WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 21,051–21,100 of 29,413 vulnerabilities

Known WordPress vulnerabilities, page 422 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	Posts Like Dislike Plugin `posts-like-dislike`	Broken Access Control No login needed	`≤ 1.1.0` Fixed in `1.1.1`	Dec 13, 2024	`CVE-2023-41849`	Patchstack
5.3 Medium	Carousel Slider Plugin `carousel-slider`	Broken Access Control No login needed	`≤ 2.2.2` Fixed in `2.2.3`	Dec 13, 2024	`CVE-2023-41848`	Patchstack
5.3 Medium	BitPay Checkout for WooCommerce Plugin `bitpay-checkout-for-woocommerce`	Broken Access Control No login needed	`≤ 4.1.0` Fixed in `5.0.0`	Dec 13, 2024	`CVE-2023-41803`	Patchstack
4.3 Medium	Super Socializer Plugin `super-socializer`	Broken Access Control	`≤ 7.13.54` Fixed in `7.13.55`	Dec 13, 2024	`CVE-2023-41802`	Patchstack
3.5 Low	Analytify Plugin `wp-analytify`	Broken Access Control	`≤ 5.1.0` Fixed in `5.1.1`	Dec 13, 2024	`CVE-2023-41695`	Patchstack
5.3 Medium	WiserNotify Social Proof Plugin `wiser-notify`	Broken Access Control No login needed	`≤ 2.5` Fixed in `2.6`	Dec 13, 2024	`CVE-2023-41690`	Patchstack
4.3 Medium	Post to Google My Business (Google Business Profile) Plugin `post-to-google-my-business`	Broken Access Control	`≤ 3.1.14` Fixed in `3.1.15`	Dec 13, 2024	`CVE-2023-41689`	Patchstack
5.4 Medium	Bulk NoIndex & NoFollow Toolkit Plugin `bulk-noindex-nofollow-toolkit-by-mad-fish`	Broken Access Control	`≤ 1.5` Fixed in `1.51`	Dec 13, 2024	`CVE-2023-41688`	Patchstack
6.5 Medium	Woocommerce Support System Plugin `wc-support-system`	Cross-Site Request Forgery No login needed	`≤ 1.2.2` Fixed in `1.2.3`	Dec 13, 2024	`CVE-2023-41686`	Patchstack
5.4 Medium	TelSender Plugin `telsender`	Broken Access Control Broken Access Control + CSRF	`≤ 1.14.11` Fixed in `1.14.12`	Dec 13, 2024	`CVE-2023-41683`	Patchstack
5.4 Medium	Abandoned Cart Lite for WooCommerce Plugin `woocommerce-abandoned-cart`	Cross-Site Request Forgery	`≤ 5.16.1` Fixed in `5.16.2`	Dec 13, 2024	`CVE-2023-41671`	Patchstack
6.5 Medium	Easy Newsletter Signups Plugin `easy-newsletter-signups`	Broken Access Control No login needed	`≤ 1.0.4`	Dec 13, 2024	`CVE-2023-41664`	Patchstack
6.5 Medium	Ovic Product Bundle Plugin `ovic-product-bundle`	Broken Access Control No login needed	`≤ 1.1.2`	Dec 13, 2024	`CVE-2023-41649`	Patchstack
5.3 Medium	Secure Admin IP Plugin `secure-admin-ip`	Authentication Bypass IP Spoofing No login needed	`≤ 2.0`	Dec 13, 2024	`CVE-2023-41133`	Patchstack
4.3 Medium	Category Slider for WooCommerce Plugin `woo-category-slider-grid`	Broken Access Control	`≤ 1.4.15` Fixed in `1.4.16`	Dec 13, 2024	`CVE-2023-41132`	Patchstack
8.1 High	Premmerce User Roles Plugin `premmerce-user-roles`	Broken Access Control	`≤ 1.0.12` Fixed in `1.0.13`	Dec 13, 2024	`CVE-2023-41130`	Patchstack
5.4 Medium	Simple URLs Plugin `simple-urls`	Broken Access Control	`≤ 117` Fixed in `118`	Dec 13, 2024	`CVE-2023-40678`	Patchstack
4.3 Medium	ReviewX Plugin `reviewx`	Broken Access Control	`≤ 1.6.17` Fixed in `1.6.18`	Dec 13, 2024	`CVE-2023-40670`	Patchstack
4.3 Medium	HUSKY Plugin `woocommerce-products-filter`	Broken Access Control	`≤ 1.3.4.2` Fixed in `1.3.4.3`	Dec 13, 2024	`CVE-2023-40334`	Patchstack
4.3 Medium	Accordion Slider Plugin `accordion-slider`	Broken Access Control	`≤ 1.9.6` Fixed in `1.9.7`	Dec 13, 2024	`CVE-2023-40331`	Patchstack
4.3 Medium	Justified Gallery Plugin `justified-gallery`	Broken Access Control	`≤ 1.7.3` Fixed in `1.8.0`	Dec 13, 2024	`CVE-2023-40213`	Patchstack
4.3 Medium	MailChimp Forms by MailMunch Plugin `mailchimp-forms-by-mailmunch`	Broken Access Control No login needed	`≤ 3.1.4` Fixed in `3.1.5`	Dec 13, 2024	`CVE-2023-40203`	Patchstack
5.4 Medium	Cost Calculator Builder Plugin `cost-calculator-builder`	Broken Access Control	`≤ 3.1.42` Fixed in `3.1.43`	Dec 13, 2024	`CVE-2023-40011`	Patchstack
5.3 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Broken Access Control No login needed	`≤ 3.1.5` Fixed in `3.2.0`	Dec 13, 2024	`CVE-2023-40005`	Patchstack
6.5 Medium	WP Project Manager Plugin `wedevs-project-manager`	Broken Access Control No login needed	`≤ 2.6.7` Fixed in `2.6.8`	Dec 13, 2024	`CVE-2023-40003`	Patchstack
4.3 Medium	iThemes Sync Plugin `ithemes-sync`	Broken Access Control	`≤ 2.1.13` Fixed in `2.1.14`	Dec 13, 2024	`CVE-2023-40001`	Patchstack
5.3 Medium	Popup by Supsystic Plugin `popup-by-supsystic`	Broken Access Control No login needed	`≤ 1.10.19` Fixed in `1.10.20`	Dec 13, 2024	`CVE-2023-39997`	Patchstack
5.3 Medium	Accordion and Accordion Slider Plugin `accordion-and-accordion-slider`	Broken Access Control No login needed	`≤ 1.2.4` Fixed in `1.2.5`	Dec 13, 2024	`CVE-2023-39996`	Patchstack
4.3 Medium	Portfolio and Projects Plugin `portfolio-and-projects`	Broken Access Control	`≤ 1.3.7` Fixed in `1.3.8`	Dec 13, 2024	`CVE-2023-39995`	Patchstack
7.5 High	Redirection for Contact Form 7 Plugin `wpcf7-redirect`	Broken Access Control No login needed	`≤ 2.9.2` Fixed in `3.0.0`	Dec 13, 2024	`CVE-2023-39920`	Patchstack
5.3 Medium	Yet Another Stars Rating Plugin `yet-another-stars-rating`	Broken Access Control No login needed	`≤ 3.4.3` Fixed in `3.4.4`	Dec 13, 2024	`CVE-2023-39305`	Patchstack
4.3 Medium	Social Share Icons & Social Share Buttons Plugin `ultimate-social-media-plus`	Broken Access Control	`≤ 3.5.7` Fixed in `3.5.8`	Dec 13, 2024	`CVE-2023-38514`	Patchstack
5.4 Medium	Instant CSS Plugin `instant-css`	Broken Access Control	`≤ 1.1.4` Fixed in `1.1.5`	Dec 13, 2024	`CVE-2023-38483`	Patchstack
5.3 Medium	Booster Elementor Addons Plugin `booster-for-elementor`	Broken Access Control No login needed	`≤ 1.4.9`	Dec 13, 2024	`CVE-2023-38480`	Patchstack
5.3 Medium	Simple Googlebot Visit Plugin `simple-googlebot-visit`	Broken Access Control No login needed	`≤ 1.2.4` Fixed in `1.2.5`	Dec 13, 2024	`CVE-2023-38479`	Patchstack
4.3 Medium	QR code MeCard/vCard generator Plugin `wp-qrcode-me-v-card`	Broken Access Control	`≤ 1.6.0` Fixed in `1.6.1`	Dec 13, 2024	`CVE-2023-38477`	Patchstack
4.3 Medium	Donations Made Easy – Smart Donations Plugin `smart-donations`	Broken Access Control Smart Donations plugin <= 4.0.12 - Broken Access Control	`≤ 4.0.12`	Dec 13, 2024	`CVE-2023-38475`	Patchstack
8.3 High	JupiterX Core Plugin `jupiterx-core`	Broken Access Control Multiple Auth. Broken Access Control	`3.0.0 – 3.3.0` Fixed in `3.3.5`	Dec 13, 2024	`CVE-2023-38385`	Patchstack
5.4 Medium	Language Plugin `wordpress-language`	Broken Access Control	`≤ 1.2.1`	Dec 13, 2024	`CVE-2023-38383`	Patchstack
5.4 Medium	Easyship WooCommerce Shipping Rates Plugin `easyship-woocommerce-shipping-rates`	Broken Access Control	`≤ 0.9.0` Fixed in `0.9.1`	Dec 13, 2024	`CVE-2023-37989`	Patchstack
6.5 Medium	YourMembership Single Sign On Plugin `login-with-yourmembership`	Broken Access Control No login needed	`≤ 1.1.3` Fixed in `1.1.4`	Dec 13, 2024	`CVE-2023-37987`	Patchstack
4.3 Medium	Quiz And Survey Master Plugin `quiz-master-next`	Broken Access Control	`≤ 8.1.10` Fixed in `8.1.11`	Dec 13, 2024	`CVE-2023-37984`	Patchstack
6.5 Medium	WooCommerce Product Stock Alert Plugin `woocommerce-product-stock-alert`	Broken Access Control No login needed	`≤ 2.0.1` Fixed in `2.0.2`	Dec 13, 2024	`CVE-2023-37971`	Patchstack
5.3 Medium	Checkout with Zelle on Woocommerce Plugin `wc-zelle`	Broken Access Control No login needed	`≤ 3.1` Fixed in `3.1.1`	Dec 13, 2024	`CVE-2023-37969`	Patchstack
6.5 Medium	DirectoryPress Plugin `directorypress`	Broken Access Control Unauthenticated Broken Access Control No login needed	`≤ 3.6.2` Fixed in `3.6.3`	Dec 13, 2024	`CVE-2023-37967`	Patchstack
6.5 Medium	WPSchoolPress Plugin `wpschoolpress`	Broken Access Control	`≤ 2.2.7` Fixed in `2.2.8`	Dec 13, 2024	`CVE-2023-37887`	Patchstack
5.3 Medium	Cryptocurrency Widgets – Price Ticker & Coins List Plugin `cryptocurrency-price-ticker-widget`	Broken Access Control Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control No login needed	`≤ 2.6.2` Fixed in `2.6.3`	Dec 13, 2024	`CVE-2023-36681`	Patchstack
5.4 Medium	Image Regenerate & Select Crop Plugin `image-regenerate-select-crop`	Broken Access Control	`≤ 7.1.0` Fixed in `7.2.0`	Dec 13, 2024	`CVE-2023-36680`	Patchstack
4.3 Medium	LiquidPoll – Advanced Polls for Creators and Brands Plugin `wp-poll`	Broken Access Control	`≤ 3.3.68` Fixed in `3.3.69`	Dec 13, 2024	`CVE-2023-36531`	Patchstack
5.3 Medium	kk Star Ratings Plugin `kk-star-ratings`	Broken Access Control Rate Manipulation due to IP Spoofing No login needed	`≤ 5.4.3` Fixed in `5.4.4`	Dec 13, 2024	`CVE-2023-36528`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.