WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 23,551–23,600 of 29,262 vulnerabilities

Known WordPress vulnerabilities, page 472 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Media Grid Widget ≤ 4.10.52 CVE-2024-8681 Wordfence
6.4 Medium OSM Plugin osm Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes ≤ 6.1.0 CVE-2024-8991 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module ≤ 2.8.3.6 CVE-2024-9049 Wordfence
6.5 Medium AI Assistant with ChatGPT by AYS Plugin Broken Access Control Unauthenticated AJAX Calls No login needed < 2.1.0 Fixed in 2.1.0 CVE-2024-7714 WPScan
7.5 High AI Chatbot with ChatGPT by AYS Plugin Information Disclosure Unauthenticated OpenAI Key Disclosure No login needed < 2.1.0 Fixed in 2.1.0 CVE-2024-7713 WPScan
8.8 High Product Enquiry for WooCommerce Plugin enquiry-quotation-for-woocommerce PHP Object Injection Authenticated (Author+) PHP Object Injection in enquiry_detail.php ≤ 2.2.33.33 CVE-2024-8922 Wordfence
7.2 High GiveWP – Donation Plugin and Fundraising Platform Plugin give SQL Injection Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter ≤ 3.16.1 CVE-2024-9130 Wordfence
6.4 Medium Absolute Reviews Plugin absolute-reviews Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name ≤ 1.1.3 CVE-2024-8965 Wordfence
4.3 Medium Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce Plugin email-subscribers Broken Access Control Email Marketing, Newsletters, Automation for WordPress & WooCommerce <= 5.7.34 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure ≤ 5.7.34 CVE-2024-8771 Wordfence
6.4 Medium Themedy Toolbox Plugin themedy-toolbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 1.0.15 CVE-2024-9177 Wordfence
5.5 Medium Form Maker Plugin form-maker Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.15.27 CVE-2024-8633 Wordfence
6.8 Medium Advanced File Manager Theme file-manager-advanced Arbitrary File Upload Authenticated (Subscriber+) Limited File Upload ≤ 5.2.8 CVE-2024-8725 Wordfence
7.2 High Advanced File Manager Plugin file-manager-advanced Local File Inclusion Authenticated (Administrator+) Local JavaScript File Inclusion via fma_locale ≤ 5.2.8 CVE-2024-8704 Wordfence
7.5 High Advanced File Manager Plugin file-manager-advanced Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload ≤ 5.2.8 CVE-2024-8126 Wordfence
7.2 High WordPress Visitors Plugin nm-visitors Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via HTTP Header No login needed ≤ 1.0 CVE-2022-4541 Wordfence
6.4 Medium Mapplic Lite Plugin mapplic-lite Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0 CVE-2024-9117 Wordfence
6.4 Medium Common Tools for Site Plugin common-tools-for-site Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.2 CVE-2024-9115 Wordfence
6.4 Medium GF Custom Style Plugin gf-custom-style Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.0 CVE-2024-9173 Wordfence
6.4 Medium Super Testimonials Plugin sola-testimonials Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter ≤ 3.0.0 CVE-2024-9127 Wordfence
6.4 Medium king_IE Plugin king-ie Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0 CVE-2024-9125 Wordfence
4.3 Medium Joy Of Text Lite Plugin joy-of-text Broken Access Control ≤ 2.3.1 CVE-2024-47337 Patchstack
5.3 Medium Sight – Professional Image Gallery and Portfolio Plugin sight Broken Access Control Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title No login needed ≤ 1.1.2 CVE-2024-9025 Wordfence
6.1 Medium Store Hours for WooCommerce Plugin order-hours-scheduler-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 4.3.20 CVE-2024-8872 Wordfence
6.4 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting User Profiles, Groups and Communities <= 5.9.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.3.2 CVE-2024-8861 Wordfence
6.1 Medium Contact Form 7 Math Captcha Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 2.0.1 CVE-2024-6517 WPScan
8.1 High Jupiter X Core Plugin jupiterx-core Authentication Bypass Limited Unauthenticated Authentication Bypass to Account Takeover No login needed ≤ 4.7.5 CVE-2024-7781 Wordfence
9.8 Critical Jupiter X Core Plugin jupiterx-core Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 4.6.5 CVE-2024-7772 Wordfence
4.3 Medium Slider by Supsystic Plugin slider-by-supsystic Broken Access Control Broken Access Control vulnerability on multiple WordPress plugins by Supsystic ≤ 1.8.6, ≤ 2.2.9 Fixed in 1.8.7 CVE-2024-47330 Patchstack
6.1 Medium Bulk NoIndex & NoFollow Toolkit Plugin bulk-noindex-nofollow-toolkit-by-mad-fish Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.15 CVE-2024-8803 Wordfence
4.3 Medium Download Monitor Plugin download-monitor Broken Access Control Missing Authorization to Authenticated (Subscriber+) Shop Enable ≤ 5.0.9 CVE-2024-8552 Wordfence
6.4 Medium 012 PS Multi Languages Plugin 012-ps-multi-languages Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6 CVE-2024-8723 Wordfence
4.3 Medium Use Any Font Plugin use-any-font Cross-Site Request Forgery No login needed ≤ 6.3.08 Fixed in 6.3.09 CVE-2024-47305 Patchstack
5.4 Medium GiveWP Plugin give Cross-Site Request Forgery Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) No login needed ≤ 3.15.1 Fixed in 3.16.0 CVE-2024-47315 Patchstack
5.3 Medium WordPress Tag Cloud Plugin – Tag Groups Plugin tag-groups Information Disclosure Sensitive Data Exposure No login needed ≤ 2.0.3 Fixed in 2.0.4 CVE-2024-43237 Patchstack
5.3 Medium Masterstudy LMS Starter Theme Information Disclosure Sensitive Data Exposure No login needed ≤ 1.1.8 Fixed in 1.1.9 CVE-2024-43990 Patchstack
7.1 High Testimonials Plugin super-testimonial Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.0.1 Fixed in 4.0.2 CVE-2024-43959 Patchstack
6.4 Medium ElementsKit Elementor addons Plugin elementskit-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget ≤ 3.2.7 CVE-2024-8546 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via piechart_settings Parameter ≤ 8.5 CVE-2024-8858 Wordfence
5.5 Medium litespeed cache Plugin litespeed-cache Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 6.4.1 CVE-2024-9169 Wordfence
6.5 Medium Livemesh Addons for Elementor Plugin addons-for-elementor Cross-Site Scripting ≤ 8.5 Fixed in 8.5.1 CVE-2024-47303 Patchstack
4.7 Medium Ninja Forms Contact Form Plugin ninja-forms Cross-Site Scripting Reflected Self-Based Cross-Site Scripting via Referer No login needed ≤ 3.8.15 CVE-2024-3866 Wordfence
8.8 High WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Plugin wc-frontend-manager Broken Access Control Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation ≤ 6.7.12 CVE-2024-8290 Wordfence
5.3 Medium Revolut Gateway for WooCommerce Plugin revolut-gateway-for-woocommerce Broken Access Control Missing Authorization to Unauthenticated Order Status Update No login needed ≤ 4.17.3 CVE-2024-8678 Wordfence
4.3 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Information Disclosure Absolute Addons For Elementor <= 2.6.5 - Authenticated (Contributor+) Sensitive Information Exposure via template_id ≤ 2.6.5 CVE-2024-8910 Wordfence
4.3 Medium adstxt Plugin Cross-Site Request Forgery Settings Update via CSRF No login needed ≤ 1.0.0 CVE-2024-7892 WPScan
4.8 Medium WP ULike Plugin wp-ulike Cross-Site Scripting Admin+ Stored XSS < 4.7.4 Fixed in 4.7.4 CVE-2024-7878 WPScan
5.3 Medium SmartSearchWP Plugin Information Disclosure Unauthenticated OpenAI Key Disclosure No login needed < 2.4.6 Fixed in 2.4.6 CVE-2024-6845 WPScan
5.3 Medium Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred Plugin mycred Broken Access Control Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade No login needed ≤ 2.7.3 CVE-2024-8658 Wordfence
9.8 Critical The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.6.4 CVE-2024-8275 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.9.7 CVE-2024-8668 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only