Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,323 High 9,483 Medium 18,323 Low 369 Not scored 15

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.

Showing 351–400 of 476 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 8 of 10
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) Plugin mailin Cross-Site Request Forgery No login needed ≤ 3.1.87 Fixed in 3.1.88 CVE-2024-8477 Wordfence
4.4 Medium Survey Maker – Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms Plugin survey-maker Cross-Site Scripting Customer Satisfaction Questionnaire, Chat Survey, Calculation Form, Payment Forms <= 4.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting ≤ 4.9.5 Fixed in 4.9.6 CVE-2024-8488 Wordfence
5.9 Medium BuddyForms Plugin buddyforms Cross-Site Scripting ≤ 2.8.12 Fixed in 2.8.13 CVE-2024-47377 Patchstack
6.5 Medium Quill Forms Plugin quillforms Cross-Site Scripting ≤ 3.7.0 Fixed in 3.8.0 CVE-2024-47393 Patchstack
6.5 Medium Zoho Forms Plugin zoho-forms Cross-Site Scripting ≤ 4.0 Fixed in 4.0.1 CVE-2024-47633 Patchstack
6.5 Medium Keap Official Opt-in Forms Plugin infusionsoft-official-opt-in-forms Cross-Site Scripting ≤ 2.0.3 CVE-2024-47642 Patchstack
4.9 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Form Manager+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-9528 Wordfence
6.1 Medium Gravity Forms Toolbar Plugin gravity-forms-toolbar Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.7.0 CVE-2024-8718 Wordfence
4.7 Medium Ninja Forms Contact Form Plugin ninja-forms Cross-Site Scripting Reflected Self-Based Cross-Site Scripting via Referer No login needed ≤ 3.8.15 Fixed in 3.8.25 CVE-2024-3866 Wordfence
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting ≤ 3.8.11 Fixed in 3.8.12 CVE-2024-43999 Patchstack
6.5 Medium Happyforms Plugin happyforms Cross-Site Scripting ≤ 1.26.0 Fixed in 1.26.1 CVE-2024-44063 Patchstack
5.4 Medium Form Vibes – Database Manager for Forms Plugin Broken Access Control Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions ≤ 1.4.12 CVE-2024-5309 Wordfence
6.1 Medium Flaming Forms Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 1.0.1 CVE-2024-7692 WPScan
5.4 Medium Flaming Forms Plugin Cross-Site Scripting Unauthenticated Stored XSS No login needed ≤ 1.0.1 CVE-2024-7691 WPScan
6.1 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Reflected XSS No login needed 3.8.6 – < 3.8.11 Fixed in 3.8.11 CVE-2024-7354 WPScan
4.2 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification ≤ 5.1.18 CVE-2024-5053 Wordfence
6.4 Medium HubSpot – CRM, Email Marketing, Live Chat, Forms & Analytics Plugin leadin Cross-Site Scripting CRM, Email Marketing, Live Chat, Forms & Analytics <= 11.1.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via HubSpot Meeting Widget ≤ 11.1.22 Fixed in 11.1.34 CVE-2024-5879 Wordfence
5.3 Medium Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Plugin funnelforms-free Broken Access Control Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Deletion No login needed ≤ 3.7.3.2 CVE-2024-5857 Wordfence
5.3 Medium Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free Plugin funnelforms-free Broken Access Control Funnelforms Free <= 3.7.3.2 - Missing Authorization to Unauthenticated Arbitrary Media Upload No login needed ≤ 3.7.3.2 CVE-2024-7447 Wordfence
6.5 Medium Funnelforms Free Plugin funnelforms-free Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion ≤ 3.7.3.2 CVE-2024-6312 Wordfence
5.4 Medium Ninja Forms Plugin ninja-forms Cross-Site Request Forgery No login needed ≤ 3.8.6 Fixed in 3.8.7 CVE-2024-39628 Patchstack
4.3 Medium Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin mailin Cross-Site Request Forgery No login needed ≤ 3.1.82 Fixed in 3.1.83 CVE-2024-43287 Patchstack
5.3 Medium Flamix: Bitrix24 and Contact Form 7 integrations Plugin flamix-bitrix24-and-contact-forms-7-integrations Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 3.1.0 CVE-2024-6568 Wordfence
5.3 Medium PDF Builder for WPForms Plugin pdf-builder-for-wpforms Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 1.2.116 CVE-2024-7414 Wordfence
4.9 Medium Formidable Forms Plugin formidable Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 6.11.1 CVE-2024-6725 Wordfence
6.5 Medium HTML Forms – Simple WordPress Forms Plugin Cross-Site Request Forgery Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF No login needed < 1.3.34 Fixed in 1.3.34 CVE-2024-6412 WPScan
4.9 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields ≤ 5.1.19 CVE-2024-6703 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6518 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6520 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6521 Wordfence
5.3 Medium Campaign Monitor Plugin forms-for-campaign-monitor Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 2.8.15 Fixed in 2.8.16 CVE-2024-6569 Wordfence
5.9 Medium HTML Forms Plugin html-forms Cross-Site Scripting Admin+ Stored XSS < 1.3.33 Fixed in 1.3.33 CVE-2024-6243 WPScan
6.5 Medium NEX-Forms – Ultimate Form Builder Plugin nex-forms-express-wp-form-builder Cross-Site Scripting Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) ≤ 8.5.10 Fixed in 8.6.1 CVE-2024-37512 Patchstack
5.3 Medium AForms Plugin aforms-form-builder-for-price-calculator-cost-estimation Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 2.2.6 Fixed in 2.2.7 CVE-2024-6565 Wordfence
5.3 Medium Gravity Forms: Multiple Form Instances Plugin gravity-forms-multiple-form-instances Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-6550 Wordfence
5.4 Medium Ninja Forms Plugin ninja-forms Arbitrary Shortcode Execution Subscriber+ Arbitrary Shortcode Execution ≤ 3.8.4 Fixed in 3.8.5 CVE-2024-37934 Patchstack
6.5 Medium WordPress Form Builder Plugin – Gutenberg Forms Plugin forms-gutenberg Broken Access Control Auth. Broken Access Control ≤ 2.2.8.3 Fixed in 2.2.9 CVE-2022-45803 Patchstack
5.3 Medium Everest Forms Plugin everest-forms Broken Access Control No login needed ≤ 2.0.3 Fixed in 2.0.3.1 CVE-2023-51377 Patchstack
5.3 Medium Piotnet Forms Plugin piotnetforms Broken Access Control No login needed ≤ 1.0.29 Fixed in 1.0.30 CVE-2023-51413 Patchstack
4.3 Medium weForms Plugin weforms Broken Access Control ≤ 1.6.18 Fixed in 1.6.19 CVE-2023-51524 Patchstack
6.3 Medium Arforms Plugin Cross-Site Scripting Reflected XSS No login needed < 6.4.1 Fixed in 6.4.1 CVE-2024-0427 WPScan
5.3 Medium Happyforms Plugin happyforms Broken Access Control No login needed ≤ 1.25.10 Fixed in 1.25.11 CVE-2024-23521 Patchstack
5.3 Medium Contact Form Builder, Contact Widget Plugin contact-forms-builder Other Bypass Vulnerability No login needed ≤ 2.1.7 CVE-2024-35747 Patchstack
5.3 Medium Easy Forms for Mailchimp Plugin yikes-inc-easy-mailchimp-extender Broken Access Control No login needed ≤ 6.9.0 CVE-2024-35742 Patchstack
5.3 Medium Upload Fields for WPForms Plugin upload-fields-for-wpforms Broken Access Control No login needed ≤ 1.0.2 CVE-2024-35661 Patchstack
4.8 Medium ArForms Plugin Cross-Site Scripting Admin+ Stored XSS < 6.6 Fixed in 6.6 CVE-2024-4621 WPScan
4.3 Medium Mollie Forms Plugin mollie-forms Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Duplication No login needed ≤ 2.6.13 Fixed in 2.6.14 CVE-2024-2368 Wordfence
6.5 Medium BuddyForms Plugin buddyforms Other Email Verification Bypass due to Insufficient Randomness No login needed ≤ 2.8.9 Fixed in 2.8.10 CVE-2024-5149 Wordfence
5.3 Medium WP Forms Puzzle Captcha Plugin wp-forms-puzzle-captcha Authentication Bypass Captcha Bypass No login needed ≤ 4.1 CVE-2023-48276 Patchstack
5.3 Medium Maspik – Spam blacklist Plugin contact-forms-anti-spam Authentication Bypass Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass No login needed ≤ 0.10.3 Fixed in 0.10.4 CVE-2023-48271 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only