WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 20,651–20,700 of 29,413 vulnerabilities

Known WordPress vulnerabilities, page 414 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium WP Docs Plugin wp-docs SQL Injection Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id' ≤ 2.2.0 CVE-2024-12635 Wordfence
6.4 Medium One Click Upsell Funnel for WooCommerce Plugin woo-one-click-upsell-funnel Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wps_wocuf_pro_yes Shortcode ≤ 3.4.9 CVE-2024-11938 Wordfence
8.8 High eCommerce Product Catalog Plugin ecommerce-product-catalog Cross-Site Request Forgery Cross-Site Request Forgery to Password Reset No login needed ≤ 3.3.43 CVE-2024-12771 Wordfence
7.2 High Custom Product Tabs For WooCommerce Plugin wb-custom-product-tabs-for-woocommerce PHP Object Injection Authenticated (Shop Manager+) PHP Object Injection ≤ 1.2.4 CVE-2024-12721 Wordfence
8.8 High SMSA Shipping(official) Plugin smsa-shipping-official Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion ≤ 2.3 CVE-2024-12066 Wordfence
6.1 Medium Ebook Store Plugin ebook-store Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 5.8001 CVE-2024-11287 Wordfence
6.1 Medium GTPayment Donations Plugin Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 1.0.0 CVE-2024-11607 WPScan
7.3 High kk Star Ratings – Rate Post & Collect User Feedbacks Plugin kk-star-ratings Arbitrary Shortcode Execution Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 5.4.10 CVE-2024-11977 Wordfence
9.8 Critical AdForest Theme Authentication Bypass No login needed ≤ 5.1.6 CVE-2024-11349 Wordfence
6.1 Medium Feedify – Web Push Notifications Plugin push-notification-by-feedify Cross-Site Scripting Web Push Notifications <= 2.4.2 - Reflected Cross-Site Scripting No login needed ≤ 2.4.2 CVE-2024-11811 Wordfence
6.4 Medium Category Post Slider Plugin category-post-slider Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4 CVE-2024-11878 Wordfence
6.4 Medium NACC Plugin nacc-wordpress-plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.1.0 CVE-2024-12506 Wordfence
6.4 Medium Outdooractive Embed Plugin outdooractive-embed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.5 CVE-2024-11774 Wordfence
6.4 Medium Spoki – Chat Buttons and WooCommerce Notifications Plugin spoki Cross-Site Scripting Chat Buttons and WooCommerce Notifications <= 2.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.15.15 CVE-2024-11893 Wordfence
6.1 Medium PKT1 Centro de envios Plugin pkt1-centro-de-envios Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.2.1 CVE-2024-11806 Wordfence
6.4 Medium Financial Calculator Plugin finance-calculator-with-application-form Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.2.1 CVE-2024-11783 Wordfence
6.4 Medium Sell Tickets Online – TicketSource Ticket Shop Plugin ticketsource-events Cross-Site Scripting TicketSource Ticket Shop for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.0.2 CVE-2024-11784 Wordfence
6.1 Medium isee-products-extractor Plugin isee-products-extractor Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.1.3 CVE-2024-11331 Wordfence
5.3 Medium Page Restriction WordPress (WP) – Protect WP Pages/Post Plugin page-and-post-restriction Information Disclosure Protect WP Pages/Post <= 1.3.6 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 1.3.6 CVE-2024-11297 Wordfence
6.4 Medium WP SHAPES Plugin wp-shapes Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload 1.0.0 CVE-2024-9619 Wordfence
9.8 Critical Store Locator Plugin store-locator Local File Inclusion Unauthenticated Local File Inclusion No login needed 3.98.9 CVE-2024-12571 Wordfence
6.4 Medium Embed Twine Plugin embed-twine Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 0.1.0 CVE-2024-12509 Wordfence
6.1 Medium Wtyczka SeoPilot dla WP Plugin wtyczka-seopilot-dla-wp Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 3.3.091 CVE-2024-11812 Wordfence
6.4 Medium Particle Background Plugin particle-background Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.2 CVE-2024-11775 Wordfence
6.4 Medium Spotlightr Plugin spotlightr Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 0.1.11 CVE-2024-11411 Wordfence
4.3 Medium Maintenance & Coming Soon Redirect Animation Plugin maintenance-coming-soon-redirect-animation Broken Access Control Missing Authorization to Settings Update ≤ 2.1.3 CVE-2024-9503 Wordfence
5.4 Medium Serious Slider Plugin cryout-serious-slider Cross-Site Scripting Contributor+ Stored XSS via Shortcode < 1.2.7 Fixed in 1.2.7 CVE-2024-11108 WPScan
4.7 Medium MaxButtons Plugin maxbuttons Cross-Site Scripting Admin+ Stored XSS via Text Color No login needed < 9.8.1 Fixed in 9.8.1 CVE-2024-8968 WPScan
4.8 Medium Download Manager Plugin download-manager Cross-Site Scripting Admin+ Stored XSS < 3.3.03 Fixed in 3.3.03 CVE-2024-10706 WPScan
4.8 Medium MaxButtons Plugin maxbuttons Cross-Site Scripting Admin+ Stored XSS via Button Width < 9.8.1 Fixed in 9.8.1 CVE-2024-10555 WPScan
6.4 Medium PCRecruiter Extensions Plugin pcrecruiter-extensions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.22 CVE-2024-11776 Wordfence
6.5 Medium Fusion Plugin fusion Cross-Site Scripting ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-37962 Patchstack
9.6 Critical AutomatorWP Plugin automatorwp Cross-Site Scripting Reflected Cross-Site Scripting via a-0-o-search_field_value No login needed ≤ 5.0.9 CVE-2024-12626 Wordfence
4.3 Medium File Manager Pro – Filester Plugin filester Broken Access Control Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation ≤ 1.8.6 CVE-2024-12331 Wordfence
4.3 Medium Button Block – Get fully customizable & multi-functional buttons Plugin button-block Information Disclosure Get fully customizable & multi-functional buttons <= 1.1.5 - Authenticated (Contributor+) Post Disclosure via Post Duplication ≤ 1.1.5 CVE-2024-12560 Wordfence
5.3 Medium Download manager Plugin download-manager Broken Access Control Improper Authorization to Unauthenticated Download of Password-Protected Files No login needed ≤ 3.3.03 CVE-2024-11768 Wordfence
7.3 High Download Manager Plugin download-manager Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 3.3.03 CVE-2024-11740 Wordfence
5.4 Medium Broken Link Checker | Finder Plugin broken-link-finder Server-Side Request Forgery Authenticated (Author+) Blind Server-Side Request Forgery ≤ 2.5.0 CVE-2024-12121 Wordfence
6.5 Medium WP Project Manager Plugin wedevs-project-manager Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure via Project Task List REST API ≤ 2.6.15 CVE-2024-10548 Wordfence
8.5 High WPLMS Plugin wplms_plugin SQL Injection Subscriber+ SQL Injection ≤ 1.9.9.5.3 Fixed in 1.9.9.5.3 CVE-2024-56047 Patchstack
7.6 High WPLMS Plugin wplms_plugin SQL Injection Instructor+ SQL Injection ≤ 1.9.9.5.3 Fixed in 1.9.9.5.3 CVE-2024-56053 Patchstack
8.8 High WPLMS Plugin wplms_plugin Privilege Escalation Arbitrary Option Update to Privilege Escalation ≤ 1.9.9 Fixed in 1.9.9.1 CVE-2024-56048 Patchstack
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Subscriber+ Arbitrary File Upload ≤ 1.9.9.5.3 Fixed in 1.9.9.5.3 CVE-2024-56050 Patchstack
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Student+ Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56052 Patchstack
9.1 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload Instructor+ Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56054 Patchstack
9.9 Critical WPLMS Plugin wplms_plugin Arbitrary File Upload ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56057 Patchstack
7.1 High Advance Menu Manager Plugin advance-menu-manager Broken Access Control Settings Change ≤ 3.1.1 Fixed in 3.1.2 CVE-2024-54381 Patchstack
9.8 Critical WooCommerce PDF Vouchers Plugin woocommerce-pdf-vouchers Authentication Bypass PDF Vouchers plugin < 4.9.9 - Broken Authentication No login needed ≤ 4.9.9 Fixed in 4.9.9 CVE-2024-54383 Patchstack
8.5 High WPLMS Plugin wplms_plugin Arbitrary File Deletion Subscriber+ Arbitrary File Deletion ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56049 Patchstack
8.5 High WPLMS Plugin wplms_plugin Arbitrary File Deletion Arbitrary Directory Deletion ≤ 1.9.9.5.2 Fixed in 1.9.9.5.2 CVE-2024-56055 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only