WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 25,851–25,900 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 518 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Login Logout Register Menu Plugin login-logout-register-menu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'llrmloginlogout' Shortcode ≤ 2.0 CVE-2024-3726 Wordfence
6.4 Medium HUSKY – Products Filter Professional for WooCommerce Plugin woocommerce-products-filter Cross-Site Scripting Products Filter Professional for WooCommerce <= 1.3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.5.3 CVE-2024-5039 Wordfence
9.1 Critical WP STAGING WordPress Backup Plugin – Migration Backup Restore Plugin wp-staging Arbitrary File Upload Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload ≤ 3.4.3 CVE-2024-3412 Wordfence
6.4 Medium Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget ≤ 5.8.14 CVE-2024-5086 Wordfence
4.8 Medium Playlist for Youtube Plugin Cross-Site Scripting Editor+ Stored XSS ≤ 1.32 CVE-2024-3937 WPScan
4.8 Medium Gianism Plugin gianism Cross-Site Scripting Admin+ Stored XSS ≤ 5.1.0 CVE-2024-3921 WPScan
9.1 Critical Site Reviews Plugin site-reviews Authentication Bypass IP Spoofing No login needed < 7.0.0 Fixed in 7.0.0 CVE-2024-3050 WPScan
4.4 Medium Fetch JFT Plugin fetch-jft Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.8.3 CVE-2024-4419 Wordfence
8.1 High AppPresser Plugin apppresser Authentication Bypass Improper Missing Encryption Exception Handling to Authentication Bypass No login needed ≤ 4.3.2 CVE-2024-4611 Wordfence
8.8 High Unlimited Elements for Elementor Plugin unlimited-elements-for-elementor Remote Code Execution Authenticated(Contributor+) Remote Code Execution via template import ≤ 1.5.89 CVE-2023-6743 Wordfence
5.3 Medium WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly Plugin tour-booking-manager Broken Access Control WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save No login needed ≤ 1.7.1 CVE-2024-0434 Wordfence
9.8 Critical Login with phone number Plugin login-with-phone-number Authentication Bypass Authentication Bypass due to Missing Empty Value Check No login needed ≤ 1.7.26 CVE-2024-5150 Wordfence
8.8 High Swiss Toolkit For WP Plugin swiss-toolkit-for-wp Authentication Bypass Authenticated (Contributor+) Authentication Bypass ≤ 1.0.7 CVE-2024-5204 Wordfence
8.8 High KKProgressbar2 Free Plugin kkprogressbar Cross-Site Request Forgery Progress Bar Deletion via CSRF No login needed ≤ 1.1.4.2 CVE-2024-4535 WPScan
6.1 Medium KKProgressbar2 Free Plugin kkprogressbar Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 1.1.4.2 CVE-2024-4534 WPScan
6.5 Medium KKProgressbar2 Free Plugin kkprogressbar SQL Injection Admin+ SQL Injection ≤ 1.1.4.2 CVE-2024-4533 WPScan
6.4 Medium Business Card Plugin Cross-Site Request Forgery Arbitrary Card Deletion via CSRF ≤ 1.0.0 CVE-2024-4532 WPScan
7.1 High Business Card Plugin Cross-Site Request Forgery Card Edit via CSRF No login needed ≤ 1.0.0 CVE-2024-4531 WPScan
6.3 Medium Business Card Plugin Cross-Site Request Forgery Category Edit via CSRF No login needed ≤ 1.0.0 CVE-2024-4530 WPScan
5.0 Medium Business Card Plugin Cross-Site Request Forgery Category Deletion via CSRF No login needed ≤ 1.0.0 CVE-2024-4529 WPScan
5.4 Medium Ditty Plugin ditty-news-ticker Cross-Site Scripting Author+ Stored XSS < 3.1.36 Fixed in 3.1.36 CVE-2024-3939 WPScan
4.7 Medium WP Booking Plugin wp-easy-booking Cross-Site Scripting Cross-site scripting vulnerability exists in WP Booking versions prior to 2.4.5. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the… No login needed prior to 2.4.5 CVE-2024-35297 jpcert
6.4 Medium Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation Plugin optinmonster Cross-Site Scripting WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.16.1 CVE-2024-4045 Wordfence
6.4 Medium Reviews and Rating – Google Reviews Plugin g-business-reviews-rating Cross-Site Scripting Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 5.2 CVE-2024-5218 Wordfence
5.3 Medium Testimonial Carousel For Elementor Plugin testimonials-carousel-elementor Broken Access Control Missing Authorization to Limited Setting Update No login needed ≤ 10.2.0 CVE-2024-4858 Wordfence
6.4 Medium Primary Addon for Elementor Plugin primary-addon-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Pricing Table Widget ≤ 1.5.5 CVE-2024-5229 Wordfence
6.4 Medium ND Shortcodes Plugin nd-shortcodes Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 7.5 CVE-2024-5220 Wordfence
7.2 High YITH WooCommerce Ajax Search Plugin yith-woocommerce-ajax-search Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 2.4.0 CVE-2024-4455 Wordfence
6.5 Medium WP Photo Album Plus Plugin wp-photo-album-plus Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 8.7.00.003 CVE-2024-4037 Wordfence
6.4 Medium Spectra – WordPress Gutenberg Blocks Plugin Cross-Site Scripting WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 2.13.0 CVE-2024-4366 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.5.1 CVE-2024-4484 Wordfence
4.3 Medium Event post Plugin event-post Broken Access Control Missing Authorization ≤ 5.9.4 CVE-2024-1376 Wordfence
6.4 Medium Custom Fonts – Host Your Fonts Locally Plugin custom-fonts Cross-Site Scripting Host Your Fonts Locally <= 2.1.4 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 2.1.4 CVE-2024-1332 Wordfence
6.4 Medium LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor Plugin include-lottie-animation-for-elementor Cross-Site Scripting JSON Based Animation Lottie & Bodymovin for Elementor <= 1.10.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.10.9 CVE-2024-5060 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.5.2 CVE-2024-4485 Wordfence
4.3 Medium Schema App Structured Data Plugin schema-app-structured-data-for-schemaorg Broken Access Control Missing Authorization ≤ 2.2.0 CVE-2024-0893 Wordfence
6.4 Medium SEOPress – On-site SEO Plugin Cross-Site Scripting On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 7.5.2.1 CVE-2024-1134 Wordfence
8.1 High Email Log Plugin email-log Remote Code Execution Unauthenticated Hook Injection No login needed ≤ 2.4.8 CVE-2024-0867 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box ≤ 5.5.4 CVE-2024-3718 Wordfence
6.4 Medium WP Go Maps (formerly WP Google Maps) Plugin wp-google-maps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 9.0.36 CVE-2024-3557 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card ≤ 5.5.4 CVE-2024-2784 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.26 CVE-2024-2618 Wordfence
9.8 Critical Pie Register - Social Sites Login (Add on) Plugin pie-register Authentication Bypass Social Sites Login (Add on) <= 1.7.7 - Authentication Bypass No login needed ≤ 1.7.7 CVE-2024-4544 Wordfence
6.4 Medium Videojs HTML5 Player Plugin videojs-html5-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode ≤ 1.1.11 CVE-2024-5205 Wordfence
4.3 Medium WP-ViperGB Plugin wp-vipergb Cross-Site Request Forgery No login needed ≤ 1.6.1 CVE-2024-4409 Wordfence
6.4 Medium Advanced iFrame Plugin advanced-iframe Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2024.3 CVE-2024-4365 Wordfence
8.1 High Hash Form – Drag & Drop Form Builder Plugin hash-form PHP Object Injection Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection No login needed ≤ 1.1.0 CVE-2024-5085 Wordfence
9.8 Critical Hash Form – Drag & Drop Form Builder Plugin hash-form Arbitrary File Upload Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution No login needed ≤ 1.1.0 CVE-2024-5084 Wordfence
8.0 High 140+ Widgets | Best Addons For Elementor – FREE Plugin xpro-elementor-addons PHP Object Injection FREE <= 1.4.3.1 - Authenticated (Contributor+) PHP Object Injection ≤ 1.4.3.1 CVE-2024-4471 Wordfence
4.3 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin Broken Access Control Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual ≤ 3.9.12 CVE-2024-1803 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only