WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 1–50 of 93 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons | Information Disclosure Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`… No login needed |
≤ 4.7.3 |
CVE-2026-100149 |
Wordfence | |
| 6.8 Medium | Unlimited Elements For Elementor | Cross-Site Scripting Contributor+ Stored XSS via Icon Library Parameter |
< 2.0.21 Fixed in 2.0.21 |
CVE-2026-85016 |
WPScan | |
| 6.1 Medium | Social Media Share Buttons & Social Sharing Icons | Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via URL No login needed |
≤ 3.0.1 |
CVE-2026-89047 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Author+ Stored XSS via Package Icon |
< 3.3.71 Fixed in 3.3.71 |
CVE-2026-86610 |
WPScan | |
| 6.1 Medium | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 3.5.9 |
CVE-2026-18964 |
Wordfence | |
| 6.8 Medium | Bold Page Builder | Cross-Site Scripting Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL |
< 5.9.8 Fixed in 5.9.8 |
CVE-2026-84021 |
WPScan | |
| 6.8 Medium | Social Media Share Buttons & Social Sharing Icons | Cross-Site Scripting Contributor+ Stored XSS via Post Title |
< 3.0.1 Fixed in 3.0.1 |
CVE-2026-19719 |
WPScan | |
| 6.4 Medium | Betheme | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode |
≤ 28.4 |
CVE-2026-6178 |
Wordfence | |
| 5.4 Medium | Royal Elementor Addons | Cross-Site Scripting Contributor+ Stored XSS via Icon Box Widget |
< 1.7.1065 Fixed in 1.7.1065 |
CVE-2026-19217 |
WPScan | |
| 6.8 Medium | YMC Filter | Cross-Site Scripting Author+ Stored XSS via SVG Icon Upload |
< 3.12.9 Fixed in 3.12.9 |
CVE-2026-16559 |
WPScan | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute |
≤ 3.3.66 |
CVE-2026-16685 |
Wordfence | |
| 6.4 Medium | Kadence Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute |
≤ 3.7.8 |
CVE-2026-18435 |
Wordfence | |
| 6.5 Medium | Ultimate Addons for WPBakery Page Builder | Path Traversal Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts No login needed |
< 3.21.4 Fixed in 3.21.4 |
CVE-2026-15382 |
WPScan | |
| 6.4 Medium | Cozy Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute |
≤ 2.2.11 |
CVE-2026-15334 |
Wordfence | |
| 6.4 Medium | Ultimate Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes |
≤ 2.9.1 |
CVE-2026-15787 |
Wordfence | |
| 6.4 Medium | Nexter Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute |
≤ 4.7.4 |
CVE-2026-6740 |
Wordfence | |
| 4.4 Medium | Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter |
≤ 3.0.6 |
CVE-2026-11358 |
Wordfence | |
| 4.3 Medium | Social Media & Share Icons | Broken Access Control No login needed |
≤ 2.8.6 Fixed in 2.8.7 |
CVE-2024-31435 |
Patchstack | |
| 6.1 Medium | WP Emoticon Rating | Cross-Site Request Forgery Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter No login needed |
≤ 1.0.1 |
CVE-2026-8910 |
Wordfence | |
| 6.1 Medium | NS Product icon badge | Cross-Site Scripting Reflected Cross-Site Scripting via PHP_SELF No login needed |
≤ 1.2.4 |
CVE-2026-8707 |
Wordfence | |
| 4.9 Medium | WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons | Cross-Site Scripting Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field |
≤ 1.0.8 |
CVE-2026-4811 |
Wordfence | |
| 6.4 Medium | Advanced Social Media Icons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode |
≤ 1.2 |
CVE-2026-7659 |
Wordfence | |
| 6.4 Medium | AccessPress Social Icons | Cross-Site Scripting WordPress Plugin AccessPress Social Icons 1.8.2 Stored XSS |
1.8.2 |
CVE-2021-47910 |
VulnCheck | |
| 6.5 Medium | Betheme | Arbitrary File Deletion Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' |
≤ 28.4 |
CVE-2026-6262 |
Wordfence | |
| 6.4 Medium | Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem | Cross-Site Scripting Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG' |
≤ 3.5.3 |
CVE-2026-2868 |
Wordfence | |
| 6.4 Medium | WP Docs | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]' |
≤ 2.2.9 |
CVE-2026-3878 |
Wordfence | |
| 6.4 Medium | Xpro Addons — 140+ Widgets for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget |
≤ 1.4.24 |
CVE-2026-2949 |
Wordfence | |
| 5.4 Medium | Archicon | PHP Object Injection Arbitrary Object Instantiation |
≤ < 1.7 Fixed in 1.7 |
CVE-2026-32506 |
Patchstack | |
| 6.5 Medium | Icon List Block | Cross-Site Scripting |
≤ 1.2.3 Fixed in 1.2.4 |
CVE-2026-32359 |
Patchstack | |
| 4.3 Medium | Social Icons Widget & Block | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation |
≤ 4.5.8 |
CVE-2026-4063 |
Wordfence | |
| 6.4 Medium | Menu Icons by ThemeIsle | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting |
≤ 0.13.20 |
CVE-2026-1755 |
Wordfence | |
| 6.5 Medium | Gutenberg Thim Blocks | Path Traversal Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter |
≤ 1.0.1 |
CVE-2025-13725 |
Wordfence | |
| 5.9 Medium | Category Icon | Cross-Site Scripting |
≤ 1.0.2 Fixed in 1.0.3 |
CVE-2025-68525 |
Patchstack | |
| 6.4 Medium | Icon List Block – Add Icon-Based Lists with Custom Styles | Server-Side Request Forgery Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery |
≤ 1.2.1 |
CVE-2025-12376 |
Wordfence | |
| 6.4 Medium | WP-Iconics | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 0.0.4 |
CVE-2025-12671 |
Wordfence | |
| 4.4 Medium | WP Carticon | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 1.0.0 |
CVE-2025-12065 |
Wordfence | |
| 6.4 Medium | Material Design Iconic Font Integration | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2 |
CVE-2025-11872 |
Wordfence | |
| 6.5 Medium | SS Font Awesome Icon | Cross-Site Scripting |
≤ 4.1.3 |
CVE-2025-58837 |
Patchstack | |
| 6.5 Medium | Themify Icons | Cross-Site Scripting |
≤ 2.0.3 Fixed in 2.0.4 |
CVE-2025-49395 |
Patchstack | |
| 5.9 Medium | Quick Favicon | Cross-Site Scripting |
≤ 0.22.8 |
CVE-2025-53287 |
Patchstack | |
| 6.4 Medium | Namasha By Mdesign | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter |
≤ 1.2.00 |
CVE-2025-6537 |
Wordfence | |
| 5.9 Medium | eMagicOne Store Manager for WooCommerce | Path Traversal Unauthenticated Arbitrary File Read No login needed |
≤ 1.2.5 |
CVE-2025-4602 |
Wordfence | |
| 6.5 Medium | RAphicon | Cross-Site Scripting |
≤ 2.1.2 |
CVE-2025-46467 |
Patchstack | |
| 4.9 Medium | Category Icon | Path Traversal Arbitrary File Download |
≤ 1.0.1 Fixed in 1.0.2 |
CVE-2025-31825 |
Patchstack | |
| 6.4 Medium | Smart Icons | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload |
≤ 1.0.4 |
CVE-2025-2513 |
Wordfence | |
| 5.3 Medium | Simple Icons | Broken Access Control No login needed |
≤ 2.8.4 |
CVE-2025-31786 |
Patchstack | |
| 5.9 Medium | Flag Icons | Cross-Site Scripting |
≤ 2.2 |
CVE-2025-31575 |
Patchstack | |
| 6.4 Medium | Gutenberg Blocks by Kadence Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' |
≤ 3.4.9 |
CVE-2025-1291 |
Wordfence | |
| 6.4 Medium | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | Cross-Site Scripting Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 3.3.5 |
CVE-2025-1450 |
Wordfence | |
| 6.5 Medium | Icon List Block | Cross-Site Scripting |
≤ 1.1.3 Fixed in 1.1.4 |
CVE-2025-26937 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.