WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 28,101–28,150 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 563 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.1 CVE-2024-1854 Wordfence
5.0 Medium ArtiBot Free Chat Bot for WordPress WebSites Plugin artibot Broken Access Control Missing Authorization to Settings Update ≤ 1.1.6 CVE-2024-0447 Wordfence
8.8 High Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Plugin play-ht PHP Object Injection Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Authenticated (Contributor+) PHP Object Injection ≤ 3.6.4 CVE-2024-1772 Wordfence
6.4 Medium Site Reviews Plugin site-reviews Cross-Site Scripting Authenticated(Subscriber+) Stored Cross-Site Scripting via display name ≤ 6.11.4 CVE-2024-2293 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.24 CVE-2024-1237 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table ≤ 5.9.9 CVE-2024-1537 Wordfence
8.8 High Conversios – Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce Plugin enhanced-e-commerce-for-woocommerce-store SQL Injection Google Analytics 4 (GA4), Meta Pixel & more Via Google Tag Manager For WooCommerce <= 7.0.7 - Authenticated (Subscriber+) SQL Injection ≤ 7.0.7 CVE-2024-1203 Wordfence
5.3 Medium Relevanssi – A Better Search Plugin relevanssi Broken Access Control A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export No login needed ≤ 2.25.0, ≤ 4.22.0 CVE-2024-1380 Wordfence
5.3 Medium Download Manager Plugin download-manager Broken Access Control Missing Authorization No login needed ≤ 3.2.84 CVE-2023-6785 Wordfence
6.1 Medium Otter Blocks PRO Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via SVG Upload No login needed ≤ 2.6.3 CVE-2024-1691 Wordfence
4.3 Medium User Shortcodes Plus Plugin user-shortcodes-plus Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via user_meta Shortcode ≤ 2.0.2 CVE-2023-6969 Wordfence
5.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Price Manipulation Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass No login needed ≤ 3.4.2 CVE-2024-1321 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Banner, Team Members, and Image Scroll Widgets ≤ 4.10.21 CVE-2024-1680 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget ≤ 2.6.9 CVE-2024-1414 Wordfence
5.3 Medium WP Show Posts Plugin wp-show-posts Information Disclosure Information Exposure No login needed ≤ 1.1.4 CVE-2024-1479 Wordfence
5.3 Medium Simple Restrict Plugin simple-restrict Broken Access Control Missing Authorization to Sensitive Information Exposure No login needed ≤ 1.2.6 CVE-2024-1083 Wordfence
9.8 Critical Malware Scanner Plugin miniorange-malware-protection Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 2.1.1, ≤ 4.7.2 CVE-2024-2172 Wordfence
5.3 Medium Maintenance Page Plugin Information Disclosure Security Mechanism Bypass via REST API No login needed ≤ 1.0.8 CVE-2024-1462 Wordfence
4.3 Medium GenerateBlocks Plugin generateblocks Information Disclosure Sensitive Information Exposure ≤ 1.8.2 CVE-2024-1452 Wordfence
4.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated(Administator+) Stored Cross-Site Scripting via settings ≤ 6.4.6.4 CVE-2024-0614 Wordfence
6.4 Medium Visual Composer Premium Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 45.6.0 CVE-2023-6880 Wordfence
5.4 Medium Related Posts Plugin related-posts-for-wp Cross-Site Request Forgery No login needed ≤ 2.2.1 CVE-2024-0592 Wordfence
6.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.85 CVE-2023-6954 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.4.40 CVE-2024-1293 Wordfence
6.1 Medium wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin wpdatatables Cross-Site Scripting WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting. No login needed ≤ 3.4.2.4 CVE-2024-0591 Wordfence
6.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.15.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via [reg-select-role] Shortcode ≤ 4.15.0 CVE-2024-1409 Wordfence
5.4 Medium Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Plugin play-ht Broken Access Control Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization ≤ 3.6.4 CVE-2024-0828 Wordfence
6.5 Medium Wp Social Login and Register Social Counter Plugin wp-social Broken Access Control Missing Authorization to Unauthenticated Social Login/Share Status Update No login needed ≤ 3.0.0 CVE-2024-1763 Wordfence
6.1 Medium WP Event Manager Plugin wp-event-manager Cross-Site Scripting Reflected Cross-Site Scripting via plugin No login needed ≤ 3.1.41 CVE-2024-0976 Wordfence
5.3 Medium Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form Plugin bit-form Broken Access Control Unauthenticated Insecure Direct Object Reference to Form Submission Alteration No login needed ≤ 2.10.1 CVE-2024-1640 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet ≤ 1.12.12 CVE-2024-1422 Wordfence
7.2 High Calculated Fields Form Professional Plugin calculated-fields-form Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 5.1.56 CVE-2024-2020 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.4.40 CVE-2024-1296 Wordfence
4.4 Medium ArtiBot Free Chat Bot for WordPress WebSites Plugin Cross-Site Scripting Authenticated (Admin+) Cross-Site Scripting ≤ 1.1.6 CVE-2024-0449 Wordfence
6.1 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 1.0.98 - Reflected Cross-Site Scripting No login needed ≤ 1.0.98 CVE-2024-1484 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export ≤ 3.4.1 CVE-2024-1127 Wordfence
8.1 High WooCommerce Add to Cart Custom Redirect Plugin woocommerce-add-to-cart-custom-redirect Broken Access Control Authenticated(Contributor+) Missing Authorization to Limited Arbitrary Options Update ≤ 1.2.13 CVE-2024-1862 Wordfence
6.4 Medium ProfilePress Plugin wp-user-avatar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.15.2 CVE-2024-1535 Wordfence
6.4 Medium Metform Elementor Contact Form Builder Plugin metform Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.8.3 CVE-2024-1585 Wordfence
4.3 Medium MainWP Dashboard Plugin mainwp Cross-Site Request Forgery Cross-Site Request Forgery via posting_bulk No login needed ≤ 4.6.0.1 CVE-2024-1642 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget ≤ 1.12.12 CVE-2024-1392 Wordfence
7.2 High Giveaways and Contests by RafflePress Plugin rafflepress Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.12.5 CVE-2024-1935 Wordfence
6.1 Medium WPvivid Backup for MainWP Plugin wpvivid-backup-mainwp Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 0.9.32 CVE-2024-1383 Wordfence
5.3 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Information Disclosure for Online Courses and Education <= 3.2.10 - Basic Information Exposure via REST route No login needed ≤ 3.2.10 CVE-2024-2106 Wordfence
5.4 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget ≤ 2.7.4.2 CVE-2024-0871 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Link Wrapper ≤ 4.0.17 CVE-2024-0326 Wordfence
8.8 High Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Path Traversal Directory Traversal to Local File Inclusion ≤ 1.12.12 CVE-2024-1358 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.7.4.2 CVE-2024-0897 Wordfence
5.3 Medium Maintenance Page Plugin Broken Access Control Missing Authorization to Sensitive Information Exposure No login needed ≤ 1.0.8 CVE-2024-1370 Wordfence
5.3 Medium FeedWordPress Plugin feedwordpress Broken Access Control Insecure Direct Object Referece No login needed ≤ 2022.0222 CVE-2024-0839 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only