WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–21 of 21 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.8 Medium Joli Table Of Contents Plugin joli-table-of-contents Cross-Site Scripting Author+ Stored XSS via joli-toc Shortcode Theme Attribute < 3.0.3 Fixed in 3.0.3 CVE-2026-84931 WPScan
3.5 Low Joli Table Of Contents Plugin joli-table-of-contents Cross-Site Scripting Admin+ Stored XSS 2.0.0 – < 2.8.1 Fixed in 2.8.1 CVE-2025-15694 WPScan
6.5 Medium Table Of Contents Block Plugin table-of-contents-block Cross-Site Scripting ≤ 1.5.0 CVE-2026-66645 Patchstack
7.1 High Table of Contents Creator Plugin table-of-contents-creator Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.4.1 CVE-2025-68836 Patchstack
4.3 Medium Easy Table of Contents Plugin easy-table-of-contents Cross-Site Request Forgery No login needed ≤ 2.0.80 Fixed in 2.0.81 CVE-2026-32343 Patchstack
4.3 Medium TOP Table Of Contents Plugin top-table-of-contents Broken Access Control ≤ 1.3.31 Fixed in 1.4.0 CVE-2026-25314 Patchstack
6.4 Medium Easy Table of Contents Plugin easy-table-of-contents Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.78 CVE-2025-13738 Wordfence
7.1 High Site Table of Contents Plugin site-table-of-contents Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 0.3 CVE-2025-31385 Patchstack
6.1 Medium LuckyWP Table of Contents Plugin luckywp-table-of-contents Cross-Site Request Forgery Cross-Site Request Forgery to Reflected Cross-Site Scripting No login needed ≤ 2.1.10 CVE-2025-2299 Wordfence
6.5 Medium Table of Contents Block Plugin table-of-contents Cross-Site Scripting ≤ 1.0.2 CVE-2025-27305 Patchstack
4.8 Medium LuckyWP Table of Contents Plugin luckywp-table-of-contents Cross-Site Scripting Admin+ Stored XSS < 2.1.7 Fixed in 2.1.7 CVE-2024-9641 WPScan
5.4 Medium Easy Table of Contents Plugin easy-table-of-contents Broken Access Control ≤ 2.0.45.2 Fixed in 2.0.46 CVE-2023-25469 Patchstack
4.8 Medium Table of Contents Plus Plugin table-of-contents-plus Cross-Site Scripting Editor+ Stored XSS ≤ 2408 CVE-2024-5578 WPScan
4.3 Medium Table of Contents Plus Plugin table-of-contents-plus Cross-Site Request Forgery No login needed ≤ 2408 Fixed in 2411 CVE-2024-49250 Patchstack
6.1 Medium easy-table-of-contents Plugin Cross-Site Scripting Editor+ Stored XSS No login needed < 2.0.68 Fixed in 2.0.68 CVE-2024-7082 WPScan
6.1 Medium Easy Table of Contents Plugin easy-table-of-contents Cross-Site Scripting Editor+ Stored XSS No login needed < 2.0.67.1 Fixed in 2.0.67.1 CVE-2024-6334 WPScan
5.9 Medium Easy Table of Contents Plugin easy-table-of-contents Cross-Site Scripting Admin+ Stored XSS < 2.0.66 Fixed in 2.0.66 CVE-2024-5573 WPScan
4.6 Medium LuckyWP Table of Contents Plugin luckywp-table-of-contents Cross-Site Scripting Admin+ Stored XSS ≤ 2.1.4 CVE-2024-2218 WPScan
5.5 Medium LuckyWP Table of Contents Plugin luckywp-table-of-contents Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.1.4 CVE-2024-2953 Wordfence
6.1 Medium LuckyWP Table of Contents Plugin luckywp-table-of-contents Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.1.5 CVE-2024-2119 Wordfence
4.4 Medium LuckyWP Table of Contents Plugin luckywp-table-of-contents Cross-Site Scripting Authenticated (Administrator+) Cross-Site Scripting ≤ 2.1.4 CVE-2023-6487 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only