WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–42 of 42 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Automatic.css Plugin automaticcss-plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via REQUEST_URI 4.0.0 CVE-2026-15273 Wordfence
6.5 Medium SureCart Plugin surecart Broken Access Control Unauthenticated Account Creation with Automatic Login No login needed < 4.7.0 Fixed in 4.7.0 CVE-2026-75793 WPScan
7.1 High Automatic Plugin wp-automatic Cross-Site Scripting No login needed < 3.135.1 Fixed in 3.135.1 CVE-2026-56045 Patchstack
8.5 High WP Sessions Time Monitoring Full Automatic Plugin activitytime SQL Injection ≤ 1.1.4 Fixed in 1.1.5 CVE-2026-39581 Patchstack
9.3 Critical GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites Plugin gptranslate SQL Injection Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection No login needed ≤ 2.32.6 Fixed in 2.32.7 CVE-2026-49776 Patchstack
6.4 Medium Auto Thumbnails Plugin automatic-thumbnail Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0 CVE-2026-8899 Wordfence
5.3 Medium WP Sessions Time Monitoring Full Automatic Plugin activitytime Broken Access Control No login needed ≤ 1.1.3 Fixed in 1.1.4 CVE-2026-32362 Patchstack
4.3 Medium Automatic Featured Images from Videos Plugin automatic-featured-images-from-videos Broken Access Control ≤ 1.2.7 Fixed in 1.2.8 CVE-2026-24535 Patchstack
5.3 Medium Autochat Automatic Conversation Plugin auyautochat-for-wp Broken Access Control Missing Authorization to Unauthenticated Settings Update No login needed ≤ 1.1.9 CVE-2025-12043 Wordfence
7.5 High PoloPag – Pix Automático para Woocommerce Plugin wc-polo-payments Local File Inclusion Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion No login needed ≤ 2.0.9 Fixed in 3.0.0 CVE-2025-60189 Patchstack
4.7 Medium Automatic Plugin - AI content generator and auto poster Plugin Cross-Site Request Forgery AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 3.118.0 CVE-2025-6247 Wordfence
8.5 High Pinterest Automatic Pin Plugin wp-pinterest-automatic SQL Injection ≤ 4.19.0 Fixed in 4.19.0 CVE-2025-39510 Patchstack
6.5 Medium Automatically Hierarchic Categories in Menu Plugin automatically-hierarchic-categories-in-menu Cross-Site Scripting ≤ 2.0.9 Fixed in 2.0.10 CVE-2025-50048 Patchstack
8.8 High Automatic Plugin - AI content generator and auto poster Plugin Arbitrary File Upload AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload ≤ 3.115.0 CVE-2025-5395 Wordfence
4.3 Medium Pinterest Automatic Pin Plugin wp-pinterest-automatic Broken Access Control ≤ 4.19.0 CVE-2025-39511 Patchstack
7.1 High Milat jQuery Automatic Popup Plugin milat-jquery-automatic-popup Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.3.1 CVE-2025-46514 Patchstack
4.3 Medium Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) Plugin Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Order Information Disclosure ≤ 4.1 CVE-2025-1284 Wordfence
7.1 High Autoglot – Automatic WordPress Translation Plugin autoglot Cross-Site Scripting Automatic WordPress Translation plugin <=2.4.7 - Reflected Cross Site Scripting (XSS) No login needed ≤ 2.4.7 Fixed in 2.4.8 CVE-2025-24548 Patchstack
7.1 High SEO Tools Plugin seo-automatic-seo-tools Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.0.7 CVE-2025-30984 Patchstack
7.1 High Automatic Ban IP Plugin automatic-ban-ip Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.7 CVE-2025-32632 Patchstack
4.3 Medium Automatic Featured Images from Videos Plugin automatic-featured-images-from-videos Broken Access Control ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-31820 Patchstack
4.7 Medium Scheduled & Automatic Order Status Controller for WooCommerce Plugin order-status-rules-for-woocommerce Open Redirect No login needed ≤ 3.7.1 Fixed in 3.7.2 CVE-2025-30781 Patchstack
7.1 High Easy Automatic Newsletter Lite Plugin easy-automatic-newsletter Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.2.0 CVE-2025-23879 Patchstack
4.3 Medium RapidLoad – Optimize Web Vitals Automatically Plugin Broken Access Control Optimize Web Vitals Automatically <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset ≤ 2.4.4 CVE-2024-13651 Wordfence
7.1 High WP Sessions Time Monitoring Full Automatic Plugin activitytime Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.1.1 Fixed in 1.1.2 CVE-2025-24718 Patchstack
6.4 Medium Automatically Hierarchic Categories in Menu Plugin automatically-hierarchic-categories-in-menu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.7 CVE-2024-13466 Wordfence
4.3 Medium Automatic YouTube Gallery Plugin automatic-youtube-gallery Broken Access Control ≤ 2.3.3 Fixed in 2.3.5 CVE-2023-41866 Patchstack
7.1 High RapidLoad – Optimize Web Vitals Automatically Plugin unusedcss Broken Access Control Optimize Web Vitals Automatically <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification and SQL Injection ≤ 2.4.2 CVE-2024-11840 Wordfence
4.9 Medium Internal Linking for SEO traffic & Ranking – Auto internal links (100% automatic) Plugin automatic-internal-links-for-seo SQL Injection Auto internal links (100% automatic) <= 1.2.1 - Authenticated (Administrator+) SQL Injection via post_id Parameter ≤ 1.2.1 CVE-2024-11009 Wordfence
6.4 Medium AutoListicle: Automatically Update Numbered List Articles Plugin autolisticle-automatically-update-numbered-list-articles Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.3 CVE-2024-11426 Wordfence
6.5 Medium wp_automatic_widget Plugin wp-automatic-widget Cross-Site Scripting ≤ 1.0.1 CVE-2024-51876 Patchstack
10.0 Critical Automatic Translation Plugin automatic-translation Arbitrary File Upload No login needed ≤ 1.0.4 CVE-2024-50493 Patchstack
9.3 Critical WP Sessions Time Monitoring Full Automatic Plugin activitytime SQL Injection No login needed ≤ 1.0.9 Fixed in 1.1.0 CVE-2024-49681 Patchstack
6.5 Medium Automatically Hierarchic Categories in Menu Plugin automatically-hierarchic-categories-in-menu Cross-Site Scripting ≤ 2.0.5 Fixed in 2.0.6 CVE-2024-47365 Patchstack
5.4 Medium Happy SCSS Compiler - Compile SCSS to CSS automatically Plugin happy-scss-compiler Broken Access Control Compile SCSS to CSS automatically <= 1.3.10 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 1.3.10 CVE-2024-5600 Wordfence
4.4 Medium Automatic Translator with Google Translate Plugin auto-translate Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Font ≤ 1.5.4 CVE-2024-0632 Wordfence
6.4 Medium WordPress Automatic Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter ≤ 3.94.0 CVE-2024-4849 Wordfence
8.8 High Automatic Plugin wp-automatic Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 3.92.0 Fixed in 3.92.1 CVE-2024-27955 Patchstack
9.3 Critical Automatic Plugin Path Traversal Unauthenticated Arbitrary File Download and SSRF No login needed ≤ 3.92.0 Fixed in 3.92.1 CVE-2024-27954 Patchstack
8.8 High Alt Text AI – Automatically generate image alt text for SEO and accessibility Plugin alttext-ai SQL Injection Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection ≤ 1.4.9 CVE-2024-4847 Wordfence
7.6 High Automatic Plugin Cross-Site Request Forgery Multiple Cross Site Request Forgery (CSRF) No login needed < 3.93.0 Fixed in 3.93.0 CVE-2024-32693 Patchstack
9.9 Critical Automatic Plugin SQL Injection Unauthenticated Arbitrary SQL Execution No login needed ≤ 3.92.0 Fixed in 3.92.1 CVE-2024-27956 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only