CVE-2026-87902Exploitation status KEV Fix Affected product W WordPress Published 09/22/2026 Severity High CVE-2026-65640Exploitation status Not known exploited Fix Affected product W WordPress Published 08/17/2026 Severity High CVE-2026-64638Exploitation status Not known exploited Fix Affected product W WordPress Published 08/07/2026 Severity High CVE-2026-45293WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability Exploitation status Not known exploited Fix Affected product W WordPress-Coding-Standards Published 07/28/2026 Severity High CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution Exploitation status KEV Fix Affected product W WordPress Published 07/17/2026 Severity Critical CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query Exploitation status KEV Fix Affected product W WordPress Published 07/17/2026 Severity Critical CVE-2020-37233WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting Exploitation status Public exploit Fix Not confirmed Affected product B Buddypress Published 05/16/2026 Severity Medium CVE-2023-54333Social-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter Exploitation status Public exploit Fix Not confirmed Affected product S Social-Share-Buttons Published 01/13/2026 Severity High CVE-2025-58674WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability Exploitation status Not known exploited Fix Affected product W WordPress Published 09/23/2025 Severity Medium CVE-2025-58246WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability Exploitation status Not known exploited Fix Affected product W WordPress Published 09/23/2025 Severity Medium CVE-2025-54352Exploitation status Public exploit Fix Not confirmed Affected product W WordPress Published 07/21/2025 Severity Low CVE-2023-25454WordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Protected Posts Logout Button Published 12/09/2024 Severity Medium CVE-2024-11292WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product W WP Private Content Plus Published 12/06/2024 Severity Medium CVE-2024-11178Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP Exploitation status Not known exploited Fix Affected product L Login with OTP Published 12/06/2024 Severity High CVE-2024-10311External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass Exploitation status Not known exploited Fix Affected product E External Database Based Actions Published 11/15/2024 Severity High CVE-2024-9927WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal Exploitation status Not known exploited Fix Affected product W WooCommerce Order Proposal Published 10/23/2024 Severity High CVE-2022-4973WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function Exploitation status Not known exploited Fix Affected product W WordPress Published 10/16/2024 Severity Medium CVE-2024-8914Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product T Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam Published 09/24/2024 Severity High CVE-2024-7381Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution Exploitation status Not known exploited Fix Affected product G Geo Controller Published 09/05/2024 Severity Medium CVE-2024-5448PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Contributor+ Stored XSS Exploitation status Public exploit Fix Not confirmed Affected product P PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode Published 06/21/2024 Severity Medium CVE-2024-5455The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion Exploitation status Not known exploited Fix Affected product T The Plus Addons for Elementor Page Builder Pro Published 06/21/2024 Severity High CVE-2024-35746WordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product B BuddyPress Cover Published 06/10/2024 Severity Critical CVE-2024-5382Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification Exploitation status Not known exploited Fix Affected product M Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Published 06/07/2024 Severity Medium CVE-2024-33576WordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WPPizza Published 05/06/2024 Severity Medium CVE-2024-34374WordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E ElementsReady Addons for Elementor Published 05/06/2024 Severity Medium CVE-2024-34367WordPress Popup Box plugin <= 4.1.2 - CSRF to XSS vulnerability Exploitation status Not known exploited Fix Affected product P Popup box Published 05/06/2024 Severity High CVE-2024-33929WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product D Directorist Published 05/03/2024 Severity Medium CVE-2024-33934WordPress Mini Loops plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product M Mini Loops Published 05/03/2024 Severity Medium CVE-2024-4439Exploitation status Not known exploited Fix Affected product W WordPress Published 05/03/2024 Severity High CVE-2024-3681Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scripting Exploitation status Not known exploited Fix Affected product I Interactive World Maps Published 05/02/2024 Severity Medium CVE-2024-3936The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization Exploitation status Not known exploited Fix Affected product T The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid Published 05/02/2024 Severity Medium CVE-2024-2960SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion Exploitation status Not known exploited Fix Affected product S SVS Pricing Tables Published 05/02/2024 Severity Medium CVE-2024-4324WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter Exploitation status Not known exploited Fix Affected product W WP Video Lightbox Published 05/02/2024 Severity Medium CVE-2024-1415Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgery Exploitation status Not known exploited Fix Affected product L Lead Form Builder & Contact Form Published 05/02/2024 Severity Medium CVE-2024-2328Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Real Media Library: Media Library Folder & File Manager Published 05/02/2024 Severity Medium CVE-2024-3729Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation Exploitation status Not known exploited Fix Affected product F Frontend Admin by DynamiApps Published 05/02/2024 Severity Critical CVE-2024-3649Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation Exploitation status Not known exploited Fix Affected product W WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Published 05/02/2024 Severity Medium CVE-2024-3670Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) <= 3.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product L Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) Published 05/02/2024 Severity Medium CVE-2024-3991ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.7 - Authenticated (contributor+) Stored Cross-Site Scripting via _id Exploitation status Not known exploited Fix Affected product S ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin Published 05/02/2024 Severity Medium CVE-2024-3647Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style' Exploitation status Not known exploited Fix Affected product P Premium Addons for Elementor – Powerful Elementor Templates & Widgets Published 05/02/2024 Severity Medium CVE-2024-3161Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget Exploitation status Not known exploited Fix Affected product J Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress Published 05/02/2024 Severity Medium CVE-2024-3071ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update Exploitation status Not known exploited Fix Affected product A ACF On-The-Go Published 05/02/2024 Severity Medium CVE-2024-33952WordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product U Unique Published 05/02/2024 Severity Medium CVE-2024-33922WordPress WP Media Cleaner plugin <= 6.7.2 - Sensitive Data Exposure via Log File vulnerability Exploitation status Not known exploited Fix Affected product W WP Media Cleaner Published 05/02/2024 Severity Medium CVE-2024-3490WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode Exploitation status Not known exploited Fix Affected product W WP Recipe Maker Published 05/02/2024 Severity Medium CVE-2024-3481Counter Box < 1.2.4 - Counter Deletion via CSRF Exploitation status Public exploit Fix Affected product C Counter Box Published 05/02/2024 Severity Medium CVE-2024-3591WordPress Geo Controller < 8.6.5 - PHP Object Injection Exploitation status Public exploit Fix Affected product G Geo Controller Published 05/01/2024 Severity Medium CVE-2024-1371LeadConnector <= 1.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion Exploitation status Not known exploited Fix Affected product L LeadConnector Published 04/30/2024 Severity Medium CVE-2024-33585WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Payment Gateway Based Fees and Discounts for WooCommerce Published 04/29/2024 Severity Medium CVE-2024-33566WordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product O OrderConvo Published 04/29/2024 Severity Critical CVE-2024-33551WordPress XStore Core plugin <= 5.3.5 - Unauthenticated SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product X XStore Core Published 04/29/2024 Severity Critical CVE-2024-2258Form Maker by 10Web <= 1.15.24 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting Exploitation status Not known exploited Fix Affected product F Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Published 04/27/2024 Severity Medium CVE-2024-33688WordPress Teluro theme <= 1.0.31 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product T Teluro Published 04/26/2024 Severity Medium CVE-2024-32822WordPress Reviews Plus plugin <= 1.3.4 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product R Reviews Plus Published 04/26/2024 Severity Medium CVE-2024-33682WordPress WP GDPR Compliance plugin <= 2.0.23 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product W WP GDPR Compliance Published 04/26/2024 Severity Medium CVE-2024-3060ENL Newsletter <= 1.0.1 - Admin+ SQL Injection Exploitation status Public exploit Fix Not confirmed Affected product E ENL Newsletter Published 04/26/2024 Severity Medium CVE-2024-2310WP Google Review Slider < 13.6 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product W WP Google Review Slider Published 04/26/2024 Severity Medium CVE-2024-3730Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode Exploitation status Not known exploited Fix Affected product S Simple Membership Published 04/25/2024 Severity Medium CVE-2024-3994Tutor LMS – eLearning and online course solution <= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tutor_instructor_list' Shortcode Exploitation status Not known exploited Fix Affected product T Tutor LMS – eLearning and online course solution Published 04/25/2024 Severity Medium CVE-2024-3988Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Sina Fancy Text Widget Exploitation status Not known exploited Fix Affected product S Sina Extension for Elementor Published 04/25/2024 Severity Medium CVE-2023-51471WordPress Checkout Mestres WP plugin <= 7.1.9.7 - Unauthenticated Arbitrary Options Update vulnerability Exploitation status Not known exploited Fix Affected product C Checkout Mestres WP Published 04/24/2024 Severity High CVE-2024-32699WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product Y YITH WooCommerce Compare Published 04/24/2024 Severity Medium CVE-2024-32789WordPress Seers plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) to XSS vulnerability Exploitation status Not known exploited Fix Affected product S Seers Published 04/24/2024 Severity High CVE-2024-32772WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product P ProfileGrid Published 04/24/2024 Severity Medium CVE-2024-32801WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W Widget Post Slider Published 04/24/2024 Severity Medium CVE-2024-32952WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product M Max Addons Pro for Bricks Published 04/24/2024 Severity High CVE-2024-32781WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product E Email Customizer for WooCommerce Published 04/24/2024 Severity High CVE-2024-32835WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability Exploitation status Not known exploited Fix Affected product I Import Export WordPress Users Published 04/24/2024 Severity Medium CVE-2024-32951WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Unauthenticated Plugin Settings Reset vulnerability Exploitation status Not known exploited Fix Affected product M Max Addons Pro for Bricks Published 04/24/2024 Severity Medium CVE-2024-3665Rank Math SEO with AI SEO Tools <= 1.0.216 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleWrapper' Exploitation status Not known exploited Fix Affected product R Rank Math SEO – AI SEO Tools to Dominate SEO Rankings Published 04/23/2024 Severity Medium CVE-2024-0900Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! <= 2.1.2 - Missing Authorization to Subscriber+ Arbitrary Post Creation Exploitation status Not known exploited Fix Affected product E EleSpare – News, Magazine and Blog Addons for Elementor Published 04/23/2024 Severity Medium CVE-2024-2798Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/23/2024 Severity Medium CVE-2024-2799Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags Exploitation status Not known exploited Fix Affected product R Royal Addons for Elementor – Addons and Templates Kit for Elementor Published 04/23/2024 Severity Medium CVE-2024-32695WordPress Language Switcher for Transposh plugin <= 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product L Language Switcher for Transposh Published 04/22/2024 Severity High CVE-2015-10132Thimo Grauerholz WP-Spreadplugin spreadplugin.php cross site scripting Exploitation status Not known exploited Fix Affected product W WP-Spreadplugin Published 04/21/2024 Severity Low CVE-2024-3731Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's' Exploitation status Not known exploited Fix Affected product C Customer Reviews for WooCommerce Published 04/19/2024 Severity Medium CVE-2024-32601WordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product P Popup Anything Published 04/18/2024 Severity Medium CVE-2024-32604WordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerability Exploitation status Not known exploited Fix Affected product W WP-Recall Published 04/18/2024 Severity Medium CVE-2022-41698WordPress If Menu – Visibility control for Menus plugin <= 0.16.3 - Broken Access Control Exploitation status Not known exploited Fix Affected product I If Menu Published 04/17/2024 Severity Medium CVE-2024-32457WordPress Elements Plus! plugin <= 2.16.3 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product E Elements Plus! Published 04/17/2024 Severity Medium CVE-2024-1219Easy Social Feed < 6.5.6 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product E Easy Social Feed Published 04/17/2024 Severity Medium CVE-2024-31292WordPress Import XML and RSS Feeds plugin <= 2.1.5 - Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product I Import XML and RSS Feeds Published 04/07/2024 Severity High CVE-2024-31211Remote Code Execution in `WP_HTML_Token` Exploitation status Not known exploited Fix Affected product W wordpress-develop Published 04/04/2024 Severity Medium CVE-2024-31210PHP file upload bypass via Plugin installer Exploitation status Not known exploited Fix Affected product W wordpress-develop Published 04/04/2024 Severity High CVE-2024-1658Grid Shortcodes < 1.1.1 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product G Grid Shortcodes Published 03/18/2024 Severity Medium CVE-2024-1279Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure Exploitation status Public exploit Fix Affected product P Paid Memberships Pro Published 03/11/2024 Severity Medium CVE-2023-5561WordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure Exploitation status Public exploit Fix Affected product W WordPress Published 10/16/2023 Severity Medium CVE-2023-39999WordPress < 6.3.2 is vulnerable to Broken Access Control Exploitation status Not confirmed Fix Affected product W WordPress Published 10/13/2023 Severity Medium CVE-2023-38000Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block Exploitation status Not confirmed Fix Affected product W WordPress Published 10/13/2023 Severity Medium CVE-2013-10027Blogger Importer Plugin blogger-importer.php restart cross-site request forgery Exploitation status Not confirmed Fix Affected product B Blogger Importer Plugin Published 06/04/2023 Severity Medium CVE-2022-47174WordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product P Performance Lab Published 05/25/2023 Severity Medium CVE-2022-47161WordPress Health Check & Troubleshooting Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product H Health Check & Troubleshooting Published 05/25/2023 Severity Medium CVE-2023-2745WordPress Core < 6.2.1 - Directory Traversal Exploitation status Not known exploited Fix Affected product W WordPress Published 05/17/2023 Severity Medium CVE-2013-10021dd32 Debug Bar Plugin class-debug-bar-queries.php render cross site scripting Exploitation status Not confirmed Fix Affected product D Debug Bar Plugin Published 03/11/2023 Severity Low CVE-2023-22622Exploitation status Not known exploited Fix Not confirmed Affected product Not confirmed Published 01/05/2023 Severity Medium CVE-2022-3590WP <= 6.1.1 - Unauthenticated Blind SSRF via DNS Rebinding Exploitation status Public exploit Fix Not confirmed Affected product W WordPress Published 12/14/2022 Severity Medium CVE-2022-43504Exploitation status Not known exploited Fix Not confirmed Affected product W WordPress Published 12/05/2022 Severity Medium CVE-2022-43497Exploitation status Not known exploited Fix Not confirmed Affected product W WordPress Published 12/05/2022 Severity Medium CVE-2022-43500Exploitation status Not known exploited Fix Not confirmed Affected product W WordPress Published 12/05/2022 Severity Medium CVE-2011-1762Exploitation status Not confirmed Fix Not confirmed Affected product W wordpress Published 04/18/2022 Severity Unknown 
.svg){kind=icon}
