WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 201–250 of 269 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin `youzify`	Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion	`≤ 1.3.0`	Oct 10, 2024	`CVE-2024-9067`	Wordfence
6.4 Medium	Curator.io: Show all your social media posts in a beautiful feed. Plugin `curatorio`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via feed_id Attribute	`≤ 1.9.1`	Oct 10, 2024	`CVE-2024-9057`	Wordfence
6.4 Medium	Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin `youzify`	Cross-Site Scripting BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode	`≤ 1.3.0`	Oct 10, 2024	`CVE-2024-8987`	Wordfence
6.4 Medium	Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg Plugin `guten-post-layout`	Cross-Site Scripting An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute	`≤ 1.2.4`	Oct 1, 2024	`CVE-2024-8288`	Wordfence
5.3 Medium	WP Hardening – Fix Your WordPress Security Plugin `wp-security-hardening`	Other Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration No login needed	`≤ 1.2.6`	Sep 18, 2024	`CVE-2024-6641`	Wordfence
6.5 Medium	PixelYourSite – Your smart PIXEL (TAG) & API Manager Plugin `pixelyoursite`	Information Disclosure Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion No login needed	`≤ 9.7.1, ≤ 10.4.2`	Sep 4, 2024	`CVE-2024-7870`	Wordfence
4.3 Medium	Masteriyo - LMS Plugin `learning-management-system`	Broken Access Control Insecure Direct Object Reference (IDOR)	`≤ 1.11.4` Fixed in `1.11.5`	Aug 18, 2024	`CVE-2024-43239`	Patchstack
6.5 Medium	Custom Layouts – Post + Product grids made easy Plugin `custom-layouts`	Cross-Site Scripting Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS)	`≤ 1.4.11` Fixed in `1.4.12`	Aug 18, 2024	`CVE-2024-43305`	Patchstack
4.3 Medium	TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool \| 1-Click Import/Export & No-Code Builder Plugin `templatespare`	Broken Access Control TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update	`≤ 2.4.2`	Aug 3, 2024	`CVE-2024-6872`	Wordfence
6.5 Medium	Blogmentor – Blog Layouts for Elementor Plugin `blogmentor`	Cross-Site Scripting Blog Layouts for Elementor plugin <= 1.5 - Cross Site Scripting (XSS)	`≤ 1.5`	Jul 22, 2024	`CVE-2024-37229`	Patchstack
5.9 Medium	PixelYourSite – Your smart PIXEL (TAG) Manager Plugin `pixelyoursite`	Cross-Site Scripting	`≤ 9.6.1.1` Fixed in `9.6.2`	Jul 21, 2024	`CVE-2024-37447`	Patchstack
6.5 Medium	Caxton – Create Pro page layouts in Gutenberg Plugin `caxton`	Cross-Site Scripting Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS)	`≤ 1.30.1`	Jul 20, 2024	`CVE-2024-37948`	Patchstack
6.5 Medium	Post Layouts for Gutenberg Plugin `post-layouts`	Cross-Site Scripting	`≤ 1.2.7`	Jul 20, 2024	`CVE-2024-38682`	Patchstack
6.5 Medium	FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor Plugin `post-block`	Cross-Site Scripting	`≤ 5.3.1` Fixed in `5.3.2`	Jul 20, 2024	`CVE-2024-38686`	Patchstack
6.4 Medium	Feeds for YouTube (YouTube video, channel, and gallery plugin) Plugin `feeds-for-youtube`	Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting	`≤ 2.2.1`	Jul 11, 2024	`CVE-2024-6256`	Wordfence
6.4 Medium	Mixed Media Gallery Blocks Plugin `simply-gallery-block`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters	`≤ 3.2.1`	Jun 28, 2024	`CVE-2024-5424`	Wordfence
6.5 Medium	Serious Slider Plugin `cryout-serious-slider`	Cross-Site Scripting	`≤ 1.2.4` Fixed in `1.2.5`	Jun 21, 2024	`CVE-2024-35762`	Patchstack
6.4 Medium	JetWidgets For Elementor Plugin `jetwidgets-for-elementor`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters	`≤ 1.0.17`	Jun 20, 2024	`CVE-2024-4626`	Wordfence
6.5 Medium	Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin `youzify`	SQL Injection BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection	`≤ 1.2.5`	Jun 20, 2024	`CVE-2024-4742`	Wordfence
6.4 Medium	Blogmentor – Blog Layouts for Elementor Plugin `blogmentor`	Cross-Site Scripting Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter	`≤ 1.5`	Jun 19, 2024	`CVE-2024-4623`	Wordfence
6.4 Medium	Video Gallery – YouTube Playlist, Channel Gallery by YotuWP Plugin `yotuwp-easy-youtube-embed`	Local File Inclusion YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode	`≤ 1.3.13`	Jun 15, 2024	`CVE-2024-4551`	Wordfence
5.3 Medium	Yoast SEO Premium Plugin `wordpress-seo-premium`	Broken Access Control Unauthenticated Zapier API Key Reset No login needed	`≤ 20.4` Fixed in `20.5`	Jun 11, 2024	`CVE-2023-28775`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget	`≤ 4.0.1`	Jun 5, 2024	`CVE-2024-5571`	Wordfence
4.3 Medium	Gutenberg Blocks and Page Layouts – Attire Blocks Plugin `attire-blocks`	Broken Access Control Attire Blocks <= 1.9.2 - Missing Authorization	`≤ 1.9.2`	Jun 5, 2024	`CVE-2024-4088`	Wordfence
6.4 Medium	SureTriggers – Connect All Your Plugins, Apps, Tools & Automate Everything! Plugin `suretriggers`	Cross-Site Scripting Connect All Your Plugins, Apps, Tools & Automate Everything! <= 1.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting via Trigger Link Shortcode	`≤ 1.0.47`	Jun 4, 2024	`CVE-2024-5485`	Wordfence
4.8 Medium	Playlist for Youtube Plugin	Cross-Site Scripting Editor+ Stored XSS	`≤ 1.32`	May 29, 2024	`CVE-2024-3937`	WPScan
6.4 Medium	Custom Fonts – Host Your Fonts Locally Plugin `custom-fonts`	Cross-Site Scripting Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting	`≤ 2.1.4`	May 24, 2024	`CVE-2024-1332`	Wordfence
4.3 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Broken Access Control Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual	`≤ 3.9.12`	May 23, 2024	`CVE-2024-1803`	Wordfence
4.3 Medium	ApplyOnline – Application Form Builder and Manager Plugin `apply-online`	Broken Access Control Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposure	`≤ 2.6.2`	May 22, 2024	`CVE-2024-2036`	Wordfence
5.3 Medium	YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin `youtube-showcase`	Broken Access Control Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation No login needed	`≤ 3.3.6`	May 21, 2024	`CVE-2024-3268`	Wordfence
6.4 Medium	Yoast SEO Plugin `wordpress-seo`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 22.6`	May 16, 2024	`CVE-2024-4984`	Wordfence
4.3 Medium	Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease Plugin	Broken Access Control Ultimate Plugin to Password Protect Your WordPress Content with Ease <= 2.6.6 - Missing Authorization to Sensitive Information Exposure	`≤ 2.6.6`	May 14, 2024	`CVE-2024-0437`	Wordfence
6.4 Medium	LearnPress – WordPress LMS Plugin `learnpress`	Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter	`≤ 4.2.6.5`	May 10, 2024	`CVE-2024-4277`	Wordfence
6.1 Medium	Yoast SEO Plugin `wordpress-seo`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 22.5`	May 9, 2024	`CVE-2024-4041`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	`≤ 3.9.16`	May 9, 2024	`CVE-2024-4316`	Wordfence
4.3 Medium	Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery Plugin `new-video-gallery`	Broken Access Control Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control	`≤ 1.5.3` Fixed in `1.5.4`	May 6, 2024	`CVE-2024-34377`	Patchstack
5.5 Medium	Where Did You Hear About Us Checkout Field for WooCommerce Plugin `wc-customer-source`	Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting	`≤ 1.3.1`	May 2, 2024	`CVE-2024-2752`	Wordfence
5.3 Medium	Advanced Post Block – Display Posts, Pages, or Custom Posts on Your Page Plugin `advanced-post-block`	Broken Access Control Display Posts, Pages, or Custom Posts on Your Page <= 1.13.4 - Missing Authorization to Information Disclosure No login needed	`≤ 1.13.4`	May 2, 2024	`CVE-2024-0908`	Wordfence
4.3 Medium	Serious Slider Plugin `cryout-serious-slider`	Cross-Site Request Forgery No login needed	`≤ 1.2.4`	Apr 26, 2024	`CVE-2024-33650`	Patchstack
4.3 Medium	EleSpare – News, Magazine and Blog Addons for Elementor Plugin `elespare`	Broken Access Control Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation	`≤ 2.1.2`	Apr 23, 2024	`CVE-2024-0900`	Wordfence
6.5 Medium	DSGVO Youtube Plugin `dsgvo-youtube`	Cross-Site Scripting	`≤ 1.4.5` Fixed in `1.4.6`	Apr 18, 2024	`CVE-2024-32596`	Patchstack
6.4 Medium	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Plugin `feedzy-rss-feeds`	Server-Side Request Forgery Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.7 - Authenticated(Contributor+) Blind Server-Side Request Forgery (SSRF)	`≤ 4.4.7`	Apr 17, 2024	`CVE-2023-6805`	Wordfence
6.5 Medium	Yoga Schedule Momoyoga Plugin `momoyoga-integration`	Cross-Site Scripting	`≤ 2.7.0`	Apr 17, 2024	`CVE-2024-32529`	Patchstack
4.3 Medium	Custom Thank You Page Customize For WooCommerce by Binary Carpenter Plugin `bc-woo-custom-thank-you-pages`	Broken Access Control	`≤ 1.4.12` Fixed in `1.4.14`	Apr 17, 2024	`CVE-2024-32517`	Patchstack
4.3 Medium	NextMove Lite Plugin `woo-thank-you-page-nextmove-lite`	Cross-Site Request Forgery No login needed	`≤ 2.18.1` Fixed in `2.18.2`	Apr 15, 2024	`CVE-2024-32104`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.9.14`	Apr 9, 2024	`CVE-2024-3244`	Wordfence
6.5 Medium	MailMunch – Grow your Email List Plugin `mailmunch`	Cross-Site Scripting Grow your Email List plugin <= 3.1.6 - Cross Site Scripting (XSS)	`≤ 3.1.6` Fixed in `3.1.7`	Apr 7, 2024	`CVE-2024-31349`	Patchstack
6.4 Medium	RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Plugin `feedzy-rss-feeds`	Cross-Site Scripting Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Error Message	`≤ 4.3.3`	Apr 7, 2024	`CVE-2023-6877`	Wordfence
6.4 Medium	Powerkit – Supercharge your WordPress Site Plugin `powerkit`	Cross-Site Scripting Supercharge your WordPress Site <= 2.9.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 2.9.1`	Apr 6, 2024	`CVE-2024-2458`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block	`≤ 3.9.14`	Apr 6, 2024	`CVE-2024-3245`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.