WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 28,051–28,100 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 562 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Premium Addons PRO Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module ≤ 2.9.12 CVE-2024-2239 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.4.40 CVE-2024-1291 Wordfence
6.4 Medium Burst Statistics – Privacy-Friendly Analytics Plugin burst-statistics Cross-Site Scripting Privacy-Friendly Analytics for WordPress <= 1.5.6.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via burst_total_pageviews_count ≤ 1.5.6.1 CVE-2024-1894 Wordfence
8.8 High Tutor LMS – eLearning and online course solution Plugin tutor SQL Injection eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection ≤ 2.6.1 CVE-2024-1751 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer Widget ≤ 2.6.9 CVE-2024-1413 Wordfence
5.3 Medium Restrict User Access – Ultimate Membership & Content Protection Plugin restrict-user-access Information Disclosure Ultimate Membership & Content Protection <= 2.5 - Information Exposure No login needed ≤ 2.5 CVE-2024-0687 Wordfence
7.2 High AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber Plugin aweber-web-form-widget SQL Injection Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection ≤ 7.3.14 CVE-2024-1793 Wordfence
4.9 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.1.9 CVE-2023-6957 Wordfence
7.5 High Product Carousel Slider & Grid Ultimate for WooCommerce Plugin woo-product-carousel-slider-and-grid-ultimate PHP Object Injection Authenticated(Contributor+) PHP Object Injection ≤ 1.9.7 CVE-2024-1950 Wordfence
5.4 Medium Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder Plugin droit-elementor-addons Cross-Site Scripting Widgets, Blocks, Templates Library For Elementor Builder <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.1.5 CVE-2024-2252 Wordfence
4.3 Medium SMS Alert Order Notifications – WooCommerce Plugin Cross-Site Request Forgery WooCommerce <= 3.6.9 - Cross-Site Request Forgery No login needed ≤ 3.6.9 CVE-2024-1489 Wordfence
6.4 Medium SiteOrigin Widgets Bundle Plugin so-widgets-bundle Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.58.7 CVE-2024-1723 Wordfence
8.6 High Hustle Plugin wordpress-popup Information Disclosure Sensitive Information Exposure via Exposed Hubspot API Keys No login needed ≤ 7.8.3 CVE-2024-0368 Wordfence
7.2 High WP Statistics Plugin wp-statistics Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 14.5 CVE-2024-2194 Wordfence
5.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting No login needed ≤ 2.7.4.2 CVE-2024-1038 Wordfence
6.4 Medium Orbit Fox by ThemeIsle Plugin themeisle-companion Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.10.30 CVE-2024-1499 Wordfence
4.3 Medium Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Plugin play-ht Cross-Site Request Forgery Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgery No login needed ≤ 3.6.4 CVE-2024-0827 Wordfence
8.8 High Brizy – Page Builder Plugin brizy Arbitrary File Upload Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload ≤ 2.4.40 CVE-2024-1311 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag ≤ 2.7.4.4 CVE-2024-1080 Wordfence
6.4 Medium Sky Addons for Elementor Plugin sky-elementor-addons Cross-Site Scripting Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL ≤ 2.4.0 CVE-2024-2286 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Covid-19 Stats Widget ≤ 2.6.9 CVE-2024-2028 Wordfence
6.4 Medium ProfilePress Plugin wp-user-avatar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via profilepress-edit-profile Shortcode ≤ 4.15.1 CVE-2024-1806 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval ≤ 3.4.2 CVE-2024-1126 Wordfence
5.3 Medium LifterLMS – WordPress LMS Plugin for eLearning Plugin lifterlms Broken Access Control WordPress LMS Plugin for eLearning <= 7.5.1 - Missing Authorization via process_review No login needed ≤ 7.5.1 CVE-2024-0377 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.23 CVE-2024-1541 Wordfence
4.3 Medium Comments Extra Fields For Post,Pages and CPT Plugin wp-comment-fields Broken Access Control Missing Authorization ≤ 5.0 CVE-2024-0829 Wordfence
4.3 Medium Bulk Edit Post Titles Plugin bulk-edit-post-titles Broken Access Control Missing Authorization via bulkUpdatePostTitles ≤ 5.0.0 CVE-2024-0369 Wordfence
6.4 Medium Database for Contact Form 7, WPforms, Elementor forms Plugin contact-form-entries Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 1.3.3 CVE-2024-2030 Wordfence
6.1 Medium YML for Yandex Market Plugin yml-for-yandex-market Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 4.2.3 CVE-2024-1365 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget ≤ 1.12.12 CVE-2024-1393 Wordfence
7.3 High Bulgarisation for WooCommerce Plugin Broken Access Control Missing Authorization No login needed ≤ 3.0.14 CVE-2024-0683 Wordfence
6.4 Medium Orbit Fox by ThemeIsle Plugin themeisle-companion Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via form widget addr2_width attribute ≤ 2.10.30 CVE-2024-1497 Wordfence
8.8 High News Announcement Scroll Plugin news-announcement-scroll SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 9.0.0 CVE-2023-5663 Wordfence
7.5 High Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid Plugin logo-showcase-ultimate PHP Object Injection Logo Carousel, Logo Slider & Logo Grid <= 1.3.8 - Authenticated(Contributor+) PHP Object Injection ≤ 1.3.8 CVE-2024-1951 Wordfence
8.8 High Academy LMS – eLearning and online course solution Plugin academy Privilege Escalation eLearning and online course solution for WordPress <= 1.9.19 - Authenticated (Subscriber+) Privilege Escalation ≤ 1.9.19 CVE-2024-1505 Wordfence
4.4 Medium Chat Bubble Plugin chat-bubble Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 2.3 CVE-2024-0898 Wordfence
6.4 Medium Simple Tweet Plugin simple-tweet Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 1.4.0.2 CVE-2024-0700 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget ≤ 2.7.4.2 CVE-2024-1074 Wordfence
5.3 Medium Page Restriction WordPress (WP) – Protect WP Pages/Post Plugin Information Disclosure Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass No login needed ≤ 1.3.4 CVE-2024-0681 Wordfence
5.3 Medium Duitku Payment Gateway Plugin duitku-social-payment-gateway Broken Access Control Missing Authorization via check_duitku_response No login needed ≤ 2.11.6 CVE-2024-0631 Wordfence
6.4 Medium Custom fields shortcode Plugin beepress Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 0.1 CVE-2023-6809 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget ≤ 1.12.12 CVE-2024-1391 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.7.4.2 CVE-2024-0896 Wordfence
6.1 Medium File Manager Pro Plugin filester Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 8.3.4 CVE-2023-7015 Wordfence
6.4 Medium Otter Blocks PRO Plugin Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS ≤ 2.6.3 CVE-2024-1684 Wordfence
9.9 Critical File Manager And File Manager Pro (Multiple Versions) Plugin Path Traversal Directory Traversal ≤ 7.2.1, ≤ 8.3.4 CVE-2023-6825 Wordfence
8.8 High Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Plugin post-grid-carousel-ultimate PHP Object Injection with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup ≤ 1.6.7 CVE-2024-2006 Wordfence
4.3 Medium Comments Extra Fields For Post,Pages and CPT Plugin wp-comment-fields Cross-Site Request Forgery No login needed ≤ 5.0 CVE-2024-0830 Wordfence
4.7 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored Self-Based Cross-Site Scripting No login needed ≤ 4.4.2 CVE-2024-1985 Wordfence
6.4 Medium Easy Accordion – Best Accordion FAQ Plugin Cross-Site Scripting Best Accordion FAQ Plugin for WordPress <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.3.4 CVE-2024-1363 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only