WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 351–378 of 378 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 8 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High Booking Calendar Plugin booking Cross-Site Request Forgery CSRF appointment scheduling No login needed < 1.3.83 Fixed in 1.3.83 CVE-2024-0856 WPScan
4.3 Medium WP Simple Booking Calendar Plugin wp-simple-booking-calendar Cross-Site Request Forgery No login needed ≤ 2.0.8.4 Fixed in 2.0.8.5 CVE-2023-51525 Patchstack
6.5 Medium My Calendar Plugin my-calendar Cross-Site Scripting ≤ 3.4.23 Fixed in 3.4.24 CVE-2024-25916 Patchstack
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval ≤ 3.4.2 CVE-2024-1126 Wordfence
5.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Price Manipulation Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass No login needed ≤ 3.4.2 CVE-2024-1321 Wordfence
6.1 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 1.0.98 - Reflected Cross-Site Scripting No login needed ≤ 1.0.98 CVE-2024-1484 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Event Export ≤ 3.4.1 CVE-2024-1127 Wordfence
7.4 High Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar ≤ 5.9.9 CVE-2024-1536 Wordfence
5.4 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion ≤ 3.4.3 CVE-2024-1125 Wordfence
6.5 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Cross-Site Scripting Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 3.4.3 CVE-2024-1320 Wordfence
6.5 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite ≤ 3.4.2 CVE-2024-1123 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending ≤ 3.4.3 CVE-2024-1124 Wordfence
4.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Data Reset No login needed ≤ 1.6.6.20 CVE-2024-1760 Wordfence
5.3 Medium Spiffy Calendar Plugin spiffy-calendar Broken Access Control No login needed < 4.9.9 Fixed in 4.9.9 CVE-2024-0855 WPScan
6.4 Medium EmbedPress Plugin embedpress Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link ≤ 3.9.8 CVE-2024-1425 Wordfence
6.5 Medium Scheduling Plugin – Online Booking Plugin calendar-booking Cross-Site Scripting Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Cross Site Scripting (XSS) ≤ 3.5.10 CVE-2024-23517 Patchstack
5.3 Medium Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin Plugin wp-event-solution Broken Access Control Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export No login needed ≤ 3.3.50 CVE-2024-1122 Wordfence
9.8 Critical Booking Calendar Plugin booking SQL Injection Unauthenticated SQL Injection No login needed ≤ 9.9 CVE-2024-1207 Wordfence
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 6.2.8.2 CVE-2023-6557 Wordfence
6.4 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode ≤ 1.0.93 CVE-2023-6808 Wordfence
6.5 Medium Dan's Embedder for Google Calendar Plugin dans-gcal Cross-Site Scripting WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS) ≤ 1.2 Fixed in 1.3 CVE-2023-51504 Patchstack
6.5 Medium WP Booking Calendar Plugin booking Cross-Site Scripting WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS) < 9.7.4 Fixed in 9.7.4 CVE-2023-51520 Patchstack
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control Unauthenticated Event Access No login needed < 3.3.6 Fixed in 3.3.6 CVE-2023-6447 WPScan
6.5 Medium EventON - WordPress Virtual Event Calendar Plugin Pro Plugin eventon-lite Cross-Site Request Forgery WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_meta No login needed ≤ 2.2.7, ≤ 4.5.4 CVE-2023-6242 Wordfence
6.5 Medium EventON - WordPress Virtual Event Calendar Plugin Cross-Site Request Forgery WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settings No login needed ≤ 2.2.8, ≤ 4.5.4 CVE-2023-6244 Wordfence
6.5 Medium EventON - WordPress Virtual Event Calendar Plugin Pro Plugin eventon-lite Broken Access Control WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta No login needed ≤ 2.2.7, ≤ 4.5.4 CVE-2023-6158 Wordfence
7.6 High Events Shortcodes For The Events Calendar Plugin template-events-calendar SQL Injection WordPress Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 is vulnerable to SQL Injection ≤ 2.3.1 Fixed in 2.3.2 CVE-2023-52142 Patchstack
6.5 Medium Private Google Calendars Plugin private-google-calendars Cross-Site Scripting WordPress Private Google Calendars Plugin <= 20231125 is vulnerable to Cross Site Scripting (XSS) ≤ 20231125 CVE-2023-52198 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only