WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 301–350 of 404 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 7 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.1 Medium Yotpo: Product & Photo Reviews for WooCommerce Plugin yotpo-social-reviews-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.7.9 CVE-2024-9356 Wordfence
9.8 Critical MultiManager WP – Manage All Your WordPress Sites Easily Plugin multimanager-wp Authentication Bypass Manage All Your WordPress Sites Easily <= 1.0.5 - Authentication Bypass via User Impersonation No login needed ≤ 1.0.5 CVE-2024-11028 Wordfence
6.1 Medium Contact Form 7 Redirect & Thank You Page Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.0.6 CVE-2024-10685 Wordfence
6.5 Medium EzyOnlineBookings Online Booking System Widget Plugin ezyonlinebookings-online-booking-system Cross-Site Scripting ≤ 1.3 CVE-2024-51628 Patchstack
8.5 High Website price calculator Plugin price-calculator-to-your-website SQL Injection ≤ 4.1 CVE-2024-51601 Patchstack
9.8 Critical Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Plugin contest-gallery SQL Injection Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection No login needed ≤ 24.0.3 CVE-2024-10687 Wordfence
5.4 Medium Youzify Plugin youzify Broken Access Control ≤ 1.2.6 Fixed in 1.2.8 CVE-2024-39635 Patchstack
7.5 High Masteriyo - LMS Plugin learning-management-system Broken Access Control No login needed ≤ 1.11.4 Fixed in 1.11.5 CVE-2024-43158 Patchstack
5.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control No login needed ≤ 1.11.6 Fixed in 1.12.0 CVE-2024-43159 Patchstack
6.5 Medium Print Barcode Labels for your WooCommerce products/orders Plugin a4-barcode-generator Broken Access Control ≤ 3.4.9 Fixed in 3.4.10 CVE-2024-43310 Patchstack
7.1 High DocumentPress Plugin documentpress-display-any-document-on-your-site Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.1 CVE-2024-49656 Patchstack
6.4 Medium StreamWeasels YouTube Integration Plugin streamweasels-youtube-integration Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sw-youtube-embed Shortcode ≤ 1.3.2 CVE-2024-10185 Wordfence
6.4 Medium Masteriyo LMS – eLearning and Online Course Builder Plugin learning-management-system Cross-Site Scripting eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality ≤ 1.13.3 CVE-2024-10000 Wordfence
8.8 High Masteriyo LMS – eLearning and Online Course Builder Plugin learning-management-system Broken Access Control eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation ≤ 1.13.3 CVE-2024-10008 Wordfence
6.5 Medium Themes4WP YouTube External Subtitles Plugin themes4wp-youtube-external-subtitles Cross-Site Scripting ≤ 1.0 CVE-2024-50470 Patchstack
7.2 High WordPress Post Grid Layouts with Pagination – Sogrid Plugin sogrid Local File Inclusion Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion ≤ 1.5.6 CVE-2024-8392 Wordfence
6.1 Medium Forms for Mailchimp by Optin Cat – Grow Your MailChimp List Plugin mailchimp-wp Cross-Site Scripting Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting No login needed ≤ 2.5.6 CVE-2024-8870 Wordfence
9.9 Critical AI Image Generator for Your Content & Featured Images – AI Postpix Plugin ai-postpix Arbitrary File Upload ≤ 1.1.8 Fixed in 1.1.8.1 CVE-2024-49671 Patchstack
6.4 Medium RSS Feed Widget Plugin rss-feed-widget Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode ≤ 2.9.9 CVE-2024-10057 Wordfence
7.2 High Boost Your Blog's Engagement with WP Post Author Plugin wp-post-author SQL Injection Authenticated (Administrator+) SQL Injection ≤ 3.8.1 CVE-2024-8757 Wordfence
4.3 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion ≤ 1.3.0 CVE-2024-9067 Wordfence
6.4 Medium Curator.io: Show all your social media posts in a beautiful feed. Plugin curatorio Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via feed_id Attribute ≤ 1.9.1 CVE-2024-9057 Wordfence
6.4 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify Cross-Site Scripting BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode ≤ 1.3.0 CVE-2024-8987 Wordfence
6.4 Medium Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg Plugin guten-post-layout Cross-Site Scripting An Advanced Post Grid Collection for WordPress Gutenberg <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute ≤ 1.2.4 CVE-2024-8288 Wordfence
5.3 Medium WP Hardening – Fix Your WordPress Security Plugin wp-security-hardening Other Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration No login needed ≤ 1.2.6 CVE-2024-6641 Wordfence
6.5 Medium PixelYourSite – Your smart PIXEL (TAG) & API Manager Plugin pixelyoursite Information Disclosure Your smart PIXEL (TAG) & API Manager <= 9.7.1 and PixelYourSite PRO <= 10.4.2 - Unauthenticated Information Exposure and Log Deletion No login needed ≤ 9.7.1, ≤ 10.4.2 CVE-2024-7870 Wordfence
4.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control Insecure Direct Object Reference (IDOR) ≤ 1.11.4 Fixed in 1.11.5 CVE-2024-43239 Patchstack
6.5 Medium Custom Layouts – Post + Product grids made easy Plugin custom-layouts Cross-Site Scripting Post + Product grids made easy plugin <= 1.4.11 - Cross Site Scripting (XSS) ≤ 1.4.11 Fixed in 1.4.12 CVE-2024-43305 Patchstack
7.1 High Invite Anyone Plugin invite-anyone Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.4.7 Fixed in 1.4.8 CVE-2024-43327 Patchstack
4.3 Medium TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder Plugin templatespare Broken Access Control TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update ≤ 2.4.2 CVE-2024-6872 Wordfence
6.5 Medium Blogmentor – Blog Layouts for Elementor Plugin blogmentor Cross-Site Scripting Blog Layouts for Elementor plugin <= 1.5 - Cross Site Scripting (XSS) ≤ 1.5 CVE-2024-37229 Patchstack
5.9 Medium PixelYourSite – Your smart PIXEL (TAG) Manager Plugin pixelyoursite Cross-Site Scripting ≤ 9.6.1.1 Fixed in 9.6.2 CVE-2024-37447 Patchstack
6.5 Medium Caxton – Create Pro page layouts in Gutenberg Plugin caxton Cross-Site Scripting Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS) ≤ 1.30.1 CVE-2024-37948 Patchstack
6.5 Medium Post Layouts for Gutenberg Plugin post-layouts Cross-Site Scripting ≤ 1.2.7 CVE-2024-38682 Patchstack
6.5 Medium FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor Plugin post-block Cross-Site Scripting ≤ 5.3.1 Fixed in 5.3.2 CVE-2024-38686 Patchstack
6.4 Medium Feeds for YouTube (YouTube video, channel, and gallery plugin) Plugin feeds-for-youtube Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.2.1 CVE-2024-6256 Wordfence
8.8 High BookYourTravel Theme Privilege Escalation Subscriber+ Privilege Escalation ≤ 8.18.17 Fixed in 8.18.19 CVE-2024-37952 Patchstack
8.5 High Youzify Plugin youzify SQL Injection ≤ 1.2.5 Fixed in 1.2.6 CVE-2024-37494 Patchstack
8.8 High Sitetweet Plugin sitetweet-tweets-user-behaviors-on-your-site-on-twitter Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 0.2 CVE-2024-5767 WPScan
6.4 Medium Mixed Media Gallery Blocks Plugin simply-gallery-block Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters ≤ 3.2.1 CVE-2024-5424 Wordfence
6.5 Medium Serious Slider Plugin cryout-serious-slider Cross-Site Scripting ≤ 1.2.4 Fixed in 1.2.5 CVE-2024-35762 Patchstack
8.8 High WP Blog Post Layouts Plugin wp-blog-post-layouts Local File Inclusion Authenticated (Contributor+) Local File Inlcusion ≤ 1.1.3 CVE-2024-5503 Wordfence
6.4 Medium JetWidgets For Elementor Plugin jetwidgets-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters ≤ 1.0.17 CVE-2024-4626 Wordfence
6.5 Medium Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin youzify SQL Injection BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection ≤ 1.2.5 CVE-2024-4742 Wordfence
6.4 Medium Blogmentor – Blog Layouts for Elementor Plugin blogmentor Cross-Site Scripting Blog Layouts for Elementor <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagination_style Parameter ≤ 1.5 CVE-2024-4623 Wordfence
6.4 Medium Video Gallery – YouTube Playlist, Channel Gallery by YotuWP Plugin yotuwp-easy-youtube-embed Local File Inclusion YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Authenticated (Contributor+) Arbitrary File Inclusion via Shortcode ≤ 1.3.13 CVE-2024-4551 Wordfence
9.8 Critical Video Gallery – YouTube Playlist, Channel Gallery by YotuWP Plugin yotuwp-easy-youtube-embed Local File Inclusion YouTube Playlist, Channel Gallery by YotuWP <= 1.3.13 - Unauthenticated Local File Inclusion No login needed ≤ 1.3.13 CVE-2024-4258 Wordfence
5.3 Medium Yoast SEO Premium Plugin wordpress-seo-premium Broken Access Control Unauthenticated Zapier API Key Reset No login needed ≤ 20.4 Fixed in 20.5 CVE-2023-28775 Patchstack
8.8 High NextMove Lite Plugin woo-thank-you-page-nextmove-lite Broken Access Control Subscriber+ Arbitrary Plugin Installation/Activation ≤ 2.17.0 Fixed in 2.18.0 CVE-2024-25092 Patchstack
6.4 Medium EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin embedpress Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget ≤ 4.0.1 CVE-2024-5571 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only