WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 25,651–25,700 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 514 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes ≤ 2.4.43 CVE-2024-1161 Wordfence
6.5 Medium BuddyForms Plugin buddyforms Other Email Verification Bypass due to Insufficient Randomness No login needed ≤ 2.8.9 CVE-2024-5149 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Information Disclosure WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API No login needed ≤ 4.2.6.8 CVE-2024-5483 Wordfence
6.4 Medium Newsletter Plugin newsletter Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via np1 ≤ 8.3.4 CVE-2024-5317 Wordfence
5.3 Medium Move Addons for Elementor Plugin move-addons Broken Access Control No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-30525 Patchstack
5.4 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control ≤ 4.9.10 Fixed in 4.9.11 CVE-2024-30528 Patchstack
4.3 Medium RT Easy Builder – Advanced addons for Elementor Plugin rt-easy-builder-advanced-addons-for-elementor Broken Access Control ≤ 2.0 Fixed in 2.1 CVE-2024-30484 Patchstack
5.3 Medium Integrate Google Drive Plugin integrate-google-drive Broken Access Control No login needed ≤ 1.3.93 Fixed in 1.3.94 CVE-2024-35670 Patchstack
6.5 Medium Picture Gallery Plugin picture-gallery Cross-Site Scripting ≤ 1.5.11 Fixed in 1.5.12 CVE-2024-34759 Patchstack
7.5 High Netgsm Plugin netgsm Broken Access Control No login needed ≤ 2.9.19 Fixed in 2.9.20 CVE-2024-35672 Patchstack
7.5 High Easy Forms for Mailchimp Plugin yikes-inc-easy-mailchimp-extender Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 6.9.0 CVE-2024-25095 Patchstack
3.5 Low Insert or Embed Articulate Content into Plugin Other Iframe Injection ≤ 4.3000000023 CVE-2024-0756 WPScan
6.5 Medium Save as PDF plugin by Pdfcrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting ≤ 3.2.3 Fixed in 3.3.0 CVE-2024-35649 Patchstack
6.5 Medium WP Flow Plus Plugin wp-imageflow2 Cross-Site Scripting ≤ 5.2.2 Fixed in 5.2.3 CVE-2024-35651 Patchstack
7.1 High Event Tickets with Ticket Scanner Plugin event-tickets-with-ticket-scanner Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2024-35652 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.8.0 Fixed in 45.9.0 CVE-2024-35653 Patchstack
6.5 Medium Responsive Theme responsive Cross-Site Scripting ≤ 5.0.3 Fixed in 5.0.3.1 CVE-2024-35654 Patchstack
5.9 Medium Brave Plugin brave-popup-builder Cross-Site Scripting Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) ≤ 0.6.9 Fixed in 0.7.0 CVE-2024-35655 Patchstack
7.1 High WPvivid Backup for MainWP Plugin wpvivid-backup-mainwp Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.9.32 Fixed in 0.9.33 CVE-2024-35664 Patchstack
6.5 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting ≤ 2.1.2 CVE-2024-35666 Patchstack
7.1 High Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin mailin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.1.77 Fixed in 3.1.78 CVE-2024-35668 Patchstack
6.5 Medium Cowidgets – Elementor Addons Plugin cowidgets-elementor-addons Cross-Site Scripting Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) ≤ 1.1.1 CVE-2024-35782 Patchstack
9.8 Critical Userpro Plugin userpro Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 5.1.8 Fixed in 5.1.9 CVE-2024-35700 Patchstack
4.9 Medium Woocommerce – Recent Purchases Plugin woo-recent-purchases Local File Inclusion Recent Purchases plugin <= 1.0.1 - File Inclusion ≤ 1.0.1 CVE-2024-35634 Patchstack
9.6 Critical Easy Digital Downloads – Recent Purchases Plugin edd-recent-purchases Local File Inclusion Recent Purchases plugin <= 1.0.2 - Remote File Inclusion No login needed ≤ 1.0.2 CVE-2024-35629 Patchstack
9.1 Critical Dextaz Ping Plugin dextaz-ping Remote Code Execution ≤ 0.65 CVE-2024-34792 Patchstack
8.5 High Stockholm Core Plugin Local File Inclusion ≤ 2.4.1 Fixed in 2.4.2 CVE-2024-34554 Patchstack
8.5 High Stockholm Theme Local File Inclusion ≤ 9.6 Fixed in 9.7 CVE-2024-34552 Patchstack
9.0 Critical Stockholm Theme Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 9.6 Fixed in 9.7 CVE-2024-34551 Patchstack
6.5 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Local File Inclusion ≤ 3.5.1 Fixed in 3.5.2 CVE-2024-34384 Patchstack
8.8 High XforWooCommerce Plugin Local File Inclusion Authenticated Local File Inclusion ≤ 2.0.2 CVE-2024-33628 Patchstack
8.5 High Element Pack Pro Plugin Path Traversal Arbitrary File Read and Phar Deserialization < 7.19.3 Fixed in 7.19.3 CVE-2024-33568 Patchstack
9.0 Critical XStore Theme Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 9.3.8 Fixed in 9.3.9 CVE-2024-33560 Patchstack
8.5 High XStore Core Plugin Local File Inclusion ≤ 5.3.8 Fixed in 5.3.9 CVE-2024-33557 Patchstack
6.5 Medium Better Elementor Addons Plugin better-elementor-addons Local File Inclusion ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-33541 Patchstack
10.0 Critical Bricks Builder Theme Remote Code Execution Unauthenticated Remote Code Execution (RCE) No login needed ≤ 1.9.6 Fixed in 1.9.6.1 CVE-2024-25600 Patchstack
5.3 Medium Malware Scanner Plugin miniorange-malware-protection Authentication Bypass IP Restriction Bypass No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2023-52176 Patchstack
3.7 Low All In One WP Security & Firewall Plugin all-in-one-wp-security-and-firewall Information Disclosure Secret Login Page Location Disclosure on Multisites No login needed ≤ 5.2.4 Fixed in 5.2.5 CVE-2023-52147 Patchstack
5.3 Medium Rate my Post – WP Rating System Plugin rate-my-post Broken Access Control WP Rating System plugin <= 3.4.2 - Broken Access Control No login needed ≤ 3.4.2 Fixed in 3.4.3 CVE-2023-51667 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Form Submission Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51544 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass IP Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51543 Patchstack
5.3 Medium Branda Plugin branda-white-labeling Authentication Bypass IP Restriction Bypass No login needed ≤ 3.4.14 Fixed in 3.4.15 CVE-2023-51542 Patchstack
6.5 Medium Booster Elite for WooCommerce Plugin Authentication Bypass Authenticated Production Creation/Modification < 7.1.3 Fixed in 7.1.3 CVE-2023-51511 Patchstack
6.5 Medium Responsive Slick Slider Plugin responsive-slick-slider Content Injection No login needed ≤ 1.4 CVE-2023-49852 Patchstack
3.7 Low Ultimate Dashboard Plugin ultimate-dashboard Information Disclosure Secret Login Page Location Disclosure on Multisites No login needed ≤ 3.7.10 Fixed in 3.7.11 CVE-2023-49822 Patchstack
5.3 Medium WP Photo Album Plus Plugin wp-photo-album-plus Information Disclosure IP Bypass No login needed ≤ 8.5.02.005 Fixed in 8.6.01.005 CVE-2023-49774 Patchstack
3.7 Low WPS Hide Login Plugin wps-hide-login Information Disclosure Secret Login Page Location Disclosure on Multisites No login needed ≤ 1.9.11 Fixed in 1.9.12 CVE-2023-49748 Patchstack
3.7 Low Coming soon and Maintenance mode Plugin coming-soon-page Authentication Bypass IP Filtering Bypass No login needed ≤ 3.7.3 Fixed in 3.7.4 CVE-2023-49741 Patchstack
5.3 Medium Restricted Site Access Plugin restricted-site-access Authentication Bypass IP Restriction Bypass No login needed ≤ 7.4.1 Fixed in 7.5.0 CVE-2023-48753 Patchstack
6.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Authentication Bypass Authenticated Production Creation/Modification ≤ 7.1.2 Fixed in 7.1.3 CVE-2023-48747 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only