WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 28,301–28,350 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 567 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical MoveTo Plugin SQL Injection WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection No login needed ≤ 6.2 CVE-2024-25910 Patchstack
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcode ≤ 7.0.3 CVE-2024-1808 Wordfence
9.3 Critical postMash – custom post order Plugin postmash SQL Injection custom post order Plugin <= 1.2.0 is vulnerable to SQL Injection No login needed ≤ 1.2.0 CVE-2024-25927 Patchstack
4.3 Medium Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Table Truncation ≤ 4.52 CVE-2024-1861 Wordfence
6.5 Medium Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan Plugin Broken Access Control Missing Authorization to Unauthenticated IP Address Whitelist No login needed ≤ 4.51 CVE-2024-1860 Wordfence
4.3 Medium Easy PayPal & Stripe Buy Now Button Plugin wp-ecommerce-paypal Cross-Site Request Forgery PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update No login needed ≤ 1.8.3, ≤ 2.1 CVE-2024-1719 Wordfence
5.3 Medium Under Construction / Maintenance Mode from Acurax Plugin coming-soon-maintenance-mode-from-acurax Information Disclosure Information Exposure No login needed ≤ 2.6 CVE-2024-1476 Wordfence
5.3 Medium Coming Soon Page & Maintenance Mode Plugin responsive-coming-soon Broken Access Control Maintenance Mode Bypass No login needed ≤ 2.2.1 CVE-2024-1136 Wordfence
4.3 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Cross-Site Request Forgery Cross-Site Request Forgery via ajax_plugin_activation No login needed ≤ 1.4.4 CVE-2024-0767 Wordfence
5.3 Medium Page Duplicator Plugin wp-page-duplicator Broken Access Control Missing Authorization to Unauthenticated Post/Page Duplication No login needed ≤ 0.1.1 CVE-2024-1368 Wordfence
8.8 High Conversios Plugin enhanced-e-commerce-for-woocommerce-store SQL Injection Authenticated (Subscriber+) SQL Injection via ee_syncProductCategory ≤ 7.0.7 CVE-2024-0786 Wordfence
5.3 Medium WP eCommerce Plugin wp-e-commerce Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Creation No login needed ≤ 3.15.1 CVE-2024-1516 Wordfence
4.3 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Broken Access Control Missing Authorization via templates_ajax_request ≤ 1.4.4 CVE-2024-0766 Wordfence
6.3 Medium Oliver POS – A WooCommerce Point of Sale (POS) Plugin Cross-Site Request Forgery A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgery No login needed ≤ 2.4.1.8 CVE-2024-1954 Wordfence
4.3 Medium Gestpay for WooCommerce Plugin Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) via ajax_set_default_card No login needed ≤ 20221130 CVE-2024-0431 Wordfence
6.5 Medium Redirects Plugin redirects Broken Access Control Missing Authorization via save No login needed ≤ 1.2.1 CVE-2024-1566 Wordfence
4.3 Medium Gestpay for WooCommerce Plugin wppdf Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) via ajax_delete_card No login needed ≤ 20221130 CVE-2024-0432 Wordfence
4.3 Medium Envo's Elementor Templates & Widgets for WooCommerce Plugin envo-elementor-for-woocommerce Cross-Site Request Forgery Cross-Site Request Forgery via ajax_theme_activation No login needed ≤ 1.4.4 CVE-2024-0768 Wordfence
5.3 Medium Page Restrict Plugin pagerestrict Information Disclosure Protection Mechanism Bypass No login needed ≤ 2.5.5 CVE-2024-0682 Wordfence
6.4 Medium CodeMirror Blocks Plugin wp-codemirror-block Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.4 CVE-2024-1791 Wordfence
4.3 Medium Gestpay for WooCommerce Plugin wppdf Cross-Site Request Forgery Cross-Site Request Forgery (CSRF) via ajax_unset_default_card No login needed ≤ 20221130 CVE-2024-0433 Wordfence
5.3 Medium WordPress Access Control Plugin wordpress-access-control Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed ≤ 4.0.13 CVE-2024-0975 Wordfence
5.3 Medium WP Private Content Plus Plugin wp-private-content-plus Information Disclosure Protection Mechanism Bypass No login needed ≤ 3.6 CVE-2024-0680 Wordfence
4.3 Medium Under Construction / Maintenance Mode from Acurax Plugin coming-soon-maintenance-mode-from-acurax Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure ≤ 2.6 CVE-2023-6922 Wordfence
9.8 Critical WP eCommerce Plugin wp-e-commerce SQL Injection Unauthenticated SQL Injection No login needed ≤ 3.15.1 CVE-2024-1514 Wordfence
4.3 Medium Yuki Theme yuki Cross-Site Request Forgery Cross-Site Request Forgery to Theme Setting Reset No login needed ≤ 1.3.14 CVE-2024-1943 Wordfence
6.4 Medium Seraphinite Accelerator Plugin seraphinite-accelerator Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck ≤ 2.20.52 CVE-2024-1568 Wordfence
4.3 Medium Yuki Theme yuki Broken Access Control Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset ≤ 1.3.13 CVE-2024-1388 Wordfence
4.3 Medium Categorify Plugin categorify Broken Access Control Missing Authorization in categorifyAjaxRenameCategory ≤ 1.0.7.4 CVE-2024-1650 Wordfence
4.3 Medium Categorify Plugin categorify Broken Access Control Missing Authorization in categorifyAjaxDeleteCategory ≤ 1.0.7.4 CVE-2024-1649 Wordfence
4.3 Medium Categorify Plugin categorify Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxClearCategory No login needed ≤ 1.0.7.4 CVE-2024-1910 Wordfence
4.3 Medium Categorify Plugin categorify Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxAddCategory No login needed ≤ 1.0.7.4 CVE-2024-1906 Wordfence
4.3 Medium Categorify Plugin categorify Broken Access Control Missing Authorization in categorifyAjaxClearCategory ≤ 1.0.7.4 CVE-2024-1652 Wordfence
4.3 Medium Categorify Plugin categorify Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition No login needed ≤ 1.0.7.4 CVE-2024-1912 Wordfence
4.3 Medium Categorify Plugin categorify Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxRenameCategory No login needed ≤ 1.0.7.4 CVE-2024-1909 Wordfence
4.3 Medium Categorify Plugin categorify Cross-Site Request Forgery Cross-Site Request Forgery via categorifyAjaxDeleteCategory No login needed ≤ 1.0.7.4 CVE-2024-1907 Wordfence
4.3 Medium Categorify Plugin categorify Broken Access Control Missing Authorization in categorifyAjaxUpdateFolderPosition ≤ 1.0.7.4 CVE-2024-1653 Wordfence
6.1 Medium Shariff Wrapper Plugin shariff Cross-Site Scripting Admin+ Stored XSS No login needed < 4.6.10 Fixed in 4.6.10 CVE-2024-1106 WPScan
7.5 High JetBackup Plugin backup Information Disclosure Directory Listing Exposing Backups No login needed < 2.0.9.9 Fixed in 2.0.9.9 CVE-2023-7165 WPScan
5.3 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control No login needed < 4.9.9 Fixed in 4.9.9 CVE-2024-0855 WPScan
4.8 Medium PageLayer Plugin Cross-Site Scripting Admin+ Stored XSS < 1.8.1 Fixed in 1.8.1 CVE-2023-7115 WPScan
4.3 Medium WPDashboardNotes Plugin Broken Access Control Unauthorised Deletion of Private Notes < 1.0.11 Fixed in 1.0.11 CVE-2023-7198 WPScan
7.5 High JobSearch WP Job Board Plugin Authentication Bypass No login needed < 2.3.4 Fixed in 2.3.4 CVE-2023-6584 WPScan
6.1 Medium Smart Forms Plugin smart-forms Broken Access Control Subscriber+ Arbitrary Entry Deletion No login needed < 2.6.87 Fixed in 2.6.87 CVE-2023-7203 WPScan
7.5 High JobSearch WP Job Board Plugin Arbitrary File Upload Arbitrary File Upload to RCE No login needed < 2.3.4 Fixed in 2.3.4 CVE-2023-6585 WPScan
6.1 Medium Persian Fonts Plugin Cross-Site Scripting Admin+ Stored XSS No login needed ≤ 1.6 CVE-2023-7167 WPScan
6.1 Medium Fatal Error Notify Plugin fatal-error-notify Cross-Site Request Forgery Subscriber+ Test Error Email Sending No login needed < 1.5.3 Fixed in 1.5.3 CVE-2023-7202 WPScan
9.8 Critical NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor Plugin notificationx SQL Injection Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection No login needed ≤ 2.8.2 CVE-2024-1698 Wordfence
5.4 Medium Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin Broken Access Control Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 1.1.2 CVE-2024-1687 Wordfence
4.3 Medium Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin woo-thank-you-page-customizer Broken Access Control Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export ≤ 1.1.2 CVE-2024-1686 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only