WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 23,201–23,250 of 29,262 vulnerabilities

Known WordPress vulnerabilities, page 465 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.4 High Facebook Chat Plugin Broken Access Control Missing Capabilities Check < 1.6 Fixed in 1.6 CVE-2020-36838 Wordfence
6.3 Medium Discount Rules for WooCommerce Plugin woo-discount-rules Broken Access Control Missing Authorization ≤ 2.0.2 CVE-2020-36834 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'update_profile_preference' ≤ 4.3.7 CVE-2023-7288 Wordfence
7.3 High Product Filter by WooBeWoo Plugin Broken Access Control Missing Authorization No login needed ≤ 1.4.9 CVE-2021-4444 Wordfence
9.8 Critical ZoomSounds Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 5.96 CVE-2021-4449 Wordfence
6.3 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Broken Access Control Missing Authorization ≤ 4.6.4 CVE-2021-4446 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'pt_cancel_subscription' ≤ 4.3.7 CVE-2023-7287 Wordfence
6.6 Medium NinjaFirewall Plugin PHP Object Injection Authenticated PHAR Deserialization < 4.3.4 Fixed in 4.3.4 CVE-2021-4451 Wordfence
7.4 High File Manager Pro Plugin filester Arbitrary File Upload Unauthenticated Limited JavaScript File Upload No login needed ≤ 8.3.9 CVE-2024-8918 Wordfence
9.8 Critical WordPress Mega Menu Plugin Arbitrary File Upload Arbitrary File Creation No login needed ≤ 2.0.6 CVE-2021-4443 Wordfence
6.1 Medium Woo Manage Fraud Orders Plugin woo-manage-fraud-orders Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.6.1 CVE-2024-9937 Wordfence
5.4 Medium ElementInvader Addons for Elementor Plugin elementinvader-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.8 CVE-2024-9888 Wordfence
5.4 Medium Community by PeepSo Plugin peepso-core Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 6.4.6.1 CVE-2024-9873 Wordfence
9.8 Critical UltimateAI Plugin Authentication Bypass No login needed ≤ 2.8.3 CVE-2024-9105 Wordfence
9.8 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution No login needed ≤ 3.16.3 CVE-2024-9634 Wordfence
6.1 Medium Kama SpamBlock Plugin kama-spamblock Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.8.2 CVE-2024-9647 Wordfence
6.1 Medium Locatoraid Store Locator Plugin locatoraid Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.9.47 CVE-2024-9652 Wordfence
4.3 Medium Multiline files upload for contact form 7 Plugin tags Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation ≤ 2.8.1 CVE-2024-9891 Wordfence
4.3 Medium WP ULike Plugin wp-ulike Cross-Site Request Forgery Cross-Site Request Forgery to Statistic Deletion No login needed ≤ 4.7.4 CVE-2024-9649 Wordfence
8.1 High AppPresser – Mobile App Framework Plugin apppresser Privilege Escalation Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP No login needed ≤ 4.4.4 CVE-2024-9305 Wordfence
5.6 Medium UltimateAI Plugin Authentication Bypass Limited User Password Change due to Improper Empty and Missing Default Value Check No login needed ≤ 2.8.3 CVE-2024-9104 Wordfence
6.1 Medium Smart Online Order for Clover Plugin clover-online-orders Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.5.7 CVE-2024-8787 Wordfence
4.7 Medium Discount Rules for WooCommerce – Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons Plugin woo-discount-rules Cross-Site Scripting Create Smart WooCommerce Coupons & Discounts, Bulk Discount, BOGO Coupons <= 2.6.5 - Reflected Cross-Site Scripting No login needed ≤ 2.6.5 CVE-2024-8541 Wordfence
6.4 Medium SEO Manager Plugin seo-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta ≤ 1.9 CVE-2024-9521 Wordfence
6.4 Medium Smart Online Order for Clover Plugin clover-online-orders Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via moo_receipt_link Shortcode ≤ 1.5.7 CVE-2024-9895 Wordfence
7.3 High AADMY – Add Auto Date Month Year Into Posts Plugin auto-date-year-month Arbitrary Shortcode Execution Add Auto Date Month Year Into Posts <= 2.0.1 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.0.1 CVE-2024-9837 Wordfence
5.3 Medium WooCommerce Plugin woocommerce Content Injection Unauthenticated HTML Injection No login needed ≤ 9.0.2 CVE-2024-9944 Wordfence
6.5 Medium WP 2FA with Telegram Plugin two-factor-login-telegram Authentication Bypass Two-Factor Authentication Bypass ≤ 3.0 CVE-2024-9820 Wordfence
4.3 Medium Elementor Plugin elementor Information Disclosure Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function ≤ 3.24.5 CVE-2024-6757 Wordfence
8.8 High WP 2FA with Telegram Plugin two-factor-login-telegram Authentication Bypass Authenticated (Subscriber+) Authentication Bypass ≤ 3.0 CVE-2024-9687 Wordfence
7.2 High Slimstat Analytics Plugin wp-slimstat Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 5.2.6 CVE-2024-9548 Wordfence
5.3 Medium WPIDE Plugin wpide Information Disclosure Unauthenticated Full Path Dislcosure No login needed ≤ 3.4.9 CVE-2024-9546 Wordfence
7.2 High Boost Your Blog's Engagement with WP Post Author Plugin wp-post-author SQL Injection Authenticated (Administrator+) SQL Injection ≤ 3.8.1 CVE-2024-8757 Wordfence
4.3 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections ≤ 1.13.8 CVE-2024-8902 Wordfence
6.4 Medium TablePress Plugin tablepress Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 2.4.2 CVE-2024-9595 Wordfence
6.4 Medium Rescue Shortcodes Plugin rescue-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.8 CVE-2024-9696 Wordfence
5.3 Medium Stackable – Page Builder Gutenberg Blocks Plugin stackable-ultimate-gutenberg-blocks Content Injection Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection No login needed ≤ 3.13.6 CVE-2024-8760 Wordfence
6.4 Medium Category Icon Plugin category-icon Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.0 CVE-2024-8915 Wordfence
6.4 Medium Social Sharing (by Danny) Plugin dvk-social-sharing Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.7 CVE-2024-9704 Wordfence
9.8 Critical WordPress File Upload Plugin wp-file-upload Arbitrary File Upload Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php No login needed ≤ 4.24.11 CVE-2024-9047 Wordfence
4.3 Medium Order Attachments for WooCommerce Plugin order-attachments-for-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload 2.0 – 2.4.1 CVE-2024-9756 Wordfence
6.1 Medium 2D Tag Cloud Plugin 2d-tag-cloud-widget-by-sujin Cross-Site Scripting Reflected Cross-Site Scripting via add_query_arg Parameter No login needed ≤ 6.0.2 CVE-2024-9670 Wordfence
4.4 Medium ImagePress - Image Gallery Plugin image-gallery Cross-Site Scripting Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings ≤ 1.2.2 CVE-2024-9776 Wordfence
6.4 Medium Mynx Page Builder Plugin mynx-page-builder Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 0.27.8 CVE-2024-9656 Wordfence
4.4 Medium Forms for Mailchimp by Optin Cat Plugin mailchimp-wp Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters ≤ 2.5.7 CVE-2024-7489 Wordfence
4.3 Medium ImagePress - Image Gallery Plugin image-gallery Broken Access Control Image Gallery <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Post Title Update ≤ 1.2.2 CVE-2024-9824 Wordfence
4.3 Medium Read more By Adam Plugin read-more Broken Access Control Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion ≤ 1.1.8 CVE-2024-9187 Wordfence
4.3 Medium ImagePress – Image Gallery Plugin image-gallery Cross-Site Request Forgery Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 1.2.2 CVE-2024-9778 Wordfence
8.8 High Bot for Telegram on WooCommerce Plugin bot-for-telegram-on-woocommerce Information Disclosure Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass ≤ 1.2.7 CVE-2024-9821 Wordfence
5.4 Medium Bridge Core Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Demo Import ≤ 3.3 CVE-2024-9860 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only