WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 24,301–24,350 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 487 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Zephyr Project Manager Plugin zephyr-project-manager Information Disclosure Sensitive Data Exposure via Export File No login needed ≤ 3.3.99 Fixed in 3.3.100 CVE-2024-38761 Patchstack
8.3 High Better Find and Replace Plugin real-time-auto-find-and-replace PHP Object Injection No login needed ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-39636 Patchstack
5.4 Medium Edubin Plugin edubin Server-Side Request Forgery No login needed ≤ 9.2.0 CVE-2024-39637 Patchstack
8.0 High WPForms User Registration Plugin Privilege Escalation Authenticated Privilege Escalation ≤ 2.1.0 Fixed in 2.1.2 CVE-2023-52209 Patchstack
7.1 High MakeStories (for Google Web Stories) Plugin makestories-helper Path Traversal Arbitrary File Download and SSRF ≤ 3.0.3 Fixed in 3.0.4 CVE-2024-38746 Patchstack
4.3 Medium The Pack Elementor addons Plugin the-pack-addon Local File Inclusion ≤ 2.0.8.6 Fixed in 2.0.8.7 CVE-2024-38768 Patchstack
9.8 Critical Backup and Staging by WP Time Capsule Plugin wp-time-capsule Authentication Bypass Authentication Bypass and Privilege Escalation No login needed ≤ 1.22.20 Fixed in 1.22.21 CVE-2024-38770 Patchstack
6.5 Medium JetWidgets for Elementor and WooCommerce Plugin jetwoo-widgets-for-elementor Local File Inclusion Contributor+ Limited Local File Inclusion ≤ 1.1.7 Fixed in 1.1.8 CVE-2024-38772 Patchstack
7.2 High CTX Feed Plugin webappick-product-feed-for-woocommerce Privilege Escalation Arbitrary Options Update ≤ 6.5.6 Fixed in 6.5.7 CVE-2024-38775 Patchstack
4.9 Medium AI Engine: ChatGPT Chatbot Plugin ai-engine Server-Side Request Forgery ≤ 2.4.7 Fixed in 2.4.8 CVE-2024-38791 Patchstack
9.0 Critical ListingPro Plugin listingpro-plugin Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 2.9.4 Fixed in 2.9.5 CVE-2024-39619 Patchstack
8.0 High ListingPro Plugin listingpro-plugin Local File Inclusion ≤ 2.9.4 Fixed in 2.9.5 CVE-2024-39621 Patchstack
8.5 High ListingPro Theme listingpro Local File Inclusion ≤ 2.9.4 Fixed in 2.9.5 CVE-2024-39624 Patchstack
5.5 Medium Timetable and Event Schedule Plugin mp-timetable PHP Object Injection ≤ 2.4.13 CVE-2024-39630 Patchstack
8.8 High PowerPack for Beaver Builder Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.33.0 Fixed in 2.33.1 CVE-2024-39633 Patchstack
8.8 High PowerPack Pro for Elementor Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.10.14 Fixed in 2.10.15 CVE-2024-39634 Patchstack
6.4 Medium Element Pack - Addon for Elementor Page Builder Plugin Cross-Site Scripting Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL ≤ 7.9.0 CVE-2024-2455 Wordfence
6.4 Medium Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks Plugin post-grid Cross-Site Scripting Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget ≤ 2.2.85 CVE-2024-6346 Wordfence
4.3 Medium Breakdance Plugin Broken Access Control Missing Authorization ≤ 1.7.1 CVE-2024-5331 Wordfence
6.4 Medium Blog2Social: Social Media Auto Post & Scheduler Plugin blog2social Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via File Upload ≤ 7.5.4 CVE-2024-7302 Wordfence
6.4 Medium Breakdance Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.7.2 CVE-2024-5330 Wordfence
7.1 High Ultimate Classified Listings Plugin ultimate-classified-listings Cross-Site Scripting Reflected XSS No login needed < 1.4 Fixed in 1.4 CVE-2024-6529 WPScan
6.5 Medium Light Poll Plugin Cross-Site Request Forgery Polls Deletion via CSRF No login needed ≤ 1.0.0 CVE-2024-6496 WPScan
4.8 Medium My Sticky Bar Plugin mystickymenu Cross-Site Scripting Admin+ Stored XSS < 2.7.2 Fixed in 2.7.2 CVE-2024-4090 WPScan
8.1 High WooCommerce Customers Manager Plugin Cross-Site Request Forgery Bulk Action via CSRF No login needed < 30.1 Fixed in 30.1 CVE-2024-3983 WPScan
4.8 Medium Swift Framework Plugin Cross-Site Scripting Contributor+ Stored XSS < 2024.04.30 Fixed in 2024.04.30 CVE-2024-2872 WPScan
6.5 Medium WooCommerce Customers Manager Plugin Cross-Site Request Forgery User Deletion via CSRF No login needed < 30.1 Fixed in 30.1 CVE-2024-2843 WPScan
6.5 Medium WooCommerce Customers Manager Plugin Cross-Site Scripting Subscriber+ Stored XSS < 30.2 Fixed in 30.2 CVE-2024-1747 WPScan
6.4 Medium Remote Content Shortcode Plugin remote-content-shortcode Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery ≤ 1.5 CVE-2024-2090 Wordfence
8.8 High FundEngine – Donation and Crowdfunding Platform Plugin wp-fundraising-donation Privilege Escalation Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation ≤ 1.7.0 CVE-2024-6698 Wordfence
5.3 Medium CTT Expresso para WooCommerce Plugin ctt-expresso-para-woocommerce Information Disclosure Information Exposure via Unprotected Directory No login needed ≤ 3.2.12 CVE-2024-6687 Wordfence
6.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.97 CVE-2024-6208 Wordfence
6.5 Medium Tainacan Plugin tainacan Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read ≤ 0.21.7 CVE-2024-7135 Wordfence
4.9 Medium Formidable Forms Plugin formidable Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 6.11.1 CVE-2024-6725 Wordfence
5.3 Medium WP Mobile Menu Plugin mobile-menu Broken Access Control Missing Authorization to _mobmenu_icon Post Meta Modification No login needed ≤ 2.8.4.4 CVE-2024-2508 Wordfence
6.5 Medium HTML Forms – Simple WordPress Forms Plugin Cross-Site Request Forgery Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF No login needed < 1.3.34 Fixed in 1.3.34 CVE-2024-6412 WPScan
5.4 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Editor+ Stored XSS < 1.2.57 Fixed in 1.2.57 CVE-2024-6408 WPScan
6.1 Medium SpiderContacts Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.1.7 CVE-2024-6272 WPScan
4.8 Medium WANotifier Plugin notifier Cross-Site Scripting Admin+ Stored XSS < 2.6.1 Fixed in 2.6.1 CVE-2024-6165 WPScan
7.2 High Lifetime free Drag & Drop Contact Form Builder for WordPress VForm Plugin v-form Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 2.1.5 CVE-2024-6770 Wordfence
6.4 Medium SiteOrigin Widgets Bundle Plugin so-widgets-bundle Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget ≤ 1.62.2 CVE-2024-5901 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode ≤ 5.0.2 CVE-2024-7100 Wordfence
5.4 Medium Zephyr Project Manager Plugin zephyr-project-manager Cross-Site Scripting Editor+ XSS < 3.3.99 Fixed in 3.3.99 CVE-2024-6536 WPScan
6.5 Medium Pardakht Delkhah Plugin Cross-Site Request Forgery Form Fields Reset via CSRF No login needed ≤ 2.9.8 CVE-2024-6230 WPScan
6.1 Medium WpStickyBar Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 2.1.0 CVE-2024-6226 WPScan
5.9 Medium Send email only on Reply to My Comment Plugin Cross-Site Scripting Stored XSS via CSRF ≤ 1.0.6 CVE-2024-6224 WPScan
6.1 Medium Send email only on Reply to My Comment Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.0.6 CVE-2024-6223 WPScan
6.8 Medium Donation Block for PayPal Plugin donations-block Cross-Site Scripting Unauthenticated Stored XSS ≤ 2.1.0 CVE-2024-6021 WPScan
9.1 Critical CZ Loan Management Plugin SQL Injection Unauthenticated SQLi No login needed ≤ 1.1 CVE-2024-5975 WPScan
6.1 Medium WP Ajax Contact Form Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.2.2 CVE-2024-5809 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only