WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 24,151–24,200 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 484 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium LearnPress Plugin learnpress Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.2.6.8.2 Fixed in 4.2.6.9 CVE-2024-39642 Patchstack
7.5 High Import and export users and customers Plugin import-users-from-csv-with-meta Information Disclosure Sensitive Information via Imported File No login needed ≤ 1.26.8 Fixed in 1.26.9 CVE-2024-38787 Patchstack
5.3 Medium Send Users Email Plugin send-users-email Information Disclosure Sensitive Data Exposure No login needed ≤ 1.5.1 Fixed in 1.5.2 CVE-2024-38760 Patchstack
5.3 Medium Coming Soon Plugin responsive-coming-soon-page Information Disclosure Responsive Coming Soon & Maintenance Mode plugin <= 1.6.3 - Sensitive Data Exposure No login needed ≤ 1.6.3 CVE-2024-38756 Patchstack
6.5 Medium Zoho Campaigns Plugin zoho-campaigns Cross-Site Scripting ≤ 2.0.8 Fixed in 2.1.0 CVE-2024-38752 Patchstack
5.3 Medium Olive One Click Demo Import Plugin olive-one-click-demo-import Information Disclosure Sensitive Data Exposure No login needed ≤ 1.1.2 CVE-2024-38749 Patchstack
7.5 High HitPay Payment Gateway for WooCommerce Plugin hitpay-payment-gateway Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 4.1.3 Fixed in 4.1.4 CVE-2024-38747 Patchstack
5.3 Medium MBE eShip Plugin mail-boxes-etc Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.2 CVE-2024-38742 Patchstack
7.1 High Contact Form 7 Summary and Print Plugin cf7-summary-and-print Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to XSS No login needed ≤ 1.2.5 Fixed in 1.2.6 CVE-2024-38724 Patchstack
7.5 High Wallet System for WooCommerce Plugin wallet-system-for-woocommerce Information Disclosure Sensitive Data Exposure via Exported File No login needed ≤ 2.5.13 Fixed in 2.5.14 CVE-2024-38699 Patchstack
7.5 High Woocommerce OpenPos Plugin Information Disclosure Unauthenticated Sensitive Data Exposure No login needed ≤ 6.4.4 CVE-2024-37935 Patchstack
4.8 Medium Generate Images – Magic Post Thumbnail Plugin Cross-Site Scripting Magic Post Thumbnail < 5.2.8 - Admin+ Stored XSS < 5.2.8 Fixed in 5.2.8 CVE-2024-6724 WPScan
6.4 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Plugin bdthemes-element-pack-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Gallery and Countdown Widgets ≤ 5.7.2 CVE-2024-7247 Wordfence
8.8 High Media Library Assistant Plugin media-library-assistant Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload via mla-inline-edit-upload-scripts AJAX Action ≤ 3.18 CVE-2024-6823 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via no_more_items_text Parameter ≤ 5.9.27 CVE-2024-7092 Wordfence
9.8 Critical JS Help Desk – The Ultimate Help Desk & Support Plugin js-support-ticket Remote Code Execution The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution No login needed ≤ 2.8.6 CVE-2024-7094 Wordfence
4.0 Medium WP Bannerize Pro Plugin wp-bannerize-pro Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting ≤ 1.9.0 CVE-2024-7388 Wordfence
5.3 Medium SmartMag Theme smartmag-responsive-retina-wordpress-magazine Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 10.1.0 Fixed in 10.1.0 CVE-2024-37930 Patchstack
5.3 Medium WP2Speed Faster Plugin wp2speed Information Disclosure Optimize PageSpeed Insights Score 90-100 plugin <= 1.0.1 - Sensitive Data Exposure No login needed ≤ 1.0.1 CVE-2024-37924 Patchstack
5.9 Medium Slider by Soliloquy Plugin soliloquy-lite Broken Access Control Broken Access Control to XSS ≤ 2.7.6 Fixed in 2.7.7 CVE-2024-35775 Patchstack
6.5 Medium Card Elements for Elementor Plugin card-elements-for-elementor Cross-Site Scripting ≤ 1.2.2 Fixed in 1.2.3 CVE-2024-43123 Patchstack
6.5 Medium Graphina Plugin graphina-elementor-charts-and-graphs Cross-Site Scripting ≤ 1.8.10 Fixed in 2.0.0 CVE-2024-43124 Patchstack
6.5 Medium WP Table Builder – WordPress Table Plugin wp-table-builder Cross-Site Scripting ≤ 1.4.15 Fixed in 1.5.0 CVE-2024-43125 Patchstack
7.1 High Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce Plugin sender-net-automated-emails Cross-Site Scripting Newsletter, SMS and Email Marketing Automation for WooCommerce plugin <= 2.6.14 - Cross Site Scripting (XSS) No login needed ≤ 2.6.14 Fixed in 2.6.16 CVE-2024-43126 Patchstack
7.1 High Products, Order & Customers Export for WooCommerce Plugin export-woocommerce Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0.11 Fixed in 2.0.12 CVE-2024-43127 Patchstack
5.9 Medium Football Pool Plugin football-pool Cross-Site Scripting ≤ 2.11.10 Fixed in 2.12.1 CVE-2024-43130 Patchstack
6.5 Medium Themify Shortcodes Plugin themify-shortcodes Cross-Site Scripting ≤ 2.1.1 Fixed in 2.1.2 CVE-2024-43133 Patchstack
5.9 Medium WappPress Plugin wapppress-builds-android-app-for-website Cross-Site Scripting ≤ 6.0.4 Fixed in 6.0.5 CVE-2024-43137 Patchstack
6.5 Medium Football Pool Plugin football-pool Cross-Site Scripting ≤ 2.11.9 Fixed in 2.11.10 CVE-2024-43139 Patchstack
6.5 Medium Selection Lite Plugin selection-lite Cross-Site Scripting ≤ 1.11 Fixed in 1.12 CVE-2024-43147 Patchstack
5.9 Medium StreamCast Plugin streamcast Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 2.2.3 Fixed in 2.2.4 CVE-2024-43148 Patchstack
6.5 Medium CM Tooltip Glossary Plugin enhanced-tooltipglossary Cross-Site Scripting ≤ 4.3.7 Fixed in 4.3.9 CVE-2024-43149 Patchstack
6.5 Medium Xpro Elementor Addons Plugin xpro-elementor-addons Cross-Site Scripting ≤ 1.4.4.2 Fixed in 1.4.4.3 CVE-2024-43150 Patchstack
6.5 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) ≤ 1.5.9 Fixed in 1.5.10 CVE-2024-43151 Patchstack
5.9 Medium 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin interactive-3d-flipbook-powered-physics-engine Cross-Site Scripting ≤ 1.15.6 Fixed in 1.15.7 CVE-2024-43152 Patchstack
6.5 Medium ComboBlocks Plugin post-grid Cross-Site Scripting ≤ 2.2.86 Fixed in 2.2.87 CVE-2024-43155 Patchstack
7.1 High Post Grid Master Plugin ajax-filter-posts Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.4.10 Fixed in 3.4.11 CVE-2024-43156 Patchstack
5.9 Medium Depicter Slider Plugin depicter Cross-Site Scripting ≤ 3.1.2 Fixed in 3.2.0 CVE-2024-43161 Patchstack
7.1 High ParcelPanel Plugin parcelpanel Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.3.2 Fixed in 4.3.3 CVE-2024-43163 Patchstack
6.5 Medium Blockspare Plugin blockspare Cross-Site Scripting ≤ 3.2.0 Fixed in 3.2.1 CVE-2024-43164 Patchstack
6.5 Medium Spectra Plugin ultimate-addons-for-gutenberg Cross-Site Scripting ≤ 2.14.1 Fixed in 2.15.1 CVE-2024-7590 Patchstack
6.5 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Cross-Site Scripting ≤ 1.3.9.2 CVE-2024-43210 Patchstack
7.1 High WC Marketplace Plugin dc-woocommerce-multi-vendor Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.1.17 CVE-2024-43213 Patchstack
6.5 Medium Filr Plugin filr-protection Cross-Site Scripting ≤ 1.2.4 Fixed in 1.2.5 CVE-2024-43216 Patchstack
7.1 High Kodex Posts likes Plugin kodex-posts-likes Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.5.0 CVE-2024-43217 Patchstack
6.5 Medium Mediavine Control Panel Plugin mediavine-control-panel Cross-Site Scripting ≤ 2.10.4 Fixed in 2.10.5 CVE-2024-43218 Patchstack
7.1 High Form Maker by 10Web Plugin form-maker Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.15.26 CVE-2024-43220 Patchstack
6.5 Medium YaMaps Plugin yamaps Cross-Site Scripting ≤ 0.6.27 CVE-2024-43224 Patchstack
6.5 Medium Enter Addons Plugin enteraddons Cross-Site Scripting ≤ 2.1.7 CVE-2024-43225 Patchstack
6.5 Medium WP Dashboard Notes Plugin wp-dashboard-notes Cross-Site Scripting ≤ 1.0.11 CVE-2024-43226 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only