WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 22,401–22,450 of 29,262 vulnerabilities

Known WordPress vulnerabilities, page 449 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Easy SVG Support Plugin easy-svg Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 3.7 CVE-2024-10269 Wordfence
9.6 Critical Registrations for The Events Calendar Plugin registrations-for-the-events-calendar Cross-Site Scripting Unauthenticated Stored XSS No login needed < 2.12.4 Fixed in 2.12.4 CVE-2024-7982 WPScan
6.4 Medium Simple Shortcode for Google Maps Plugin simple-google-maps-short-code Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.5.4 CVE-2024-10621 Wordfence
4.8 Medium Safe SVG Plugin safe-svg Cross-Site Scripting Author+ SVG Sanitisation Bypass < 2.2.6 Fixed in 2.2.6 CVE-2024-8378 WPScan
4.3 Medium Jetpack Plugin jetpack Broken Access Control Subscriber+ Arbitrary Feedback Access 13.9 – < 13.9.1, 13.8 – < 13.8.2, 13.7 – < 13.7.1, … Fixed in 13.9.1 CVE-2024-9926 WPScan
6.4 Medium Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider Plugin bdthemes-prime-slider-lite Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget ≤ 3.15.18 CVE-2024-8442 Wordfence
4.8 Medium WP Booking Calendar Plugin Cross-Site Scripting Admin+ Stored XSS < 10.6.3 Fixed in 10.6.3 CVE-2024-10027 WPScan
6.4 Medium Event Post Plugin event-post Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via events_cal Shortcode ≤ 5.9.6 CVE-2024-10186 Wordfence
6.4 Medium Pricing Tables WordPress Plugin – Easy Pricing Tables Plugin easy-pricing-tables Cross-Site Scripting Easy Pricing Tables <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fontFamily Attribute ≤ 3.2.6 CVE-2024-8323 Wordfence
6.4 Medium Active Products Tables for WooCommerce. Use constructor to create tables Plugin profit-products-tables-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via woot_button Shortcode ≤ 1.0.6.4 CVE-2024-10168 Wordfence
6.4 Medium MapPress Maps Plugin mappress-google-maps-for-wordpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block ≤ 2.94.1 CVE-2024-10715 Wordfence
10.0 Critical WP JobSearch Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 2.6.7 CVE-2024-8615 Wordfence
9.9 Critical WP JobSearch Plugin Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload ≤ 2.6.7 CVE-2024-8614 Wordfence
5.3 Medium EleForms – All In One Form Integration including DB for Elementor Plugin all-contact-form-integration-for-elementor Broken Access Control All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization No login needed ≤ 2.9.9.9 CVE-2024-6626 Wordfence
4.3 Medium Tumult Hype Animations Plugin tumult-hype-animations Broken Access Control Missing Authorization ≤ 1.9.14 CVE-2024-10543 Wordfence
8.1 High Social Share, Social Login and Social Comments Plugin – Super Socializer Plugin Authentication Bypass Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider No login needed ≤ 7.13.68 CVE-2024-9946 Wordfence
5.3 Medium Video Gallery for WooCommerce Plugin video-wc-gallery Broken Access Control Missing Authorization to Unauthenticated Limited File Deletion No login needed ≤ 1.31 CVE-2024-10535 Wordfence
8.1 High Heateor Social Login Plugin Authentication Bypass Authentication Bypass via Disqus OAuth provider No login needed ≤ 1.1.35 CVE-2024-10020 Wordfence
9.9 Critical mFolio Lite Plugin mfolio-lite Broken Access Control Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files ≤ 1.2.1 CVE-2024-9307 Wordfence
6.1 Medium Wp-ImageZoom Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.1.0 CVE-2024-9934 WPScan
4.8 Medium WP ULike Plugin wp-ulike Cross-Site Scripting Admin+ Stored XSS via Widgets < 4.7.5 Fixed in 4.7.5 CVE-2024-7879 WPScan
6.1 Medium WS Form LITE – Drag & Drop Contact Form Builder Plugin ws-form Cross-Site Scripting Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL No login needed ≤ 1.9.244 CVE-2024-10647 Wordfence
7.5 High Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin everest-backup Information Disclosure WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log No login needed ≤ 2.2.13 CVE-2024-10028 Wordfence
4.3 Medium Contact Form 7 – Dynamic Text Extension Plugin contact-form-7-dynamic-text-extension Information Disclosure Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode ≤ 4.5 CVE-2024-10084 Wordfence
4.3 Medium Ultimate Bootstrap Elements for Elementor Plugin ultimate-bootstrap-elements-for-elementor Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure ≤ 1.4.6 CVE-2024-10329 Wordfence
7.3 High Tickera – WordPress Event Ticketing Plugin tickera-event-ticketing-system Arbitrary Shortcode Execution WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 3.5.4.4 CVE-2024-10263 Wordfence
5.4 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Open Map Widget ≤ 5.10.2 CVE-2024-9867 Wordfence
6.5 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Plugin bdthemes-element-pack-lite Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 5.10.2 CVE-2024-9657 Wordfence
6.4 Medium XT Floating Cart for WooCommerce Plugin woo-floating-cart-lite Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.8.2 CVE-2024-9178 Wordfence
4.3 Medium 140+ Widgets | Xpro Addons For Elementor – FREE Plugin xpro-elementor-addons Information Disclosure FREE <= 1.4.6 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Template ≤ 1.4.6 CVE-2024-10319 Wordfence
9.8 Critical Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Plugin contest-gallery SQL Injection Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection No login needed ≤ 24.0.3 CVE-2024-10687 Wordfence
4.4 Medium Photo Gallery by 10Web Plugin photo-gallery Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.8.30 CVE-2024-9878 Wordfence
4.3 Medium Zotpress Plugin zotpress Broken Access Control Missing Authorization ≤ 7.3.12 CVE-2024-7429 Wordfence
6.1 Medium Seriously Simple Podcasting Plugin seriously-simple-podcasting Cross-Site Scripting Reflected Cross-Site Scripting via add_query_arg Parameter No login needed ≤ 3.5.0 CVE-2024-9667 Wordfence
8.8 High WooCommerce Report Plugin ithemelandco-woo-report Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Options Update No login needed ≤ 1.5.1 CVE-2024-10711 Wordfence
8.1 High Social Login - WordPress / WooCommerce Plugin Authentication Bypass WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 2.7.7 CVE-2024-10114 Wordfence
6.4 Medium Basticom Framework Plugin basticom-framework Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.5.0 CVE-2024-9443 Wordfence
8.1 High Loginizer Security and Loginizer Plugin loginizer Authentication Bypass Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 1.9.2 CVE-2024-10097 Wordfence
4.8 Medium Pods Plugin pods Cross-Site Scripting Admin+ Stored XSS < 3.2.7.1 Fixed in 3.2.7.1 CVE-2024-9883 WPScan
4.1 Medium Post From Frontend Plugin Cross-Site Request Forgery Post Deletion via CSRF ≤ 1.0.0 CVE-2024-9689 WPScan
4.8 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Cross-Site Scripting Admin+ Stored XSS < 1.6.7.55 Fixed in 1.6.7.55 CVE-2024-7877 WPScan
4.8 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Cross-Site Scripting Admin+ Stored XSS < 1.6.7.55 Fixed in 1.6.7.55 CVE-2024-7876 WPScan
4.8 Medium Table of Contents Plus Plugin table-of-contents-plus Cross-Site Scripting Editor+ Stored XSS ≤ 2408 CVE-2024-5578 WPScan
6.4 Medium Shortcodes Blocks Creator Ultimate Plugin ultimate-shortcodes-creator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.1.3 CVE-2024-10340 Wordfence
6.5 Medium Knowledge Base Plugin knowledgebase Cross-Site Scripting ≤ 2.2.0 Fixed in 2.2.1 CVE-2024-51677 Patchstack
6.5 Medium Elo Rating Shortcode Plugin elo-rating-shortcode Cross-Site Scripting ≤ 1.0.3 Fixed in 1.0.4 CVE-2024-51678 Patchstack
6.5 Medium Cresta Addons for Elementor Plugin cresta-addons-for-elementor Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.0.9 Fixed in 1.1.0 CVE-2024-51680 Patchstack
6.5 Medium WP Pocket URLs Plugin wp-pocket-urls Cross-Site Scripting ≤ 1.0.3 Fixed in 1.0.4 CVE-2024-51681 Patchstack
6.5 Medium HT Builder – WordPress Theme Builder for Elementor Plugin ht-builder Cross-Site Scripting WordPress Theme Builder for Elementor plugin <= 1.3.0 - Stored Cross Site Scripting (XSS) ≤ 1.3.0 Fixed in 1.3.1 CVE-2024-51682 Patchstack
6.5 Medium Custom post type templates for Elementor Plugin custom-post-type-templates-for-elementor Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.10.1 Fixed in 1.1.12 CVE-2024-51683 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only