WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 201–250 of 253 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium WP Booking Calendar Plugin booking Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode ≤ 10.2.1 CVE-2024-6930 Wordfence
6.5 Medium Booking Ultra Pro Plugin booking-ultra-pro Cross-Site Scripting ≤ 1.1.13 CVE-2024-38676 Patchstack
6.5 Medium Calendar.online / Kalender.digital Plugin kalender-digital Cross-Site Scripting Plugin plugin <= 1.0.8 - Cross Site Scripting (XSS) ≤ 1.0.8 Fixed in 1.0.9 CVE-2024-38678 Patchstack
4.3 Medium Event Manager, Events Calendar, Tickets, Registrations – Eventin Plugin wp-event-solution Broken Access Control Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data Import ≤ 4.0.4 CVE-2024-6033 Wordfence
6.4 Medium WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Plugin wp-event-manager Cross-Site Scripting Events Calendar, Registrations, Sell Tickets with WooCommerce <= 3.1.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events' Shortcode ≤ 3.1.43 CVE-2024-2691 Wordfence
6.5 Medium Events Calendar for Google Plugin events-calendar-for-google Local File Inclusion ≤ 2.1.0 CVE-2024-38716 Patchstack
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Local File Inclusion ≤ 4.4.2 Fixed in 4.4.3 CVE-2024-37499 Patchstack
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting ≤ 4.4.0 Fixed in 4.4.1 CVE-2024-35761 Patchstack
6.5 Medium Scheduling Plugin – Online Booking Plugin calendar-booking Broken Access Control Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection No login needed ≤ 3.5.10 CVE-2024-1634 Wordfence
6.5 Medium The Events Calendar (Free Plugin Broken Access Control Contributor+ Arbitrary Events Access < 6.4.0.1 Fixed in 6.4.0.1 CVE-2024-1295 WPScan
6.4 Medium Events Manager – Calendar, Bookings, Tickets, and more! Plugin events-manager Cross-Site Scripting Calendar, Bookings, Tickets, and more! <= 6.4.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via event, location, and event_category Shortcodes ≤ 6.4.7.3 CVE-2024-3492 Wordfence
6.5 Medium Calendarista Basic Edition Plugin calendarista-basic-edition Broken Access Control No login needed ≤ 3.0.5 Fixed in 3.0.6 CVE-2024-30534 Patchstack
5.4 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control ≤ 4.9.10 Fixed in 4.9.11 CVE-2024-30528 Patchstack
4.3 Medium CP Multi View Event Calendar Plugin cp-multi-view-calendar Broken Access Control Missing Authorization Leading To Feedback Submission ≤ 1.4.10 Fixed in 1.4.11 CVE-2023-28492 Patchstack
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Information Disclosure Sensitive Data Exposure No login needed ≤ 2.8.6 Fixed in 3.0.0 CVE-2023-33321 Patchstack
6.4 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.7.14 CVE-2024-4288 Wordfence
6.4 Medium Happy Addons for Elementor Authenticated (Contributor+) Stored-XSS Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar Widget ≤ 3.10.7 CVE-2024-4391 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' ≤ 5.9.19 CVE-2024-4448 Wordfence
5.4 Medium MF Gig Calendar Plugin Cross-Site Scripting Editor+ Stored XSS ≤ 1.2.1 CVE-2024-3755 WPScan
5.9 Medium Archives Calendar Widget Plugin archives-calendar-widget Cross-Site Scripting ≤ 1.0.15 CVE-2024-33950 Patchstack
6.5 Medium Pretty Google Calendar Plugin pretty-google-calendar Cross-Site Scripting ≤ 1.7.2 CVE-2024-33640 Patchstack
5.4 Medium MF Gig Calendar Plugin mf-gig-calendar Cross-Site Request Forgery No login needed ≤ 1.2.1 CVE-2024-33651 Patchstack
4.3 Medium The Events Calendar Plugin the-events-calendar Cross-Site Request Forgery No login needed ≤ 6.3.0 Fixed in 6.3.1 CVE-2024-31433 Patchstack
4.3 Medium Calendarista Basic Edition Plugin calendarista-basic-edition Cross-Site Request Forgery No login needed ≤ 3.0.2 Fixed in 3.0.3 CVE-2024-31942 Patchstack
6.1 Medium BizCalendar Web Plugin bizcalendar-web Cross-Site Scripting Reflected Cross-Site Scripting via 'tab' No login needed ≤ 1.1.0.25 CVE-2024-1780 Wordfence
5.4 Medium My Calendar Plugin my-calendar Cross-Site Scripting Authenticated Stored XSS < 3.4.24 Fixed in 3.4.24 CVE-2024-1274 WPScan
6.5 Medium WooCommerce Bookings Calendar Plugin woo-bookings-calendar Cross-Site Scripting ≤ 1.0.36 CVE-2024-31117 Patchstack
5.4 Medium Spiffy Calendar Plugin spiffy-calendar Cross-Site Scripting No login needed ≤ 4.9.7 Fixed in 4.9.10 CVE-2024-30427 Patchstack
5.9 Medium EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting ≤ 3.3.9 Fixed in 3.4.0 CVE-2024-29776 Patchstack
4.3 Medium WP Simple Booking Calendar Plugin wp-simple-booking-calendar Cross-Site Request Forgery No login needed ≤ 2.0.8.4 Fixed in 2.0.8.5 CVE-2023-51525 Patchstack
6.5 Medium My Calendar Plugin my-calendar Cross-Site Scripting ≤ 3.4.23 Fixed in 3.4.24 CVE-2024-25916 Patchstack
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval ≤ 3.4.2 CVE-2024-1126 Wordfence
5.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Price Manipulation Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass No login needed ≤ 3.4.2 CVE-2024-1321 Wordfence
6.1 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 1.0.98 - Reflected Cross-Site Scripting No login needed ≤ 1.0.98 CVE-2024-1484 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export ≤ 3.4.1 CVE-2024-1127 Wordfence
5.4 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion ≤ 3.4.3 CVE-2024-1125 Wordfence
6.5 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Cross-Site Scripting Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 3.4.3 CVE-2024-1320 Wordfence
6.5 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite ≤ 3.4.2 CVE-2024-1123 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending ≤ 3.4.3 CVE-2024-1124 Wordfence
4.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Data Reset No login needed ≤ 1.6.6.20 CVE-2024-1760 Wordfence
5.3 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control No login needed < 4.9.9 Fixed in 4.9.9 CVE-2024-0855 WPScan
6.4 Medium EmbedPress Plugin embedpress Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link ≤ 3.9.8 CVE-2024-1425 Wordfence
6.5 Medium Scheduling Plugin – Online Booking Plugin calendar-booking Cross-Site Scripting Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Cross Site Scripting (XSS) ≤ 3.5.10 CVE-2024-23517 Patchstack
5.3 Medium Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin Plugin wp-event-solution Broken Access Control Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export No login needed ≤ 3.3.50 CVE-2024-1122 Wordfence
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 6.2.8.2 CVE-2023-6557 Wordfence
6.4 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 1.0.93 CVE-2023-6808 Wordfence
6.5 Medium Dan's Embedder for Google Calendar Plugin dans-gcal Cross-Site Scripting WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) ≤ 1.2 Fixed in 1.3 CVE-2023-51504 Patchstack
6.5 Medium WP Booking Calendar Plugin booking Cross-Site Scripting WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS) < 9.7.4 Fixed in 9.7.4 CVE-2023-51520 Patchstack
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control Unauthenticated Event Access No login needed < 3.3.6 Fixed in 3.3.6 CVE-2023-6447 WPScan
6.5 Medium EventON - WordPress Virtual Event Calendar Plugin Pro Plugin eventon-lite Cross-Site Request Forgery WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta No login needed ≤ 2.2.7, ≤ 4.5.4 CVE-2023-6242 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only