WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–16 of 16 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Gravity Forms Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via Hidden File Upload Field No login needed ≤ 3.1.0.4 CVE-2026-84434 Wordfence
9.8 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Arbitrary File Upload Unauthenticated Arbitrary File Upload via Chunked File Upload No login needed ≤ 1.1.9 CVE-2026-87796 Wordfence
9.1 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Broken Access Control Missing Authorization to Unauthenticated Arbitrary Media Deletion No login needed ≤ 1.1.8 CVE-2026-5581 Wordfence
9.6 Critical Gravity Forms Plugin gravityforms Arbitrary File Deletion No login needed ≤ 2.10.0.1 Fixed in 2.10.1 CVE-2026-48866 Patchstack
9.8 Critical WP Gravity Forms Salesforce Plugin gf-salesforce-crmperks PHP Object Injection No login needed ≤ 1.5.1 Fixed in 1.5.2 CVE-2025-60180 Patchstack
9.8 Critical WP Gravity Forms HubSpot Plugin gf-hubspot PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.2.6 Fixed in 1.2.7 CVE-2025-60178 Patchstack
9.8 Critical WP Gravity Forms Constant Contact Plugin gf-constant-contact PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.1.2 Fixed in 1.1.3 CVE-2025-60174 Patchstack
9.8 Critical WP Gravity Forms Zoho CRM and Bigin Plugin gf-zoho PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2025-60091 Patchstack
9.8 Critical WP Gravity Forms Insightly Plugin gf-insightly PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.1.6 Fixed in 1.1.7 CVE-2025-60090 Patchstack
9.8 Critical WP Gravity Forms FreshDesk Plugin gf-freshdesk PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.3.5 Fixed in 1.3.6 CVE-2025-60089 Patchstack
9.8 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 1.1.7 CVE-2025-14344 Wordfence
9.8 Critical Gravity Forms Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'copy_post_image' No login needed ≤ 2.9.20 CVE-2025-12352 Wordfence
9.8 Critical WP Gravity Forms Keap/Infusionsoft Plugin gf-infusionsoft PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-58636 Patchstack
9.8 Critical Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets PHP Object Injection No login needed ≤ 1.2.6 Fixed in 1.2.7 CVE-2025-60209 Patchstack
9.3 Critical Salesmate Add-On for Gravity Forms Plugin gf-salesmate-add-on SQL Injection No login needed ≤ 2.0.3 Fixed in 2.0.4 CVE-2025-31551 Patchstack
9.0 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Arbitrary File Upload No login needed ≤ 1.1.3 Fixed in 1.1.5 CVE-2025-23921 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only