WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 301–350 of 476 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | Constant Contact Forms | Broken Access Control |
≤ 2.0.3 Fixed in 2.1.0 |
CVE-2023-34387 |
Patchstack | |
| 4.3 Medium | Formidable Forms | Broken Access Control No login needed |
≤ 5.5.4 Fixed in 5.5.5 |
CVE-2022-45806 |
Patchstack | |
| 6.4 Medium | Cognito Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter |
≤ 2.0.7 Fixed in 2.0.8 |
CVE-2024-10182 |
Wordfence | |
| 5.4 Medium | ARForms | Broken Access Control Subscriber+ Plugin Settings Change |
≤ 6.4.1 |
CVE-2024-54217 |
Patchstack | |
| 5.3 Medium | ARForms Form Builder | Content Injection HTML Injection No login needed |
≤ 1.7.1 Fixed in 1.7.2 |
CVE-2024-54223 |
Patchstack | |
| 4.3 Medium | GoDaddy Email Marketing | Broken Access Control |
≤ 1.4.3 |
CVE-2023-49156 |
Patchstack | |
| 6.1 Medium | Contact Form Plugin by Fluent Forms | Cross-Site Scripting Admin+ Stored XSS |
< 5.2.1 Fixed in 5.2.1 |
CVE-2024-9651 |
WPScan | |
| 6.1 Medium | Smoove connector for Elementor forms | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 4.1.0 Fixed in 4.2.0 |
CVE-2024-11367 |
Wordfence | |
| 4.3 Medium | SMS for Lead Capture Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion |
≤ 1.1.0 |
CVE-2024-11353 |
Wordfence | |
| 5.4 Medium | Maspik – Spam blacklist | Cross-Site Request Forgery CSRF to Settings Change |
≤ 2.2.7 Fixed in 2.2.8 |
CVE-2024-53806 |
Patchstack | |
| 6.3 Medium | Pojo Forms | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode |
≤ 1.4.7 |
CVE-2024-10909 |
Wordfence | |
| 6.4 Medium | Contact Form, Survey & Form Builder – MightyForms | Cross-Site Scripting MightyForms <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.3.9 |
CVE-2024-11897 |
Wordfence | |
| 6.1 Medium | Campaign Monitor Forms by Optin Cat | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 2.5.7 |
CVE-2024-11326 |
Wordfence | |
| 5.2 Medium | AWeber Forms by Optin Cat | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 2.5.7 |
CVE-2024-11325 |
Wordfence | |
| 4.3 Medium | Smart Marketing SMS and Newsletters Forms | Broken Access Control |
≤ 5.0.4 Fixed in 5.0.5 |
CVE-2024-53784 |
Patchstack | |
| 4.3 Medium | WordPress Contact Forms by Cimatti | Cross-Site Request Forgery Cross-Site Request Forgery via process_bulk_action Function No login needed |
≤ 1.9.2 |
CVE-2024-10521 |
Wordfence | |
| 4.8 Medium | Everest Forms | Cross-Site Scripting Admin+ Stored XSS |
< 3.0.4.2 Fixed in 3.0.4.2 |
CVE-2024-10471 |
WPScan | |
| 6.1 Medium | Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder | Cross-Site Scripting Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter No login needed |
≤ 6.16.1.2 |
CVE-2024-11188 |
Wordfence | |
| 6.4 Medium | HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.3.4 |
CVE-2024-11332 |
Wordfence | |
| 4.8 Medium | Formidable Forms | Cross-Site Scripting Admin+ Stored XSS |
< 6.14.1 Fixed in 6.14.1 |
CVE-2024-9768 |
WPScan | |
| 6.1 Medium | MailChimp Forms by MailMunch | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 3.2.3 |
CVE-2024-8726 |
Wordfence | |
| 5.9 Medium | Ninja Forms | Cross-Site Scripting The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) |
≤ 3.8.16 Fixed in 3.8.18 |
CVE-2024-50514 |
Patchstack | |
| 5.9 Medium | Ninja Forms | Cross-Site Scripting The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) |
≤ 3.8.16 Fixed in 3.8.18 |
CVE-2024-50515 |
Patchstack | |
| 6.5 Medium | SV Forms | Cross-Site Scripting |
≤ 2.0.05 |
CVE-2024-51877 |
Patchstack | |
| 6.5 Medium | Mage Front End Forms | Cross-Site Scripting |
≤ 1.1.4 |
CVE-2024-52339 |
Patchstack | |
| 6.5 Medium | Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera | Cross-Site Scripting |
≤ 4.0 |
CVE-2024-52347 |
Patchstack | |
| 4.3 Medium | EleForms – All In One Form Integration including DB for Elementor | Cross-Site Request Forgery All In One Form Integration including DB for Elementor <= 2.9.9.9 - Cross-Site Request Forgery No login needed |
≤ 2.9.9.9 |
CVE-2024-6628 |
Wordfence | |
| 4.3 Medium | WPForms – Easy Form Builder | Cross-Site Request Forgery Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion No login needed |
≤ 1.9.1.6 |
CVE-2024-10593 |
Wordfence | |
| 6.5 Medium | Styler for Ninja Forms | Broken Access Control Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license |
≤ 3.3.4 |
CVE-2024-10717 |
Wordfence | |
| 6.1 Medium | Constant Contact Forms by MailMunch | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 2.1.2 Fixed in 2.1.3 |
CVE-2024-9614 |
Wordfence | |
| 5.3 Medium | EleForms – All In One Form Integration including DB for Elementor | Broken Access Control All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization No login needed |
≤ 2.9.9.9 |
CVE-2024-6626 |
Wordfence | |
| 5.3 Medium | CRM Perks Forms | Broken Access Control No login needed |
≤ 1.1.5 Fixed in 1.1.6 |
CVE-2024-37463 |
Patchstack | |
| 6.5 Medium | Charitable | Broken Access Control No login needed |
≤ 1.8.1.7 Fixed in 1.8.1.8 |
CVE-2024-37510 |
Patchstack | |
| 5.3 Medium | Charitable | Broken Access Control No login needed |
≤ 1.8.1.7 Fixed in 1.8.1.8 |
CVE-2024-37506 |
Patchstack | |
| 5.3 Medium | EleForms | Broken Access Control No login needed |
≤ 2.9.9.9 |
CVE-2024-38748 |
Patchstack | |
| 5.9 Medium | MailChimp Subscribe Forms | Cross-Site Scripting Stored Cross-Site Scripting |
≤ 4.0.9.9 |
CVE-2024-43211 |
Patchstack | |
| 5.3 Medium | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation No login needed |
≤ 1.36.0 |
CVE-2024-9700 |
Wordfence | |
| 6.1 Medium | Forms for Mailchimp by Optin Cat – Grow Your MailChimp List | Cross-Site Scripting Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting No login needed |
≤ 2.5.6 |
CVE-2024-8870 |
Wordfence | |
| 6.1 Medium | FormFacade – WordPress plugin for Google Forms | Cross-Site Scripting WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting No login needed |
≤ 1.3.6 Fixed in 1.3.7 |
CVE-2024-9613 |
Wordfence | |
| 6.4 Medium | File Upload Types by WPForms | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 1.4.0 Fixed in 1.5.0 |
CVE-2024-10016 |
Wordfence | |
| 6.1 Medium | GetResponse Forms by Optin Cat | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 2.5.7 |
CVE-2024-8740 |
Wordfence | |
| 4.3 Medium | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation No login needed |
≤ 1.35.1 |
CVE-2024-9351 |
Wordfence | |
| 4.3 Medium | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation No login needed |
≤ 1.35.1 |
CVE-2024-9352 |
Wordfence | |
| 4.3 Medium | Paytium: Mollie payment forms & donations | Broken Access Control Missing Authorization in 'check_mollie_account_details' |
≤ 4.3.7 |
CVE-2023-7293 |
Wordfence | |
| 4.3 Medium | Paytium: Mollie payment forms & donations | Broken Access Control Missing Authorization in 'paytium_notice_dismiss' |
≤ 4.3.7 |
CVE-2023-7292 |
Wordfence | |
| 4.3 Medium | Paytium: Mollie payment forms & donations | Broken Access Control Missing Authorization in 'check_for_verified_profiles' |
≤ 4.3.7 |
CVE-2023-7290 |
Wordfence | |
| 5.4 Medium | Paytium: Mollie payment forms & donations | Broken Access Control Missing Authorization in 'paytium_sw_save_api_keys' |
≤ 4.3.7 |
CVE-2023-7289 |
Wordfence | |
| 5.4 Medium | Paytium: Mollie payment forms & donations | Broken Access Control Missing Authorization in 'update_profile_preference' |
≤ 4.3.7 |
CVE-2023-7288 |
Wordfence | |
| 5.4 Medium | Paytium: Mollie payment forms & donations | Broken Access Control Missing Authorization in 'pt_cancel_subscription' |
≤ 4.3.7 |
CVE-2023-7287 |
Wordfence | |
| 4.4 Medium | Forms for Mailchimp by Optin Cat | Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters |
≤ 2.5.7 |
CVE-2024-7489 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.