WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 251–269 of 269 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout ≤ 2.8.3 CVE-2024-2868 Wordfence
6.5 Medium B Slider - Slider for your block editor Plugin b-slider Cross-Site Scripting ≤ 1.1.12 Fixed in 1.1.13 CVE-2024-30432 Patchstack
5.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color' ≤ 3.9.12 CVE-2024-2688 Wordfence
4.3 Medium RevivePress – Keep your Old Content Evergreen Plugin wp-auto-republish Broken Access Control Keep your Old Content Evergreen <= 1.5.6 - Missing Authorization ≤ 1.5.6 CVE-2024-1844 Wordfence
6.1 Medium Travelpayouts Plugin travelpayouts Open Redirect No login needed ≤ 1.1.15 CVE-2024-0337 WPScan
4.3 Medium Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Plugin play-ht Cross-Site Request Forgery Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgery No login needed ≤ 3.6.4 CVE-2024-0827 Wordfence
5.4 Medium Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio Plugin play-ht Broken Access Control Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization ≤ 3.6.4 CVE-2024-0828 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block ≤ 3.9.10 CVE-2024-1802 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget ≤ 3.9.10 CVE-2024-2128 Wordfence
5.3 Medium NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce Plugin finale-woocommerce-sales-countdown-timer-discount Broken Access Control Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure No login needed ≤ 2.17.0, ≤ 2.18.0 CVE-2024-1120 Wordfence
5.4 Medium Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin Broken Access Control Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 1.1.2 CVE-2024-1687 Wordfence
4.3 Medium Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin woo-thank-you-page-customizer Broken Access Control Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export ≤ 1.1.2 CVE-2024-1686 Wordfence
6.5 Medium AMP for WP Plugin accelerated-mobile-pages Broken Access Control Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data ≤ 1.0.93.1 CVE-2024-1043 Wordfence
6.5 Medium My Agile Privacy – The only GDPR solution for WordPress that you can truly trust Plugin myagileprivacy Cross-Site Scripting WordPress My Agile Privacy Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS) ≤ 2.1.7 Fixed in 2.1.8 CVE-2023-51404 Patchstack
4.3 Medium RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Plugin feedzy-rss-feeds Broken Access Control Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing Authorization ≤ 4.4.1 CVE-2024-1092 Wordfence
5.3 Medium Author Box, Guest Author and Co-Authors for Your Posts – Molongui Plugin Information Disclosure Molongui <= 4.7.4 - Information Exposure via ma_debug No login needed ≤ 4.7.4 CVE-2023-7014 Wordfence
5.4 Medium RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Plugin feedzy-rss-feeds Broken Access Control Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Missing Authorization ≤ 4.3.2 CVE-2023-6798 Wordfence
6.4 Medium RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Plugin feedzy-rss-feeds Cross-Site Scripting Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 4.3.2 CVE-2023-6801 Wordfence
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode < 3.9.5 Fixed in 3.9.5 CVE-2023-6986 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only