WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 201–250 of 251 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Responsive Image Gallery, Gallery Album Plugin gallery-album Broken Access Control Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control ≤ 2.0.3 CVE-2024-37542 Patchstack
6.4 Medium Flatsome | Multi-Purpose Responsive WooCommerce Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 3.18.7 CVE-2024-5346 Wordfence
5.4 Medium Responsive video embed Plugin responsive-video-embed Cross-Site Scripting Contributor+ Stored XSS No login needed < 0.5.1 Fixed in 0.5.1 CVE-2024-5475 WPScan
6.4 Medium Master Slider – Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode ≤ 3.9.10 CVE-2024-4375 Wordfence
4.3 Medium Slider by Soliloquy Plugin soliloquy-lite Broken Access Control Responsive Image Slider for WordPress plugin <= 2.7.2 - Broken Access Control ≤ 2.7.2 Fixed in 2.7.3 CVE-2023-51519 Patchstack
6.4 Medium WordPress Online Booking and Scheduling Plugin – Bookly Plugin bookly-responsive-appointment-booking-tool Cross-Site Scripting Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter ≤ 23.2 CVE-2024-5584 Wordfence
4.3 Medium Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery Plugin new-image-gallery Broken Access Control ≤ 1.4.5 Fixed in 1.4.6 CVE-2024-35721 Patchstack
4.3 Medium Slider Responsive Slideshow – Image slider, Gallery slideshow Plugin slider-responsive-slideshow Broken Access Control Image slider, Gallery slideshow plugin <= 1.4.0 - Broken Access Control ≤ 1.4.0 Fixed in 1.4.2 CVE-2024-35722 Patchstack
4.3 Medium Responsive Lightbox Plugin responsive-lightbox Broken Access Control ≤ 2.4.6 Fixed in 2.4.7 CVE-2024-31252 Patchstack
6.5 Medium Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor Plugin kenta-blocks Cross-Site Scripting ≤ 1.3.9 Fixed in 1.4.0 CVE-2024-35731 Patchstack
8.5 High Responsive Image Gallery, Gallery Album Plugin gallery-album SQL Injection Image and Video Gallery with Thumbnails plugin <= 2.0.3 - SQL Injection ≤ 2.0.3 CVE-2024-35750 Patchstack
5.4 Medium WP Mobile Menu – The Mobile-Friendly Responsive Menu Plugin mobile-menu Cross-Site Scripting The Mobile-Friendly Responsive Menu <= 2.8.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Alt ≤ 2.8.4.2 CVE-2024-3987 Wordfence
6.4 Medium Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. Plugin responsive-add-ons Cross-Site Scripting Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 3.0.5 CVE-2024-5222 Wordfence
6.5 Medium Responsive Theme responsive Cross-Site Scripting ≤ 5.0.3 Fixed in 5.0.3.1 CVE-2024-35654 Patchstack
6.5 Medium Responsive Slick Slider Plugin responsive-slick-slider Content Injection No login needed ≤ 1.4 CVE-2023-49852 Patchstack
5.4 Medium Responsive Tabs Plugin responsive-tabs Content Injection HTML Content Injection < 4.0.6 Fixed in 4.0.6 CVE-2023-45635 Patchstack
6.4 Medium Master Slider - Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.9.9 CVE-2023-6382 Wordfence
8.8 High Responsive Owl Carousel for Elementor Plugin responsive-owl-carousel-elementor Local File Inclusion ≤ 1.2.0 CVE-2024-5345 Wordfence
5.4 Medium Responsive Contact Form Builder & Lead Generation Plugin lead-form-builder Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 1.9.1 CVE-2024-4261 Wordfence
6.4 Medium Master Slider – Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.9.9 CVE-2024-4470 Wordfence
7.7 High Bookly Plugin bookly-responsive-appointment-booking-tool Arbitrary File Deletion Authenticated Arbitrary File Deletion ≤ 21.7.1 Fixed in 21.8 CVE-2023-26526 Patchstack
8.8 High Ditty – Responsive News Tickers, Sliders, and Lists Plugin ditty-news-ticker PHP Object Injection Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection ≤ 3.1.38 CVE-2024-3954 Wordfence
5.3 Medium Slider Carousel – Responsive Image Slider Plugin slider-images Broken Access Control Responsive Image Slider plugin <=1.5.1 - Broken Access Control No login needed ≤ 1.5.1 Fixed in 1.5.2 CVE-2023-25457 Patchstack
6.1 Medium Responsive Contact Form Builder & Lead Generation Plugin Cross-Site Scripting Admin+ Stored XSS No login needed ≤ 1.8.9 CVE-2024-3637 WPScan
4.3 Medium Responsive Contact Form Builder & Lead Generation Plugin lead-form-builder Cross-Site Request Forgery No login needed ≤ 1.8.9 CVE-2024-1415 Wordfence
4.3 Medium Responsive Contact Form Builder & Lead Generation Plugin lead-form-builder Broken Access Control Missing Authorization No login needed ≤ 1.8.9 CVE-2024-1416 Wordfence
5.4 Medium Ovic Responsive WPBakery Plugin ovic-vc-addon Broken Access Control ≤ 1.3.0 CVE-2024-32142 Patchstack
5.4 Medium Responsive Tabs Plugin responsive-tabs Cross-Site Scripting Contributor+ Stored XSS < 4.0.7 Fixed in 4.0.7 CVE-2024-1846 WPScan
6.4 Medium Slider, Gallery, and Carousel by MetaSlider – Responsive WordPress Slideshows Plugin ml-slider Cross-Site Scripting Responsive WordPress Slideshows <= 3.70.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via metaslider Shortcode ≤ 3.70.0 CVE-2024-3285 Wordfence
6.1 Medium Responsive Gallery Grid Plugin responsive-gallery-grid Cross-Site Scripting Admin+ Stored XSS No login needed < 2.3.11 Fixed in 2.3.11 CVE-2024-1664 WPScan
7.1 High Responsive Image Gallery, Gallery Album Plugin gallery-album Cross-Site Scripting Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0.3 CVE-2024-30550 Patchstack
6.5 Medium Responsive flipbook Plugin wppdf Cross-Site Scripting ≤ 1.0.0 CVE-2024-30552 Patchstack
6.5 Medium Responsive Image Gallery, Gallery Album Plugin gallery-album Cross-Site Scripting Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) ≤ 2.0.3 CVE-2024-31120 Patchstack
7.1 High Creative Image Slider – Responsive Slider Plugin creative-image-slider Cross-Site Scripting No login needed ≤ 2.1.3 Fixed in 2.5.0 CVE-2024-30447 Patchstack
8.5 High WP Responsive Tabs horizontal vertical and accordion Tabs Plugin responsive-horizontal-vertical-and-accordion-tabs SQL Injection ≤ 1.1.17 Fixed in 1.1.18 CVE-2024-30497 Patchstack
7.5 High Responsive Theme responsive Broken Access Control Missing Authorization to HTML Injection No login needed ≤ 5.0.2 CVE-2024-2848 Wordfence
5.4 Medium Lightbox slider – Responsive Lightbox Gallery Plugin simple-lightbox-gallery PHP Object Injection Responsive Lightbox Gallery <= 1.9.9 - Authenticated (Contributor+) PHP Object Injection ≤ 1.9.9 CVE-2024-1858 Wordfence
6.5 Medium WEN Responsive Columns Plugin wen-responsive-columns Cross-Site Scripting ≤ 1.3.2 Fixed in 1.3.3 CVE-2024-27988 Patchstack
6.5 Medium WP Responsive Tabs horizontal vertical and accordion Tabs Plugin responsive-horizontal-vertical-and-accordion-tabs Cross-Site Scripting ≤ 1.1.17 Fixed in 1.1.18 CVE-2024-27989 Patchstack
5.4 Medium Responsive Pricing Table Plugin dk-pricr-responsive-pricing-table Cross-Site Scripting Author+ Stored XSS < 5.1.11 Fixed in 5.1.11 CVE-2024-1333 WPScan
6.4 Medium Master Slider – Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.9.10 CVE-2024-1449 Wordfence
4.4 Medium Master Slider – Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.9.9 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback ≤ 3.9.9 CVE-2024-0611 Wordfence
5.4 Medium Master Slider - Responsive Touch Slider Plugin master-slider Cross-Site Request Forgery Responsive Touch Slider <= 3.9.10 - Cross-Site Request Forgery via process_bulk_action No login needed ≤ 3.9.10 CVE-2023-6326 Wordfence
8.8 High Slider Responsive Slideshow – Image slider, Gallery slideshow Plugin PHP Object Injection Image slider, Gallery slideshow <= 1.3.8 - Authenticated (Contributor+) PHP Object Injection ≤ 1.3.8 CVE-2024-1859 Wordfence
5.3 Medium Coming Soon Page & Maintenance Mode Plugin responsive-coming-soon Broken Access Control Maintenance Mode Bypass No login needed ≤ 2.2.1 CVE-2024-1136 Wordfence
4.3 Medium JTRT Responsive Tables Plugin jtrt-responsive-tables Cross-Site Request Forgery WordPress JTRT Responsive Tables Plugin <= 4.1.9 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 4.1.9 CVE-2024-24802 Patchstack
7.5 High Brooklyn | Creative Multi-Purpose Responsive Theme PHP Object Injection WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection ≤ 4.9.7.6 CVE-2024-24926 Patchstack
7.1 High Brooklyn | Creative Multi-Purpose Responsive Theme Cross-Site Scripting WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 4.9.7.6 CVE-2024-24927 Patchstack
8.8 High Ovic Responsive WPBakery Plugin PHP Object Injection Subscriber+ Option Update < 1.2.9 Fixed in 1.2.9 CVE-2023-5235 WPScan
6.5 Medium WP Tabs – Responsive Tabs Plugin wp-expand-tabs-free Cross-Site Scripting WordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS) ≤ 2.2.0 Fixed in 2.2.1 CVE-2023-52124 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only