WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–28 of 28 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Brands for WooCommerce Plugin brands-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute ≤ 3.8.8 CVE-2026-15648 Wordfence
4.3 Medium Avada Custom Branding Plugin fusion-white-label-branding Broken Access Control ≤ 1.2 CVE-2026-65524 Patchstack
4.4 Medium Brands for WooCommerce Plugin brands-for-woocommerce Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field ≤ 3.8.8 CVE-2026-15647 Wordfence
6.4 Medium Brands for WooCommerce Plugin brands-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute ≤ 3.8.8 CVE-2026-15646 Wordfence
6.2 Medium Brandfolder Plugin brandfolder Local File Inclusion WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php No login needed ≤ 3.0 CVE-2016-20080 VulnCheck
6.4 Medium Theme Wibar Theme Cross-Site Scripting WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component 1.1.8 CVE-2020-37235 VulnCheck
4.3 Medium Premmerce Brands for WooCommerce Plugin premmerce-woocommerce-brands Broken Access Control Missing Authorization To Authenticated (Subscriber+) Brand Permalink Settings Update ≤ 1.2.13 CVE-2025-12783 Wordfence
6.5 Medium Perfect Brands for WooCommerce Plugin perfect-woocommerce-brands SQL Injection Authenticated (Contributor+) SQL Injection ≤ 3.6.2 CVE-2025-10144 Wordfence
4.3 Medium Premmerce Brands for WooCommerce Plugin premmerce-woocommerce-brands Cross-Site Request Forgery No login needed ≤ 1.2.13 Fixed in 1.2.14 CVE-2025-62890 Patchstack
6.4 Medium Brandfolder Plugin brandfolder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 5.0.19 CVE-2025-5843 Wordfence
4.3 Medium My Wp Brand Plugin my-wp-brand Cross-Site Request Forgery No login needed ≤ 1.1.3 Fixed in 1.1.4 CVE-2025-53269 Patchstack
6.4 Medium Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin gs-woo-brands Cross-Site Scripting Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.2 CVE-2024-11746 Wordfence
5.3 Medium My Wp Brand Plugin my-wp-brand Broken Access Control Hide menu & Hide Plugin plugin <= 1.1.2 - Broken Access Control No login needed ≤ 1.1.2 Fixed in 1.1.3 CVE-2024-49694 Patchstack
6.5 Medium Brand Plugin brand Cross-Site Scripting ≤ 1.1.6 Fixed in 1.1.7 CVE-2024-54348 Patchstack
5.3 Medium Brands for WooCommerce Plugin brands-for-woocommerce Broken Access Control No login needed ≤ 3.8.2.2 Fixed in 3.8.2.3 CVE-2023-44149 Patchstack
4.3 Medium LiquidPoll – Advanced Polls for Creators and Brands Plugin wp-poll Broken Access Control ≤ 3.3.68 Fixed in 3.3.69 CVE-2023-36531 Patchstack
5.3 Medium Branded Social Images Plugin branded-social-images Broken Access Control No login needed ≤ 1.1.0 Fixed in 1.1.1 CVE-2023-28536 Patchstack
6.1 Medium Branda – White Label & Branding, Custom Login Page Customizer Plugin branda-white-labeling Cross-Site Scripting White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting No login needed ≤ 3.4.21 CVE-2024-9371 Wordfence
6.5 Medium Brand my Footer Plugin brand-my-footer Cross-Site Scripting ≤ 1.1 CVE-2024-51801 Patchstack
6.4 Medium Debrandify · Remove or Replace WordPress Branding Plugin debrandify Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.1.2 CVE-2024-9674 Wordfence
6.4 Medium Branding Plugin branding Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0 CVE-2024-9452 Wordfence
6.5 Medium LiquidPoll – Advanced Polls for Creators and Brands Plugin wp-poll Cross-Site Scripting Unauthenticated Cross Site Scripting (XSS) No login needed ≤ 3.3.77 Fixed in 3.3.78 CVE-2024-39655 Patchstack
5.9 Medium Branda Plugin branda-white-labeling Cross-Site Scripting ≤ 3.4.17 Fixed in 3.4.18 CVE-2024-37239 Patchstack
5.5 Medium WP Total Branding Plugin wp-total-branding Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via title Parameter ≤ 1.2 CVE-2024-6625 Wordfence
5.3 Medium Branda – White Label WordPress, Custom Login Page Customizer Plugin branda-white-labeling Information Disclosure White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure No login needed ≤ 3.4.18 CVE-2024-6554 Wordfence
6.4 Medium Branda – White Label WordPress, Custom Login Page Customizer Plugin branda-white-labeling Cross-Site Scripting White Label WordPress, Custom Login Page Customizer <= 3.4.17 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload ≤ 3.4.17 CVE-2024-5191 Wordfence
5.3 Medium Branda Plugin branda-white-labeling Authentication Bypass IP Restriction Bypass No login needed ≤ 3.4.14 Fixed in 3.4.15 CVE-2023-51542 Patchstack
4.3 Medium Pretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin Cross-Site Request Forgery Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 3.6.3 CVE-2024-2326 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only