WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 1,951–2,000 of 2,122 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Information Disclosure Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.13 - Unauthenticated Sensitive Information Exposure No login needed |
≤ 5.9.13 |
CVE-2024-2974 |
Wordfence | |
| 6.4 Medium | Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders | Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 5.9.11 |
CVE-2024-2650 |
Wordfence | |
| 5.3 Medium | WooCommerce Clover Payment Gateway | Broken Access Control Missing Authorization via callback_handler No login needed |
≤ 1.3.1 |
CVE-2024-0626 |
Wordfence | |
| 7.5 High | WooCommerce Cloak Affiliate Links | Broken Access Control Missing Authorization to Unauthenticated Permalink Modification No login needed |
≤ 1.0.33 |
CVE-2024-1308 |
Wordfence | |
| 4.3 Medium | WooCommerce | Cross-Site Request Forgery No login needed |
≤ 8.5.2 Fixed in 8.6.0 |
CVE-2024-22155 |
Patchstack | |
| 7.1 High | ELEX WooCommerce Dynamic Pricing and Discounts | Cross-Site Scripting No login needed |
≤ 2.1.2 Fixed in 2.1.3 |
CVE-2024-31255 |
Patchstack | |
| 6.4 Medium | Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel | Cross-Site Scripting Image Carousel & Photo Gallery, Post Carousel & Post Grid, Product Carousel & Product Grid for WooCommerce <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sp_wp_carousel_shortcode' |
≤ 2.6.3 |
CVE-2024-2949 |
Wordfence | |
| 5.3 Medium | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | Broken Access Control Missing Authorization to Unauthenticated Settings Reset No login needed |
≤ 4.4.2 |
CVE-2024-3216 |
Wordfence | |
| 6.4 Medium | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) | Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout |
≤ 2.8.3 |
CVE-2024-2868 |
Wordfence | |
| 6.8 Medium | WooCommerce Cart Abandonment Recovery | Cross-Site Request Forgery Templates/Abandoned Orders Deletion via CSRF |
< 1.2.27 Fixed in 1.2.27 |
CVE-2024-2322 |
WPScan | |
| 7.1 High | Woocommerce Social Media Share Buttons | Cross-Site Request Forgery CSRF to Cross Site Scripting (XSS) No login needed |
≤ 1.3.0 |
CVE-2024-31109 |
Patchstack | |
| 6.5 Medium | Product Sort and Display for WooCommerce | Broken Access Control Missing Authorization No login needed |
≤ 2.4.1 |
CVE-2024-1807 |
Wordfence | |
| 6.1 Medium | WooCommerce Product Filter | Cross-Site Scripting Admin+ Stored XSS No login needed |
< 1.4.4 Fixed in 1.4.4 |
CVE-2024-2278 |
WPScan | |
| 4.8 Medium | WooCommerce Product Filter | Cross-Site Scripting Reflected XSS |
< 1.4.4 Fixed in 1.4.4 |
CVE-2024-2263 |
WPScan | |
| 4.7 Medium | WooCommerce Product Filter | Cross-Site Request Forgery Filter Deletion via CSRF No login needed |
< 1.4.4 Fixed in 1.4.4 |
CVE-2024-2262 |
WPScan | |
| 6.5 Medium | WooCommerce Bookings Calendar | Cross-Site Scripting |
≤ 1.0.36 |
CVE-2024-31117 |
Patchstack | |
| 5.4 Medium | Popup Cart Lite for WooCommerce | Cross-Site Request Forgery No login needed |
≤ 1.1 |
CVE-2024-31100 |
Patchstack | |
| 6.5 Medium | WC Marketplace | Cross-Site Scripting |
≤ 4.1.3 Fixed in 4.1.4 |
CVE-2024-30433 |
Patchstack | |
| 4.3 Medium | HUSKY – Products Filter for WooCommerce (formerly WOOF) | Cross-Site Request Forgery No login needed |
≤ 1.3.5.1 Fixed in 1.3.5.2 |
CVE-2024-30462 |
Patchstack | |
| 5.3 Medium | Klarna Payments for WooCommerce | Broken Access Control No login needed |
≤ 3.2.4 Fixed in 3.3.0 |
CVE-2024-30477 |
Patchstack | |
| 4.3 Medium | Custom WooCommerce Checkout Fields Editor | Cross-Site Request Forgery No login needed |
≤ 1.3.0 Fixed in 1.3.1 |
CVE-2024-30518 |
Patchstack | |
| 5.3 Medium | Wholesale For WooCommerce | Information Disclosure Unauthenticated Sensitive Data Exposure No login needed |
≤ 2.3.0 Fixed in 2.3.1 |
CVE-2024-30469 |
Patchstack | |
| 5.3 Medium | FG PrestaShop to WooCommerce | Information Disclosure Sensitive Data Exposure via Log File No login needed |
≤ 4.45.1 Fixed in 4.47.0 |
CVE-2024-30511 |
Patchstack | |
| 4.3 Medium | Import Export WordPress Users | Path Traversal |
≤ 2.5.2 Fixed in 2.5.3 |
CVE-2024-30492 |
Patchstack | |
| 4.3 Medium | WOOCS – WooCommerce Currency Switcher | Cross-Site Request Forgery Currency Switcher Professional for WooCommerce plugin <= 1.4.1.7 - Cross Site Request Forgery (CSRF) No login needed |
≤ 1.4.1.7 Fixed in 1.4.1.8 |
CVE-2024-30458 |
Patchstack | |
| 7.2 High | HUSKY – Products Filter Professional for WooCommerce | Local File Inclusion Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion |
≤ 1.3.5.2 |
CVE-2024-3061 |
Wordfence | |
| 7.2 High | WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.13.1 |
CVE-2024-0609 |
Wordfence | |
| 6.5 Medium | WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting | SQL Injection Authenticated (Subscriber+) SQL Injection |
≤ 1.13.1 |
CVE-2024-0608 |
Wordfence | |
| 7.1 High | Preview E-mails for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.2.1 Fixed in 2.2.2 |
CVE-2024-27999 |
Patchstack | |
| 6.5 Medium | Booster Plus for WooCommerce | Information Disclosure Auth. Sensitive Data Exposure |
< 7.1.2 Fixed in 7.1.2 |
CVE-2023-52231 |
Patchstack | |
| 6.5 Medium | Booster Elite for WooCommerce | Information Disclosure Auth. Sensitive Data Exposure |
< 7.1.2 Fixed in 7.1.2 |
CVE-2023-52234 |
Patchstack | |
| 8.2 High | PDF Invoices and Packing Slips For WooCommerce | PHP Object Injection |
≤ 1.3.7 Fixed in 1.3.8 |
CVE-2024-30230 |
Patchstack | |
| 5.4 Medium | WooCommerce Stripe Payment Gateway | Cross-Site Request Forgery No login needed |
≤ 7.6.0 Fixed in 7.6.1 |
CVE-2023-44999 |
Patchstack | |
| 7.1 High | BizPrint | Cross-Site Request Forgery CSRF to XSS No login needed |
≤ 4.5.5 Fixed in 4.5.6 |
CVE-2024-29773 |
Patchstack | |
| 7.1 High | Booster for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 7.1.7 Fixed in 7.1.8 |
CVE-2024-29760 |
Patchstack | |
| 7.1 High | Conversios.io | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 6.9.1 Fixed in 7.0.0 |
CVE-2024-29794 |
Patchstack | |
| 6.5 Medium | Gratisfaction | Cross-Site Scripting |
≤ 4.3.4 Fixed in 4.3.5 |
CVE-2024-29798 |
Patchstack | |
| 7.1 High | Shipping with Venipak for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.19.5 Fixed in 1.19.6 |
CVE-2024-29805 |
Patchstack | |
| 5.9 Medium | WCFM – Frontend Manager for WooCommerce | Cross-Site Scripting |
≤ 6.7.8 Fixed in 6.7.9 |
CVE-2024-29929 |
Patchstack | |
| 7.1 High | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 4.4.0 Fixed in 4.4.1 |
CVE-2024-22288 |
Patchstack | |
| 7.1 High | Product Feed PRO for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 13.2.5 Fixed in 13.2.6 |
CVE-2024-24800 |
Patchstack | |
| 9.1 Critical | Product Import Export for WooCommerce | Arbitrary File Upload |
≤ 2.4.1 Fixed in 2.4.2 |
CVE-2024-30231 |
Patchstack | |
| 4.3 Medium | WooCommerce Conversion Tracking | Broken Access Control |
≤ 2.0.11 Fixed in 2.0.12 |
CVE-2024-24711 |
Patchstack | |
| 4.3 Medium | Location Picker at Checkout for WooCommerce | Broken Access Control |
≤ 1.8.9 Fixed in 1.9.0 |
CVE-2024-24719 |
Patchstack | |
| 6.5 Medium | WooCommerce Box Office | Broken Access Control |
≤ 1.2.2 Fixed in 1.2.3 |
CVE-2024-24799 |
Patchstack | |
| 6.5 Medium | Points and Rewards for WooCommerce | Broken Access Control No login needed |
≤ 1.5.0 Fixed in 1.6.0 |
CVE-2023-27608 |
Patchstack | |
| 8.8 High | BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages | PHP Object Injection Authenticated (Subscriber+) PHP Object Injection in get_simple_request |
≤ 3.4.20 |
CVE-2024-2025 |
Wordfence | |
| 6.4 Medium | Custom WooCommerce Checkout Fields Editor | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting |
≤ 1.3.1 |
CVE-2024-1697 |
Wordfence | |
| 6.1 Medium | WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 4.4.1 |
CVE-2024-0957 |
Wordfence | |
| 6.5 Medium | YITH WooCommerce Gift Cards Premium | Cross-Site Scripting Unauth. Gift Card Creation Leading to Stored XSS No login needed |
≤ 3.23.1 Fixed in 3.24.0 |
CVE-2022-44633 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.