WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 201–250 of 284 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Indeed Membership Pro Plugin Authentication Bypass No login needed 7.3 – < 8.6.1 Fixed in 8.6.1 CVE-2020-36832 Wordfence
4.7 Medium Simple Membership After Login Redirection Plugin simple-membership-after-login-redirection Open Redirect No login needed ≤ 1.6 Fixed in 1.7 CVE-2024-47354 Patchstack
4.3 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion ≤ 1.3.0 CVE-2024-9067 Wordfence
6.4 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Cross-Site Scripting BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode ≤ 1.3.0 CVE-2024-8987 Wordfence
6.4 Medium Memberful – Membership Plugin memberful-wp Cross-Site Scripting Membership Plugin <= 1.73.7 - Authenticated (contributor+) Stored Cross-Site Scripting ≤ 1.73.7 CVE-2024-9242 Wordfence
5.3 Medium Ultimate Member Plugin ultimate-member Cross-Site Request Forgery Cross-Site Request Forgery to Membership Status Change No login needed ≤ 2.8.6 CVE-2024-8520 Wordfence
6.1 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Cross-Site Scripting Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting No login needed ≤ 2.12.8 CVE-2024-9222 Wordfence
5.3 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles Plugin peepso-core Information Disclosure Social Network, Membership, Registration, User Profiles <= 6.4.6.0 - Unauthenticated Full Path Disclosure No login needed ≤ 6.4.6.0 CVE-2024-7426 Wordfence
4.4 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles Plugin peepso-core Cross-Site Scripting Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via content Parameter ≤ 6.4.5.0 CVE-2024-7618 Wordfence
4.4 Medium Community by PeepSo – Social Network, Membership, Registration, User Profiles Plugin peepso-core Cross-Site Scripting Social Network, Membership, Registration, User Profiles <= 6.4.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 6.4.5.0 CVE-2024-7655 Wordfence
4.3 Medium WP User Manager Plugin wp-user-manager Cross-Site Request Forgery User Profile Builder & Membership plugin <= 2.9.10 - Cross Site Request Forgery (CSRF) No login needed ≤ 2.9.10 Fixed in 2.9.11 CVE-2024-43336 Patchstack
9.0 Critical Ultimate Membership Pro Plugin indeed-membership-pro PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 12.7 Fixed in 12.8 CVE-2024-43242 Patchstack
9.4 Critical Ultimate Membership Pro Plugin indeed-membership-pro Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 12.7 Fixed in 12.8 CVE-2024-43240 Patchstack
7.1 High Ultimate Membership Pro Plugin indeed-membership-pro Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 12.7 Fixed in 12.8 CVE-2024-43241 Patchstack
6.4 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Scripting Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload ≤ 4.0.37 CVE-2024-7703 Wordfence
6.1 Medium Opal Membership Plugin opal-membership Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.2.4 CVE-2024-7649 Wordfence
4.3 Medium Opal Membership Plugin opal-membership Information Disclosure Authenticated (Subscriber+) Information Disclosure ≤ 1.2.4 CVE-2024-7648 Wordfence
6.5 Medium Paid Memberships Pro - Member Directory Add On Plugin Information Disclosure Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi < 1.2.6 Fixed in 1.2.6 CVE-2024-1287 WPScan
4.9 Medium Paid Memberships Pro - Membership Maps Add On Plugin Information Disclosure Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure < 0.7 Fixed in 0.7 CVE-2024-1286 WPScan
6.5 Medium Team Members Plugin team-members Cross-Site Scripting ≤ 5.3.3 Fixed in 5.3.4 CVE-2024-38670 Patchstack
7.6 High Paid Memberships Pro Plugin paid-memberships-pro SQL Injection Authenticated SQL Injection ≤ 3.0.5 Fixed in 3.0.6 CVE-2024-37486 Patchstack
9.8 Critical UsersWP – Front-end login form, User Registration, User Profile & Members Directory Plugin userswp SQL Injection Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' No login needed ≤ 1.2.10 CVE-2024-6265 Wordfence
6.4 Medium WPZOOM Addons for Elementor (Templates, Widgets) Plugin wpzoom-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 1.1.38 CVE-2024-5686 Wordfence
6.5 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify SQL Injection BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection ≤ 1.2.5 CVE-2024-4742 Wordfence
5.4 Medium Paid Memberships Pro Plugin Broken Access Control ≤ 1.2.3 Fixed in 1.2.4 CVE-2023-39990 Patchstack
8.2 High Paid Memberships Pro CCBill Gateway Plugin Broken Access Control Unauthenticated Broken Access Control No login needed ≤ 0.3 Fixed in 0.4 CVE-2023-40608 Patchstack
5.4 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery Cross-Site Request Forgery to Membership Modification No login needed ≤ 2.12.10 CVE-2024-1407 Wordfence
5.3 Medium BuddyPress Members Only Plugin buddypress-members-only Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed ≤ 3.4.8 CVE-2024-0972 Wordfence
8.3 High ARMember Plugin armember-membership Privilege Escalation Membership Plan Bypass ≤ 4.0.10 Fixed in 4.0.11 CVE-2023-47837 Patchstack
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode ≤ 7.1.5 CVE-2024-4553 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Other Group Members Limit Bypass ≤ 5.8.2 Fixed in 5.8.3 CVE-2024-32774 Patchstack
8.8 High ARMember Plugin armember-membership Privilege Escalation ≤ 4.0.10 Fixed in 4.0.11 CVE-2023-51356 Patchstack
8.6 High Simple Membership Plugin simple-membership Privilege Escalation Unauthenticated Membership Role Privilege Escalation No login needed ≤ 4.3.4 Fixed in 4.3.5 CVE-2023-41957 Patchstack
8.8 High Simple Membership Plugin simple-membership Privilege Escalation Authenticated Account Takeover ≤ 4.3.4 Fixed in 4.3.5 CVE-2023-41956 Patchstack
6.4 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.5 CVE-2024-4383 Wordfence
4.3 Medium ProfileGrid – User Profiles, Memberships, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization ≤ 5.8.3 CVE-2024-3606 Wordfence
5.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 3.0.1 CVE-2024-3215 Wordfence
6.1 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin Open Redirect Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect No login needed ≤ 4.0.30 CVE-2024-4133 Wordfence
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.15.4 CVE-2024-2867 Wordfence
5.3 Medium WP-Members Membership Plugin Information Disclosure Unprotected Storage of Potentially Sensitive Files No login needed ≤ 3.4.9.3 CVE-2024-2920 Wordfence
5.4 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.3 CVE-2024-3730 Wordfence
4.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Request Forgery No login needed ≤ 2.11.0 Fixed in 2.11.1 CVE-2024-32728 Patchstack
5.4 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 2.12.10 Fixed in 3.0 CVE-2024-32793 Patchstack
4.3 Medium Paid Memberships Pro Plugin paid-memberships-pro Cross-Site Request Forgery No login needed ≤ 2.12.10 Fixed in 3.0 CVE-2024-32794 Patchstack
9.1 Critical ARMember Plugin armember-membership Broken Access Control Membership Plugin plugin <= 4.0.28 - Broken Access Control No login needed ≤ 4.0.28 Fixed in 4.0.29 CVE-2024-32948 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - Cross Site Request Forgery (CSRF) No login needed ≤ 5.7.8 Fixed in 5.7.9 CVE-2024-31362 Patchstack
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'reg-single-checkbox' ≤ 4.15.5 CVE-2024-3210 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 8.3.4 CVE-2024-1461 Wordfence
5.3 Medium s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin s2member Information Disclosure Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure No login needed ≤ 230815 CVE-2024-0899 Wordfence
6.4 Medium Beaver Builder Addons by WPZOOM Plugin wpzoom-addons-for-beaver-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Members Widget ≤ 1.3.4 CVE-2024-2186 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only