WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 5,351–5,400 of 8,943 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 108 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.5 Medium	Linet ERP-Woocommerce Integration Plugin `linet-erp-woocommerce-integration`	Cross-Site Request Forgery CSRF to Broken Access Control No login needed	`≤ 3.5.7` Fixed in `3.5.8`	Jan 24, 2025	`CVE-2025-24594`	Patchstack
6.5 Medium	All Embed – Elementor Addons Plugin `all-embed-addons-for-elementor`	Cross-Site Scripting Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS)	`≤ 1.1.3` Fixed in `1.1.4`	Jan 24, 2025	`CVE-2025-24595`	Patchstack
6.5 Medium	WP Fast Total Search Plugin `fulltext-search`	Cross-Site Request Forgery No login needed	`≤ 1.78.258` Fixed in `1.79.262`	Jan 24, 2025	`CVE-2025-24572`	Patchstack
6.5 Medium	Patreon Plugin `patreon-connect`	Broken Access Control No login needed	`≤ 1.9.1` Fixed in `1.9.2`	Jan 24, 2025	`CVE-2025-24588`	Patchstack
4.3 Medium	Ultimate Coming Soon & Maintenance Plugin `ultimate-coming-soon`	Cross-Site Request Forgery No login needed	`≤ 1.0.9` Fixed in `1.1.0`	Jan 24, 2025	`CVE-2025-24543`	Patchstack
6.5 Medium	PageLayer Plugin `pagelayer`	Cross-Site Scripting	`≤ 1.9.4` Fixed in `1.9.5`	Jan 24, 2025	`CVE-2025-24573`	Patchstack
5.3 Medium	Paytium Plugin `paytium`	Information Disclosure Full Path Disclosure (FPD) No login needed	`≤ 4.4.11` Fixed in `4.4.12`	Jan 24, 2025	`CVE-2025-24552`	Patchstack
6.5 Medium	Caching Compatible Cookie Opt-In and JavaScript Plugin `caching-compatible-cookie-optin-and-javascript`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 0.0.10` Fixed in `0.0.11`	Jan 24, 2025	`CVE-2025-24547`	Patchstack
4.3 Medium	JSM Show Post Metadata Plugin `jsm-show-post-meta`	Broken Access Control	`≤ 4.6.0` Fixed in `4.6.1`	Jan 24, 2025	`CVE-2025-24589`	Patchstack
5.9 Medium	Nested Pages Plugin `wp-nested-pages`	Cross-Site Scripting	`≤ 3.2.9` Fixed in `3.2.10`	Jan 24, 2025	`CVE-2025-24579`	Patchstack
6.5 Medium	Event post Plugin `event-post`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 5.9.7` Fixed in `5.9.8`	Jan 24, 2025	`CVE-2025-24585`	Patchstack
6.5 Medium	Icegram Plugin `icegram`	Cross-Site Scripting	`≤ 3.1.31` Fixed in `3.1.32`	Jan 24, 2025	`CVE-2025-24542`	Patchstack
6.5 Medium	ElementInvader Addons for Elementor Plugin `elementinvader-addons-for-elementor`	Cross-Site Scripting	`≤ 1.3.0` Fixed in `1.3.1`	Jan 24, 2025	`CVE-2025-24578`	Patchstack
4.3 Medium	GDPR CCPA Compliance Support Plugin `ninja-gdpr-compliance`	Broken Access Control	`≤ 2.7.1` Fixed in `2.7.2`	Jan 24, 2025	`CVE-2025-24591`	Patchstack
5.4 Medium	WP Fast Total Search Plugin `fulltext-search`	Broken Access Control	`≤ 1.78.258` Fixed in `1.79.262`	Jan 24, 2025	`CVE-2025-24571`	Patchstack
5.4 Medium	Ultimate Coming Soon & Maintenance Plugin `ultimate-coming-soon`	Cross-Site Request Forgery No login needed	`≤ 1.0.9` Fixed in `1.1.0`	Jan 24, 2025	`CVE-2025-24546`	Patchstack
5.3 Medium	12 Step Meeting List Plugin `12-step-meeting-list`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 3.16.5` Fixed in `3.16.6`	Jan 24, 2025	`CVE-2025-24582`	Patchstack
6.5 Medium	12 Step Meeting List Plugin `12-step-meeting-list`	Broken Access Control Arbitrary Content Deletion	`≤ 3.16.5` Fixed in `3.16.6`	Jan 24, 2025	`CVE-2025-24580`	Patchstack
6.5 Medium	HelloAsso Plugin `helloasso`	Cross-Site Scripting	`≤ 1.1.11` Fixed in `1.1.12`	Jan 24, 2025	`CVE-2025-24575`	Patchstack
4.3 Medium	Starter Templates Plugin `astra-sites`	Cross-Site Request Forgery No login needed	`≤ 4.4.9` Fixed in `4.4.10`	Jan 24, 2025	`CVE-2025-24568`	Patchstack
4.3 Medium	Product Size Charts Plugin for WooCommerce Plugin `woo-advanced-product-size-chart`	Broken Access Control	`≤ 2.4.5` Fixed in `2.4.6`	Jan 24, 2025	`CVE-2025-23991`	Patchstack
6.5 Medium	Jobify - Job Board Theme	Broken Access Control Job Board WordPress Theme <= 4.2.7 - Missing Authorization to Unauthenticated Server-Side Request Forgery, Arbitrary Image Upload, and Image Generation No login needed	`≤ 4.2.7`	Jan 24, 2025	`CVE-2024-13698`	Wordfence
6.4 Medium	Precious Metals Charts and Widgets Plugin `precious-metals-chart-and-widgets`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-site Scripting	`≤ 1.2.8`	Jan 24, 2025	`CVE-2024-13572`	Wordfence
6.1 Medium	SEO Blogger to WordPress Migration using 301 Redirection Plugin `seo-blogger-to-wordpress-301-redirector`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 0.4.8`	Jan 23, 2025	`CVE-2024-13422`	Wordfence
5.9 Medium	Toocheke Companion Plugin `toocheke-companion`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 1.166` Fixed in `1.167`	Jan 22, 2025	`CVE-2025-23992`	Patchstack
6.5 Medium	Database Sync Plugin `database-sync`	Information Disclosure Sensitive Data Exposure	`≤ 0.5.1`	Jan 22, 2025	`CVE-2025-23486`	Patchstack
4.3 Medium	Debug Tool Plugin `debug-tool`	Broken Access Control	`≤ 2.2`	Jan 22, 2025	`CVE-2025-23684`	Patchstack
4.3 Medium	WPBot Pro Wordpress Chatbot Plugin	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation	`≤ 13.5.5`	Jan 22, 2025	`CVE-2024-12879`	Wordfence
4.3 Medium	AnyRoad Plugin `anyguide`	Cross-Site Request Forgery No login needed	`≤ 1.3.2`	Jan 21, 2025	`CVE-2025-23996`	Patchstack
4.3 Medium	Widget Options Plugin `widget-options`	Broken Access Control Broken Access Control to Notice Dimissal	`≤ 4.0.8` Fixed in `4.0.9`	Jan 21, 2025	`CVE-2025-22722`	Patchstack
4.3 Medium	ApplyOnline Plugin `apply-online`	Broken Access Control	`≤ 2.6.7.1` Fixed in `2.6.7.2`	Jan 21, 2025	`CVE-2025-22721`	Patchstack
6.5 Medium	Online Payments – Get Paid with PayPal, Square & Stripe Plugin `paypal-payment-button-by-vcita`	Cross-Site Scripting	`≤ 3.20.0` Fixed in `3.30.0`	Jan 21, 2025	`CVE-2025-22661`	Patchstack
5.9 Medium	Related Post Shortcode Plugin `related-post-shortcode`	Cross-Site Scripting	`≤ 1.2`	Jan 21, 2025	`CVE-2025-22276`	Patchstack
6.5 Medium	Weaver Themes Shortcode Compatibility Plugin `weaver-themes-shortcode-compatibility`	Cross-Site Scripting	`≤ 1.0.4`	Jan 21, 2025	`CVE-2025-22267`	Patchstack
6.5 Medium	Tamara Checkout Plugin `tamara-checkout`	Cross-Site Scripting	`≤ 1.9.9.1` Fixed in `1.9.9.1`	Jan 21, 2025	`CVE-2025-23997`	Patchstack
6.5 Medium	Flexible PDF Coupons Plugin `flexible-coupons`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 1.10.3` Fixed in `1.10.3`	Jan 21, 2025	`CVE-2025-22825`	Patchstack
6.5 Medium	Ad Blocking Detector Plugin `ad-blocking-detector`	Cross-Site Scripting	`≤ 3.6.0`	Jan 21, 2025	`CVE-2025-22732`	Patchstack
6.5 Medium	MailChimp Subscribe Forms Plugin `mailchimp-subscribe-sm`	Cross-Site Scripting	`≤ 4.1` Fixed in `4.2`	Jan 21, 2025	`CVE-2025-22727`	Patchstack
6.5 Medium	FAT Event Lite Plugin `fat-event-lite`	Cross-Site Scripting	`≤ 1.1`	Jan 21, 2025	`CVE-2025-22718`	Patchstack
5.9 Medium	Bonjour Bar Plugin `bonjour-bar`	Cross-Site Scripting	`≤ 1.0.0`	Jan 21, 2025	`CVE-2025-22262`	Patchstack
5.3 Medium	Poll Maker Plugin `poll-maker`	Content Injection HTML Injection No login needed	`≤ 5.5.5` Fixed in `5.5.5`	Jan 21, 2025	`CVE-2024-56277`	Patchstack
4.3 Medium	Buzz Club – Night Club, DJ and Music Festival Event Theme	Broken Access Control Night Club, DJ and Music Festival Event WordPress Theme <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Option Update	`≤ 2.0.4`	Jan 18, 2025	`CVE-2025-0515`	Wordfence
4.4 Medium	Podlove Podcast Publisher Plugin `podlove-podcasting-plugin-for-wordpress`	Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via Feed Name	`≤ 4.1.25`	Jan 18, 2025	`CVE-2025-0554`	Wordfence
6.5 Medium	SOCIAL.NINJA Plugin `seo-meta`	Cross-Site Scripting	`≤ 0.2`	Jan 16, 2025	`CVE-2025-23907`	Patchstack
6.5 Medium	Metaphor Widgets Plugin `mtphr-widgets`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 2.4`	Jan 16, 2025	`CVE-2025-23816`	Patchstack
5.3 Medium	Copy Move Posts Plugin `copy-move-posts`	Broken Access Control No login needed	`≤ 1.6`	Jan 16, 2025	`CVE-2025-23764`	Patchstack
5.4 Medium	Woo Tuner Plugin `woo-tuner`	Broken Access Control	`≤ 0.1.2`	Jan 16, 2025	`CVE-2025-23761`	Patchstack
4.3 Medium	Sur.ly Plugin `surly`	Broken Access Control	`≤ 3.0.3`	Jan 16, 2025	`CVE-2025-23957`	Patchstack
6.5 Medium	Kopa Nictitate Toolkit Plugin `kopa-nictitate-toolkit`	Cross-Site Scripting	`≤ 1.0.2`	Jan 16, 2025	`CVE-2025-23965`	Patchstack
5.4 Medium	WordPress Graphs & Charts Plugin `graph-lite`	Broken Access Control	`≤ 2.0.8`	Jan 16, 2025	`CVE-2025-23961`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.