WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 201–246 of 246 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 3.9.16 CVE-2024-4316 Wordfence
4.3 Medium The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Plugin the-post-grid Broken Access Control Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization ≤ 7.6.1 CVE-2024-3936 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin Cross-Site Scripting Page Builder Features <= 3.2.34 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.34 CVE-2024-2273 Wordfence
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' ≤ 2.6.9 CVE-2024-3725 Wordfence
6.4 Medium Getwid – Gutenberg Blocks Plugin getwid Cross-Site Scripting Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown' ≤ 2.0.7 CVE-2024-3588 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id ≤ 2.8.7 CVE-2024-3991 Wordfence
4.3 Medium Spectra – WordPress Gutenberg Blocks Plugin ultimate-addons-for-gutenberg Path Traversal WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal ≤ 2.12.6 CVE-2024-3107 Wordfence
6.4 Medium Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery Plugin gt3-photo-video-gallery Cross-Site Scripting GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting ≤ 2.7.7.21 CVE-2024-4035 Wordfence
6.4 Medium Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) Plugin Cross-Site Scripting Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Post Overlay ≤ 3.7.0 CVE-2024-3929 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +10 Modules – All in One Solution (formerly WooLentor) <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.1 CVE-2024-1057 Wordfence
5.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.9 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting via "Social Icons" Block ≤ 4.5.9 CVE-2024-3818 Wordfence
6.5 Medium Gutenberg Block Editor Toolkit Plugin block-options Cross-Site Scripting ≤ 1.40.4 Fixed in 1.40.5 CVE-2024-32586 Patchstack
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Arbitrary File Upload Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Author+) Limited File Upload to Stored Cross-Site Scripting ≤ 2.6.8 CVE-2024-3344 Wordfence
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes ≤ 2.6.8 CVE-2024-3343 Wordfence
6.4 Medium Stackable – Page Builder Gutenberg Blocks Plugin stackable-ultimate-gutenberg-blocks Cross-Site Scripting Page Builder Gutenberg Blocks <= 3.12.11 - Authenticated(Contributor+) Stored Cross-Site Scripting via Posts Block ≤ 3.12.11 CVE-2024-2039 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.4 - Authenticated (Contributor+) Stored Cross-site Scripting via QR Code Widget ≤ 2.8.4 CVE-2024-2946 Wordfence
6.4 Medium Spectra – WordPress Gutenberg Blocks Plugin Cross-Site Scripting WordPress Gutenberg Blocks <= 2.10.3 - Authenticated(Contributor+) Cross-Site Scripting via Custom CSS ≤ 2.10.3 CVE-2023-6486 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Widget ≤ 3.2.25 CVE-2024-1999 Wordfence
4.4 Medium Gutenberg Blocks by Kadence Blocks Plugin Cross-Site Scripting Authenticated(Editor+) Stored Cross-Site Scripting via Contact Form Message Settings ≤ 3.2.17 CVE-2024-0598 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.14 CVE-2024-3244 Wordfence
6.4 Medium Getwid – Gutenberg Blocks Plugin getwid Cross-Site Scripting Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content ≤ 2.0.5 CVE-2024-1948 Wordfence
6.4 Medium BetterDocs – Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg Plugin Cross-Site Scripting Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer For Elementor & Gutenberg <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.4.2 CVE-2024-2845 Wordfence
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.6.4 CVE-2024-2226 Wordfence
6.5 Medium Essential Blocks for Gutenberg Plugin essential-blocks Cross-Site Scripting ≤ 4.5.3 Fixed in 4.5.4 CVE-2024-31306 Patchstack
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block ≤ 3.9.14 CVE-2024-3245 Wordfence
6.5 Medium Gutenberg Blocks by Kadence Blocks Plugin Cross-Site Scripting Contributor+ Stored XSS < 3.2.26 Fixed in 3.2.26 CVE-2024-2509 WPScan
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via CountUp Widget ≤ 3.2.31 CVE-2024-2919 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout ≤ 2.8.3 CVE-2024-2868 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks Plugin kadence-blocks Server-Side Request Forgery ≤ 3.2.25 Fixed in 3.2.26 CVE-2024-24888 Patchstack
5.4 Medium Page Builder Gutenberg Blocks Plugin coblocks Cross-Site Scripting Contributor+ Stored XSS < 3.1.7 Fixed in 3.1.7 CVE-2024-2369 WPScan
6.4 Medium Gutenberg Block Editor Toolkit – EditorsKit Plugin block-options Cross-Site Scripting EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.40.4 CVE-2024-2794 Wordfence
6.5 Medium OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Plugin stepbyteservice-openstreetmap Cross-Site Scripting ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-30450 Patchstack
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.6.5 CVE-2024-2841 Wordfence
6.4 Medium Page Builder Gutenberg Blocks – CoBlocks Plugin coblocks Cross-Site Scripting CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.1.6 CVE-2024-1049 Wordfence
5.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color' ≤ 3.9.12 CVE-2024-2688 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.3 CVE-2024-2255 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.23 CVE-2024-1541 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.1 CVE-2024-1854 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block ≤ 3.9.10 CVE-2024-1802 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget ≤ 3.9.10 CVE-2024-2128 Wordfence
5.3 Medium Build & Control Block Patterns – Boost up Gutenberg Editor Plugin control-block-patterns Broken Access Control Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization No login needed ≤ 1.3.5.4 CVE-2024-1095 Wordfence
5.3 Medium Getwid – Gutenberg Blocks Plugin getwid Authentication Bypass Gutenberg Blocks <= 2.0.4 - Captcha Bypass No login needed ≤ 2.0.4 CVE-2023-6963 Wordfence
4.3 Medium Getwid – Gutenberg Blocks Plugin getwid Broken Access Control Gutenberg Blocks <= 2.0.4 - Missing Authorization to Recaptcha API Key Modification ≤ 2.0.4 CVE-2023-6959 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.4.6 CVE-2023-7071 Wordfence
6.4 Medium Post Grid Combo – 36+ Gutenberg Blocks Plugin Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting ≤ 2.2.64 CVE-2023-6645 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode < 3.9.5 Fixed in 3.9.5 CVE-2023-6986 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only