WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 5,151–5,200 of 8,943 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 104 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.5 Medium	Forex Calculators Plugin `fx-calculators`	Cross-Site Scripting	`≤ 1.3.6` Fixed in `1.3.7`	Feb 16, 2025	`CVE-2025-22689`	Patchstack
6.5 Medium	AWS S3 for WordPress Plugin – Upcasted Plugin `upcasted-s3-offload`	Cross-Site Scripting	`≤ 3.0.3` Fixed in `3.0.4`	Feb 16, 2025	`CVE-2025-22676`	Patchstack
5.3 Medium	LTL Freight Quotes – Worldwide Express Edition Plugin `ltl-freight-quotes-worldwide-express-edition`	Broken Access Control Worldwide Express Edition plugin <= 5.0.20 - Arbitrary Content Deletion No login needed	`≤ 5.0.20` Fixed in `5.0.21`	Feb 16, 2025	`CVE-2025-22291`	Patchstack
6.5 Medium	LTL Freight Quotes – Unishippers Edition Plugin `ltl-freight-quotes-unishippers-edition`	Broken Access Control Unishippers Edition plugin <= 2.5.8 - Broken Access Control No login needed	`≤ 2.5.8` Fixed in `2.5.9`	Feb 16, 2025	`CVE-2025-22289`	Patchstack
6.3 Medium	Photography Plugin `photography`	Broken Access Control	`≤ 7.7.2`	Feb 14, 2025	`CVE-2025-22702`	Patchstack
6.3 Medium	Accessibility Suite Plugin `online-accessibility`	Broken Access Control Multiple Broken Access Control	`≤ 4.18` Fixed in `4.19`	Feb 14, 2025	`CVE-2025-22698`	Patchstack
5.8 Medium	IdeaPush Plugin `ideapush`	Broken Access Control No login needed	`≤ 8.71` Fixed in `8.73`	Feb 14, 2025	`CVE-2025-24607`	Patchstack
6.5 Medium	WP Mailster Plugin `wp-mailster`	Information Disclosure Sensitive Data Exposure	`≤ 1.8.16.0` Fixed in `1.8.17.0`	Feb 14, 2025	`CVE-2025-24567`	Patchstack
6.5 Medium	Push Notification for Post and BuddyPress Plugin `push-notification-for-post-and-buddypress`	Broken Access Control Settings Change No login needed	`≤ 2.11` Fixed in `2.12`	Feb 14, 2025	`CVE-2025-23771`	Patchstack
6.5 Medium	OPSI Israel Domestic Shipments Plugin `woo-ups-pickup`	Broken Access Control No login needed	`≤ 2.8.2`	Feb 14, 2025	`CVE-2025-23766`	Patchstack
6.5 Medium	WPLingo Plugin `wplingo`	Broken Access Control Arbitrary Content Deletion	`≤ 1.1.2`	Feb 14, 2025	`CVE-2025-23534`	Patchstack
6.5 Medium	Embed Google Map Plugin `embed-google-map`	Cross-Site Scripting	`≤ 3.2`	Feb 13, 2025	`CVE-2025-26539`	Patchstack
6.5 Medium	Prezi Embedder Plugin `prezi-embedder`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 2.1`	Feb 13, 2025	`CVE-2025-26538`	Patchstack
6.5 Medium	Google Drive WP Media Plugin `google-drive-wp-media`	Cross-Site Scripting	`≤ 2.4.4`	Feb 13, 2025	`CVE-2025-26574`	Patchstack
6.5 Medium	Font Awesome WP Plugin `font-awesome-wp`	Cross-Site Scripting	`≤ 1.0`	Feb 13, 2025	`CVE-2025-26567`	Patchstack
5.9 Medium	Elfsight Yottie Lite Plugin `yottie-lite`	Cross-Site Scripting	`≤ 1.3.3`	Feb 13, 2025	`CVE-2025-26561`	Patchstack
6.5 Medium	Aparat Responsive Plugin `aparat-responsive`	Cross-Site Scripting	`≤ 1.3`	Feb 13, 2025	`CVE-2025-26558`	Patchstack
6.1 Medium	Listivo - Classified Ads Theme	Cross-Site Scripting Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site Scripting No login needed	`≤ 2.3.67`	Feb 13, 2025	`CVE-2024-13867`	Wordfence
5.4 Medium	Global Gallery - WordPress Responsive Gallery Plugin	Arbitrary Shortcode Execution WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution	`≤ 9.1.5`	Feb 12, 2025	`CVE-2024-13814`	Wordfence
6.4 Medium	Discover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin `gs-woo-brands`	Cross-Site Scripting Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 1.3.2`	Feb 12, 2025	`CVE-2024-11746`	Wordfence
6.4 Medium	Puzzles \| WP Magazine / Review with Store WordPress Theme + RTL Theme	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	`≤ 4.2.4`	Feb 12, 2025	`CVE-2024-13769`	Wordfence
4.3 Medium	aDirectory – WordPress Directory Listing Plugin `adirectory`	Broken Access Control WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion	`≤ 2.3`	Feb 12, 2025	`CVE-2024-13541`	Wordfence
5.3 Medium	The Ultimate WordPress Toolkit – WP Extended Plugin	Broken Access Control WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation No login needed	`≤ 3.0.13`	Feb 12, 2025	`CVE-2024-13554`	Wordfence
6.4 Medium	DWT - Directory & Listing Theme	Cross-Site Scripting Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.3.4`	Feb 8, 2025	`CVE-2025-0169`	Wordfence
4.3 Medium	GlobalQuran Plugin `globalquran`	Cross-Site Request Forgery CSRF to Settings Change No login needed	`≤ 1.0`	Feb 7, 2025	`CVE-2025-25143`	Patchstack
5.4 Medium	Infusionsoft Analytics Plugin `infusionsoft-web-tracker`	Cross-Site Request Forgery No login needed	`≤ 2.0`	Feb 7, 2025	`CVE-2025-25145`	Patchstack
6.5 Medium	Optimate Ads Plugin `optimate-ads`	Cross-Site Scripting	`≤ 1.0.3`	Feb 7, 2025	`CVE-2025-25136`	Patchstack
4.3 Medium	Songkick Concerts and Festivals Plugin `songkick-concerts-and-festivals`	Cross-Site Request Forgery No login needed	`≤ 0.9.7` Fixed in `0.10.0`	Feb 7, 2025	`CVE-2025-25146`	Patchstack
6.5 Medium	Smart Countdown FX Plugin `smart-countdown-fx`	Cross-Site Scripting	`≤ 1.5.5`	Feb 7, 2025	`CVE-2025-25117`	Patchstack
4.3 Medium	Slide Banners Plugin `slide-banners`	Broken Access Control	`≤ 1.3`	Feb 7, 2025	`CVE-2025-25120`	Patchstack
5.9 Medium	Pop Up Plugin `popup-seo-optimized`	Cross-Site Scripting	`≤ 0.1`	Feb 7, 2025	`CVE-2025-25105`	Patchstack
4.3 Medium	Indeed API Plugin `indeed-api`	Cross-Site Request Forgery CSRF to Settings Change No login needed	`≤ 0.5`	Feb 7, 2025	`CVE-2025-25103`	Patchstack
6.5 Medium	External Video For Everybody Plugin `external-video-for-everybody`	Cross-Site Scripting	`≤ 2.1.1`	Feb 7, 2025	`CVE-2025-25097`	Patchstack
5.4 Medium	Event Kikfyre Plugin `kikfyre-events-calendar-tickets`	Broken Access Control	`≤ 2.1.8`	Feb 7, 2025	`CVE-2025-25110`	Patchstack
5.4 Medium	WP Spell Check Plugin `wp-spell-check`	Cross-Site Request Forgery No login needed	`≤ 9.21` Fixed in `9.22`	Feb 7, 2025	`CVE-2025-25111`	Patchstack
4.8 Medium	Embed RSS Plugin `embed-rss`	Arbitrary Shortcode Execution	`≤ 3.1`	Feb 7, 2025	`CVE-2025-25081`	Patchstack
6.5 Medium	ReverbNation Widgets Plugin `reverbnation-widgets`	Cross-Site Scripting Cross Site Scripting (XSS) vulnerability<	`≤ 2.1`	Feb 7, 2025	`CVE-2025-25095`	Patchstack
6.1 Medium	Child Themes Helper Plugin `child-themes-helper`	Cross-Site Request Forgery CSRF to Arbitrary File Deletion No login needed	`≤ 2.2.7`	Feb 7, 2025	`CVE-2025-25093`	Patchstack
6.5 Medium	RSS in Page Plugin `rss-in-page`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 2.9.1`	Feb 7, 2025	`CVE-2025-25096`	Patchstack
6.5 Medium	WP SimpleWeather Plugin `wp-simpleweather`	Cross-Site Scripting	`≤ 0.2.5`	Feb 7, 2025	`CVE-2025-25085`	Patchstack
6.5 Medium	Breaking News Ticker Plugin `breaking-news-ticker`	Cross-Site Scripting	`≤ 2.4.4`	Feb 7, 2025	`CVE-2025-25094`	Patchstack
6.5 Medium	Kona Gallery Block Plugin `kona-instagram-feed-for-gutenberg`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 1.7`	Feb 7, 2025	`CVE-2025-25080`	Patchstack
6.5 Medium	Easy Chart Builder Plugin `easy-chart-builder`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 1.3`	Feb 7, 2025	`CVE-2025-25077`	Patchstack
6.5 Medium	Google Earth Embed Plugin `google-earth-tours`	Cross-Site Scripting	`≤ 1.0`	Feb 7, 2025	`CVE-2025-25078`	Patchstack
6.5 Medium	Simple Select All Text Box Plugin `simple-select-all-text-box`	Cross-Site Scripting	`≤ 3.2`	Feb 7, 2025	`CVE-2025-25079`	Patchstack
6.5 Medium	Links in Captions Plugin `links-in-captions`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 1.2`	Feb 7, 2025	`CVE-2025-25098`	Patchstack
6.5 Medium	FlexIDX Home Search Plugin `flexidx-home-search`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 2.1.2`	Feb 7, 2025	`CVE-2025-25082`	Patchstack
5.9 Medium	Easy WP Tiles Plugin `easy-wp-tiles`	Cross-Site Scripting	`≤ 1`	Feb 7, 2025	`CVE-2025-25073`	Patchstack
6.5 Medium	NextGen Cooliris Gallery Plugin `nextgen-cooliris-gallery`	Cross-Site Scripting	`≤ 0.7`	Feb 7, 2025	`CVE-2025-25091`	Patchstack
6.5 Medium	Graceful Email Obfuscation Plugin `graceful-email-obfuscation`	Cross-Site Scripting	`≤ 0.2.2`	Feb 7, 2025	`CVE-2025-25076`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.