WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 26,451–26,500 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 530 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Inline Google Spreadsheet Viewer Plugin inline-google-spreadsheet-viewer Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.13.2 CVE-2024-3674 Wordfence
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.15.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.15.4 CVE-2024-2867 Wordfence
6.4 Medium WP ULike Plugin wp-ulike Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.6.9 CVE-2024-1572 Wordfence
6.5 Medium FOX – Currency Switcher Professional for WooCommerce Plugin woocommerce-currency-switcher Arbitrary Shortcode Execution Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.4.1.8 CVE-2024-3734 Wordfence
5.3 Medium WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) Plugin gdpr-cookie-consent Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Deletion No login needed ≤ 3.0.2 CVE-2024-3599 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style' ≤ 4.10.28 CVE-2024-3647 Wordfence
6.4 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 2.6.4 CVE-2024-3161 Wordfence
4.3 Medium ACF On-The-Go Plugin acf-on-the-go Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update ≤ 1.0.1 CVE-2024-3071 Wordfence
8.8 High WP Datepicker Plugin wp-datepicker Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update ≤ 2.1.0 CVE-2024-3895 Wordfence
6.4 Medium Jeg Elementor Kit Plugin jeg-elementor-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Banner ≤ 2.6.4 CVE-2024-3819 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.10.28 CVE-2024-3885 Wordfence
8.8 High Barcode Scanner with Inventory & Order Manager Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders SQL Injection Authenticated (Subscriber+) SQL Injection ≤ 1.5.4 CVE-2024-2661 Wordfence
4.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 1.0.262 CVE-2024-3338 Wordfence
7.5 High Grid Gallery – Photo Image Grid Gallery Plugin new-grid-gallery PHP Object Injection Photo Image Grid Gallery <= 1.4.3 - Authenticated (Contributor+) PHP Object Injection via shortcode ≤ 1.4.3 CVE-2024-1897 Wordfence
6.4 Medium Shortcodes and extra features for Phlox Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'aux_gmaps' Shortcode ≤ 2.15.7 CVE-2024-3341 Wordfence
6.4 Medium WPBakery Visual Composer Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title tag attribute ≤ 7.5 CVE-2024-1841 Wordfence
4.3 Medium WordPress Backup & Migration Plugin Broken Access Control Missing Authorization to Directory Traversal ≤ 1.4.8 CVE-2024-3546 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin Cross-Site Scripting Absolute Addons For Elementor <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Grid Widget ≤ 2.4.9 CVE-2024-3308 Wordfence
6.4 Medium Royal Elementor Addons and Templates Plugin royal-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Flip Carousel, Flip Box, Post Grid, and Taxonomy List Widget Attributes ≤ 1.3.971 CVE-2024-3675 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget ≤ 2.6.9.3 CVE-2024-2750 Wordfence
7.2 High PDF Invoices & Packing Slips for WooCommerce Plugin woocommerce-pdf-invoices-packing-slips Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 3.8.0 CVE-2024-3045 Wordfence
4.4 Medium Mhr Post Ticker Plugin mhr-post-ticker Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 1.1 CVE-2024-3021 Wordfence
5.3 Medium Analytify Plugin wp-analytify Broken Access Control Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification No login needed ≤ 5.2.3 CVE-2024-1584 Wordfence
6.4 Medium All in One SEO – Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic Plugin Cross-Site Scripting Best WordPress SEO Plugin – Easily Improve SEO Rankings & Increase Traffic <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.6.0 CVE-2024-3554 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid ≤ 2.6.9.2 CVE-2024-2503 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery & Interactive Circle ≤ 5.9.15 CVE-2024-3728 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.17 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.17 CVE-2024-4156 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action ≤ 2.6.9.4 CVE-2024-3985 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.15 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.15 CVE-2024-4003 Wordfence
4.3 Medium Different Menu in Different Pages – Control Menu Visibility (All in One) Plugin different-menus-in-different-pages Broken Access Control Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplication ≤ 2.3.2 CVE-2024-3206 Wordfence
7.2 High PDF Invoices & Packing Slips for WooCommerce Plugin woocommerce-pdf-invoices-packing-slips Server-Side Request Forgery Unauthenticated Server-Side Request Forgery No login needed ≤ 3.8.0 CVE-2024-3047 Wordfence
4.3 Medium 5280 Bootstrap Modal Contact Form Plugin 5280-bootstrap-modal-contact-form Cross-Site Request Forgery Cross-Site Request Forgery to Bulk Delete Messages No login needed ≤ 1.0 CVE-2024-0847 Wordfence
6.4 Medium Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder Plugin supreme-modules-for-divi Cross-Site Scripting Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting ≤ 2.5.3 CVE-2024-4334 Wordfence
6.5 Medium Booster for WooCommerce Plugin woocommerce-jetpack Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 7.1.8 CVE-2024-3957 Wordfence
5.3 Medium Drag and Drop Multiple File Upload – Contact Form 7 Plugin Arbitrary File Upload Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure No login needed ≤ 1.3.7.7 CVE-2024-3717 Wordfence
5.4 Medium Enhanced Media Library Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 2.8.9 CVE-2024-2840 Wordfence
4.3 Medium Easy Restaurant Table Booking Plugin fd-elementor-imagebox Cross-Site Request Forgery No login needed ≤ 1.0.0 CVE-2024-4083 Wordfence
7.5 High Photo Gallery Plugin new-photo-gallery PHP Object Injection Authenticated(Contributor+) PHP Object Injection via Shortcode ≤ 1.4.2 CVE-2024-1896 Wordfence
4.3 Medium Spectra – WordPress Gutenberg Blocks Plugin ultimate-addons-for-gutenberg Path Traversal WordPress Gutenberg Blocks <= 2.12.6 - Authenticated (Contributor+) Path Traversal ≤ 2.12.6 CVE-2024-3107 Wordfence
6.4 Medium FileBird – WordPress Media Library Folders & File Manager Plugin filebird Cross-Site Scripting WordPress Media Library Folders & File Manager <= 5.6.3 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 5.6.3 CVE-2024-2345 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Cross-Site Scripting Absolute Addons For Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' ≤ 2.4.6 CVE-2024-2085 Wordfence
6.4 Medium Social Sharing Plugin – Social Warfare Plugin social-warfare Cross-Site Scripting Social Warfare <= 4.4.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.6.1 CVE-2024-1959 Wordfence
4.3 Medium Country State City Dropdown CF7 Plugin country-state-city-auto-dropdown Broken Access Control Missing Authorization ≤ 2.7.1 CVE-2024-3520 Wordfence
6.4 Medium Elementor ImageBox Plugin fd-elementor-imagebox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.8 CVE-2024-3074 Wordfence
6.4 Medium Shortcodes and extra features for Phlox Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS ≤ 2.15.7 CVE-2024-1348 Wordfence
5.3 Medium Send PDF for Contact Form 7 Plugin send-pdf-for-contact-form-7 Broken Access Control Missing Authorization No login needed ≤ 1.0.2.3 CVE-2024-3585 Wordfence
8.8 High Calendar Plugin calendar SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 1.3.14 CVE-2024-2831 Wordfence
4.3 Medium MaxGalleria Plugin maxgalleria Broken Access Control Missing Authorization ≤ 6.4.2 CVE-2024-3581 Wordfence
4.4 Medium AnnounceKit Plugin announcekit Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 2.0.9 CVE-2024-3023 Wordfence
7.1 High ARForms Form Builder Plugin arforms-form-builder Broken Access Control Missing Authorization to Authenticated(Subscriber+) Arbitrary Option Deletion ≤ 1.6.4 CVE-2024-1945 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only