-fields Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Setting Reset No login needed ≤ 2.4.13 CVE-2024-5804 Wordfence
5.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions ≤ 3.13.0 CVE-2024-5977 Wordfence
6.5 Medium WPCS Plugin currency-switcher Arbitrary Shortcode Execution WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution No login needed ≤ 1.2.0.3 CVE-2024-38700 Patchstack
6.4 Medium MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin mp3-music-player-by-sonaar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode ≤ 5.5 CVE-2024-5664 Wordfence
6.1 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin Cross-Site Scripting Contributor+ Stored XSS No login needed ≤ 1.7 CVE-2024-5448 WPScan
5.4 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.7 CVE-2024-5447 WPScan
5.3 Medium SiteGuard WP Plugin siteguard Other SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard… No login needed prior to 1.7.7 CVE-2024-37881 jpcert
5.3 Medium WP Fundraising Donation and Crowdfunding Platform Plugin wp-fundraising-donation Broken Access Control Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control No login needed ≤ 1.6.4 Fixed in 1.7.0 CVE-2024-34758 Patchstack
6.5 Medium If-So Dynamic Content Personalization Plugin if-so Broken Access Control No login needed ≤ 1.7.1 Fixed in 1.7.1.1 CVE-2024-34820 Patchstack
6.5 Medium Recurring PayPal Donations Plugin recurring-donation Cross-Site Scripting ≤ 1.7 Fixed in 1.8 CVE-2024-35676 Patchstack
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality ≤ 2.4.43 CVE-2024-1164 Wordfence
6.4 Medium HUSKY – Products Filter Professional for WooCommerce Plugin woocommerce-products-filter Cross-Site Scripting Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.5.3 CVE-2024-5039 Wordfence
4.4 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin paypal-pay-buy-donation-and-cart-buttons-shortcode Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 1.7 CVE-2024-3065 Wordfence
6.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Cross-Site Scripting Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.10.0 CVE-2024-3714 Wordfence
5.3 Medium Conditional Checkout Fields for WooCommerce Plugin Authentication Bypass Broken Authentication No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2022-45070 Patchstack
5.9 Medium Corona Virus (COVID-19) Banner & Live Data Plugin corona-virus-covid-19-banner Cross-Site Scripting ≤ 1.8.0.2 CVE-2024-34429 Patchstack
5.9 Medium Conversational Forms for ChatBot Plugin conversational-forms Cross-Site Scripting ≤ 1.2.0 Fixed in 1.3.0 CVE-2024-34380 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only