WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 28,401–28,450 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 569 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return No login needed ≤ 2.11.1 CVE-2024-1389 Wordfence
8.8 High RSS Aggregator by Feedzy Plugin feedzy-rss-feeds SQL Injection Authenticated(Contributor+) SQL Injection ≤ 4.4.2 CVE-2024-1317 Wordfence
6.1 Medium Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.2.8 CVE-2024-0821 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update in optimizeAllOn No login needed ≤ 3.1.13 CVE-2024-1336 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Broken Access Control Missing Authorization to Settings Update in disableOptimization ≤ 3.1.13 CVE-2024-0984 Wordfence
4.4 Medium Insert PHP Code Snippet Plugin insert-php-code-snippet Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 1.3.4 CVE-2024-0658 Wordfence
6.1 Medium Microsoft Clarity Plugin microsoft-clarity Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 0.9.3 CVE-2024-0590 Wordfence
6.4 Medium Page scroll to id Plugin page-scroll-to-id Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.7.8 CVE-2024-1445 Wordfence
6.4 Medium Booster for WooCommerce Plugin woocommerce-jetpack Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 7.1.6 CVE-2024-1054 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update in disableOptimization No login needed ≤ 3.1.13 CVE-2024-1335 Wordfence
7.3 High Oliver POS – A WooCommerce Point of Sale (POS) Plugin oliver-pos Broken Access Control A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization No login needed ≤ 2.4.2.0 CVE-2024-0702 Wordfence
8.8 High WP Recipe Maker Plugin wp-recipe-maker Broken Access Control Missing Authorization to Authenticated (Subscriber+) SQL Injecton ≤ 9.1.2 CVE-2024-1206 Wordfence
4.3 Medium Royal Elementor Addons and Templates Plugin Cross-Site Request Forgery Cross-Site Request Forgery via add_to_wishlist No login needed ≤ 1.3.87 CVE-2024-0512 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.8 CVE-2024-1276 Wordfence
4.3 Medium Royal Elementor Addons and Templates Plugin Cross-Site Request Forgery Cross-Site Request Forgery via add_to_compare No login needed ≤ 1.3.87 CVE-2024-0514 Wordfence
5.3 Medium Directorist Plugin directorist Broken Access Control Missing Authorization to Unauthenticated Settings Change No login needed ≤ 7.8.4 CVE-2024-1322 Wordfence
4.3 Medium Schema & Structured Data for WP & AMP Plugin schema-and-structured-data-for-wp Broken Access Control Missing Authorization to reCaptcha Key Modification ≤ 1.26 CVE-2024-1288 Wordfence
4.4 Medium Password Protected Plugin Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 2.6.6 CVE-2024-0656 Wordfence
6.4 Medium SiteOrigin Widgets Bundle Plugin so-widgets-bundle Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.58.2 CVE-2024-1070 Wordfence
4.3 Medium Royal Elementor Addons and Templates Plugin Cross-Site Request Forgery Cross-Site Request Forgery via remove_from_compare No login needed ≤ 1.3.87 CVE-2024-0515 Wordfence
5.3 Medium My Private Site Plugin jonradio-private-site Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed ≤ 3.0.14 CVE-2024-0978 Wordfence
4.4 Medium Simple Share Buttons Adder Plugin simple-share-buttons-adder Cross-Site Scripting Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings ≤ 8.4.11 CVE-2024-0621 Wordfence
6.4 Medium Schema & Structured Data for WP & AMP Plugin schema-and-structured-data-for-wp Cross-Site Scripting Authenticated (Custom) Stored Cross-Site Scripting ≤ 1.26 CVE-2024-1586 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Broken Access Control Missing Authorization to Settings Update in optimizeAllOn ≤ 3.1.13 CVE-2024-1089 Wordfence
6.4 Medium Featured Image from URL (FIFU) Plugin featured-image-from-url Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url ≤ 4.6.2 CVE-2024-1496 Wordfence
7.6 High Contact Form builder with drag & drop for WordPress – Kali Forms Plugin kali-forms Broken Access Control Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivation ≤ 2.3.41 CVE-2024-1217 Wordfence
6.4 Medium Email Encoder – Protect Email Addresses and Phone Numbers Plugin email-encoder-bundle Cross-Site Scripting Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.2.0 CVE-2024-1282 Wordfence
6.4 Medium Elementor Addons by Livemesh Plugin addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.3.2 CVE-2024-1235 Wordfence
5.3 Medium WP Maintenance Plugin wp-maintenance Information Disclosure Information Exposure No login needed ≤ 6.1.6 CVE-2024-1472 Wordfence
6.4 Medium ProfilePress Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode ≤ 4.14.4 CVE-2024-1408 Wordfence
6.4 Medium PowerPack Addons for Elementor Plugin powerpack-lite-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget ≤ 2.7.15 CVE-2024-1411 Wordfence
6.4 Medium EmbedPress Plugin embedpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.8 CVE-2024-1349 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update in stopOptimizeAll No login needed ≤ 3.1.13 CVE-2024-1338 Wordfence
6.4 Medium Ocean Extra Plugin ocean-extra Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.2.4 CVE-2024-1277 Wordfence
6.4 Medium ProfilePress Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.14.4 CVE-2024-1570 Wordfence
6.5 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Cross-Site Scripting ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.14.4 CVE-2024-1519 Wordfence
6.4 Medium EmbedPress Plugin embedpress Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link ≤ 3.9.8 CVE-2024-1425 Wordfence
5.3 Medium WPify Woo Czech Plugin Broken Access Control Missing Authorization No login needed ≤ 4.0.8 CVE-2024-1492 Wordfence
5.3 Medium Coming Soon Maintenance Mode Plugin coming-soon-maintenance-mode Information Disclosure Information Exposure No login needed ≤ 1.0.5 CVE-2024-1475 Wordfence
5.3 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Broken Access Control Improper Authorization via submit_review No login needed ≤ 5.38.12 CVE-2024-1044 Wordfence
6.4 Medium Elementor Website Builder – More than Just a Page Builder Plugin elementor Cross-Site Scripting More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_alt ≤ 3.18.3 CVE-2024-0506 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.8 CVE-2024-1236 Wordfence
5.3 Medium PPWP – Password Protect Pages Plugin password-protect-page Information Disclosure Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass No login needed ≤ 1.8.9 CVE-2024-0620 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Broken Access Control Missing Authorization to Plugin Data Removal in reinitialize ≤ 3.1.13 CVE-2024-1091 Wordfence
4.3 Medium Royal Elementor Addons and Templates Plugin Cross-Site Request Forgery Cross-Site Request Forgery via remove_from_wishlist No login needed ≤ 1.3.87 CVE-2024-0513 Wordfence
5.4 Medium Login Lockdown – Protect Login Form Plugin login-lockdown Broken Access Control Protect Login Form <= 2.08 - Missing Authorization ≤ 2.08 CVE-2024-1340 Wordfence
4.3 Medium SKT Page Builder Plugin skt-builder Broken Access Control Missing Authorization to Authenticated(Subscriber+) Content Injection ≤ 4.1 CVE-2024-1337 Wordfence
4.3 Medium ImageRecycle pdf & image compression Plugin imagerecycle-pdf-image-compression Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Data Removal in reinitialize No login needed ≤ 3.1.13 CVE-2024-1339 Wordfence
6.1 Medium Matomo Plugin Cross-Site Scripting Reflected Cross-Site Scripting via idsite No login needed ≤ 4.15.3 CVE-2023-6923 Wordfence
5.9 Medium InfiniteWP Client Plugin iwp-client Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 1.12.3 CVE-2023-6565 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only