WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 1–50 of 115 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.8 Medium | Horizontal Scrolling Announcements | Cross-Site Scripting Contributor+ Stored XSS via Style Field |
≤ 2.6 |
CVE-2026-17005 |
WPScan | |
| 4.3 Medium | WPLP Cookie Consent | Broken Access Control Subscriber+ Banner Settings Overwrite and A/B Test Data Reset |
3.6.5 – < 4.4.2 Fixed in 4.4.2 |
CVE-2026-82185 |
WPScan | |
| 4.3 Medium | Cookie Banner for GDPR / CCPA – WPLP Cookie Consent | Cross-Site Request Forgery WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries No login needed |
≤ 4.3.7 |
CVE-2026-15136 |
Wordfence | |
| 5.3 Medium | Members | Information Disclosure Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel No login needed |
≤ 3.2.22 |
CVE-2026-12426 |
Wordfence | |
| 4.3 Medium | Cookie Banner for GDPR / CCPA | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action |
≤ 4.3.6 |
CVE-2026-12955 |
Wordfence | |
| 4.9 Medium | Cookie Banner for GDPR / CCPA | SQL Injection Authenticated (Administrator+) SQL Injection via 'scan_id' Parameter |
≤ 4.3.6 |
CVE-2026-14475 |
Wordfence | |
| 4.9 Medium | Cookie Banner for GDPR / CCPA | SQL Injection Authenticated (Administrator+) SQL Injection via 's' Parameter |
≤ 4.3.5 |
CVE-2026-12920 |
Wordfence | |
| 4.3 Medium | Masteriyo LMS | Broken Access Control Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification |
≤ 2.2.1 |
CVE-2026-11773 |
Wordfence | |
| 4.3 Medium | Reviews and Rating | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action |
≤ 1.1.4 |
CVE-2026-9619 |
Wordfence | |
| 6.1 Medium | Osiris Signature Banner | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter No login needed |
≤ 0.5 |
CVE-2026-8905 |
Wordfence | |
| 5.9 Medium | Progress Planner | Cross-Site Scripting |
≤ 1.9.0 Fixed in 1.9.1 |
CVE-2026-28116 |
Patchstack | |
| 4.3 Medium | Barcode Scanner with Inventory & Order Manager | Cross-Site Request Forgery No login needed |
≤ 1.11.0 Fixed in 1.12.0 |
CVE-2026-42645 |
Patchstack | |
| 5.3 Medium | WP Bannerize Pro | Broken Access Control No login needed |
≤ 1.11.0 Fixed in 1.11.1 |
CVE-2026-25012 |
Patchstack | |
| 6.4 Medium | Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder | Cross-Site Scripting Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 6.10.0.2 |
CVE-2025-15522 |
Wordfence | |
| 6.4 Medium | Smart App Banners | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' and 'verticalalign' Shortcode Attributes |
≤ 1.2 |
CVE-2025-13841 |
Wordfence | |
| 5.3 Medium | Cookie Banner for GDPR / CCPA – WPLP Cookie Consent | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Deletion No login needed |
≤ 4.0.7 |
CVE-2025-14061 |
Wordfence | |
| 4.3 Medium | AnnunciFunebri Impresa | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion |
≤ 4.7.0 |
CVE-2025-14447 |
Wordfence | |
| 4.4 Medium | Weekly Planner | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 1.0 |
CVE-2025-12186 |
Wordfence | |
| 4.4 Medium | YouTube Subscribe | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID |
≤ 3.0.0 |
CVE-2025-12025 |
Wordfence | |
| 4.3 Medium | Uncanny Automator | Information Disclosure Sensitive Data Exposure |
≤ 6.10.0 Fixed in 6.10.0 |
CVE-2025-66056 |
Patchstack | |
| 4.3 Medium | USB Qr Code Scanner For Woocommerce | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 1.0.0 |
CVE-2025-12588 |
Wordfence | |
| 5.3 Medium | Shelf Planner | Information Disclosure Unauthenticated Information Exposure via Log Files No login needed |
≤ 2.8.1 |
CVE-2025-11891 |
Wordfence | |
| 5.3 Medium | Shelf Planner | Broken Access Control Missing Authorization to Unauthenticated Settings Update No login needed |
≤ 2.8.1 |
CVE-2025-11894 |
Wordfence | |
| 6.5 Medium | Jannah - Extensions | Cross-Site Scripting Extensions plugin <= 1.1.4 - Cross Site Scripting (XSS) |
≤ 1.1.4 Fixed in 1.1.5 |
CVE-2025-64208 |
Patchstack | |
| 6.8 Medium | Real Cookie Banner: GDPR & ePrivacy Cookie Consent | Server-Side Request Forgery Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint |
≤ 5.2.4 |
CVE-2025-12136 |
Wordfence | |
| 4.4 Medium | Simple Banner | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 3.0.10 |
CVE-2025-12033 |
Wordfence | |
| 6.5 Medium | Wp cycle text announcement | SQL Injection Authenticated (Contributor+) SQL Injection |
≤ 8.1 |
CVE-2025-9198 |
Wordfence | |
| 5.3 Medium | Wide Banner | Broken Access Control No login needed |
≤ 1.0.4 |
CVE-2025-58919 |
Patchstack | |
| 5.9 Medium | Plugin Security Scanner | Cross-Site Scripting |
≤ 2.0.2 |
CVE-2025-57950 |
Patchstack | |
| 6.5 Medium | Uncanny Toolkit for LearnDash | Cross-Site Scripting |
≤ 3.7.0.3 Fixed in 3.7.0.4 |
CVE-2025-57988 |
Patchstack | |
| 6.4 Medium | StreamWeasels Kick Integration | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel Parameter |
≤ 1.1.5 |
CVE-2025-9442 |
Wordfence | |
| 4.4 Medium | WP Bannerize Pro | Server-Side Request Forgery |
≤ 1.10.0 Fixed in 1.11.0 |
CVE-2025-58615 |
Patchstack | |
| 6.5 Medium | Cookie Notice & Consent Banner for GDPR & CCPA Compliance | Cross-Site Scripting |
≤ 1.7.11 Fixed in 1.7.12 |
CVE-2025-58607 |
Patchstack | |
| 4.3 Medium | Malcure Malware Scanner | Broken Access Control |
≤ 16.8 Fixed in 16.9 |
CVE-2025-3701 |
Patchstack | |
| 4.3 Medium | Uncanny Automator | Broken Access Control |
≤ 6.7.0.1 Fixed in 6.8.0 |
CVE-2025-58193 |
Patchstack | |
| 5.3 Medium | WP Discord Post Plus – Supports Unlimited Channels | Cross-Site Request Forgery Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) No login needed |
≤ 1.0.2 |
CVE-2025-49896 |
Patchstack | |
| 6.4 Medium | Anber Elementor Addon | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link |
≤ 1.0.1 |
CVE-2025-7439 |
Wordfence | |
| 4.9 Medium | Barcode Scanner with Inventory & Order Manager | Path Traversal Arbitrary File Download |
≤ 1.9.0 Fixed in 1.9.1 |
CVE-2025-54715 |
Patchstack | |
| 4.9 Medium | Security Ninja – Secure Firewall & Secure Malware Scanner | Path Traversal Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read |
5.201 – 5.242 |
CVE-2025-8009 |
Wordfence | |
| 6.5 Medium | Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read |
≤ 16.8 |
CVE-2025-7772 |
Wordfence | |
| 4.3 Medium | CM Pop-Up banners | Broken Access Control |
≤ 1.8.4 Fixed in 1.8.5 |
CVE-2025-54018 |
Patchstack | |
| 4.3 Medium | PixelBeds Channel Manager and Hotel Booking Engine | Cross-Site Request Forgery No login needed |
≤ 1.0 |
CVE-2025-49965 |
Patchstack | |
| 5.9 Medium | AppBanners | Cross-Site Scripting |
≤ 1.5.14 |
CVE-2025-30625 |
Patchstack | |
| 6.5 Medium | Uncanny Automator | Broken Access Control No login needed |
≤ 6.4.0.2 Fixed in 6.5.0 |
CVE-2025-48133 |
Patchstack | |
| 4.8 Medium | Real Cookie Banner | Cross-Site Scripting Admin+ Stored XSS |
< 5.1.6 Fixed in 5.1.6 |
CVE-2025-1485 |
WPScan | |
| 6.5 Medium | Uncanny Toolkit for LearnDash | Cross-Site Scripting |
≤ 3.7.0.2 Fixed in 3.7.0.3 |
CVE-2025-48080 |
Patchstack | |
| 5.4 Medium | Planning Center Online Giving | Cross-Site Scripting Contributor+ XSS via Shortcode |
≤ 1.0.0 |
CVE-2024-11502 |
WPScan | |
| 5.4 Medium | Uncanny Automator | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update |
≤ 6.4.0.2 |
CVE-2025-4520 |
Wordfence | |
| 6.5 Medium | The Great Firewords of China | Cross-Site Scripting |
≤ 1.2 |
CVE-2025-22771 |
Patchstack | |
| 4.3 Medium | illow – Cookies Consent | Cross-Site Request Forgery Cookies Consent plugin <= 0.2.0 - Cross Site Request Forgery (CSRF) No login needed |
≤ 0.2.0 |
CVE-2025-39426 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.