WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 1–50 of 85 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.6 High | Slider by 10Web | SQL Injection |
≤ 1.2.63 |
CVE-2026-42710 |
Patchstack | |
| 6.5 Medium | 10Web Social Photo Feed | Broken Access Control No login needed |
≤ 1.4.35 |
CVE-2026-39787 |
Patchstack | |
| 4.3 Medium | WDS MCP Content Manager | Broken Access Control |
≤ 3.10.4 |
CVE-2026-39599 |
Patchstack | |
| 8.8 High | Save as PDF Plugin by PDFCrowd | Remote Code Execution Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute |
≤ 4.6.1 |
CVE-2026-92807 |
Wordfence | |
| 6.4 Medium | WP Crowdfunding | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter |
≤ 2.2.1 |
CVE-2026-19945 |
Wordfence | |
| 4.9 Medium | WP Crowdfunding | SQL Injection Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta |
≤ 2.2.1 |
CVE-2026-19944 |
Wordfence | |
| 7.4 High | Slider by 10Web | Cross-Site Request Forgery No login needed |
≤ 1.2.63 |
CVE-2026-66635 |
Patchstack | |
| 4.3 Medium | WP Crowdfunding | Broken Access Control Subscriber+ Campaign Creation via Missing Authorization |
< 2.2.1 Fixed in 2.2.1 |
CVE-2026-14859 |
WPScan | |
| 4.3 Medium | WP Crowdfunding | Information Disclosure Subscriber+ Order Data Disclosure via IDOR |
< 2.2.1 Fixed in 2.2.1 |
CVE-2026-14858 |
WPScan | |
| 4.3 Medium | WP Crowdfunding | Broken Access Control Subscriber+ Campaign Update Modification via IDOR |
< 2.2.1 Fixed in 2.2.1 |
CVE-2026-14857 |
WPScan | |
| 8.1 High | WPMU DEV Dashboard | Authentication Bypass Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint No login needed |
≤ 5.0.0 |
CVE-2026-15459 |
Wordfence | |
| 7.1 High | Dynamic Pricing With Discount Rules for WooCommerce | Cross-Site Scripting Reflected XSS via wdpAjax No login needed |
< 5.0.0 Fixed in 5.0.0 |
CVE-2026-13725 |
WPScan | |
| 5.3 Medium | Helpfulcrowd Product Reviews | Broken Access Control Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update No login needed |
≤ 1.2.9 |
CVE-2026-8499 |
Wordfence | |
| 4.0 Medium | Contact Form Maker | Cross-Site Request Forgery Contact Form by WD 1.13.1 CSRF to Local File Inclusion No login needed |
1.13.1 |
CVE-2019-25734 |
VulnCheck | |
| 9.8 Critical | Ad Manager WD | Path Traversal WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download No login needed |
1.0.11 |
CVE-2019-25727 |
VulnCheck | |
| 4.8 Medium | GWD Connect | Broken Access Control Unauthenticated Limited Code Execution via update_agent No login needed |
≤ 2.9 |
CVE-2026-6663 |
Wordfence | |
| 7.2 High | HTTP Headers | Remote Code Execution Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters |
≤ 1.19.2 |
CVE-2026-4132 |
Wordfence | |
| 6.5 Medium | LearnDash LMS | SQL Injection Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter |
≤ 5.0.3 |
CVE-2026-3079 |
Wordfence | |
| 6.4 Medium | WDES Responsive Popup | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute |
≤ 1.3.6 |
CVE-2026-1804 |
Wordfence | |
| 6.1 Medium | Save as PDF Plugin by PDFCrowd | Cross-Site Scripting Reflected Cross-Site Scripting via options No login needed |
≤ 4.5.5 |
CVE-2026-0862 |
Wordfence | |
| 5.3 Medium | WP Directory Kit | Information Disclosure Unauthenticated Email Exposure via wdk_public_action No login needed |
≤ 1.4.9 |
CVE-2025-13920 |
Wordfence | |
| 6.5 Medium | WDV One Page Docs | Broken Access Control No login needed |
≤ 1.2.4 |
CVE-2025-68896 |
Patchstack | |
| 3.8 Low | Crowdsignal Forms | Broken Access Control |
≤ 1.7.2 Fixed in 1.8.0 |
CVE-2025-69015 |
Patchstack | |
| 8.1 High | W&D | Local File Inclusion No login needed |
≤ 1.0 |
CVE-2025-60052 |
Patchstack | |
| 7.2 High | 10WebMapBuilder | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change No login needed |
< 1.0.64 Fixed in 1.0.64 |
CVE-2020-36853 |
Wordfence | |
| 5.3 Medium | WhyDonate – FREE Donate button – Crowdfunding – Fundraising | Broken Access Control FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion No login needed |
≤ 4.0.15 |
CVE-2025-10186 |
Wordfence | |
| 4.3 Medium | WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder | Broken Access Control Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function |
≤ 1.2.16 |
CVE-2025-9029 |
Wordfence | |
| 6.5 Medium | Save as PDF | Cross-Site Scripting |
≤ 4.5.2 Fixed in 4.5.3 |
CVE-2025-59552 |
Patchstack | |
| 7.2 High | Ultimate Video Player | Server-Side Request Forgery No login needed |
≤ 10.1 |
CVE-2025-49430 |
Patchstack | |
| 5.3 Medium | Ultimate Video Player | Broken Access Control No login needed |
≤ 10.1 |
CVE-2025-49432 |
Patchstack | |
| 6.4 Medium | Crowdfunding for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter |
≤ 3.1.14 |
CVE-2025-5767 |
Wordfence | |
| 7.5 High | Easy Video Player Wordpress & WooCommerce | Path Traversal Arbitrary File Download No login needed |
≤ 10.0 |
CVE-2025-28955 |
Patchstack | |
| 4.3 Medium | TM Replace Howdy | Cross-Site Request Forgery No login needed |
≤ 1.4.2 |
CVE-2025-49972 |
Patchstack | |
| 8.1 High | Krowd | Local File Inclusion No login needed |
≤ 1.5.0 Fixed in 1.5.0 |
CVE-2025-32595 |
Patchstack | |
| 4.8 Medium | Save as PDF by Pdfcrowd | Cross-Site Scripting Admin+ Stored XSS |
< 3.2.2 Fixed in 3.2.2 |
CVE-2024-3062 |
WPScan | |
| 4.3 Medium | FundEngine | Cross-Site Request Forgery No login needed |
≤ 1.7.3 Fixed in 1.7.4 |
CVE-2025-47459 |
Patchstack | |
| 7.1 High | Crowdfunding for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 3.1.12 Fixed in 3.1.13 |
CVE-2025-32628 |
Patchstack | |
| 9.3 Critical | CWD – Stealth Links | SQL Injection Stealth Links plugin <= 1.3 - SQL Injection No login needed |
≤ 1.3 |
CVE-2025-22655 |
Patchstack | |
| 7.1 High | Social Crowd | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 0.9.6.1 |
CVE-2025-31390 |
Patchstack | |
| 6.5 Medium | BWD Elementor Addons | Cross-Site Scripting |
≤ 4.4.2 |
CVE-2025-32189 |
Patchstack | |
| 6.5 Medium | WP Crowdfunding | Cross-Site Scripting |
≤ 2.1.15 Fixed in 2.1.16 |
CVE-2025-31892 |
Patchstack | |
| 6.4 Medium | WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder | Cross-Site Scripting Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.2.3 |
CVE-2024-12189 |
Wordfence | |
| 6.1 Medium | Slider by 10Web | Cross-Site Scripting Contributor+ Stored XSS No login needed |
< 1.2.62 Fixed in 1.2.62 |
CVE-2024-10566 |
WPScan | |
| 6.1 Medium | Slider by 10Web | Cross-Site Scripting Admin+ Stored XSS via Widget No login needed |
< 1.2.62 Fixed in 1.2.62 |
CVE-2024-10565 |
WPScan | |
| 5.3 Medium | WP Crowdfunding | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Post Content Download No login needed |
≤ 2.1.14 |
CVE-2025-1508 |
Wordfence | |
| 9.8 Critical | Save as PDF | PHP Object Injection No login needed |
≤ 4.4.0 Fixed in 4.4.1 |
CVE-2025-24671 |
Patchstack | |
| 5.3 Medium | LearnDash LMS | Broken Access Control No login needed |
≤ 4.20.0.1 Fixed in 4.20.0.3 |
CVE-2025-24662 |
Patchstack | |
| 7.1 High | FWD Slider | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0 |
CVE-2025-23462 |
Patchstack | |
| 4.3 Medium | BWD Elementor Addons | Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates |
≤ 4.3.18 |
CVE-2024-12532 |
Wordfence | |
| 5.4 Medium | 10Web Map Builder for Google Maps | Broken Access Control Notice Dismissal |
≤ 1.0.73 Fixed in 1.0.74 |
CVE-2023-45272 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.