Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,575 vulnerabilities, 2,034 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,326 High 9,490 Medium 18,379 Low 377 Not scored 3

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 28, 2026.

Showing 5,051–5,100 of 17,576 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 102 of 352
Severity Component Vulnerability Affected versions Published CVE Source
8.5 High DZS Video Gallery Plugin dzs-videogallery SQL Injection ≤ 12.39 Fixed in 12.40 CVE-2025-49049 Patchstack
7.1 High xPromoter Plugin top_bar_promoter Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.4 CVE-2025-49046 Patchstack
7.1 High Super Interactive Maps Plugin super-interactive-maps Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3 CVE-2025-49045 Patchstack
7.1 High Magic Responsive Slider and Carousel Plugin magic_carousel Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6 CVE-2025-49043 Patchstack
7.1 High Magic Slider Plugin magic_slider Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.2 CVE-2025-48094 Patchstack
7.1 High Image&Video FullScreen Background Plugin lbg_fullscreen_fullwidth_slider Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.7 CVE-2025-47666 Patchstack
5.3 Medium WoodMart Theme woodmart Arbitrary Shortcode Execution No login needed ≤ 8.3.7 Fixed in 8.3.8 CVE-2025-47600 Patchstack
3.8 Low Tutor LMS Plugin tutor Broken Access Control Insecure Direct Object References (IDOR) ≤ 3.9.4 Fixed in 3.9.5 CVE-2025-47555 Patchstack
5.9 Medium Stackable Plugin stackable-ultimate-gutenberg-blocks Cross-Site Scripting ≤ 3.19.5 Fixed in 3.19.6 CVE-2025-47500 Patchstack
8.1 High Anarkali Plugin anarkali Local File Inclusion No login needed ≤ 1.0.9 CVE-2025-47474 Patchstack
7.1 High HTML5 Video Player with Playlist & Multiple Skins Plugin lbg-vp2-html5-rightside Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.3.5 CVE-2025-32123 Patchstack
4.3 Medium Element Pack Elementor Addons Plugin bdthemes-element-pack-lite Cross-Site Request Forgery No login needed ≤ 8.3.13 Fixed in 8.3.14 CVE-2025-31413 Patchstack
7.1 High HTML5 Video Player Plugin lbg-vp2-html5-bottom Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.3.5 CVE-2025-27005 Patchstack
9.8 Critical Academy LMS – WordPress LMS Plugin for Complete eLearning Solution Plugin academy Privilege Escalation WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover No login needed ≤ 3.5.0 CVE-2025-15521 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Broken Access Control WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API No login needed ≤ 4.3.2.4 CVE-2025-14798 Wordfence
4.3 Medium Newsletter – Send awesome emails from Plugin newsletter Cross-Site Request Forgery Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription No login needed ≤ 9.1.0 CVE-2026-1051 Wordfence
4.3 Medium Phrase TMS Integration Plugin memsource-connector Broken Access Control Missing Authorization to Authenticated (Subscriber+) Log Deletion ≤ 4.7.5 CVE-2025-12168 Wordfence
10.0 Critical Modular DS Plugin modular-connector Privilege Escalation No login needed 2.5.2 – < 2.6.0 Fixed in 2.6.0 CVE-2026-23800 Patchstack
5.0 Medium DK PDF – WordPress PDF Generator Plugin dk-pdf Server-Side Request Forgery WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery ≤ 2.3.0 Fixed in 2.3.1 CVE-2025-14793 Wordfence
5.3 Medium Fancy Product Designer | WooCommerce Plugin Information Disclosure Unauthenticated Full Path Disclosure via 'pdf' Parameter No login needed ≤ 6.4.8 CVE-2025-15526 Wordfence
6.5 Medium Awesome Support – WordPress HelpDesk & Support Plugin awesome-support Broken Access Control WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion No login needed ≤ 6.3.6 Fixed in 6.3.7 CVE-2025-12641 Wordfence
10.0 Critical Modular DS Plugin modular-connector Privilege Escalation No login needed ≤ 2.5.1 Fixed in 2.5.2 CVE-2026-23550 Patchstack
4.3 Medium SocialChamp with Plugin auto-post-to-social-media-wp-to-social-champ Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 1.3.5 CVE-2025-14846 Wordfence
6.4 Medium Woodpecker Plugin woodpecker Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_name' Shortcode Attribute ≤ 3.0.4 CVE-2025-13967 Wordfence
5.3 Medium Re Gallery Plugin regallery Broken Access Control No login needed ≤ 1.18.9 Fixed in 1.18.10 CVE-2026-22486 Patchstack
4.3 Medium Speed Kit Plugin baqend Broken Access Control ≤ 2.0.2 CVE-2026-22487 Patchstack
5.3 Medium Dashboard Welcome for Beaver Builder Plugin dashboard-welcome-for-beaver-builder Broken Access Control No login needed ≤ 1.0.8 CVE-2026-22488 Patchstack
4.3 Medium Image Slider Slideshow Plugin image-slider-slideshow Broken Access Control Insecure Direct Object References (IDOR) ≤ 1.8 CVE-2026-22489 Patchstack
5.4 Medium Bulk Landing Page Creator for WordPress LPagery Plugin lpagery Broken Access Control ≤ 2.4.9 Fixed in 2.4.10 CVE-2026-22490 Patchstack
4.3 Medium Docket Cache Plugin docket-cache Broken Access Control ≤ 24.07.04 Fixed in 24.07.05 CVE-2026-22492 Patchstack
5.4 Medium GA4WP: Google Analytics Plugin ga-for-wp Broken Access Control ≤ 2.10.0 CVE-2026-22517 Patchstack
6.5 Medium X Addons for Elementor Plugin x-addons-elementor Cross-Site Scripting ≤ 1.0.23 CVE-2026-22518 Patchstack
6.5 Medium MediaPress Plugin mediapress Cross-Site Scripting ≤ 1.6.2 Fixed in 1.6.3 CVE-2026-22519 Patchstack
7.5 High Handmade Framework Plugin handmade-framework Local File Inclusion ≤ 3.9 CVE-2026-22521 Patchstack
6.5 Medium Block Slider Plugin block-slider Broken Access Control ≤ 2.2.3 CVE-2026-22522 Patchstack
5.3 Medium Zorka Theme zorka Broken Access Control No login needed ≤ 1.5.7 CVE-2026-0676 Patchstack
4.3 Medium Campaign Monitor Plugin forms-for-campaign-monitor Broken Access Control ≤ 2.9.1 Fixed in 2.9.2 CVE-2026-0674 Patchstack
5.4 Medium Easy Media Download Plugin easy-media-download Content Injection CSS Injection ≤ 1.1.11 Fixed in 1.1.12 CVE-2025-69169 Patchstack
7.1 High Scroll rss excerpt Plugin scroll-rss-excerpt Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.0 CVE-2025-68892 Patchstack
7.1 High WP App Bar Plugin wp-app-bar Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.5 CVE-2025-68891 Patchstack
7.1 High e-shops Plugin e-shops-cart2 Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.4 CVE-2025-68890 Patchstack
7.1 High Pinpoll Plugin pinpoll Cross-Site Scripting No login needed ≤ 4.0.0 CVE-2025-68889 Patchstack
7.1 High WP-BusinessDirectory Plugin wp-businessdirectory Cross-Site Scripting No login needed ≤ 4.0.1 CVE-2025-68887 Patchstack
6.5 Medium Flaming Password Reset Plugin flaming-password-reset Cross-Site Scripting ≤ 1.0.3 CVE-2025-68875 Patchstack
7.1 High Visitor Stats Widget Plugin visitor-stats-widget Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.5.0 CVE-2025-68874 Patchstack
7.1 High PRIMER by chloédigital Plugin primer-by-chloedigital Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.25 CVE-2025-68873 Patchstack
6.5 Medium Effect Maker Plugin effect-maker Cross-Site Scripting ≤ 1.2.1 CVE-2025-68867 Patchstack
8.1 High Hendon Theme hendon Local File Inclusion No login needed ≤ 1.7 Fixed in 1.7 CVE-2025-67937 Patchstack
8.1 High Curly Theme curly Local File Inclusion No login needed ≤ 3.3 Fixed in 3.3 CVE-2025-67936 Patchstack
8.1 High Optimize Theme optimizewp Local File Inclusion No login needed ≤ 2.4 Fixed in 2.4 CVE-2025-67935 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only