WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 127 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical GDPR Framework By Data443 Plugin gdpr-framework PHP Object Injection No login needed ≤ 2.5.0 CVE-2026-39797 Patchstack
6.4 Medium Redux Framework Plugin redux-framework Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field ≤ 4.5.14 CVE-2026-90992 Wordfence
4.3 Medium Redux Framework Plugin redux-framework Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter ≤ 4.5.14 CVE-2026-88999 Wordfence
3.5 Low The Post Grid Plugin the-post-grid Content Injection Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening < 7.9.5 Fixed in 7.9.5 CVE-2026-84151 WPScan
6.4 Medium Redux Framework Plugin redux-framework Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input ≤ 4.5.13 CVE-2026-5410 Wordfence
6.4 Medium Redux Framework Plugin redux-framework Cross-Site Scripting Authenticated (Subscriber+) Cross-Site Scripting via User Input ≤ 4.5.13 CVE-2026-5400 Wordfence
6.4 Medium Redux Framework Plugin redux-framework Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value ≤ 4.5.13.1 CVE-2026-5399 Wordfence
6.4 Medium SEOWriting Plugin seowriting Cross-Site Scripting SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload ≤ 1.12.5 CVE-2026-75134 VulnCheck
8.1 High Golo Framework Plugin golo-framework Local File Inclusion No login needed < 1.7.5 Fixed in 1.7.5 CVE-2026-28150 Patchstack
8.5 High CubeWP Plugin cubewp-framework SQL Injection ≤ 1.1.30 Fixed in 1.1.31 CVE-2026-28168 Patchstack
4.9 Medium CubeWP Framework Plugin cubewp-framework Information Disclosure Contributor+ Arbitrary Post and User Meta Disclosure via IDOR ≤ 1.1.30 CVE-2026-17018 WPScan
8.1 High CubeWP Framework Plugin cubewp-framework SQL Injection Subscriber+ SQL Injection via cubewp_remove_relation < 1.1.31 Fixed in 1.1.31 CVE-2026-17017 WPScan
6.5 Medium The GDPR Framework Plugin gdpr-framework Broken Access Control Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam No login needed < 2.4.0 Fixed in 2.4.0 CVE-2026-14816 WPScan
7.5 High CubeWP Framework Plugin cubewp-framework Path Traversal Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter No login needed ≤ 1.1.30 CVE-2026-13339 Wordfence
6.5 Medium CubeWP Framework Plugin cubewp-framework SQL Injection Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter ≤ 1.1.30 CVE-2026-6453 Wordfence
5.3 Medium Civi Framework Plugin civi-framework Broken Access Control No login needed ≤ 2.2.0 CVE-2026-65525 Patchstack
8.8 High Redux Framework Plugin redux-framework Privilege Escalation Subscriber+ Privilege Escalation to Administrator < 4.5.13 Fixed in 4.5.13 CVE-2026-12525 WPScan
7.5 High Golo Framework Plugin golo-framework Local File Inclusion ≤ 1.7.3 CVE-2026-57794 Patchstack
6.4 Medium Advanced iFrame Plugin advanced-iframe Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute ≤ 2026.1 CVE-2026-6742 Wordfence
6.8 Medium Meta Box – WordPress Custom Fields Framework Plugin meta-box Arbitrary File Deletion WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion No login needed ≤ 5.11.1 Fixed in 5.11.2 CVE-2026-39468 Patchstack
6.1 Medium Ad Inserter Plugin ad-inserter Cross-Site Scripting Reflected Cross-Site Scripting via URL Parameters in iframe Mode No login needed ≤ 2.8.15 CVE-2026-9280 Wordfence
7.1 High Felan Framework Plugin felan-framework Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.1.3 CVE-2025-22741 Patchstack
6.4 Medium WP Iframe Geo Style for Amazon affiliates Plugin wp-iframe-geo-style-for-amazon-affiliates Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute ≤ 1.1 CVE-2026-8837 Wordfence
7.1 High Darna Framework Plugin darna-framework Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.9 CVE-2026-27088 Patchstack
7.1 High Wolverine Framework Plugin wolverine-framework Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.9 CVE-2026-27087 Patchstack
7.1 High Handmade Framework Plugin handmade-framework Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.9 CVE-2026-22520 Patchstack
6.4 Medium Contact List Plugin contact-list Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter ≤ 3.0.18 CVE-2026-3516 Wordfence
7.5 High ModelTheme Framework Plugin modeltheme-framework Broken Access Control No login needed ≤ 2.0.0 Fixed in 2.0.0 CVE-2025-69303 Patchstack
6.5 Medium Advanced iFrame Plugin advanced-iframe Cross-Site Scripting ≤ 2025.10 Fixed in 2026.0 CVE-2026-25453 Patchstack
6.4 Medium Apollo13 Framework Extension Plugin apollo13-framework-extensions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter ≤ 1.9.8 CVE-2025-13617 Wordfence
7.5 High Spirit Framework Plugin spirit-framework Local File Inclusion ≤ 1.2.13 CVE-2024-54263 Patchstack
4.3 Medium CubeWP – All-in-One Dynamic Content Framework Plugin cubewp-framework Information Disclosure All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php ≤ 1.1.27 CVE-2025-6461 Wordfence
4.3 Medium REHub Framework Plugin rehub-framework Information Disclosure Sensitive Data Exposure ≤ 19.9.9.4 Fixed in 19.9.9.4 CVE-2025-63051 Patchstack
6.4 Medium CubeWP Plugin cubewp-framework Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode ≤ 1.1.26 CVE-2025-8615 Wordfence
5.3 Medium CubeWP – All-in-One Dynamic Content Framework Plugin cubewp-framework Information Disclosure All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure No login needed ≤ 1.1.27 CVE-2025-12129 Wordfence
7.5 High Handmade Framework Plugin handmade-framework Local File Inclusion ≤ 3.9 CVE-2026-22521 Patchstack
9.3 Critical Felan Framework Plugin felan-framework SQL Injection No login needed ≤ 1.1.3 CVE-2025-23993 Patchstack
9.8 Critical Felan Framework Plugin felan-framework Privilege Escalation Account Takeover No login needed ≤ 1.1.3 CVE-2025-23504 Patchstack
7.5 High REHub Framework Plugin rehub-framework Broken Access Control No login needed ≤ 19.9.5 Fixed in 19.9.9.6 CVE-2025-14358 Patchstack
7.5 High CubeWP Plugin cubewp-framework Broken Access Control No login needed ≤ 1.1.27 Fixed in 1.1.28 CVE-2025-68036 Patchstack
5.9 Medium Basticom Framework Plugin basticom-framework Cross-Site Scripting ≤ 1.5.2 Fixed in 1.5.3 CVE-2025-67629 Patchstack
8.1 High Frame Theme frame Local File Inclusion No login needed ≤ 2.4.0 CVE-2025-58899 Patchstack
6.4 Medium Redux Framework Plugin redux-framework Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter ≤ 4.5.8 CVE-2025-9488 Wordfence
6.4 Medium Custom Frames Plugin custom-frames Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter ≤ 1.0.1 CVE-2025-13705 Wordfence
6.5 Medium REHub Framework Plugin rehub-framework Cross-Site Scripting ≤ 19.9.9.7 Fixed in 19.9.9.7 CVE-2025-63050 Patchstack
6.4 Medium Inline frame – Iframe Plugin inline-frame-iframe Cross-Site Scripting Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.1 CVE-2025-12645 Wordfence
9.8 Critical Sneeit Framework Plugin Remote Code Execution Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback No login needed ≤ 8.3 CVE-2025-6389 Wordfence
5.3 Medium WP Headless CMS Framework Plugin wp-rest-headless Other Unauthenticated Protection Mechanism Bypass No login needed ≤ 1.15 CVE-2025-11260 Wordfence
5.3 Medium AppPresser – Mobile App Framework Plugin apppresser Broken Access Control Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure No login needed ≤ 4.5.0 CVE-2025-11881 Wordfence
6.4 Medium Open Source Genesis Framework Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 3.6.0 CVE-2025-10737 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only