WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 27,601–27,650 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 553 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Sunshine Photo Cart Plugin sunshine-photo-cart PHP Object Injection No login needed ≤ 3.1.1 Fixed in 3.1.2 CVE-2024-30221 Patchstack
8.5 High ARMember Plugin armember-membership PHP Object Injection ≤ 4.0.26 Fixed in 4.0.27 CVE-2024-30222 Patchstack
9.0 Critical ARMember Plugin armember-membership PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 4.0.26 Fixed in 4.0.27 CVE-2024-30223 Patchstack
10.0 Critical WholesaleX Plugin wholesalex PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2024-30224 Patchstack
10.0 Critical WP Migrate Plugin PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 2.6.10 Fixed in 2.6.11 CVE-2024-30225 Patchstack
5.1 Medium Pz-LinkCard Plugin pz-linkcard Server-Side Request Forgery Contributor+ SSRF ≤ 2.5.1 CVE-2024-0677 WPScan
6.1 Medium Pz-LinkCard Plugin pz-linkcard Cross-Site Scripting Admin+ Stored XSS No login needed ≤ 2.5.1 CVE-2024-0673 WPScan
7.1 High Pz-LinkCard Plugin pz-linkcard Cross-Site Scripting Reflected XSS No login needed ≤ 2.5.1 CVE-2024-0672 WPScan
9.0 Critical BetterDocs Plugin betterdocs PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 3.3.3 Fixed in 3.3.4 CVE-2024-30226 Patchstack
9.0 Critical Geo Controller Plugin cf-geoplugin PHP Object Injection No login needed ≤ 8.6.4 Fixed in 8.6.5 CVE-2024-30227 Patchstack
9.9 Critical Hercules Core Plugin PHP Object Injection Auth. PHP Object Injection ≤ 6.4 Fixed in 6.5 CVE-2024-30228 Patchstack
8.0 High GiveWP Plugin give PHP Object Injection ≤ 3.4.2 Fixed in 3.5.0 CVE-2024-30229 Patchstack
8.2 High PDF Invoices and Packing Slips For WooCommerce Plugin pdf-invoices-and-packing-slips-for-woocommerce PHP Object Injection ≤ 1.3.7 Fixed in 1.3.8 CVE-2024-30230 Patchstack
8.5 High Contest Gallery Plugin contest-gallery SQL Injection ≤ 21.3.4 Fixed in 21.3.5 CVE-2024-30236 Patchstack
7.6 High Slider by Supsystic Plugin slider-by-supsystic SQL Injection ≤ 1.8.10 Fixed in 1.8.11 CVE-2024-30237 Patchstack
8.5 High Zoho Campaigns Plugin zoho-campaigns SQL Injection ≤ 2.0.6 Fixed in 2.0.7 CVE-2024-30239 Patchstack
8.5 High Calendarista Plugin SQL Injection ≤ 15.5.7 Fixed in 15.5.9 CVE-2024-30240 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection ≤ 5.7.1 Fixed in 5.7.2 CVE-2024-30241 Patchstack
8.5 High Contact Form to Any API Plugin contact-form-to-any-api SQL Injection Auth. SQL Injection ≤ 1.1.8 Fixed in 1.1.9 CVE-2024-30242 Patchstack
8.5 High WordPress Tooltips Plugin wordpress-tooltips SQL Injection Auth. SQL Injection < 9.4.5 Fixed in 9.4.5 CVE-2024-30243 Patchstack
8.5 High Church Admin Plugin church-admin SQL Injection SQL Injection via shortcode ≤ 4.0.27 Fixed in 4.0.28 CVE-2024-30244 Patchstack
7.6 High DecaLog Plugin decalog SQL Injection ≤ 3.9.0 Fixed in 3.9.1 CVE-2024-30245 Patchstack
5.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.2 CVE-2024-2091 Wordfence
4.3 Medium Events Manager Plugin events-manager Cross-Site Request Forgery No login needed ≤ 6.4.7.1 CVE-2024-2110 Wordfence
8.8 High Meta Tag Manager Plugin meta-tag-manager PHP Object Injection Authenticated (Subscriber+) PHP Object Injection ≤ 3.0.2 CVE-2024-1770 Wordfence
6.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.4.7.1 CVE-2024-2111 Wordfence
6.1 Medium WordPress Countdown Widget Plugin wordpress-countdown-widget Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) No login needed ≤ 3.1.9.1 Fixed in 3.1.9.3 CVE-2022-45847 Patchstack
8.5 High Contest Gallery Plugin contest-gallery SQL Injection ≤ 21.3.2 Fixed in 21.3.2.1 CVE-2024-30238 Patchstack
4.3 Medium Don't Muck My Markup Plugin dont-muck-my-markup Cross-Site Request Forgery No login needed ≤ 1.8 CVE-2024-23510 Patchstack
5.4 Medium Post Video Players Plugin video-playlist-and-gallery-plugin Cross-Site Request Forgery No login needed ≤ 1.159 Fixed in 1.160 CVE-2024-23515 Patchstack
7.1 High Fusion Builder Plugin fusion-builder Cross-Site Request Forgery No login needed ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39311 Patchstack
5.4 Medium WooCommerce Stripe Payment Gateway Plugin woocommerce-gateway-stripe Cross-Site Request Forgery No login needed ≤ 7.6.0 Fixed in 7.6.1 CVE-2023-44999 Patchstack
4.7 Medium Uncanny Toolkit for LearnDash Plugin uncanny-learndash-toolkit Open Redirect No login needed ≤ 3.6.4.3 Fixed in 3.6.4.4 CVE-2023-34020 Patchstack
7.1 High BizPrint Plugin print-google-cloud-print-gcp-woocommerce Cross-Site Request Forgery CSRF to XSS No login needed ≤ 4.5.5 Fixed in 4.5.6 CVE-2024-29773 Patchstack
7.1 High Co-marquage service-public.fr Plugin co-marquage-service-public Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.5.72 Fixed in 0.5.73 CVE-2024-29758 Patchstack
7.1 High Calculated Fields Form Plugin calculated-fields-form Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.54 Fixed in 1.2.55 CVE-2024-29759 Patchstack
7.1 High Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 7.1.7 Fixed in 7.1.8 CVE-2024-29760 Patchstack
6.5 Medium WP Post Disclaimer Plugin wp-post-disclaimer Cross-Site Scripting ≤ 1.0.3 Fixed in 1.0.4 CVE-2024-29761 Patchstack
6.5 Medium Off-Canvas Sidebars & Menus (Slidebars) Plugin off-canvas-sidebars Cross-Site Scripting ≤ 0.5.8.1 Fixed in 0.5.8.2 CVE-2024-29762 Patchstack
7.1 High WordPress Meta Data and Taxonomies Filter (MDTF) Plugin wp-meta-data-filter-and-taxonomy-filter Cross-Site Scripting Meta Data and Taxonomies Filter plugin <= 1.3.3 - Cross Site Scripting (XSS) No login needed ≤ 1.3.3 Fixed in 1.3.3.1 CVE-2024-29763 Patchstack
6.5 Medium Molongui Plugin molongui-authorship Cross-Site Scripting ≤ 4.7.7 Fixed in 4.7.8 CVE-2024-29764 Patchstack
6.5 Medium Aparat Plugin wp-aparat Cross-Site Scripting ≤ 2.2.0 Fixed in 2.2.1 CVE-2024-29765 Patchstack
6.5 Medium StreamWeasels Twitch Integration Plugin streamweasels-twitch-integration Cross-Site Scripting ≤ 1.7.5 Fixed in 1.7.6 CVE-2024-29766 Patchstack
7.1 High Doneren met Mollie Plugin doneren-met-mollie Cross-Site Scripting No login needed ≤ 2.10.2 Fixed in 2.10.3 CVE-2024-29767 Patchstack
5.9 Medium Astra Theme astra Cross-Site Scripting ≤ 4.6.4 Fixed in 4.6.5 CVE-2024-29768 Patchstack
6.5 Medium Portfolio Gallery – Image Gallery Plugin portfolio-filter-gallery Cross-Site Scripting ≤ 1.5.6 Fixed in 1.5.7 CVE-2024-29769 Patchstack
7.1 High Forminator Plugin forminator Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.29.0 Fixed in 1.29.1 CVE-2024-29777 Patchstack
7.1 High Shortlinks by Pretty Links Plugin pretty-link Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.6.2 Fixed in 3.6.3 CVE-2024-29770 Patchstack
6.5 Medium Dracula Dark Mode - The Revolutionary Dark Mode Plugin dracula-dark-mode Cross-Site Scripting ≤ 1.0.8 Fixed in 1.0.9 CVE-2024-29771 Patchstack
6.5 Medium MyBookTable Bookstore Plugin mybooktable Cross-Site Scripting ≤ 3.3.7 Fixed in 3.3.8 CVE-2024-29772 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only