WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 2,151–2,200 of 2,544 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 44 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Arigato Autoresponder and Newsletter Plugin bft-autoresponder Cross-Site Request Forgery No login needed ≤ 2.7.2.3 Fixed in 2.7.2.4 CVE-2024-34823 Patchstack
4.3 Medium Social Warfare Plugin social-warfare Cross-Site Request Forgery No login needed ≤ 4.4.5.1 Fixed in 4.4.6 CVE-2024-34825 Patchstack
4.3 Medium TranslatePress Plugin translatepress-multilingual Cross-Site Request Forgery TranslatePress plugin <= 2.7.5 - Cross Site Request Forgery (CSRF) No login needed ≤ 2.7.5 Fixed in 2.7.6 CVE-2024-34827 Patchstack
4.3 Medium Church Admin Plugin church-admin Cross-Site Request Forgery No login needed ≤ 4.1.32 Fixed in 4.2.0 CVE-2024-34828 Patchstack
4.7 Medium reCAPTCHA Jetpack Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 0.2.2 CVE-2024-3941 WPScan
8.8 High reCAPTCHA Jetpack Plugin Cross-Site Request Forgery Settings Update via CSRF No login needed ≤ 0.2.2 CVE-2024-3940 WPScan
5.4 Medium Swift Performance Lite Plugin swift-performance-lite Broken Access Control Incorrect Authorization to Authenticated (Subscriber+) Settings Modification ≤ 2.3.6.18 CVE-2024-3722 Wordfence
4.3 Medium DS Site Message Plugin ds-site-message Cross-Site Request Forgery No login needed ≤ 1.14.4 CVE-2024-34439 Patchstack
4.3 Medium WP Favorite Posts Plugin wp-favorite-posts Cross-Site Request Forgery No login needed ≤ 1.6.8 CVE-2024-34427 Patchstack
4.3 Medium Barcode Scanner with Inventory & Order Manager Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders Cross-Site Request Forgery No login needed ≤ 1.5.4 Fixed in 1.5.5 CVE-2024-34557 Patchstack
7.1 High Add Custom CSS and JS Plugin Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 1.20 CVE-2024-3903 WPScan
6.1 Medium LetterPress Plugin Cross-Site Request Forgery Subscriber Deletion via CSRF No login needed ≤ 1.2.2 CVE-2024-3590 WPScan
4.8 Medium Ungallery Plugin ungallery Cross-Site Scripting Stored XSS via CSRF ≤ 2.2.4 CVE-2024-3582 WPScan
7.6 High ARForms Form Builder Plugin arforms-form-builder Broken Access Control No login needed ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-31270 Patchstack
4.3 Medium Restaurant and Cafe Theme restaurant-and-cafe Cross-Site Request Forgery No login needed ≤ 1.2.1 Fixed in 1.2.2 CVE-2024-34379 Patchstack
7.1 High Popup box Plugin ays-popup-box Cross-Site Request Forgery CSRF to XSS No login needed ≤ 4.1.2 Fixed in 4.1.3 CVE-2024-34367 Patchstack
7.5 High MF Gig Calendar Plugin Cross-Site Request Forgery Arbitrary Event Deletion via CSRF No login needed ≤ 1.2.1 CVE-2024-3756 WPScan
5.4 Medium Stop Spammers Security | Block Spam Users, Comments, Forms Plugin Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) via sfs_process No login needed ≤ 2024.4 CVE-2023-7065 Wordfence
4.3 Medium CM Tooltip Glossary – Powerful Glossary Plugin enhanced-tooltipglossary Cross-Site Request Forgery Powerful Glossary Plugin <= 4.2.11 - Cross-Site Request Forgery No login needed ≤ 4.2.11 CVE-2024-4086 Wordfence
6.4 Medium Social Sharing Plugin – Social Warfare Plugin social-warfare Cross-Site Scripting Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.6.1 CVE-2024-1959 Wordfence
7.1 High ARForms Form Builder Plugin arforms-form-builder Broken Access Control Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion ≤ 1.6.4 CVE-2024-1945 Wordfence
6.5 Medium Perfect Pullquotes Plugin perfect-pullquotes Cross-Site Scripting ≤ 1.7.5 CVE-2024-33951 Patchstack
9.6 Critical Xserver Migrator Plugin xserver-migrator Cross-Site Request Forgery CSRF to Arbitrary File Upload No login needed ≤ 1.6.1 CVE-2024-33913 Patchstack
5.2 Medium Counter Box Plugin counter-box Cross-Site Request Forgery Counter Deletion via CSRF < 1.2.4 Fixed in 1.2.4 CVE-2024-3481 WPScan
6.1 Medium Herd Effects Plugin Cross-Site Request Forgery Effect Deletion via CSRF < 5.2.7 Fixed in 5.2.7 CVE-2024-3478 WPScan
4.3 Medium Popup Box Plugin ays-popup-box Cross-Site Request Forgery Popup Deletion via CSRF No login needed < 2.2.7 Fixed in 2.2.7 CVE-2024-3477 WPScan
8.8 High Side Menu Lite Plugin side-menu-lite Cross-Site Request Forgery Menu Deletion via CSRF No login needed < 4.2.1 Fixed in 4.2.1 CVE-2024-3476 WPScan
7.5 High Sticky Buttons Plugin sticky-buttons Cross-Site Request Forgery Button Deletion via CSRF < 3.2.4 Fixed in 3.2.4 CVE-2024-3475 WPScan
8.8 High Wow Skype Buttons Plugin Cross-Site Request Forgery Button Deletion via CSRF No login needed < 4.0.4 Fixed in 4.0.4 CVE-2024-3474 WPScan
5.9 Medium Modal Window Plugin modal-window Cross-Site Request Forgery Modal Deletion via CSRF No login needed < 5.3.10 Fixed in 5.3.10 CVE-2024-3472 WPScan
3.4 Low Button Generator Plugin button-generation Cross-Site Request Forgery Button Deletion via CSRF < 3.0 Fixed in 3.0 CVE-2024-3471 WPScan
4.5 Medium Float menu Plugin float-menu Cross-Site Request Forgery Menu Deletion via CSRF < 6.0.1 Fixed in 6.0.1 CVE-2024-2405 WPScan
5.0 Medium Knowledge Base documentation & wiki plugin – BasePress Plugin basepress Server-Side Request Forgery ≤ 2.16.1 Fixed in 2.16.2.1 CVE-2024-33590 Patchstack
5.4 Medium Piotnet Addons For Elementor Pro Plugin Server-Side Request Forgery Unauthenticated Server Side Request Forgery (SSRF) No login needed ≤ 7.1.17 CVE-2024-33634 Patchstack
4.4 Medium Auto Featured Image (Auto Post Thumbnail) Plugin auto-post-thumbnail Server-Side Request Forgery ≤ 4.0.0 CVE-2024-33629 Patchstack
4.4 Medium Absolutely Glamorous Custom Admin Plugin ag-custom-admin Server-Side Request Forgery Custom Dashboard & Login Page plugin <= 7.2.2 - Server Side Request Forgery (SSRF) ≤ 7.2.2 CVE-2024-33627 Patchstack
7.1 High Regenerate post permalink Plugin regenerate-post-permalinks Cross-Site Request Forgery Cross Site Request Forgery (CSRF) leading to XSS No login needed ≤ 1.0.3 CVE-2024-33681 Patchstack
5.4 Medium Piotnet Addons For Elementor Pro Plugin Cross-Site Request Forgery No login needed ≤ 7.1.17 CVE-2024-33632 Patchstack
3.8 Low MM-email2image Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 0.2.5 CVE-2024-3076 WPScan
4.3 Medium Teluro Theme teluro Cross-Site Request Forgery No login needed ≤ 1.0.31 Fixed in 1.0.36 CVE-2024-33688 Patchstack
4.3 Medium Radio Station Plugin radio-station Cross-Site Request Forgery No login needed ≤ 2.5.7 Fixed in 2.5.8 CVE-2024-33689 Patchstack
4.3 Medium Financio Theme financio Cross-Site Request Forgery No login needed ≤ 1.1.3 Fixed in 1.1.4 CVE-2024-33690 Patchstack
4.3 Medium OptinMonster Plugin optinmonster Cross-Site Request Forgery Cross Site Request Forgery (CSRF) Notice Dismissal No login needed ≤ 2.15.3 Fixed in 2.16.0 CVE-2024-33691 Patchstack
4.3 Medium Contact Form 7 Extension For Mailchimp Plugin contact-form-7-mailchimp-extension Cross-Site Request Forgery No login needed ≤ 0.5.70 CVE-2024-33677 Patchstack
4.3 Medium ClickCease Click Fraud Protection Plugin clickcease-click-fraud-protection Cross-Site Request Forgery No login needed ≤ 3.2.7 Fixed in 3.2.8 CVE-2024-33678 Patchstack
4.3 Medium FameTheme Demo Importer Plugin famethemes-demo-importer Cross-Site Request Forgery No login needed ≤ 1.1.5 Fixed in 1.1.6 CVE-2024-33679 Patchstack
5.4 Medium MainWP Child Reports Plugin mainwp-child-reports Cross-Site Request Forgery No login needed ≤ 2.1.1 Fixed in 2.2 CVE-2024-33680 Patchstack
5.4 Medium WP GDPR Compliance Plugin wp-gdpr-compliance Cross-Site Request Forgery No login needed ≤ 2.0.23 CVE-2024-33682 Patchstack
4.3 Medium Hide Dashboard Notifications Plugin wp-hide-backed-notices Cross-Site Request Forgery No login needed ≤ 1.2.3 Fixed in 1.3 CVE-2024-33683 Patchstack
5.4 Medium Smart Maintenance Mode Plugin smart-maintenance-mode Cross-Site Request Forgery No login needed ≤ 1.4.4 CVE-2024-33638 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only