WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–36 of 36 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	Document Embedder Plugin `document-emberdder`	Broken Access Control Unauthenticated Private Document Download via Token Oracle No login needed	`< 2.3.1` Fixed in `2.3.1`	Aug 27, 2026	`CVE-2026-16567`	WPScan
9.8 Critical	Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … Plugin `advanced-responsive-video-embedder`	Authentication Bypass Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter No login needed	`10.8.7`	Jul 29, 2026	`CVE-2026-18072`	Wordfence
7.2 High	3D Flipbook PDF Viewer & Embedder Plugin `pdf-embed-viewer`	Server-Side Request Forgery No login needed	`≤ 1.4.2` Fixed in `1.4.4`	Jul 27, 2026	`CVE-2026-59552`	Patchstack
4.3 Medium	PDF Embedder Plugin `pdf-embedder`	Information Disclosure Authenticated (Contributor+) Information Exposure via Block Editor Page	`≤ 4.9.3`	May 28, 2026	`CVE-2026-7526`	Wordfence
6.4 Medium	Responsive Video Embedder Plugin `responsive-video-embedder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.1`	May 27, 2026	`CVE-2026-8877`	Wordfence
5.3 Medium	3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery Plugin `interactive-3d-flipbook-powered-physics-engine`	Broken Access Control PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure No login needed	`≤ 1.16.17`	Apr 14, 2026	`CVE-2026-1314`	Wordfence
4.3 Medium	Document Embedder Plugin `document-emberdder`	Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion	`≤ 2.0.4`	Jan 28, 2026	`CVE-2026-1389`	Wordfence
5.9 Medium	UseStrict's Calendly Embedder Plugin `cal-embedder-lite`	Cross-Site Scripting	`≤ 1.1.7.2` Fixed in `1.2`	Dec 9, 2025	`CVE-2025-67555`	Patchstack
8.6 High	Document Embedder – Embed PDFs, Word, Excel, and Other Files Plugin	Broken Access Control Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation No login needed	`≤ 2.0.0`	Nov 5, 2025	`CVE-2025-12384`	Wordfence
5.3 Medium	Embedder for Google Reviews Plugin `embedder-for-google-reviews`	Broken Access Control No login needed	`≤ 1.7.3` Fixed in `1.7.4`	Aug 14, 2025	`CVE-2025-54730`	Patchstack
6.4 Medium	Drive Folder Embedder Plugin `drive-folder-embeder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter	`≤ 1.1.0`	Jun 26, 2025	`CVE-2025-6546`	Wordfence
8.8 High	Embedder Plugin `embedder`	Broken Access Control Authenticated (Subscriber+) Arbitrary Options Update	`1.3 – 1.3.5`	Apr 10, 2025	`CVE-2025-3417`	Wordfence
7.1 High	Video Embedder Plugin `video-embedder`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.7.1` Fixed in `1.8`	Mar 28, 2025	`CVE-2025-31458`	Patchstack
6.5 Medium	Simplebooklet PDF Viewer and Embedder Plugin `simplebooklet`	Cross-Site Scripting	`≤ 1.1.1` Fixed in `1.1.3`	Mar 27, 2025	`CVE-2025-30922`	Patchstack
6.4 Medium	Simplebooklet PDF Viewer and Embedder Plugin `simplebooklet`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 1.1.2`	Feb 18, 2025	`CVE-2024-13588`	Wordfence
6.5 Medium	Prezi Embedder Plugin `prezi-embedder`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 2.1`	Feb 13, 2025	`CVE-2025-26538`	Patchstack
10.0 Critical	iSpring Embedder Plugin `embed-ispring`	Cross-Site Request Forgery CSRF to Arbitrary File Upload No login needed	`≤ 1.0`	Jan 16, 2025	`CVE-2025-23922`	Patchstack
7.1 High	LSD Google Maps Embedder Plugin `lsd-google-maps-embedder`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.1`	Jan 16, 2025	`CVE-2025-23871`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Cross-Site Scripting Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'	`≤ 4.1.3`	Nov 28, 2024	`CVE-2024-11203`	Wordfence
6.5 Medium	Pdf Embedder Fay Plugin `pdf-embedder-fay`	Cross-Site Scripting	`≤ 1.10.1`	Nov 19, 2024	`CVE-2024-51795`	Patchstack
8.8 High	Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder Plugin `real3d-flipbook-lite`	Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload	`≤ 4.8`	Nov 16, 2024	`CVE-2024-9849`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget	`≤ 4.0.1`	Jun 5, 2024	`CVE-2024-5571`	Wordfence
4.3 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Broken Access Control Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual	`≤ 3.9.12`	May 23, 2024	`CVE-2024-1803`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	`≤ 3.9.16`	May 9, 2024	`CVE-2024-4316`	Wordfence
5.9 Medium	3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook Plugin `real3d-flipbook-lite`	Cross-Site Scripting	`≤ 3.71` Fixed in `3.72`	May 8, 2024	`CVE-2024-34561`	Patchstack
6.4 Medium	Google Doc Embedder Plugin `google-document-embedder`	Server-Side Request Forgery Authenticated (Contributor+) Blind Server Side Request Forgery	`≤ 2.6.4`	Apr 30, 2024	`CVE-2024-0216`	Wordfence
7.1 High	3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook Plugin `real3d-flipbook-lite`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.62` Fixed in `3.63`	Apr 22, 2024	`CVE-2024-32694`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.9.14`	Apr 9, 2024	`CVE-2024-3244`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block	`≤ 3.9.14`	Apr 6, 2024	`CVE-2024-3245`	Wordfence
5.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color'	`≤ 3.9.12`	Mar 23, 2024	`CVE-2024-2688`	Wordfence
5.5 Medium	PDF Embedder Plugin `pdf-embedder`	Cross-Site Scripting	`≤ 4.6.4` Fixed in `4.7.1`	Mar 19, 2024	`CVE-2024-29141`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block	`≤ 3.9.10`	Mar 7, 2024	`CVE-2024-1802`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget	`≤ 3.9.10`	Mar 7, 2024	`CVE-2024-2128`	Wordfence
6.5 Medium	Dan's Embedder for Google Calendar Plugin `dans-gcal`	Cross-Site Scripting WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)	`≤ 1.2` Fixed in `1.3`	Feb 5, 2024	`CVE-2023-51504`	Patchstack
7.1 High	PDF Poster – PDF Embedder Plugin `pdf-poster`	Cross-Site Scripting PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS) No login needed	`≤ 2.1.17` Fixed in `2.1.18`	Jan 31, 2024	`CVE-2024-23508`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`< 3.9.5` Fixed in `3.9.5`	Jan 3, 2024	`CVE-2023-6986`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.