WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 251–300 of 345 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical MultiManager WP – Manage All Your WordPress Sites Easily Plugin multimanager-wp Authentication Bypass Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation No login needed ≤ 1.0.5 CVE-2024-11028 Wordfence
7.3 High The FOX – Currency Switcher Professional for WooCommerce Plugin Arbitrary Shortcode Execution Currency Switcher Professional for WooCommerce <= 1.4.2.2 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.4.2.2 CVE-2024-10640 Wordfence
6.1 Medium Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Plugin charitable Cross-Site Scripting Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.3 - Reflected Cross-Site Scripting No login needed ≤ 1.8.3 CVE-2024-10876 Wordfence
4.3 Medium Content Slider Block – Create fully functional slider with Gutenberg block Plugin content-slider-block Information Disclosure Create fully functional slider with Gutenberg block <= 3.1.5 - Authenticated (Contributor+) Post Disclosure ≤ 3.1.5 CVE-2024-10667 Wordfence
6.5 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37510 Patchstack
5.3 Medium Charitable Plugin charitable Broken Access Control No login needed ≤ 1.8.1.7 Fixed in 1.8.1.8 CVE-2024-37506 Patchstack
5.3 Medium AidWP Plugin wp-stripe-donation Broken Access Control No login needed ≤ 3.2.3 Fixed in 3.2.4 CVE-2024-50459 Patchstack
5.9 Medium Conditional Fields for Contact Form 7 Plugin cf7-conditional-fields Cross-Site Scripting ≤ 2.4.15 Fixed in 2.5 CVE-2024-50412 Patchstack
6.4 Medium Masteriyo LMS – eLearning and Online Course Builder Plugin learning-management-system Cross-Site Scripting eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality ≤ 1.13.3 CVE-2024-10000 Wordfence
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode ≤ 2.1.11 CVE-2024-10117 Wordfence
6.1 Medium Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.2.133 CVE-2024-9214 Wordfence
8.5 High SermonAudio Widgets Plugin sermonaudio-widgets SQL Injection ≤ 1.9.3 CVE-2024-49614 Patchstack
4.3 Medium wp-Monalisa Plugin wp-monalisa Cross-Site Request Forgery No login needed ≤ 6.4 Fixed in 6.5 CVE-2024-48038 Patchstack
7.1 High Encyclopedia / Glossary / Wiki Plugin encyclopedia-lexicon-glossary-wiki-dictionary Cross-Site Scripting No login needed ≤ 1.7.60 Fixed in 1.7.61 CVE-2024-49320 Patchstack
7.1 High Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'create_mollie_profile' ≤ 4.3.7 CVE-2023-7294 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_mollie_account_details' ≤ 4.3.7 CVE-2023-7293 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_notice_dismiss' ≤ 4.3.7 CVE-2023-7292 Wordfence
7.1 High Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'create_mollie_account' ≤ 4.3.7 CVE-2023-7291 Wordfence
4.3 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'check_for_verified_profiles' ≤ 4.3.7 CVE-2023-7290 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'paytium_sw_save_api_keys' ≤ 4.3.7 CVE-2023-7289 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'update_profile_preference' ≤ 4.3.7 CVE-2023-7288 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'pt_cancel_subscription' ≤ 4.3.7 CVE-2023-7287 Wordfence
9.8 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.16.3 - Unauthenticated PHP Object Injection to Remote Code Execution No login needed ≤ 3.16.3 CVE-2024-9634 Wordfence
6.1 Medium PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Plugin revisionary Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.5.14 CVE-2024-9436 Wordfence
9.8 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection No login needed ≤ 3.16.1 CVE-2024-8353 Wordfence
7.2 High GiveWP – Donation Plugin and Fundraising Platform Plugin give SQL Injection Donation Plugin and Fundraising Platform <= 3.16.1 - Authenticated (GiveWP Manager+) SQL Injection via order Parameter ≤ 3.16.1 CVE-2024-9130 Wordfence
5.3 Medium Sight – Professional Image Gallery and Portfolio Plugin sight Broken Access Control Professional Image Gallery and Portfolio <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title No login needed ≤ 1.1.2 CVE-2024-9025 Wordfence
5.4 Medium GiveWP Plugin give Cross-Site Request Forgery Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) No login needed ≤ 3.15.1 Fixed in 3.16.0 CVE-2024-47315 Patchstack
5.3 Medium HUSKY – Products Filter Professional for WooCommerce Plugin Broken Access Control Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe No login needed ≤ 1.3.6.1 CVE-2024-7491 Wordfence
9.8 Critical Donation Forms by Charitable – Donations Plugin & Fundraising Platform Plugin charitable Broken Access Control Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation No login needed ≤ 1.8.1.14 CVE-2024-8791 Wordfence
7.3 High FOX – Currency Switcher Professional for WooCommerce Plugin woocommerce-currency-switcher Arbitrary Shortcode Execution Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.4.2.1 CVE-2024-8271 Wordfence
8.1 High MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Plugin mp3-music-player-by-sonaar Broken Access Control Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion ≤ 5.7.0.1 CVE-2024-7856 Wordfence
6.5 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update No login needed ≤ 3.13.0 CVE-2024-5940 Wordfence
5.3 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure No login needed ≤ 3.13.0 CVE-2024-5939 Wordfence
10.0 Critical GiveWP – Donation Plugin and Fundraising Platform Plugin give PHP Object Injection Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution No login needed ≤ 3.14.1 CVE-2024-5932 Wordfence
5.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.14.1 - Missing Authorization to Authenticated (Subscriber+) Limited File Deletion ≤ 3.14.1 CVE-2024-5941 Wordfence
8.8 High FundEngine – Donation and Crowdfunding Platform Plugin wp-fundraising-donation Privilege Escalation Donation and Crowdfunding Platform <= 1.7.0 - Authenticated (Subscriber+) Privilege Escalation ≤ 1.7.0 CVE-2024-6698 Wordfence
6.8 Medium Donation Block for PayPal Plugin donations-block Cross-Site Scripting Unauthenticated Stored XSS ≤ 2.1.0 CVE-2024-6021 WPScan
4.3 Medium Conditional Fields for Contact Form 7 Plugin cf7-conditional-fields Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Setting Reset No login needed ≤ 2.4.13 CVE-2024-5804 Wordfence
5.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions ≤ 3.13.0 CVE-2024-5977 Wordfence
9.8 Critical HUSKY - Products Filter Professional for WooCommerce Plugin woocommerce-products-filter SQL Injection Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection No login needed ≤ 1.3.6 CVE-2024-6457 Wordfence
6.5 Medium WPCS Plugin currency-switcher Arbitrary Shortcode Execution WordPress Currency Switcher Professional plugin <= 1.2.0.3 - Arbitrary Shortcode Execution No login needed ≤ 1.2.0.3 CVE-2024-38700 Patchstack
6.4 Medium MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin mp3-music-player-by-sonaar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode ≤ 5.5 CVE-2024-5664 Wordfence
8.8 High Houzez Theme - Functionality Plugin SQL Injection Functionality <= 3.2.2 - Authenticated (Seller+) SQL Injection ≤ 3.2.2 CVE-2024-5793 Wordfence
6.1 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin Cross-Site Scripting Contributor+ Stored XSS No login needed ≤ 1.7 CVE-2024-5448 WPScan
5.4 Medium PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.7 CVE-2024-5447 WPScan
9.8 Critical Lifeline Donation Plugin lifeline-donation Authentication Bypass No login needed ≤ 1.2.6 CVE-2024-5432 Wordfence
5.3 Medium SiteGuard WP Plugin siteguard Other SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard… No login needed prior to 1.7.7 CVE-2024-37881 jpcert
5.3 Medium WP Fundraising Donation and Crowdfunding Platform Plugin wp-fundraising-donation Broken Access Control Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control No login needed ≤ 1.6.4 Fixed in 1.7.0 CVE-2024-34758 Patchstack
6.5 Medium If-So Dynamic Content Personalization Plugin if-so Broken Access Control No login needed ≤ 1.7.1 Fixed in 1.7.1.1 CVE-2024-34820 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only