WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 25,951–26,000 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 520 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.1 Medium NextScripts: Social Networks Auto-Poster Plugin social-networks-auto-poster-facebook-twitter-g Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via User Agent No login needed ≤ 4.4.3 CVE-2024-1762 Wordfence
5.3 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) Plugin bdthemes-element-pack-lite Other Form Submission Admin Email Bypass No login needed ≤ 5.6.3 CVE-2024-3927 Wordfence
5.4 Medium NextScripts: Social Networks Auto-Poster Plugin social-networks-auto-poster-facebook-twitter-g Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Deletion No login needed ≤ 4.4.3 CVE-2024-1446 Wordfence
4.3 Medium WP Scraper Plugin wp-scraper Broken Access Control Missing Authorization to Arbitrary Page/Post Creation ≤ 5.7 CVE-2024-3663 Wordfence
9.8 Critical Business Directory Plugin – Easy Listing Directories Plugin business-directory-plugin SQL Injection Easy Listing Directories for WordPress <= 6.4.2 - Unauthenticated SQL Injection via listingfields Parameter No login needed ≤ 6.4.2 CVE-2024-4443 Wordfence
6.4 Medium Elegant Addons for elementor Plugin elegant-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via HTML tags ≤ 1.0.8 CVE-2024-3066 Wordfence
6.4 Medium Elegant Addons for elementor Plugin elegant-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Switcher, Slider, and Iconbox Widgets ≤ 1.0.8 CVE-2024-5092 Wordfence
6.4 Medium Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced Plugin toolbar-extras Cross-Site Scripting WordPress Admin Bar Enhanced <= 1.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.9 CVE-2024-3611 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin learnpress Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 4.2.6.6 CVE-2024-4971 Wordfence
6.5 Medium Download Plugins and Themes from Dashboard Plugin download-plugins-dashboard Path Traversal Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with… prior to 1.8.6 CVE-2024-35162 jpcert
6.4 Medium WPKoi Templates for Elementor Plugin wpkoi-templates-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Parameters ≤ 2.5.9 CVE-2024-4980 Wordfence
5.0 Medium AI ChatBot Plugin chatbot Broken Access Control Missing Authorization via openai_file_delete_callback ≤ 5.3.4 CVE-2024-0453 Wordfence
5.0 Medium AI ChatBot Plugin chatbot Broken Access Control Missing Authorization via openai_file_upload_callback ≤ 5.3.4 CVE-2024-0452 Wordfence
5.0 Medium AI ChatBot Plugin chatbot Broken Access Control Missing Authorization via openai_file_list_callback ≤ 5.3.4 CVE-2024-0451 Wordfence
8.8 High Media Library Assistant Plugin media-library-assistant SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 3.15 CVE-2024-3518 Wordfence
6.1 Medium Media Library Assistant Plugin media-library-assistant Cross-Site Scripting Reflected Cross-Site Scripting via lang No login needed ≤ 3.15 CVE-2024-3519 Wordfence
6.4 Medium ElementsKit Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.6.1 CVE-2024-4452 Wordfence
5.3 Medium YouTube Video Gallery by YouTube Showcase – Video Gallery Plugin youtube-showcase Broken Access Control Video Gallery Plugin for WordPress <= 3.3.6 - Missing Authorization to Arbitrary Post/Page Creation No login needed ≤ 3.3.6 CVE-2024-3268 Wordfence
6.4 Medium Elementor Website Builder – More than Just a Page Builder Plugin elementor Cross-Site Scripting More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 3.21.5 CVE-2024-4619 Wordfence
6.4 Medium Page Builder by SiteOrigin Plugin siteorigin-panels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode ≤ 2.29.15 CVE-2024-4361 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Cross-Site Scripting Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.5.2 CVE-2024-4876 Wordfence
6.4 Medium Move Addons for Elementor Plugin move-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.3.1 CVE-2024-4695 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_members Shortcode ≤ 7.1.5 CVE-2024-4553 Wordfence
6.4 Medium WP Table Builder – WordPress Table Plugin wp-table-builder Cross-Site Scripting WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.14 CVE-2024-4700 Wordfence
7.1 High ShopLentor Plugin woolentor-addons Broken Access Control Missing Authorization to WordPress Option Modification ≤ 2.8.8 CVE-2024-4566 Wordfence
6.4 Medium ShopLentor Plugin woolentor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode ≤ 2.8.8 CVE-2024-3345 Wordfence
4.3 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Broken Access Control Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update ≤ 2.5.2 CVE-2024-4875 Wordfence
9.1 Critical Salon booking system Plugin salon-booking-system Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 9.9 CVE-2024-4442 Wordfence
6.4 Medium Master Slider – Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.9.9 CVE-2024-4470 Wordfence
6.4 Medium Uber Menu Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 3.8.2 CVE-2024-4710 Wordfence
5.4 Medium Carousel Slider Plugin carousel-slider Cross-Site Scripting Editor+ Stored XSS < 2.2.11 Fixed in 2.2.11 CVE-2024-4372 WPScan
7.1 High Sailthru Triggermail Plugin sailthru-triggermail Cross-Site Scripting Admin+ Stored XSS No login needed ≤ 1.1 CVE-2024-4290 WPScan
6.1 Medium Sailthru Triggermail Plugin sailthru-triggermail Cross-Site Scripting Reflected XSS No login needed ≤ 1.1 CVE-2024-4289 WPScan
4.8 Medium Survey Maker Plugin survey-maker Cross-Site Scripting Admin+ Stored XSS via Plugin Settings < 4.2.9 Fixed in 4.2.9 CVE-2024-4061 WPScan
6.1 Medium Social Icons Widget & Block Plugin Cross-Site Scripting Admin+ Stored XSS No login needed < 4.2.18 Fixed in 4.2.18 CVE-2024-2189 WPScan
6.4 Medium Blocksy Theme blocksy Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.46 CVE-2024-4943 Wordfence
6.4 Medium Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks Plugin Cross-Site Scripting Combo Blocks <= 2.2.80 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.2.80 CVE-2024-3155 Wordfence
6.1 Medium All in One SEO Plugin all-in-one-seo-pack Cross-Site Scripting Contributor+ Stored XSS No login needed < 4.6.1.1 Fixed in 4.6.1.1 CVE-2024-3368 WPScan
6.4 Medium Happy Addons for Elementor Plugin happy-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.10.8 CVE-2024-5088 Wordfence
6.4 Medium Piotnet Addons For Elementor Plugin piotnet-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.4.26 CVE-2024-4432 Wordfence
6.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.1.16 CVE-2024-4709 Wordfence
6.4 Medium Testimonial Carousel For Elementor Plugin testimonials-carousel-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 10.1.1 CVE-2024-4698 Wordfence
6.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 5.1.13 CVE-2024-2772 Wordfence
7.5 High Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Setting Manipulation No login needed ≤ 5.1.16 CVE-2024-2782 Wordfence
9.8 Critical Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Settings Update and Limited Privilege Escalation No login needed ≤ 5.1.16 CVE-2024-2771 Wordfence
7.5 High Salient Core Plugin Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode ≤ 2.0.7 CVE-2024-3812 Wordfence
6.4 Medium Salient Shortcodes Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.5.3 CVE-2024-3811 Wordfence
8.8 High Salient Shortcodes Plugin Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode ≤ 1.5.3 CVE-2024-3810 Wordfence
6.4 Medium WordPress Automatic Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter ≤ 3.94.0 CVE-2024-4849 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.12 CVE-2024-4891 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only