WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 64 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Team Showcase Supreme Plugin Information Disclosure Unauthenticated Sensitive Data Disclosure via wpm_6310_team_member_details No login needed < 9.3 Fixed in 9.3 CVE-2026-11871 WPScan
5.3 Medium Team Plugin tlp-team Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 6.0.0 Fixed in 6.0.1 CVE-2026-95592 Patchstack
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Team Member+ User Email Disclosure via Users and Customers REST Endpoints < 1.6.12.17 Fixed in 1.6.12.17 CVE-2026-16541 WPScan
4.4 Medium Team Members Plugin team-showcase-supreme Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter ≤ 8.7 CVE-2026-12114 Wordfence
6.4 Medium Team Master Plugin team-master Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.1.2 CVE-2026-8870 Wordfence
6.5 Medium Team Showcase Plugin team Cross-Site Scripting ≤ 1.22.28 CVE-2025-62745 Patchstack
4.3 Medium Multicollab: Content Team Collaboration and Editorial Workflow Plugin commenting-feature Broken Access Control Missing Authorization to Authenticated (Subscriber+) Collaboration Comment ≤ 5.2 CVE-2025-4202 Wordfence
5.3 Medium Team Plugin tlp-team Broken Access Control No login needed ≤ 5.0.13 Fixed in 5.0.14 CVE-2026-32396 Patchstack
6.4 Medium Team Section Block Plugin team-section Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link ≤ 2.0.0 CVE-2026-0833 Wordfence
6.5 Medium Team Showcase Plugin team-showcase Cross-Site Scripting ≤ 2.9 Fixed in 3.0.0 CVE-2025-69335 Patchstack
6.4 Medium All-in-One Addons for Elementor – WidgetKit Plugin widgetkit-for-elementor Cross-Site Scripting WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets ≤ 2.5.6 CVE-2025-8779 Wordfence
5.3 Medium Devs CRM – Manage tasks, attendance and teams all together Plugin devs-crm Broken Access Control Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoure No login needed ≤ 1.1.8 CVE-2025-13092 Wordfence
5.3 Medium Devs CRM – Manage tasks, attendance and teams all together Plugin devs-crm Broken Access Control Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update No login needed ≤ 1.1.8 CVE-2025-13093 Wordfence
4.3 Medium Employee Spotlight – Team Member Showcase & Meet the Team Plugin employee-spotlight Broken Access Control Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification ≤ 5.1.3 CVE-2025-13403 Wordfence
6.1 Medium Centangle Team Showcase Plugin centangle-team Cross-Site Request Forgery Cross-Site Request Forgery To Plugin's Settings Modification And Stored Cross-Site Scripting No login needed ≤ 1.0.0 CVE-2025-12456 Wordfence
6.4 Medium Employee Spotlight – Team Member Showcase & Meet the Team Plugin Cross-Site Scripting Team Member Showcase & Meet the Team Plugin <= 5.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.1.2 CVE-2025-12090 Wordfence
5.3 Medium eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams Plugin eroom-zoom-meetings-webinar Information Disclosure Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure No login needed ≤ 1.5.6 CVE-2025-11760 Wordfence
6.4 Medium WP Responsive Meet The Team Plugin wp-responsive-meet-the-team Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-11818 Wordfence
6.4 Medium Team Members Plugin team-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.3.5 CVE-2025-8440 Wordfence
4.3 Medium Team Plugin tlp-team Broken Access Control ≤ 5.0.6 Fixed in 5.0.7 CVE-2025-57975 Patchstack
5.3 Medium Team Manager Plugin wp-team-manager Broken Access Control No login needed ≤ 2.6.8 CVE-2025-58222 Patchstack
6.5 Medium Custom Team Manager Plugin custom-team-manager Cross-Site Scripting ≤ 2.4.2 CVE-2025-58840 Patchstack
6.3 Medium Inpersttion For Plugin err-our-team Remote Code Execution Authenticated (Contributor+) Arbitrary Function Call ≤ 1.0 CVE-2025-8905 Wordfence
6.5 Medium Theme Junkie Team Content Plugin theme-junkie-team-content Cross-Site Scripting ≤ 0.1.1 CVE-2025-53301 Patchstack
6.5 Medium HT Team Member Plugin ht-team-member Cross-Site Scripting ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-49309 Patchstack
4.3 Medium Team Showcase Plugin team-showcase-cm Arbitrary Shortcode Execution ≤ 25.05.13 Fixed in 25.05.13 CVE-2025-49250 Patchstack
4.3 Medium Team Showcase Plugin team-showcase-cm Broken Access Control ≤ 25.05.13 Fixed in 25.05.13 CVE-2025-49248 Patchstack
6.4 Medium NinjaTeam Chat for Telegram Plugin ninjateam-telegram Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter ≤ 1.1 CVE-2025-5236 Wordfence
5.4 Medium EKC Tournament Manager Plugin ekc-tournament-manager Cross-Site Request Forgery Create Tournaments/Teams via CSRF < 2.2.2 Fixed in 2.2.2 CVE-2024-9709 WPScan
4.8 Medium Team Members Showcase Plugin wps-team Cross-Site Scripting Editor+ Stored XSS < 4.4.2 Fixed in 4.4.2 CVE-2024-9236 WPScan
6.4 Medium Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder Plugin wps-team Cross-Site Scripting Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.4.1 CVE-2025-3521 Wordfence
6.4 Medium WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Plugin wedevs-project-manager Cross-Site Scripting Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.22 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.6.22 CVE-2025-3100 Wordfence
4.9 Medium Team Circle Image Slider With Lightbox Plugin circle-image-slider-with-lightbox SQL Injection Authenticated (Admin+) SQL Injection ≤ 1.0.4 CVE-2019-25223 Wordfence
6.5 Medium Team Members for Elementor Page Builder Plugin team-members-for-elementor Cross-Site Scripting ≤ 1.0.4 CVE-2025-31771 Patchstack
4.3 Medium Our Team Members Plugin our-team-members Information Disclosure Sensitive Data Exposure ≤ 2.2 Fixed in 2.3 CVE-2025-30802 Patchstack
6.5 Medium Team Section Block Plugin team-section Cross-Site Scripting ≤ 1.0.9 Fixed in 1.1.0 CVE-2025-26949 Patchstack
6.4 Medium AMO Team Showcase Plugin amo-team-showcase Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode ≤ 1.1.4 CVE-2025-1407 Wordfence
6.4 Medium Team Builder For WPBakery Page Builder(Formerly Visual Composer) Plugin team-builder-for-wpbakery-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0 CVE-2024-13591 Wordfence
4.3 Medium Team Builder – Meet the Team Plugin team-display Broken Access Control Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 1.3 CVE-2024-13687 Wordfence
4.3 Medium Team – Team Members Showcase Plugin tlp-team Broken Access Control Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 4.4.9 CVE-2024-13439 Wordfence
6.1 Medium Team Rosters Plugin team-rosters Cross-Site Scripting Reflected Cross-Site Scripting via 'tab' No login needed ≤ 4.7 CVE-2024-12320 Wordfence
6.5 Medium WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts Plugin wedevs-project-manager SQL Injection Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.16 - Authenticated (Subscriber+) SQL Injection ≤ 2.6.16 CVE-2024-12195 Wordfence
6.4 Medium NinjaTeam Chat for Telegram Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0 CVE-2024-11885 Wordfence
4.3 Medium Team Member Plugin team-showcase-supreme Local File Inclusion Multi Language Supported Team plugin <= 7.4 - Limited Local File Inclusion ≤ 7.4 Fixed in 7.5 CVE-2024-52385 Patchstack
6.4 Medium Spectra – WordPress Gutenberg Blocks Plugin ultimate-addons-for-gutenberg Cross-Site Scripting WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget ≤ 2.16.2 CVE-2024-10484 Wordfence
6.5 Medium Luzuk Team Plugin luzuk-team Cross-Site Scripting ≤ 0.1.0 CVE-2024-51871 Patchstack
6.5 Medium OS Our Team Plugin os-our-team Cross-Site Scripting ≤ 1.7 CVE-2024-52341 Patchstack
6.4 Medium HT Team Member Plugin ht-team-member Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode ≤ 1.1.4 CVE-2024-10223 Wordfence
6.4 Medium Royal Elementor Addons and Templates Plugin royal-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Widget ≤ 1.3.986 CVE-2024-8482 Wordfence
4.8 Medium NinjaTeam Header Footer Custom Code Plugin header-footer-code Cross-Site Scripting Admin+ Stored XSS via CSS Styles < 1.2 Fixed in 1.2 CVE-2024-6617 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only