WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 25,601–25,650 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 513 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium WordPress prettyPhoto Plugin prettyphoto Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter ≤ 1.2.3 CVE-2024-5162 Wordfence
6.4 Medium Magical Addons For Elementor Plugin magical-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.39 CVE-2024-5161 Wordfence
9.1 Critical Startklar Elementor Addons Plugin startklar-elmentor-forms-extwidgets Path Traversal Unauthenticated Path Traversal to Arbitrary Directory Deletion No login needed ≤ 1.7.15 CVE-2024-5153 Wordfence
5.3 Medium WP-Recall – Registration, Profile, Commerce & More Plugin wp-recall Broken Access Control Registration, Profile, Commerce & More <= 16.26.6 - Unauthenticated Payment Deletion via delete_payment No login needed ≤ 16.26.6 CVE-2024-1175 Wordfence
6.4 Medium Rotating Tweets (Twitter widget and shortcode) Plugin rotatingtweets Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.9.10 CVE-2024-5141 Wordfence
5.3 Medium Open Graph Plugin opengraph Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 1.11.2 CVE-2024-5615 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via URLs ≤ 2.1.2 CVE-2024-4458 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets ≤ 2.1.2 CVE-2024-4212 Wordfence
4.3 Medium WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing Plugin wp-dark-mode Broken Access Control WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization ≤ 5.0.4 CVE-2024-5449 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Titles ≤ 2.1.2 CVE-2024-4459 Wordfence
6.4 Medium SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster Plugin sellkit Cross-Site Scripting Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 1.9.8 CVE-2024-4608 Wordfence
6.4 Medium Materialis Companion Plugin materialis-companion Cross-Site Scripting Authenticated (Contributor+) Store Cross-Site Scripting via materialis_contact_form Shortcode ≤ 1.3.41 CVE-2024-4707 Wordfence
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags ≤ 2.1.2 CVE-2024-2922 Wordfence
6.4 Medium Qi Addons For Elementor Plugin qi-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget ≤ 1.7.2 CVE-2024-4364 Wordfence
5.4 Medium Countdown, Coming Soon, Maintenance – Countdown & Clock Plugin countdown-builder Broken Access Control Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection ≤ 2.7.8 CVE-2024-2017 Wordfence
6.4 Medium Testimonials Widget Plugin testimonials-widget Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode ≤ 4.0.4 CVE-2024-4705 Wordfence
8.8 High Cowidgets – Elementor Addons Plugin Local File Inclusion Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion ≤ 1.1.2 CVE-2024-5179 Wordfence
6.4 Medium Clever Addons for Elementor Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple CAFE Widgets ≤ 2.1.9 CVE-2024-2350 Wordfence
6.4 Medium Easy Social Like Box – Popup – Sidebar Widget Plugin cardoza-facebook-like-box Cross-Site Scripting Popup – Sidebar Widget <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.0 CVE-2024-5224 Wordfence
8.1 High The Moneytizer Plugin the-moneytizer Broken Access Control Missing Authorization via multiple AJAX actions ≤ 9.6.3 CVE-2023-6966 Wordfence
6.4 Medium Image Hover Effects for Elementor with Lightbox and Flipbox Plugin image-hover-effects-with-carousel Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via _id, oxi_addons_f_title_tag, and content_description_tag Parameters ≤ 3.0.2 CVE-2024-5001 Wordfence
6.5 Medium Album and Image Gallery plus Lightbox Plugin album-and-image-gallery-plus-lightbox Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.0 CVE-2024-4194 Wordfence
6.1 Medium EasyAzon – Amazon Associates Affiliate Plugin easyazon Cross-Site Scripting Amazon Associates Affiliate Plugin <= 5.1.0 - Reflected Cross-Site Scripting via easyazon-cloaking-locale No login needed ≤ 5.1.0 CVE-2023-6956 Wordfence
5.3 Medium Restrict for Elementor Plugin restrict-for-elementor Information Disclosure Protection Mechanism Bypass No login needed ≤ 1.0.7 CVE-2024-0910 Wordfence
8.1 High The Moneytizer Plugin the-moneytizer Cross-Site Request Forgery Cross-Site Request Forgery via multiple AJAX actions ≤ 9.6.3 CVE-2023-6968 Wordfence
4.4 Medium Custom Dash Plugin custom-dash Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.0.2 CVE-2024-4942 Wordfence
6.4 Medium Simple Image Popup Shortcode Plugin simple-image-popup-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0 CVE-2024-5342 Wordfence
4.3 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Broken Access Control Missing Authorization to Page/Post Creation ≤ 1.3.5 CVE-2024-4788 Wordfence
8.8 High XootiX Framework <= Various Plugin Versions Plugin easy-login-woocommerce Broken Access Control Missing Authorization to Arbitrary Options Update ≤ 2.6, ≤ 2.6.1, 2.5, … CVE-2024-5324 Wordfence
4.3 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Broken Access Control ≤ 1.5.109 Fixed in 1.5.110 CVE-2024-35674 Patchstack
4.3 Medium Pure Chat Plugin pure-chat Cross-Site Request Forgery No login needed ≤ 2.22 Fixed in 2.3 CVE-2024-35673 Patchstack
6.1 Medium GP Premium Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.4.0 CVE-2024-3469 Wordfence
4.3 Medium Restaurant Menu and Food Ordering Plugin food-and-drink-menu Broken Access Control Missing Authorization to Menu Creation ≤ 2.4.16 CVE-2024-5459 Wordfence
6.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_modal_login_form Shortcode ≤ 3.2.93 CVE-2024-4001 Wordfence
6.4 Medium GamiPress – Link Plugin gamipress-link Cross-Site Scripting Link <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.4 CVE-2024-5536 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_lightbox Shortcode ≤ 7.1.6 CVE-2024-4821 Wordfence
8.8 High LifterLMS – WordPress LMS Plugin for eLearning Plugin SQL Injection WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode ≤ 7.6.2 CVE-2024-4743 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget ≤ 4.0.1 CVE-2024-5571 Wordfence
6.4 Medium Blocksy Theme blocksy Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.50 CVE-2024-5439 Wordfence
6.4 Medium Weaver Xtreme Theme Support Plugin weaverx-theme-support Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode ≤ 6.4 CVE-2024-4939 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Missing Authorization ≤ 5.8.6 CVE-2024-5453 Wordfence
6.4 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter ≤ 1.3.2 CVE-2024-5006 Wordfence
6.4 Medium Responsive Addons – Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. Plugin responsive-add-ons Cross-Site Scripting Starter Templates, Advanced Features and Customizer Settings for Responsive Theme. <= 3.0.5 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 3.0.5 CVE-2024-5222 Wordfence
4.3 Medium Gutenberg Blocks and Page Layouts – Attire Blocks Plugin attire-blocks Broken Access Control Attire Blocks <= 1.9.2 - Missing Authorization ≤ 1.9.2 CVE-2024-4088 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality ≤ 2.4.43 CVE-2024-1164 Wordfence
4.3 Medium Mollie Forms Plugin mollie-forms Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Duplication No login needed ≤ 2.6.13 CVE-2024-2368 Wordfence
7.4 High Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL ≤ 2.4.43 CVE-2024-3667 Wordfence
7.2 High Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form No login needed ≤ 2.4.43 CVE-2024-2087 Wordfence
7.1 High Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting ≤ 2.4.41 CVE-2024-1940 Wordfence
9.8 Critical Email Subscribers by Icegram Express Plugin email-subscribers SQL Injection Unauthenticated SQL Injection via hash No login needed ≤ 5.7.20 CVE-2024-4295 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only