WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 24,651–24,700 of 29,211 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | SchedulePress | Information Disclosure Unauthenticated Full Path Disclosure No login needed |
≤ 5.1.3 |
CVE-2024-6557 |
Wordfence | |
| 6.1 Medium | WPS Hide Login | Information Disclosure Hidden Login Page Disclosure No login needed |
< 1.9.16.4 Fixed in 1.9.16.4 |
CVE-2024-6289 |
WPScan | |
| 6.1 Medium | WP eStore | Cross-Site Scripting Reflected XSS in Category Editing No login needed |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6076 |
WPScan | |
| 8.8 High | WP eStore | Cross-Site Request Forgery Coupon Deletion via CSRF No login needed |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6075 |
WPScan | |
| 5.4 Medium | WP eStore | Cross-Site Scripting Reflected XSS in Customer Editing |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6074 |
WPScan | |
| 4.7 Medium | WP eStore | Cross-Site Scripting Reflected XSS in Discount Editing No login needed |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6073 |
WPScan | |
| 6.1 Medium | WP eStore | Cross-Site Scripting Reflected XSS via $_SERVER['REQUEST_URI'] No login needed |
< 8.5.5 Fixed in 8.5.5 |
CVE-2024-6072 |
WPScan | |
| 8.8 High | Insert or Embed Articulate Content into | Arbitrary File Upload Author+ Arbitrary File Upload |
< 4.3000000024 Fixed in 4.3000000024 |
CVE-2024-5630 |
WPScan | |
| 4.3 Medium | WP Links Page | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Image Update |
≤ 4.9.5 |
CVE-2024-6465 |
Wordfence | |
| 4.8 Medium | if-so | Cross-Site Scripting Admin+ Stored XSS |
< 1.8.0.4 Fixed in 1.8.0.4 |
CVE-2024-6070 |
WPScan | |
| 6.8 Medium | WP eMember | Cross-Site Scripting Reflected XSS |
< 10.6.7 Fixed in 10.6.7 |
CVE-2024-5744 |
WPScan | |
| 7.1 High | WP eMember | Cross-Site Scripting Reflected XSS via Member Edit No login needed |
< 10.6.7 Fixed in 10.6.7 |
CVE-2024-5715 |
WPScan | |
| 5.4 Medium | if-so | Cross-Site Scripting Reflected XSS |
< 1.8.0.4 Fixed in 1.8.0.4 |
CVE-2024-5713 |
WPScan | |
| 5.4 Medium | WordPress Plugin Tournamatch | Cross-Site Scripting Admin+ Stored XSS via Ladders |
< 4.6.1 Fixed in 4.6.1 |
CVE-2024-5644 |
WPScan | |
| 5.4 Medium | WordPress Plugin Tournamatch | Cross-Site Scripting Subscriber+ Stored XSS |
< 4.6.1 Fixed in 4.6.1 |
CVE-2024-5627 |
WPScan | |
| 4.7 Medium | Ditty | Cross-Site Scripting Author+ Stored XSS No login needed |
< 3.1.43 Fixed in 3.1.43 |
CVE-2024-5575 |
WPScan | |
| 7.1 High | WP QuickLaTeX | Cross-Site Scripting Admin+ Stored XSS in Background Color field No login needed |
< 3.8.7 Fixed in 3.8.7 |
CVE-2024-5472 |
WPScan | |
| 9.1 Critical | Bug Library | Remote Code Execution Unauthenticated RCE No login needed |
< 2.1.1 Fixed in 2.1.1 |
CVE-2024-5450 |
WPScan | |
| 5.9 Medium | NextGEN Gallery | Cross-Site Scripting Admin+ Stored XSS |
< 3.59.3 Fixed in 3.59.3 |
CVE-2024-5442 |
WPScan | |
| 7.1 High | WP Affiliate Platform | Cross-Site Request Forgery Profile Update via CSRF No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5287 |
WPScan | |
| 4.8 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Banner Editing |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5286 |
WPScan | |
| 6.8 Medium | WP Affiliate Platform | Cross-Site Scripting Stored XSS via CSRF |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5284 |
WPScan | |
| 6.1 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Lead Editing No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5283 |
WPScan | |
| 6.1 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Registration Form No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5282 |
WPScan | |
| 6.1 Medium | WP Affiliate Platform | Cross-Site Scripting Reflected XSS via Affiliate Editing No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5281 |
WPScan | |
| 4.7 Medium | WP Affiliate Platform | Cross-Site Scripting POST Reflected XSS No login needed |
< 6.5.1 Fixed in 6.5.1 |
CVE-2024-5280 |
WPScan | |
| 8.1 High | CM Email Registration Blacklist and Whitelist | Cross-Site Request Forgery Add/Delete Emails via CSRF Add and delete any item from blacklist/whitelist No login needed |
< 1.4.9 Fixed in 1.4.9 |
CVE-2024-5167 |
WPScan | |
| 7.1 High | SULly | Cross-Site Scripting Admin+ Stored XSS No login needed |
< 4.3.1 Fixed in 4.3.1 |
CVE-2024-5151 |
WPScan | |
| 8.8 High | WP eMember | Arbitrary File Upload Admin+ Arbitrary File Upload |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5080 |
WPScan | |
| 6.1 Medium | WP eMember | Cross-Site Scripting Unauthenticated Stored XSS via Member Registration No login needed |
< 10.6.7 Fixed in 10.6.7 |
CVE-2024-5079 |
WPScan | |
| 6.8 Medium | WP eMember | Cross-Site Scripting Stored XSS in Blacklist via CSRF |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5077 |
WPScan | |
| 8.8 High | WP eMember | Cross-Site Request Forgery Bulk Delete via CSRF No login needed |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5076 |
WPScan | |
| 5.9 Medium | WP eMember | Cross-Site Scripting Reflected XSS |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5075 |
WPScan | |
| 5.4 Medium | WP eMember | Cross-Site Scripting Reflected XSS |
< 10.6.6 Fixed in 10.6.6 |
CVE-2024-5074 |
WPScan | |
| 8.8 High | SULly | Cross-Site Request Forgery Plugin Reset via CSRF No login needed |
< 4.3.1 Fixed in 4.3.1 |
CVE-2024-5034 |
WPScan | |
| 5.9 Medium | SULly | Cross-Site Scripting Admin+ Stored XSS via CSRF |
< 4.3.1 Fixed in 4.3.1 |
CVE-2024-5033 |
WPScan | |
| 4.7 Medium | SULly | Cross-Site Scripting Reflected XSS No login needed |
< 4.3.1 Fixed in 4.3.1 |
CVE-2024-5032 |
WPScan | |
| 6.5 Medium | CM WordPress Search And Replace | Cross-Site Request Forgery Plugin Reset via CSRF |
< 1.3.9 Fixed in 1.3.9 |
CVE-2024-5028 |
WPScan | |
| 4.8 Medium | User Submitted Posts | Cross-Site Scripting Admin+ Stored XSS |
< 20240516 Fixed in 20240516 |
CVE-2024-5002 |
WPScan | |
| 6.8 Medium | Index WP MySQL For Speed | Cross-Site Scripting Admin+ Reflected XSS |
< 1.4.18 Fixed in 1.4.18 |
CVE-2024-4977 |
WPScan | |
| 5.9 Medium | EventON | Cross-Site Scripting Admin+ Stored Cross-Site Scripting via event subtitle |
< 2.2.15 Fixed in 2.2.15 |
CVE-2024-4752 |
WPScan | |
| 5.4 Medium | Embed Peertube Playlist | Cross-Site Scripting Editor+ Stored XSS |
< 1.10 Fixed in 1.10 |
CVE-2024-4602 |
WPScan | |
| 6.1 Medium | Support SVG | Cross-Site Scripting Stored XSS via SVG Upload No login needed |
< 1.1.0 Fixed in 1.1.0 |
CVE-2024-4272 |
WPScan | |
| 6.1 Medium | SVG Block | Cross-Site Scripting Author+ Stored XSS via SVG File Upload No login needed |
< 1.1.20 Fixed in 1.1.20 |
CVE-2024-4269 |
WPScan | |
| 4.7 Medium | Shortcodes Ultimate Pro | Cross-Site Scripting Contributor+ Stored Cross-Site Scripting XSS No login needed |
< 7.1.5 Fixed in 7.1.5 |
CVE-2024-4217 |
WPScan | |
| 5.9 Medium | Product Enquiry for WooCommerce | Cross-Site Scripting Admin+ Stored XSS |
< 3.1.8 Fixed in 3.1.8 |
CVE-2024-3964 |
WPScan | |
| 6.5 Medium | RafflePress Lite | Cross-Site Scripting Editor+ Stored XSS |
< 1.12.14 Fixed in 1.12.14 |
CVE-2024-3963 |
WPScan | |
| 4.6 Medium | OpenPGP Form Encryption | Cross-Site Scripting Contributor+ Stored XSS |
< 1.5.1 Fixed in 1.5.1 |
CVE-2024-3919 |
WPScan | |
| 5.9 Medium | Hostel | Cross-Site Scripting Reflected XSS |
< 1.1.5.3 Fixed in 1.1.5.3 |
CVE-2024-3753 |
WPScan | |
| 4.8 Medium | Seriously Simple Podcasting | Cross-Site Scripting Admin+ Stored XSS |
< 3.3.0 Fixed in 3.3.0 |
CVE-2024-3751 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.