WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 161 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.6 High	Slider by 10Web Plugin `slider-wd`	SQL Injection	`≤ 1.2.63`	Oct 7, 2026	`CVE-2026-42710`	Patchstack
7.1 High	LayerSlider Plugin `layerslider`	Cross-Site Scripting No login needed	`≤ 8.4.0` Fixed in `8.4.1`	Sep 30, 2026	`CVE-2026-97253`	Patchstack
7.2 High	Responsive Slider Gallery Plugin `responsive-slider-gallery`	PHP Object Injection	`≤ 1.5.5` Fixed in `1.5.6`	Sep 30, 2026	`CVE-2026-94122`	Patchstack
8.0 High	WP Review Slider Pro Plugin	Cross-Site Scripting Subscriber+ Stored XSS via Review Form Fields	`< 12.7.12` Fixed in `12.7.12`	Sep 26, 2026	`CVE-2026-84096`	WPScan
8.0 High	WP Review Slider Pro Plugin	Cross-Site Scripting Subscriber+ Stored XSS via Review Import	`< 12.7.12` Fixed in `12.7.12`	Sep 26, 2026	`CVE-2026-84095`	WPScan
7.2 High	WP Yelp Review Slider Plugin `wp-yelp-review-slider`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) No login needed	`≤ 9.2`	Sep 22, 2026	`CVE-2026-93778`	Wordfence
8.8 High	Slider Hero Plugin	Cross-Site Scripting Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers No login needed	`< 9.1.3` Fixed in `9.1.3`	Aug 22, 2026	`CVE-2026-76789`	WPScan
7.4 High	Slider by 10Web Plugin `slider-wd`	Cross-Site Request Forgery No login needed	`≤ 1.2.63`	Aug 18, 2026	`CVE-2026-66635`	Patchstack
7.5 High	Depicter Slider Plugin `depicter`	SQL Injection No login needed	`≤ 4.8.0`	Aug 18, 2026	`CVE-2026-66622`	Patchstack
7.6 High	WP Google Review Slider Plugin `wp-google-places-review-slider`	SQL Injection	`≤ 18.4` Fixed in `18.5`	Jul 27, 2026	`CVE-2026-66427`	Patchstack
7.1 High	Slider Pro Plugin `sliderpro`	Cross-Site Scripting No login needed	`≤ 4.8.13` Fixed in `4.8.14`	Jul 23, 2026	`CVE-2026-57699`	Patchstack
7.5 High	Jssor Slider by jssor.com Plugin `jssor-slider`	Path Traversal Unauthenticated Arbitrary File Read via 'url' Parameter No login needed	`≤ 3.1.24`	Jul 8, 2026	`CVE-2026-14244`	Wordfence
7.1 High	Slider Revolution Plugin `revslider`	Cross-Site Scripting No login needed	`7.0.0 – 7.0.16` Fixed in `7.1.0`	Jul 2, 2026	`CVE-2026-57678`	Patchstack
7.5 High	WP Review Slider Pro Plugin	SQL Injection Unauthenticated SQL Injection via 'notinstring' Parameter No login needed	`≤ 12.7.2`	Jul 2, 2026	`CVE-2026-8441`	Wordfence
7.1 High	Quick Interest Slider Plugin `quick-interest-slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.6` Fixed in `3.1.7`	Jun 26, 2026	`CVE-2026-56039`	Patchstack
7.1 High	Master Slider Plugin `master-slider`	Cross-Site Scripting No login needed	`≤ 3.11.3`	Jun 25, 2026	`CVE-2026-56014`	Patchstack
8.1 High	WP Review Slider Pro Plugin	Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter	`≤ 12.6.8`	Jun 16, 2026	`CVE-2026-8442`	Wordfence
8.8 High	WP Review Slider Pro Plugin	SQL Injection Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter	`≤ 12.6.8`	Jun 16, 2026	`CVE-2026-8444`	Wordfence
8.8 High	WP Review Slider Pro Plugin	SQL Injection Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter	`≤ 12.6.8`	Jun 16, 2026	`CVE-2026-8443`	Wordfence
7.1 High	Social Slider Feed Plugin `instagram-slider-widget`	Cross-Site Scripting No login needed	`≤ 2.3.2` Fixed in `2.3.3`	Jun 15, 2026	`CVE-2026-39507`	Patchstack
8.2 High	Apptha Slider Gallery Plugin	SQL Injection WordPress Plugin Apptha Slider Gallery 1.0 SQL Injection No login needed	`1.0`	Jun 9, 2026	`CVE-2017-20249`	VulnCheck
7.5 High	Apptha Slider Gallery Plugin	Path Traversal WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download No login needed	`1.0`	Jun 9, 2026	`CVE-2017-20248`	VulnCheck
8.2 High	Google Review Slider Plugin `wp-google-places-review-slider`	SQL Injection WordPress Plugin Google Review Slider 6.1 SQL Injection via tid No login needed	`6.1`	Jun 4, 2026	`CVE-2019-25745`	VulnCheck
8.8 High	HS Brand Logo Slider Plugin `hs-brand-logo-slider`	Arbitrary File Upload WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload	`2.1`	May 16, 2026	`CVE-2020-37227`	VulnCheck
8.8 High	Slider Revolution Plugin	Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url	`7.0.0 – 7.0.10`	May 7, 2026	`CVE-2026-6692`	Wordfence
7.2 High	Responsive Slider by MetaSlider Plugin `ml-slider`	PHP Object Injection	`≤ 3.106.0` Fixed in `3.107.0`	Apr 21, 2026	`CVE-2026-39467`	Patchstack
7.2 High	Quick Interest Slider Plugin `quick-interest-slider`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed	`≤ 3.1.5`	Apr 15, 2026	`CVE-2026-5694`	Wordfence
7.2 High	Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts Plugin `post-carousel`	PHP Object Injection Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection	`≤ 3.0.12`	Apr 14, 2026	`CVE-2026-3017`	Wordfence
7.1 High	Image Slider by Ays Plugin `ays-slider`	Cross-Site Scripting No login needed	`≤ <= 2.7.1` Fixed in `2.7.2`	Mar 25, 2026	`CVE-2026-32494`	Patchstack
8.8 High	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Plugin `nextgen-gallery`	Local File Inclusion NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion	`≤ 4.0.4`	Mar 18, 2026	`CVE-2026-1463`	Wordfence
7.1 High	LambertGroup - AllInOne - Content Slider Plugin `all-in-one-contentslider`	Cross-Site Scripting AllInOne - Content Slider plugin <= 3.8 - Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.8`	Mar 5, 2026	`CVE-2026-28109`	Patchstack
7.1 High	LBG Zoominoutslider Plugin `lbg_zoominoutslider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.4.5`	Mar 5, 2026	`CVE-2026-28103`	Patchstack
7.1 High	UberSlider Classic Plugin `uberslider_classic`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.5`	Mar 5, 2026	`CVE-2026-28102`	Patchstack
7.1 High	UberSlider MouseInteraction Plugin `uberslider_mouseinteraction`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.3`	Mar 5, 2026	`CVE-2026-28101`	Patchstack
7.1 High	UberSlider PerpetuumMobile Plugin `uberslider_perpetuummobile`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.3`	Mar 5, 2026	`CVE-2026-28100`	Patchstack
7.1 High	UberSlider Ultra Plugin `uberslider_ultra`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.3`	Mar 5, 2026	`CVE-2026-28099`	Patchstack
8.8 High	Slider Responsive Slideshow – Image slider, Gallery slideshow Plugin `slider-responsive-slideshow`	PHP Object Injection Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection	`≤ 1.5.4`	Feb 20, 2026	`CVE-2026-22346`	Patchstack
7.5 High	Flexi Product Slider and Grid for WooCommerce Plugin `flexi-product-slider-grid`	Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute	`≤ 1.0.5`	Feb 14, 2026	`CVE-2026-1988`	Wordfence
7.1 High	Accordion Slider PRO Plugin `accordion_slider_pro`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2`	Jan 22, 2026	`CVE-2025-49066`	Patchstack
7.1 High	Magic Responsive Slider and Carousel Plugin `magic_carousel`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.6`	Jan 22, 2026	`CVE-2025-49043`	Patchstack
7.1 High	Magic Slider Plugin `magic_slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.2`	Jan 22, 2026	`CVE-2025-48094`	Patchstack
7.1 High	Image&Video FullScreen Background Plugin `lbg_fullscreen_fullwidth_slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.6.7`	Jan 22, 2026	`CVE-2025-47666`	Patchstack
7.1 High	Header Image Slider Plugin `header-image-slider`	Cross-Site Scripting No login needed	`≤ 0.3`	Jan 6, 2026	`CVE-2024-30547`	Patchstack
7.1 High	Content Grid Slider Plugin `content-grid-slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5`	Dec 29, 2025	`CVE-2025-68879`	Patchstack
8.8 High	Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Plugin `nextgen-gallery`	Local File Inclusion NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'	`≤ 3.59.12`	Dec 18, 2025	`CVE-2025-13641`	Wordfence
8.5 High	LBG Zoominoutslider Plugin `lbg_zoominoutslider`	SQL Injection	`≤ 5.4.4` Fixed in `5.4.5`	Dec 16, 2025	`CVE-2025-68056`	Patchstack
8.5 High	Image&Video FullScreen Background Plugin `lbg_fullscreen_fullwidth_slider`	SQL Injection	`≤ 1.6.7`	Dec 9, 2025	`CVE-2025-62093`	Patchstack
8.5 High	Accordion Slider PRO Plugin `accordion_slider_pro`	SQL Injection	`≤ 1.2` Fixed in `1.3`	Dec 9, 2025	`CVE-2025-67518`	Patchstack
7.1 High	flexoslider Plugin `flexoslider`	Cross-Site Scripting No login needed	`≤ 1.0004`	Nov 6, 2025	`CVE-2025-52764`	Patchstack
7.1 High	Range Slider Addon for Gravity Forms Plugin `range-slider-addon-for-gravity-forms`	Cross-Site Scripting No login needed	`≤ 1.1.6` Fixed in `1.1.7`	Nov 6, 2025	`CVE-2025-49905`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.