WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 451–500 of 1,456 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 10 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Wonka Slide Plugin wonka-slide Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.3 CVE-2026-1613 Wordfence
6.4 Medium Wikiloops Track Player Plugin wikiloops-track-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2026-1611 Wordfence
6.4 Medium Video Onclick Plugin video-onclick Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.4.7 CVE-2026-1608 Wordfence
6.4 Medium Simple Bible Verse via Shortcode Plugin simple-bible-verse-via-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1 CVE-2026-1570 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 5.4.8 CVE-2025-12159 Wordfence
6.4 Medium Bold Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode ≤ 5.5.1 CVE-2025-12803 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode ≤ 5.6.1 CVE-2025-15267 Wordfence
6.4 Medium Employee Directory Plugin employee-staff-directory Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute ≤ 1.2.1 CVE-2026-1279 Wordfence
6.4 Medium WaveSurfer-WP Plugin wavesurfer-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute ≤ 2.8.3 CVE-2026-1909 Wordfence
6.4 Medium Orange Confort+ accessibility toolbar Plugin orange-confort-plus Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.7 CVE-2026-1808 Wordfence
6.4 Medium Docus Plugin docus Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0.6 CVE-2026-1888 Wordfence
4.3 Medium Timeline Block Plugin timeline-block-block Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute ≤ 1.3.3 CVE-2026-1228 Wordfence
6.4 Medium Essential Widgets Plugin essential-widgets Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 3.0 CVE-2026-0867 Wordfence
8.8 High SportsPress Plugin sportspress Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode ≤ 2.7.26 CVE-2025-15368 Wordfence
4.3 Medium Latest Post Shortcode Plugin latest-post-shortcode Broken Access Control ≤ 14.2.0 Fixed in 14.2.1 CVE-2026-24995 Patchstack
6.5 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting ≤ 3.1.1 Fixed in 3.1.2 CVE-2026-24988 Patchstack
6.4 Medium Passster – Password Protect Pages and Content Plugin content-protector Cross-Site Scripting Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.2.24 CVE-2025-14865 Wordfence
6.4 Medium Buy Now Plus Plugin buy-now-plus Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0.2 CVE-2026-1295 Wordfence
6.4 Medium Forms Bridge Plugin forms-bridge Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute ≤ 4.2.5 CVE-2026-1244 Wordfence
6.4 Medium LeadBI Plugin leadbi Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute ≤ 1.7 CVE-2026-1189 Wordfence
6.4 Medium CM CSS Columns Plugin cm-css-columns Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute ≤ 1.2.1 CVE-2026-1098 Wordfence
6.4 Medium Administrative Shortcodes Plugin administrative-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes ≤ 0.3.4 CVE-2026-1099 Wordfence
6.4 Medium ThemeRuby Multi Authors Plugin themeruby-multi-authors Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes ≤ 1.0.0 CVE-2026-1097 Wordfence
6.4 Medium Canto Testimonials Plugin canto-testimonials Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute ≤ 1.0 CVE-2026-1095 Wordfence
4.3 Medium Simple Crypto Shortcodes Plugin simple-crypto-shortcodes Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 1.0.2 CVE-2025-14903 Wordfence
7.5 High Administrative Shortcodes Plugin administrative-shortcodes Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute ≤ 0.3.4 CVE-2026-1257 Wordfence
6.4 Medium WP DSGVO Tools (GDPR) Plugin shapepress-dsgvo Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode ≤ 3.1.36 CVE-2026-0914 Wordfence
7.3 High BuddyPress Plugin buddypress Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 14.3.3 CVE-2024-11976 Wordfence
6.4 Medium RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Plugin wp-rss-aggregator Cross-Site Scripting RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode ≤ 5.0.10 CVE-2025-14745 Wordfence
6.4 Medium Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin uncanny-automator Cross-Site Scripting Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 6.10.0.2 CVE-2025-15522 Wordfence
6.5 Medium Penci Shortcodes & Performance Plugin penci-shortcodes Cross-Site Scripting ≤ 6.1 Fixed in 6.2 CVE-2026-24354 Patchstack
4.3 Medium User Registration Plugin user-registration Arbitrary Shortcode Execution ≤ 4.4.9 Fixed in 5.0 CVE-2026-24353 Patchstack
5.3 Medium DeepDigital Theme deepdigital Arbitrary Shortcode Execution No login needed ≤ 1.0.2 CVE-2026-22469 Patchstack
5.3 Medium FluentForm Plugin fluentform Arbitrary Shortcode Execution No login needed ≤ 6.1.11 Fixed in 6.1.12 CVE-2025-69001 Patchstack
5.3 Medium WoodMart Theme woodmart Arbitrary Shortcode Execution No login needed ≤ 8.3.7 Fixed in 8.3.8 CVE-2025-47600 Patchstack
6.4 Medium CubeWP Plugin cubewp-framework Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode ≤ 1.1.26 CVE-2025-8615 Wordfence
6.4 Medium User Submitted Posts Plugin user-submitted-posts Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode ≤ 20260110 CVE-2026-0913 Wordfence
6.4 Medium Related Posts by Taxonomy Plugin related-posts-by-taxonomy Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode ≤ 2.7.6 CVE-2026-0916 Wordfence
7.2 High GetContentFromURL Plugin getcontentfromurl Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute No login needed ≤ 1.0 CVE-2025-14613 Wordfence
6.4 Medium SpiceForms Form Builder Plugin spiceforms-form-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0 CVE-2025-12178 Wordfence
6.5 Medium Gotham Block Extra Light Plugin gotham-block-extra-light Path Traversal Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode ≤ 1.5.0 CVE-2025-15020 Wordfence
6.4 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Modern Heading Widget ≤ 2.17.13 CVE-2025-12379 Wordfence
6.4 Medium Countdown Timer - Widget Countdown Plugin widget-countdown Cross-Site Scripting Widget Countdown <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.7.7 CVE-2025-14555 Wordfence
6.4 Medium The Tooltip Plugin the-tooltip Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0.2 CVE-2025-13908 Wordfence
6.4 Medium Menu Card Plugin menu-card Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.8.0 CVE-2025-13862 Wordfence
6.4 Medium Autogen Headers Menu Plugin autogen-headers-menu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'head_class' Shortcode Parameter ≤ 1.0.1 CVE-2025-13704 Wordfence
6.4 Medium Curved Text Plugin curved-text Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.1 CVE-2025-13854 Wordfence
6.4 Medium Woodpecker Plugin woodpecker Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute ≤ 3.0.4 CVE-2025-13967 Wordfence
6.4 Medium Debt.com Business in a Box Plugin debtcom-business-in-a-box Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.1.0 CVE-2025-13852 Wordfence
6.4 Medium PullQuote Plugin pullquote Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0 CVE-2025-13903 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only