WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 251–300 of 313 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Tutor LMS Pro Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Insecure Direct Object Reference ≤ 2.7.2 CVE-2024-5784 Wordfence
5.4 Medium Tutor LMS Plugin tutor Cross-Site Request Forgery No login needed ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-39645 Patchstack
6.4 Medium Tutor LMS Elementor Addons Plugin tutor-lms-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Course Carousel Widget ≤ 2.1.4 CVE-2024-5576 Wordfence
5.3 Medium Sensei LMS Plugin sensei-lms Broken Access Control No login needed ≤ 4.23.1, ≤ 4.23.1.1.23.1 Fixed in 4.24.0 CVE-2024-35686 Patchstack
7.6 High Tutor LMS Plugin tutor SQL Injection ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-43282 Patchstack
4.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control Insecure Direct Object Reference (IDOR) ≤ 1.11.4 Fixed in 1.11.5 CVE-2024-43239 Patchstack
6.5 Medium Tutor LMS Plugin tutor Cross-Site Scripting ≤ 2.7.3 Fixed in 2.7.4 CVE-2024-43231 Patchstack
8.8 High LearnPress – WordPress LMS Plugin learnpress SQL Injection WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter ≤ 4.2.6.9.3 CVE-2024-7548 Wordfence
4.3 Medium Tutor LMS – Migration Tool Plugin tutor-lms-migration-tool Broken Access Control Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml ≤ 2.2.0 CVE-2024-1804 Wordfence
5.3 Medium Tutor LMS – Migration Tool Plugin tutor-lms-migration-tool Broken Access Control Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml No login needed ≤ 2.2.0 CVE-2024-1798 Wordfence
4.3 Medium Academy LMS Plugin academy Broken Access Control ≤ 2.0.4 Fixed in 2.0.5 CVE-2024-38701 Patchstack
9.1 Critical MasterStudy LMS Plugin Privilege Escalation Privilege Escalation to Instructor No login needed < 3.3.24 Fixed in 3.3.24 CVE-2024-5973 WPScan
5.9 Medium Tutor LMS Plugin tutor Cross-Site Scripting ≤ 2.7.2 Fixed in 2.7.3 CVE-2024-37947 Patchstack
4.9 Medium Tutor LMS Plugin tutor Path Traversal ≤ 2.7.1 Fixed in 2.7.2 CVE-2024-37266 Patchstack
7.6 High Tutor LMS Plugin tutor SQL Injection ≤ 2.7.1 Fixed in 2.7.2 CVE-2024-37256 Patchstack
5.4 Medium LearnDash LMS - Reports Free Plugin wisdm-reports-for-learndash Broken Access Control Reports Free <= 1.8.2.1 - Missing Authorization to Plugin Settings Update ≤ 1.8.2.1 CVE-2024-5648 Wordfence
3.5 Low Academy LMS Plugin academy Open Redirect ≤ 2.0.4 CVE-2024-37234 Patchstack
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Other WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration No login needed ≤ 4.2.6.8.1 CVE-2024-6099 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Broken Access Control WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass No login needed ≤ 4.2.6.8.1 CVE-2024-6088 Wordfence
8.3 High Tutor LMS Plugin tutor Broken Access Control Multiple Broken Access Control vulnerabilities ≤ 2.1.8 Fixed in 2.1.9 CVE-2023-25799 Patchstack
4.3 Medium Academy LMS Plugin academy Broken Access Control ≤ 1.9.16 Fixed in 1.9.17 CVE-2024-32714 Patchstack
4.3 Medium Tutor LMS – eLearning and online course solution Plugin tutor Broken Access Control eLearning and online course solution <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion ≤ 2.7.1 CVE-2024-5438 Wordfence
7.2 High Tutor LMS – eLearning and online course solution Plugin tutor SQL Injection eLearning and online course solution <= 2.7.1 -Authenticated (Administrator+) SQL Injection ≤ 2.7.1 CVE-2024-4902 Wordfence
8.8 High LifterLMS – WordPress LMS Plugin for eLearning Plugin SQL Injection WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode ≤ 7.6.2 CVE-2024-4743 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Information Disclosure WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API No login needed ≤ 4.2.6.8 CVE-2024-5483 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin learnpress Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 4.2.6.6 CVE-2024-4971 Wordfence
9.8 Critical Masteriyo - LMS Plugin learning-management-system Privilege Escalation No login needed ≤ 1.7.2 Fixed in 1.7.3 CVE-2024-24882 Patchstack
8.8 High Tutor LMS Pro Plugin Broken Access Control Missing Authorization to SQL Injection ≤ 2.7.0 CVE-2024-4352 Wordfence
8.8 High Tutor LMS Pro Plugin Broken Access Control Missing Authorization to Privilege Escalation ≤ 2.7.0 CVE-2024-4351 Wordfence
7.3 High Tutor LMS Pro Plugin Broken Access Control Missing Authorization No login needed ≤ 2.7.0 CVE-2024-4222 Wordfence
9.8 Critical Tutor LMS Plugin tutor Broken Access Control Missing Authorization No login needed ≤ 2.7.0 CVE-2024-4223 Wordfence
8.8 High Tutor LMS Plugin tutor SQL Injection Authenticated (Instructor+) SQL Injection ≤ 2.7.0 CVE-2024-4318 Wordfence
6.5 Medium Tutor LMS – eLearning and online course solution Plugin tutor Broken Access Control eLearning and online course solution <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion ≤ 2.7.0 CVE-2024-4279 Wordfence
5.3 Medium Academy LMS Plugin academy Information Disclosure Sensitive Data Exposure No login needed ≤ 1.9.25 Fixed in 1.9.26 CVE-2024-35171 Patchstack
6.4 Medium LearnPress – WordPress LMS Plugin learnpress Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_html Parameter ≤ 4.2.6.5 CVE-2024-4277 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Other WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration No login needed ≤ 4.2.6.5 CVE-2024-4444 Wordfence
9.8 Critical LearnPress – WordPress LMS Plugin learnpress SQL Injection WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection No login needed ≤ 4.2.6.5 CVE-2024-4434 Wordfence
8.8 High LearnPress – WordPress LMS Plugin learnpress Arbitrary File Upload WordPress LMS Plugin <= 4.2.6.5 - Authenticated (Instructor+) Arbitrary File Upload ≤ 4.2.6.5 CVE-2024-4397 Wordfence
7.1 High Academy LMS Plugin academy Broken Access Control Broken Access Control on Paid Courses ≤ 1.9.16 Fixed in 1.9.17 CVE-2024-33912 Patchstack
6.5 Medium Tutor LMS Plugin tutor Broken Access Control Missing Authorization to Unauthenticated Limited Options Update No login needed ≤ 2.6.2 CVE-2024-3553 Wordfence
6.3 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.3.8 - Missing Authorization ≤ 3.3.8 CVE-2024-3942 Wordfence
5.4 Medium Tutor LMS – eLearning and online course solution Plugin tutor Cross-Site Scripting eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode ≤ 2.6.2 CVE-2024-3994 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin Cross-Site Scripting WordPress LMS Plugin <= 4.2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.6.4 CVE-2024-3560 Wordfence
4.3 Medium LifterLMS Plugin lifterlms Cross-Site Request Forgery No login needed ≤ 7.5.0 Fixed in 7.5.1 CVE-2024-31363 Patchstack
9.8 Critical MasterStudy LMS Plugin masterstudy-lms-learning-management-system Local File Inclusion Unauthenticated Local File Inclusion via template No login needed ≤ 3.3.3 CVE-2024-3136 Wordfence
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control Missing Authorization to Sensitive Information Exposure in search_posts ≤ 3.2.13 CVE-2024-1904 Wordfence
8.8 High LearnPress – WordPress LMS Plugin learnpress Cross-Site Request Forgery WordPress LMS Plugin <= 4.0.0 - Cross-Site Request Forgery to Privilege Escalation No login needed ≤ 4.0.0 CVE-2024-2115 Wordfence
9.8 Critical MasterStudy LMS Plugin masterstudy-lms-learning-management-system Local File Inclusion Unauthenticated Local File Inclusion via modal No login needed ≤ 3.3.0 CVE-2024-2411 Wordfence
9.8 Critical MasterStudy LMS Plugin masterstudy-lms-learning-management-system Privilege Escalation Unauthenticated Privilege Escalation via stm_lms_register AJAX Action No login needed ≤ 3.3.1 CVE-2024-2409 Wordfence
6.5 Medium Tutor LMS Elementor Addons Plugin tutor-lms-elementor-addons Cross-Site Scripting ≤ 2.1.3 Fixed in 2.1.4 CVE-2024-29913 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only