WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 25,301–25,350 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 507 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Broken Access Control ≤ 4.1.0 Fixed in 4.1.1 CVE-2024-32143 Patchstack
4.3 Medium Aspose.Words Exporter Plugin aspose-doc-exporter Broken Access Control Import and Export word documents plugin <= 6.3.1 - Broken Access Control ≤ 6.3.1 CVE-2024-32146 Patchstack
5.3 Medium Builder for WooCommerce reviews shortcodes – ReviewShort Plugin woo-product-reviews-shortcode Broken Access Control ReviewShort plugin <= 1.01.5 - Broken Access Control No login needed ≤ 1.01.5 Fixed in 1.01.6 CVE-2024-34763 Patchstack
5.3 Medium Fastly Plugin fastly Broken Access Control No login needed ≤ 1.2.25 Fixed in 1.2.26 CVE-2024-34768 Patchstack
6.5 Medium BookingPress Plugin bookingpress-appointment-booking Broken Access Control Appointment Duration Manipulation No login needed ≤ 1.0.82 Fixed in 1.0.83 CVE-2024-34799 Patchstack
5.3 Medium Preloader for Website Plugin preloader-for-website Broken Access Control Unauthenticated Broken Access Control No login needed ≤ 1.2.2 Fixed in 1.3 CVE-2023-48273 Patchstack
4.3 Medium MailerLite – WooCommerce integration Plugin woo-mailerlite Broken Access Control WooCommerce integration plugin <= 2.0.8 - Broken Access Control ≤ 2.0.8 Fixed in 2.0.9 CVE-2023-52227 Patchstack
5.4 Medium Tagembed Plugin tagembed-widget Broken Access Control ≤ 5.8 Fixed in 5.9 CVE-2024-34804 Patchstack
5.4 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Broken Access Control ≤ 1.26.5 Fixed in 1.26.6 CVE-2024-34815 Patchstack
4.3 Medium Revolut Gateway for WooCommerce Plugin revolut-gateway-for-woocommerce Broken Access Control ≤ 4.9.7 Fixed in 4.9.8 CVE-2023-52224 Patchstack
5.3 Medium WP Fundraising Donation and Crowdfunding Platform Plugin wp-fundraising-donation Broken Access Control Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control No login needed ≤ 1.6.4 Fixed in 1.7.0 CVE-2024-34758 Patchstack
5.3 Medium MC Woocommerce Wishlist Plugin smart-wishlist-for-more-convert Broken Access Control No login needed ≤ 1.7.2 Fixed in 1.7.3 CVE-2024-34819 Patchstack
4.3 Medium Ninja Tables Plugin ninja-tables Broken Access Control ≤ 5.0.6 Fixed in 5.0.7 CVE-2024-23503 Patchstack
8.6 High Post SMTP Mailer/Email Log Plugin post-smtp Broken Access Control Broken Access Control on API No login needed ≤ 2.8.6 Fixed in 2.8.7 CVE-2023-52233 Patchstack
5.3 Medium Contact List Plugin contact-list Broken Access Control No login needed ≤ 2.9.87 Fixed in 2.9.88 CVE-2024-34821 Patchstack
5.3 Medium Radio Player Plugin radio-player Broken Access Control No login needed ≤ 2.0.73 Fixed in 2.0.74 CVE-2024-34753 Patchstack
4.3 Medium Slider by Soliloquy Plugin soliloquy-lite Broken Access Control Responsive Image Slider for WordPress plugin <= 2.7.2 - Broken Access Control ≤ 2.7.2 Fixed in 2.7.3 CVE-2023-51519 Patchstack
5.4 Medium Welcart e-Commerce Plugin usc-e-shop Broken Access Control ≤ 2.9.14 Fixed in 2.10.0 CVE-2024-32144 Patchstack
5.3 Medium Happyforms Plugin happyforms Broken Access Control No login needed ≤ 1.25.10 Fixed in 1.25.11 CVE-2024-23521 Patchstack
5.3 Medium MC4WP Plugin mailchimp-for-wp Broken Access Control No login needed ≤ 4.9.9 Fixed in 4.9.10 CVE-2023-51682 Patchstack
5.3 Medium weMail Plugin wemail Broken Access Control No login needed ≤ 1.14.2 Fixed in 1.14.3 CVE-2024-34822 Patchstack
6.3 Medium CF7 WOW Styler Plugin cf7-styler Broken Access Control ≤ 1.6.4 Fixed in 1.6.5 CVE-2024-34826 Patchstack
6.5 Medium If-So Dynamic Content Personalization Plugin if-so Broken Access Control No login needed ≤ 1.7.1 Fixed in 1.7.1.1 CVE-2024-34820 Patchstack
8.6 High WC Marketplace Plugin dc-woocommerce-multi-vendor Broken Access Control No login needed ≤ 4.0.25 Fixed in 4.0.26 CVE-2024-24703 Patchstack
4.3 Medium Pardot Plugin pardot Broken Access Control ≤ 2.1.0 Fixed in 2.1.1 CVE-2024-32148 Patchstack
4.3 Medium WP Discourse Plugin wp-discourse Broken Access Control ≤ 2.5.1 Fixed in 2.5.2 CVE-2024-35168 Patchstack
5.3 Medium WooCommerce Canada Post Shipping Plugin Broken Access Control No login needed ≤ 2.8.3 Fixed in 2.8.4 CVE-2023-51498 Patchstack
4.3 Medium Photo Gallery by 10Web Plugin photo-gallery Broken Access Control ≤ 1.8.25 Fixed in 1.8.26 CVE-2024-35628 Patchstack
5.4 Medium WP Translate Plugin wp-translate Broken Access Control ≤ 5.3.0 CVE-2024-35663 Patchstack
6.5 Medium ActivityPub Plugin activitypub Broken Access Control Unauthenticated Broken Access Control No login needed ≤ 1.0.5 Fixed in 1.0.6 CVE-2023-52199 Patchstack
5.3 Medium Insert Post Ads Plugin insert-post-ads Broken Access Control No login needed ≤ 1.3.2 CVE-2024-35665 Patchstack
5.3 Medium WP EasyCart Plugin wp-easycart Broken Access Control No login needed ≤ 5.5.19 Fixed in 5.6.0 CVE-2024-35667 Patchstack
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.23 CVE-2024-5189 Wordfence
4.3 Medium MJ Update History Plugin mj-update-history Broken Access Control ≤ 1.0.4 CVE-2024-35671 Patchstack
5.3 Medium Leyka Plugin leyka Broken Access Control No login needed ≤ 3.31.1 Fixed in 3.31.2 CVE-2024-35683 Patchstack
5.4 Medium WordPress Backup & Migration Plugin wp-migration-duplicator Broken Access Control ≤ 1.4.3 Fixed in 1.4.4 CVE-2023-52183 Patchstack
5.3 Medium weDocs Plugin wedocs Broken Access Control No login needed ≤ 2.1.4 Fixed in 2.1.5 CVE-2024-34442 Patchstack
5.3 Medium Radcliffe 2 Theme Broken Access Control No login needed ≤ 2.0.17 Fixed in 2.0.18 CVE-2024-35685 Patchstack
5.4 Medium Product Expiry for WooCommerce Plugin product-expiry-for-woocommerce Broken Access Control ≤ 2.5 Fixed in 2.6 CVE-2023-52179 Patchstack
5.3 Medium MC Woocommerce Wishlist Plugin smart-wishlist-for-more-convert Broken Access Control No login needed ≤ 1.7.8 Fixed in 1.7.9 CVE-2024-34813 Patchstack
6.4 Medium WordPress Online Booking and Scheduling Plugin – Bookly Plugin bookly-responsive-appointment-booking-tool Cross-Site Scripting Bookly <= 23.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Profile Parameter ≤ 23.2 CVE-2024-5584 Wordfence
4.3 Medium SportsPress – Sports Club & League Manager Plugin sportspress Broken Access Control Sports Club & League Manager plugin <= 2.7.20 - Broken Access Control ≤ 2.7.20 Fixed in 2.7.21 CVE-2024-34824 Patchstack
4.3 Medium WooCommerce Conversion Tracking Plugin woocommerce-conversion-tracking Broken Access Control ≤ 2.0.11 Fixed in 2.0.12 CVE-2023-52217 Patchstack
5.4 Medium Load More Anything Plugin ajax-load-more-anything Broken Access Control ≤ 3.3.3 Fixed in 3.3.4 CVE-2024-24704 Patchstack
5.3 Medium WooCommerce Product Vendors Plugin Broken Access Control Unauthenticated Broken Access Control No login needed ≤ 2.2.2 Fixed in 2.2.3 CVE-2023-52186 Patchstack
5.3 Medium Cookie Consent Plugin uk-cookie-consent Broken Access Control No login needed ≤ 3.2 Fixed in 3.2.1 CVE-2024-35692 Patchstack
6.5 Medium Copymatic – AI Content Writer & Generator Plugin copymatic Broken Access Control No login needed ≤ 1.9 Fixed in 2.0 CVE-2024-35716 Patchstack
4.3 Medium Elementor Website Builder Plugin elementor Broken Access Control ≤ 3.13.2 Fixed in 3.13.3 CVE-2023-33922 Patchstack
5.3 Medium Yoast SEO Premium Plugin wordpress-seo-premium Broken Access Control Unauthenticated Zapier API Key Reset No login needed ≤ 20.4 Fixed in 20.5 CVE-2023-28775 Patchstack
8.3 High Tutor LMS Plugin tutor Broken Access Control Multiple Broken Access Control vulnerabilities ≤ 2.1.8 Fixed in 2.1.9 CVE-2023-25799 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only