WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 57 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium 10Web Social Photo Feed Plugin wd-instagram-feed Broken Access Control No login needed ≤ 1.4.35 CVE-2026-39787 Patchstack
4.3 Medium WDS MCP Content Manager Plugin wds-mcp-content-manager Broken Access Control ≤ 3.10.4 CVE-2026-39599 Patchstack
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter ≤ 2.2.1 CVE-2026-19945 Wordfence
4.9 Medium WP Crowdfunding Plugin wp-crowdfunding SQL Injection Authenticated (Shop Manager+) SQL Injection via 'wpneo_reward' Post Meta ≤ 2.2.1 CVE-2026-19944 Wordfence
4.3 Medium WP Crowdfunding Plugin wp-crowdfunding Broken Access Control Subscriber+ Campaign Creation via Missing Authorization < 2.2.1 Fixed in 2.2.1 CVE-2026-14859 WPScan
4.3 Medium WP Crowdfunding Plugin wp-crowdfunding Information Disclosure Subscriber+ Order Data Disclosure via IDOR < 2.2.1 Fixed in 2.2.1 CVE-2026-14858 WPScan
4.3 Medium WP Crowdfunding Plugin wp-crowdfunding Broken Access Control Subscriber+ Campaign Update Modification via IDOR < 2.2.1 Fixed in 2.2.1 CVE-2026-14857 WPScan
5.3 Medium Helpfulcrowd Product Reviews Plugin helpfulcrowd-product-reviews Broken Access Control Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update No login needed ≤ 1.2.9 CVE-2026-8499 Wordfence
4.0 Medium Contact Form Maker Plugin contact-form-maker Cross-Site Request Forgery Contact Form by WD 1.13.1 CSRF to Local File Inclusion No login needed 1.13.1 CVE-2019-25734 VulnCheck
4.8 Medium GWD Connect Plugin graphic-web-design-inc Broken Access Control Unauthenticated Limited Code Execution via update_agent No login needed ≤ 2.9 CVE-2026-6663 Wordfence
6.5 Medium LearnDash LMS Plugin sfwd-lms SQL Injection Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter ≤ 5.0.3 CVE-2026-3079 Wordfence
6.4 Medium WDES Responsive Popup Plugin wdes-responsive-popup Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute ≤ 1.3.6 CVE-2026-1804 Wordfence
6.1 Medium Save as PDF Plugin by PDFCrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting Reflected Cross-Site Scripting via options No login needed ≤ 4.5.5 CVE-2026-0862 Wordfence
5.3 Medium WP Directory Kit Plugin wpdirectorykit Information Disclosure Unauthenticated Email Exposure via wdk_public_action No login needed ≤ 1.4.9 CVE-2025-13920 Wordfence
6.5 Medium WDV One Page Docs Plugin wdv-one-page-docs Broken Access Control No login needed ≤ 1.2.4 CVE-2025-68896 Patchstack
5.3 Medium WhyDonate – FREE Donate button – Crowdfunding – Fundraising Plugin wp-whydonate Broken Access Control FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion No login needed ≤ 4.0.15 CVE-2025-10186 Wordfence
4.3 Medium WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Plugin wdesignkit Broken Access Control Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function ≤ 1.2.16 CVE-2025-9029 Wordfence
6.5 Medium Save as PDF Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting ≤ 4.5.2 Fixed in 4.5.3 CVE-2025-59552 Patchstack
5.3 Medium Ultimate Video Player Plugin fwduvp Broken Access Control No login needed ≤ 10.1 CVE-2025-49432 Patchstack
6.4 Medium Crowdfunding for WooCommerce Plugin crowdfunding-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter ≤ 3.1.14 CVE-2025-5767 Wordfence
4.3 Medium TM Replace Howdy Plugin tm-replace-howdy Cross-Site Request Forgery No login needed ≤ 1.4.2 CVE-2025-49972 Patchstack
4.8 Medium Save as PDF by Pdfcrowd Plugin Cross-Site Scripting Admin+ Stored XSS < 3.2.2 Fixed in 3.2.2 CVE-2024-3062 WPScan
4.3 Medium FundEngine Plugin wp-fundraising-donation Cross-Site Request Forgery No login needed ≤ 1.7.3 Fixed in 1.7.4 CVE-2025-47459 Patchstack
6.5 Medium BWD Elementor Addons Plugin bwd-elementor-addons Cross-Site Scripting ≤ 4.4.2 CVE-2025-32189 Patchstack
6.5 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting ≤ 2.1.15 Fixed in 2.1.16 CVE-2025-31892 Patchstack
6.4 Medium WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Plugin Cross-Site Scripting Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.3 CVE-2024-12189 Wordfence
6.1 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Contributor+ Stored XSS No login needed < 1.2.62 Fixed in 1.2.62 CVE-2024-10566 WPScan
6.1 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Admin+ Stored XSS via Widget No login needed < 1.2.62 Fixed in 1.2.62 CVE-2024-10565 WPScan
5.3 Medium WP Crowdfunding Plugin wp-crowdfunding Broken Access Control Missing Authorization to Authenticated (Subscriber+) Post Content Download No login needed ≤ 2.1.14 CVE-2025-1508 Wordfence
5.3 Medium LearnDash LMS Plugin sfwd-lms Broken Access Control No login needed ≤ 4.20.0.1 Fixed in 4.20.0.3 CVE-2025-24662 Patchstack
4.3 Medium BWD Elementor Addons Plugin bwd-elementor-addons Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates ≤ 4.3.18 CVE-2024-12532 Wordfence
5.4 Medium 10Web Map Builder for Google Maps Plugin wd-google-maps Broken Access Control Notice Dismissal ≤ 1.0.73 Fixed in 1.0.74 CVE-2023-45272 Patchstack
4.3 Medium 10WebAnalytics Plugin wd-google-analytics Broken Access Control ≤ 1.2.12 CVE-2023-47807 Patchstack
4.3 Medium WP Crowdfunding Plugin wp-crowdfunding Broken Access Control ≤ 2.1.5 Fixed in 2.1.6 CVE-2023-41870 Patchstack
4.3 Medium WP Crowdfunding Plugin wp-crowdfunding Broken Access Control Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation ≤ 2.1.12 CVE-2024-11911 Wordfence
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.1.15 CVE-2024-11910 Wordfence
6.6 Medium WDesignkit Plugin wdesignkit Arbitrary File Upload ≤ 1.0.40 Fixed in 1.1.0 CVE-2024-53811 Patchstack
6.4 Medium Pricing Tables For WPBakery Page Builder (formerly Visual Composer) Plugin pricing-tables-for-visual-composer Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode ≤ 1.4 CVE-2024-10175 Wordfence
6.4 Medium Save as PDF Plugin by Pdfcrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.2.1 CVE-2024-10891 Wordfence
4.3 Medium Crowdsignal Dashboard – Polls, Surveys & more Plugin polldaddy Cross-Site Request Forgery No login needed ≤ 3.1.3 Fixed in 3.1.4 CVE-2024-43338 Patchstack
6.5 Medium Wd-image-magnifier-xoss Plugin wd-image-magnifier-xoss Cross-Site Scripting ≤ 1.0 CVE-2024-51840 Patchstack
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Broken Access Control Settings Change ≤ 2.1.10 Fixed in 2.1.11 CVE-2024-43937 Patchstack
6.4 Medium WP Crowdfunding Plugin wp-crowdfunding Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode ≤ 2.1.11 CVE-2024-10117 Wordfence
6.1 Medium 10Web Social Post Feed Plugin wd-facebook-feed Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.2.9 CVE-2024-9607 Wordfence
4.8 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Admin+ Stored XSS < 1.2.59 Fixed in 1.2.59 CVE-2024-8283 WPScan
5.4 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Editor+ Stored XSS < 1.2.57 Fixed in 1.2.57 CVE-2024-6408 WPScan
5.4 Medium IgnitionDeck Crowdfunding Platform Plugin ignitiondeck Broken Access Control Missing Authorization ≤ 1.9.8 CVE-2024-4410 Wordfence
5.9 Medium Save as PDF plugin by Pdfcrowd Plugin save-as-pdf-by-pdfcrowd Cross-Site Scripting ≤ 4.0.0 Fixed in 4.0.1 CVE-2024-37549 Patchstack
6.1 Medium Slider by 10Web Plugin slider-wd Cross-Site Scripting Editor+ Stored XSS No login needed < 1.2.56 Fixed in 1.2.56 CVE-2024-6026 WPScan
5.3 Medium WP Fundraising Donation and Crowdfunding Platform Plugin wp-fundraising-donation Broken Access Control Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control No login needed ≤ 1.6.4 Fixed in 1.7.0 CVE-2024-34758 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only