WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 27,501–27,550 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 551 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin woocommerce-products-filter Cross-Site Request Forgery No login needed ≤ 1.3.5.1 Fixed in 1.3.5.2 CVE-2024-30462 Patchstack
4.3 Medium BEAR Plugin woo-bulk-editor Broken Access Control ≤ 1.1.4.3 Fixed in 1.1.4.4 CVE-2024-30463 Patchstack
4.3 Medium All In One WP Security & Firewall Plugin all-in-one-wp-security-and-firewall Cross-Site Request Forgery Security and Firewall plugin <= 5.2.6 - Cross Site Request Forgery (CSRF) No login needed ≤ 5.2.6 Fixed in 5.2.7 CVE-2024-30468 Patchstack
5.3 Medium Klarna Payments for WooCommerce Plugin klarna-payments-for-woocommerce Broken Access Control No login needed ≤ 3.2.4 Fixed in 3.3.0 CVE-2024-30477 Patchstack
4.3 Medium Simple Revisions Delete Plugin simple-revisions-delete Cross-Site Request Forgery No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2024-30482 Patchstack
4.3 Medium Custom WooCommerce Checkout Fields Editor Plugin add-fields-to-checkout-page-woocommerce Cross-Site Request Forgery No login needed ≤ 1.3.0 Fixed in 1.3.1 CVE-2024-30518 Patchstack
5.4 Medium Landingi Landing Pages Plugin landingi-landing-pages Cross-Site Request Forgery No login needed ≤ 3.1.1 Fixed in 3.1.2 CVE-2024-30521 Patchstack
6.5 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Insecure Direct Object References (IDOR) ≤ 5.7.2 Fixed in 5.7.3 CVE-2024-30513 Patchstack
5.3 Medium Wholesale For WooCommerce Plugin Information Disclosure Unauthenticated Sensitive Data Exposure No login needed ≤ 2.3.0 Fixed in 2.3.1 CVE-2024-30469 Patchstack
5.3 Medium FG PrestaShop to WooCommerce Plugin fg-prestashop-to-woocommerce Information Disclosure Sensitive Data Exposure via Log File No login needed ≤ 4.45.1 Fixed in 4.47.0 CVE-2024-30511 Patchstack
5.3 Medium Paid Memberships Pro – Payfast Gateway Add On Plugin pmpro-payfast Information Disclosure Payfast Gateway Add On plugin <= 1.4.1 - Sensitive Data Exposure via Log File No login needed ≤ 1.4.1 Fixed in 1.4.2 CVE-2024-30514 Patchstack
4.3 Medium Import Export WordPress Users Plugin users-customers-import-export-for-wp-woocommerce Path Traversal ≤ 2.5.2 Fixed in 2.5.3 CVE-2024-30492 Patchstack
6.5 Medium WP Hotel Booking Plugin wp-hotel-booking Broken Access Control No login needed ≤ 2.0.9.2 Fixed in 2.0.9.3 CVE-2024-30508 Patchstack
2.7 Low Molongui Plugin molongui-authorship Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.7.7 Fixed in 4.7.8 CVE-2024-30507 Patchstack
7.1 High All In One Redirection Plugin all-in-one-redirection-404-pages-list Cross-Site Scripting No login needed ≤ 2.2.0 CVE-2024-30506 Patchstack
5.4 Medium Church Admin Plugin church-admin Broken Access Control No login needed ≤ 4.1.18 Fixed in 4.1.19 CVE-2024-30505 Patchstack
7.6 High WP Travel Engine Plugin wp-travel-engine SQL Injection ≤ 5.7.9 Fixed in 5.8.0 CVE-2024-30504 Patchstack
9.3 Critical WP Travel Engine Plugin wp-travel-engine SQL Injection Unauth. Blind SQL Injection No login needed ≤ 5.7.9 Fixed in 5.8.0 CVE-2024-30502 Patchstack
7.6 High Download Monitor Plugin download-monitor SQL Injection Auth. SQL Injection ≤ 4.9.4 Fixed in 4.9.5 CVE-2024-30501 Patchstack
8.5 High CRM Perks Forms Plugin crm-perks-forms SQL Injection ≤ 1.1.4 Fixed in 1.1.5 CVE-2024-30499 Patchstack
9.3 Critical CRM Perks Forms Plugin crm-perks-forms SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.1.4 Fixed in 1.1.5 CVE-2024-30498 Patchstack
8.5 High WP Responsive Tabs horizontal vertical and accordion Tabs Plugin responsive-horizontal-vertical-and-accordion-tabs SQL Injection ≤ 1.1.17 Fixed in 1.1.18 CVE-2024-30497 Patchstack
8.5 High Element Pack Elementor Addons Plugin bdthemes-element-pack-lite SQL Injection ≤ 5.5.3 Fixed in 5.5.4 CVE-2024-30496 Patchstack
7.6 High Falang multilanguage Plugin falang SQL Injection ≤ 1.3.47 Fixed in 1.3.48 CVE-2024-30495 Patchstack
7.6 High OSS Aliyun Plugin oss-aliyun SQL Injection ≤ 1.4.10 Fixed in 1.4.11 CVE-2024-30494 Patchstack
4.3 Medium Church Admin Plugin church-admin Cross-Site Request Forgery No login needed ≤ 4.1.7 Fixed in 4.1.8 CVE-2024-30493 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection ≤ 5.7.8 Fixed in 5.7.9 CVE-2024-30491 Patchstack
9.3 Critical ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection No login needed ≤ 5.7.8 Fixed in 5.7.9 CVE-2024-30490 Patchstack
8.5 High Zotpress Plugin zotpress SQL Injection ≤ 7.3.7 Fixed in 7.3.8 CVE-2024-30488 Patchstack
7.6 High MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin mp3-music-player-by-sonaar Broken Access Control ≤ 5.1 Fixed in 5.1.1 CVE-2024-30487 Patchstack
8.5 High Media Library Folders Plugin media-library-plus SQL Injection Auth. SQL Injection ≤ 8.1.7 Fixed in 8.1.8 CVE-2024-30486 Patchstack
7.6 High WordPress Announcement & Notification Banner Plugin – Bulletin Plugin bulletin-announcements SQL Injection Bulletin plugin <= 3.8.5 - SQL Injection ≤ 3.8.5 Fixed in 3.9.0 CVE-2024-30478 Patchstack
10.0 Critical Salon booking system Plugin salon-booking-system Arbitrary File Upload No login needed ≤ 9.5 Fixed in 9.5.1 CVE-2024-30510 Patchstack
9.9 Critical CubeWP – All-in-One Dynamic Content Framework Plugin cubewp-framework Arbitrary File Upload ≤ 1.1.12 Fixed in 1.1.13 CVE-2024-30500 Patchstack
5.9 Medium Fluent CRM Plugin fluent-crm Cross-Site Scripting ≤ 2.8.44 Fixed in 2.8.45 CVE-2024-30430 Patchstack
6.5 Medium wp-forecast Plugin wp-forecast Cross-Site Scripting ≤ 9.2 Fixed in 9.3 CVE-2024-30429 Patchstack
7.1 High Contest Gallery Plugin contest-gallery Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 24.0.3 Fixed in 24.0.4 CVE-2024-30428 Patchstack
5.4 Medium Spiffy Calendar Plugin spiffy-calendar Cross-Site Scripting No login needed ≤ 4.9.7 Fixed in 4.9.10 CVE-2024-30427 Patchstack
6.5 Medium Hash Elements Plugin hash-elements Cross-Site Scripting ≤ 1.3.3 Fixed in 1.3.4 CVE-2024-30426 Patchstack
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.7.4.4 Fixed in 2.7.4.5 CVE-2024-30425 Patchstack
6.5 Medium Better Elementor Addons Plugin better-elementor-addons Cross-Site Scripting ≤ 1.3.7 Fixed in 1.3.8 CVE-2024-30423 Patchstack
7.1 High Jobeleon Theme Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2022-47153 Patchstack
4.3 Medium WPCS Plugin currency-switcher Cross-Site Request Forgery WordPress Currency Switcher Professional plugin <=1.2.0.1 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.2.0.1 Fixed in 1.2.0.2 CVE-2024-30456 Patchstack
4.3 Medium WordPress Meta Data and Taxonomies Filter (MDTF) Plugin wp-meta-data-filter-and-taxonomy-filter Cross-Site Request Forgery No login needed ≤ 1.3.3.1 Fixed in 1.3.3.2 CVE-2024-30457 Patchstack
4.3 Medium WOOCS – WooCommerce Currency Switcher Plugin woocommerce-currency-switcher Cross-Site Request Forgery Currency Switcher Professional for WooCommerce plugin <= 1.4.1.7 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.4.1.7 Fixed in 1.4.1.8 CVE-2024-30458 Patchstack
6.5 Medium Sponsors Plugin wp-sponsors Cross-Site Scripting ≤ 3.5.1 CVE-2024-30483 Patchstack
7.1 High Mailster Plugin mailster Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.0.6 Fixed in 4.0.7 CVE-2024-30503 Patchstack
6.5 Medium Lordicon Animated Icons Plugin lordicon-interactive-icons Cross-Site Scripting ≤ 2.0.1 CVE-2024-30519 Patchstack
6.5 Medium Carousel Anything For WPBakery Page Builder Plugin carousel-anything Cross-Site Scripting ≤ 2.1 CVE-2024-30520 Patchstack
7.5 High Responsive Theme responsive Broken Access Control Missing Authorization to HTML Injection No login needed ≤ 5.0.2 CVE-2024-2848 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only