WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 1–39 of 39 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.5 Medium Temporary Login Without Password Plugin temporary-login-without-password Broken Access Control Authenticated Temporary Access Revocation Bypass via Application Passwords < 1.9.9 Fixed in 1.9.9 CVE-2026-77753 WPScan
5.3 Medium Revolut Gateway for WooCommerce Plugin revolut-gateway-for-woocommerce Broken Access Control No login needed < 4.22.10 Fixed in 4.22.10 CVE-2026-73353 Patchstack
6.1 Medium Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) Plugin mailin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.1.77 CVE-2026-15297 Wordfence
7.1 High Slider Revolution Plugin revslider Cross-Site Scripting No login needed 7.0.0 – 7.0.16 Fixed in 7.1.0 CVE-2026-57678 Patchstack
6.5 Medium Slider Revolution Plugin Information Disclosure Authenticated (Subscriber+) Sensitive Information Disclosure 7.0 – 7.0.10 CVE-2026-7542 Wordfence
4.3 Medium Slider Revolution Plugin Broken Access Control Incorrect Authorization to Authenticated (Contributor+) Sensitive Information Exposure 7.0.0 – 7.0.14 CVE-2026-9048 Wordfence
4.3 Medium Slider Revolution 6.0.0-6.7.55 and Plugin Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation 6.0.0 – 6.7.55, 7.0.0 – 7.0.14 CVE-2026-9050 Wordfence
5.3 Medium Slider Revolution Plugin Information Disclosure Unauthenticated Sensitive Information Exposure via 'sliders/stream' No login needed 6.0 – 6.7.54, 7.0 – 7.0.9 CVE-2026-6728 Wordfence
8.8 High Slider Revolution Plugin Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url 7.0.0 – 7.0.10 CVE-2026-6692 Wordfence
6.5 Medium Brevo - Email, SMS, Web Push, Chat, and more. Plugin mailin Broken Access Control Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling No login needed ≤ 3.3.0 CVE-2025-14799 Wordfence
7.2 High Brevo for WooCommerce Plugin woocommerce-sendinblue-newsletter-subscription Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.0.49 CVE-2025-14436 Wordfence
7.5 High Revolution Plugin revolution Local File Inclusion ≤ 2.5.8 Fixed in 2.5.8 CVE-2025-62066 Patchstack
8.1 High Grevo Theme grevo Local File Inclusion No login needed ≤ 2.4 Fixed in 2.5 CVE-2025-62029 Patchstack
6.5 Medium Slider Revolution Plugin Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary File Read ≤ 6.7.37 CVE-2025-10249 Wordfence
6.5 Medium Slider Revolution Plugin Path Traversal Authenticated (Contributor+) Arbitrary File Read via 'used_svg' and 'used_images' ≤ 6.7.36 CVE-2025-9217 Wordfence
7.1 High Revolution Video Player With Bottom Playlist Plugin revolution-video-player Cross-Site Scripting No login needed ≤ 2.9.2 Fixed in 2.9.3 CVE-2025-53212 Patchstack
7.1 High Revolution Video Player Plugin revolution_video_player Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.9.2 CVE-2025-31058 Patchstack
7.5 High Revo Plugin revo Local File Inclusion No login needed ≤ 4.0.26 CVE-2025-39476 Patchstack
6.4 Medium Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Plugin Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.16.5 CVE-2024-12043 Wordfence
6.4 Medium Prime Slider - Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider Plugin bdthemes-prime-slider-lite Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider <= 3.15.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blog Widget ≤ 3.15.18 CVE-2024-8442 Wordfence
4.3 Medium Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) Plugin mailin Cross-Site Request Forgery No login needed ≤ 3.1.87 CVE-2024-8477 Wordfence
6.4 Medium Slider Revolution Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 6.7.18 CVE-2024-8107 Wordfence
5.3 Medium Revolut Gateway for WooCommerce Plugin revolut-gateway-for-woocommerce Broken Access Control Missing Authorization to Unauthenticated Order Status Update No login needed ≤ 4.17.3 CVE-2024-8678 Wordfence
4.3 Medium Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin mailin Cross-Site Request Forgery No login needed ≤ 3.1.82 Fixed in 3.1.83 CVE-2024-43287 Patchstack
5.9 Medium Slider Revolution Plugin Cross-Site Scripting ≤ 6.7.13 Fixed in 6.7.14 CVE-2024-37449 Patchstack
7.1 High Slider Revolution Plugin Broken Access Control Unauthenticated Broken Access Control No login needed < 6.7.0 Fixed in 6.7.0 CVE-2024-34444 Patchstack
5.9 Medium Slider Revolution Plugin Cross-Site Scripting < 6.7.11 Fixed in 6.7.11 CVE-2024-34443 Patchstack
4.3 Medium Revolut Gateway for WooCommerce Plugin revolut-gateway-for-woocommerce Broken Access Control ≤ 4.9.7 Fixed in 4.9.8 CVE-2023-52224 Patchstack
6.4 Medium Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Plugin bdthemes-prime-slider-lite Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pacific Widget ≤ 3.14.7 CVE-2024-5640 Wordfence
7.1 High Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin mailin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.1.77 Fixed in 3.1.78 CVE-2024-35668 Patchstack
6.4 Medium Slider Revolution Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex ≤ 6.7.10 CVE-2024-4637 Wordfence
6.4 Medium Slider Revolution Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes ≤ 6.7.10 CVE-2024-4581 Wordfence
6.4 Medium Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Plugin Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pagepiling Widget ≤ 3.14.1 CVE-2024-3997 Wordfence
6.4 Medium Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Plugin Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.14.3 CVE-2024-4339 Wordfence
8.5 High Sendinblue for WooCommerce Plugin woocommerce-sendinblue-newsletter-subscription Path Traversal Arbitrary File Download and Deletion ≤ 4.0.17 Fixed in 4.0.18 CVE-2024-32807 Patchstack
6.4 Medium Slider Revolution Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via htmltag Parameter ≤ 6.7.7 CVE-2024-4092 Wordfence
5.4 Medium Prime Slider – Addons for Elementor Plugin Cross-Site Scripting Addons For Elementor (Revolution of a slider, Hero Slider, Media Slider, Drag Drop Slider, Video Slider, Product Slider, Ecommerce Slider) <= 3.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.14.0 CVE-2024-1730 Wordfence
6.5 Medium Dracula Dark Mode - The Revolutionary Dark Mode Plugin dracula-dark-mode Cross-Site Scripting ≤ 1.0.8 Fixed in 1.0.9 CVE-2024-29771 Patchstack
8.8 High Slider Revolution Plugin PHP Object Injection Author+ Insecure Deserialization leading to RCE < 6.6.19 Fixed in 6.6.19 CVE-2023-6528 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only