WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–30 of 30 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.5 High	Vimeo Plugin `vimeo`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.2.2`	Aug 6, 2026	`CVE-2026-65543`	Patchstack
9.8 Critical	Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … Plugin `advanced-responsive-video-embedder`	Authentication Bypass Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin' Parameter No login needed	`10.8.7`	Jul 29, 2026	`CVE-2026-18072`	Wordfence
4.3 Medium	Vimeotheque Plugin `codeflavors-vimeo-video-post-lite`	Cross-Site Request Forgery No login needed	`≤ 2.3.5.2` Fixed in `2.3.6`	Dec 24, 2025	`CVE-2025-68584`	Patchstack
4.3 Medium	Vimeo SimpleGallery Plugin `vimeo-simplegallery`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification	`≤ 0.2`	Dec 12, 2025	`CVE-2025-14170`	Wordfence
6.5 Medium	Video Gallery – Vimeo and YouTube Gallery Plugin `smart-grid-gallery`	Cross-Site Scripting Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS)	`≤ 1.1.7`	Aug 28, 2025	`CVE-2025-48349`	Patchstack
7.1 High	Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin `lbg_vp_youtube_vimeo_addon_visual_composer`	Cross-Site Scripting No login needed	`≤ 2.1` Fixed in `2.2`	Aug 20, 2025	`CVE-2025-48154`	Patchstack
7.1 High	Youtube Vimeo Video Player and Slider WP Plugin `video-player-youtube-vimeo`	Cross-Site Scripting No login needed	`≤ 3.8` Fixed in `3.9`	Aug 20, 2025	`CVE-2025-48159`	Patchstack
7.1 High	Youtube Vimeo Video Player and Slider Plugin `video_player_youtube_vimeo`	Cross-Site Scripting No login needed	`≤ 3.8` Fixed in `3.9`	Aug 20, 2025	`CVE-2025-53563`	Patchstack
7.1 High	Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin `lbg_vp_youtube_vimeo_addon_visual_composer`	Cross-Site Scripting No login needed	`≤ 2.1`	Aug 14, 2025	`CVE-2025-30626`	Patchstack
7.1 High	Workbox Video from Vimeo & Youtube Plugin `workbox-video-from-vimeo-youtube-plugin`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.2.2`	Apr 11, 2025	`CVE-2025-32534`	Patchstack
8.5 High	Vimeotheque Plugin `codeflavors-vimeo-video-post-lite`	SQL Injection	`≤ 2.3.4.2` Fixed in `2.3.4.3`	Mar 27, 2025	`CVE-2025-30806`	Patchstack
5.3 Medium	Vimeography Plugin `vimeography`	Information Disclosure Full Path Disclosure (FPD) No login needed	`≤ 2.4.4` Fixed in `2.4.5`	Dec 16, 2024	`CVE-2024-54366`	Patchstack
7.2 High	YouTube Gallery and Vimeo Gallery Plugin `gallery-videos`	SQL Injection Authenticated (Administrator+) SQL Injection	`≤ 2.4.2`	Dec 6, 2024	`CVE-2024-10247`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Cross-Site Scripting Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor <= 4.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'provider_name'	`≤ 4.1.3`	Nov 28, 2024	`CVE-2024-11203`	Wordfence
5.5 Medium	Mixed Media Gallery Blocks Plugin	Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting	`≤ 3.2.4.2`	Nov 22, 2024	`CVE-2024-10034`	Wordfence
4.3 Medium	Ultimate YouTube Video & Shorts Player With Vimeo Plugin `ultimate-youtube-video-player`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Setting Exposure	`≤ 3.3`	Nov 22, 2024	`CVE-2024-11355`	Wordfence
4.3 Medium	Ultimate YouTube Video & Shorts Player With Vimeo Plugin `ultimate-youtube-video-player`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Playlist/Video Deletion	`≤ 3.3`	Nov 21, 2024	`CVE-2024-11354`	Wordfence
6.4 Medium	Mixed Media Gallery Blocks Plugin `simply-gallery-block`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via galleryID and className Parameters	`≤ 3.2.1`	Jun 28, 2024	`CVE-2024-5424`	Wordfence
4.3 Medium	Vimeography: Vimeo Video Gallery Plugin `vimeography`	Cross-Site Request Forgery No login needed	`≤ 2.4.1` Fixed in `2.4.2`	Jun 21, 2024	`CVE-2024-35770`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget	`≤ 4.0.1`	Jun 5, 2024	`CVE-2024-5571`	Wordfence
4.3 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Broken Access Control Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual	`≤ 3.9.12`	May 23, 2024	`CVE-2024-1803`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter	`≤ 3.9.16`	May 9, 2024	`CVE-2024-4316`	Wordfence
4.3 Medium	Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery Plugin `new-video-gallery`	Broken Access Control Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control	`≤ 1.5.3` Fixed in `1.5.4`	May 6, 2024	`CVE-2024-34377`	Patchstack
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.9.14`	Apr 9, 2024	`CVE-2024-3244`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Block	`≤ 3.9.14`	Apr 6, 2024	`CVE-2024-3245`	Wordfence
5.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripting via 'embedpress_doc_custom_color'	`≤ 3.9.12`	Mar 23, 2024	`CVE-2024-2688`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Block	`≤ 3.9.10`	Mar 7, 2024	`CVE-2024-1802`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget	`≤ 3.9.10`	Mar 7, 2024	`CVE-2024-2128`	Wordfence
8.8 High	Vimeography: Vimeo Video Gallery Plugin `vimeography`	PHP Object Injection Authenticated (Contributor+) PHP Object Injection	`≤ 2.3.2`	Mar 5, 2024	`CVE-2024-0825`	Wordfence
6.4 Medium	EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Plugin `embedpress`	Cross-Site Scripting Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`< 3.9.5` Fixed in `3.9.5`	Jan 3, 2024	`CVE-2023-6986`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.