WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 501–550 of 2,544 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 11 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.1 High	Flexible PDF Invoices for WooCommerce & Plugin `flexible-invoices`	Cross-Site Request Forgery No login needed	`≤ 6.0.13` Fixed in `6.0.14`	Sep 22, 2025	`CVE-2025-57977`	Patchstack
4.3 Medium	Advanced Appointment Booking & Scheduling Plugin `advanced-appointment-booking-scheduling`	Cross-Site Request Forgery No login needed	`≤ 2.1`	Sep 22, 2025	`CVE-2025-57978`	Patchstack
6.5 Medium	BP Disable Activation Reloaded Plugin `bp-disable-activation-reloaded`	Cross-Site Request Forgery No login needed	`≤ 1.2.1`	Sep 22, 2025	`CVE-2025-57983`	Patchstack
4.4 Medium	MakeStories (for Google Web Stories) Plugin `makestories-helper`	Server-Side Request Forgery	`≤ 3.0.4`	Sep 22, 2025	`CVE-2025-57984`	Patchstack
4.3 Medium	Mail Baby SMTP Plugin `mail-baby-smtp`	Cross-Site Request Forgery No login needed	`≤ 2.8` Fixed in `3.2.12`	Sep 22, 2025	`CVE-2025-57992`	Patchstack
5.3 Medium	Memberful - Membership Plugin `memberful-wp`	Broken Access Control No login needed	`≤ 1.75.0` Fixed in `1.76.0`	Sep 22, 2025	`CVE-2025-58000`	Patchstack
5.4 Medium	DriCub Plugin `dricub-driving-school`	Server-Side Request Forgery No login needed	`≤ 2.9`	Sep 22, 2025	`CVE-2025-58005`	Patchstack
6.4 Medium	Content Mask Plugin `content-mask`	Server-Side Request Forgery	`≤ 1.8.5.2` Fixed in `1.8.5.3`	Sep 22, 2025	`CVE-2025-58011`	Patchstack
4.3 Medium	SV Proven Expert Plugin `sv-provenexpert`	Cross-Site Request Forgery No login needed	`≤ 2.0.06`	Sep 22, 2025	`CVE-2025-58010`	Patchstack
8.8 High	CouponXxL Plugin `couponxxl`	Cross-Site Request Forgery No login needed	`≤ 4.5.0`	Sep 22, 2025	`CVE-2025-58013`	Patchstack
4.3 Medium	Quiz Maker Plugin `quiz-maker`	Cross-Site Request Forgery No login needed	`≤ 6.7.0.64` Fixed in `6.7.0.65`	Sep 22, 2025	`CVE-2025-58014`	Patchstack
4.3 Medium	WP Compiler Plugin `wp-compiler`	Cross-Site Request Forgery No login needed	`≤ 1.0.0`	Sep 22, 2025	`CVE-2025-58032`	Patchstack
4.3 Medium	Fastly Plugin `fastly`	Cross-Site Request Forgery No login needed	`≤ 1.2.28` Fixed in `1.2.29`	Sep 22, 2025	`CVE-2025-58199`	Patchstack
4.3 Medium	Flexible FAQ Plugin `flexible-faq`	Cross-Site Request Forgery No login needed	`≤ 0.2`	Sep 22, 2025	`CVE-2025-58200`	Patchstack
4.3 Medium	Show Pages List Plugin `show-pages-list`	Cross-Site Request Forgery No login needed	`≤ 1.2.0`	Sep 22, 2025	`CVE-2025-58219`	Patchstack
5.4 Medium	Printeers Print & Ship Plugin `invition-print-ship`	Cross-Site Request Forgery No login needed	`≤ 1.17.0`	Sep 22, 2025	`CVE-2025-58224`	Patchstack
4.3 Medium	Force Update Translations Plugin `force-update-translations`	Cross-Site Request Forgery No login needed	`≤ 0.5` Fixed in `0.6.0`	Sep 22, 2025	`CVE-2025-58236`	Patchstack
8.8 High	Constructo Plugin `constructo`	Cross-Site Request Forgery No login needed	`≤ 4.3.9`	Sep 22, 2025	`CVE-2025-58244`	Patchstack
8.8 High	Findgo Plugin `fingo`	Cross-Site Request Forgery No login needed	`≤ 1.3.55` Fixed in `1.3.60.1`	Sep 22, 2025	`CVE-2025-58250`	Patchstack
9.6 Critical	Custom Post Type Images Plugin `custom-post-types-image`	Cross-Site Request Forgery No login needed	`≤ 0.5`	Sep 22, 2025	`CVE-2025-58255`	Patchstack
7.1 High	Nokri Theme `nokri`	Cross-Site Request Forgery No login needed	`≤ 1.6.4`	Sep 22, 2025	`CVE-2025-58259`	Patchstack
7.1 High	Mavis HTTPS to HTTP Redirection Plugin `mavis-https-to-http-redirect`	Cross-Site Request Forgery No login needed	`≤ 1.4.3`	Sep 22, 2025	`CVE-2025-58261`	Patchstack
7.1 High	Sweet Energy Efficiency Plugin `sweet-energy-efficiency`	Cross-Site Request Forgery No login needed	`≤ 1.0.8` Fixed in `1.0.9`	Sep 22, 2025	`CVE-2025-58262`	Patchstack
7.1 High	WPMK PDF Generator Plugin `wpmk-pdf-generator`	Cross-Site Request Forgery No login needed	`≤ 1.0.1`	Sep 22, 2025	`CVE-2025-58268`	Patchstack
7.1 High	Stock Message Plugin `stock-message`	Cross-Site Request Forgery No login needed	`≤ 1.1.0`	Sep 22, 2025	`CVE-2025-58267`	Patchstack
7.1 High	NIX Anti-Spam Light Plugin `nix-anti-spam-light`	Cross-Site Request Forgery No login needed	`≤ 0.0.4`	Sep 22, 2025	`CVE-2025-58270`	Patchstack
7.1 High	Grid Plugin `grid`	Cross-Site Request Forgery No login needed	`≤ 2.3.1` Fixed in `2.3.2`	Sep 22, 2025	`CVE-2025-58657`	Patchstack
7.1 High	Auction Feed Plugin `auction-feed`	Cross-Site Request Forgery No login needed	`≤ 1.1.4`	Sep 22, 2025	`CVE-2025-58671`	Patchstack
7.1 High	WP Content Protection Plugin `wp-content-protection`	Cross-Site Request Forgery No login needed	`≤ 1.3`	Sep 22, 2025	`CVE-2025-58670`	Patchstack
4.3 Medium	Interact: Embed A Quiz On Your Site Plugin `interact-quiz-embed`	Cross-Site Request Forgery No login needed	`≤ 3.1` Fixed in `3.2`	Sep 22, 2025	`CVE-2025-58675`	Patchstack
7.1 High	HORIZONTAL SLIDER Plugin `horizontal-slider`	Cross-Site Request Forgery No login needed	`≤ 2.4`	Sep 22, 2025	`CVE-2025-58676`	Patchstack
7.1 High	ShrinkTheWeb (STW) Website Previews Plugin `shrinktheweb-website-preview-plugin`	Cross-Site Request Forgery No login needed	`≤ 2.8.5`	Sep 22, 2025	`CVE-2025-58677`	Patchstack
8.5 High	Perfect Brands for WooCommerce Plugin `perfect-woocommerce-brands`	SQL Injection	`≤ 3.6.2` Fixed in `3.6.3`	Sep 22, 2025	`CVE-2025-58686`	Patchstack
7.1 High	Current Age Plugin `current-age`	Cross-Site Request Forgery No login needed	`≤ 1.6` Fixed in `1.7`	Sep 22, 2025	`CVE-2025-58687`	Patchstack
7.1 High	Casengo Live Chat Support Plugin `the-casengo-chat-widget`	Cross-Site Request Forgery No login needed	`≤ 2.1.4`	Sep 22, 2025	`CVE-2025-58688`	Patchstack
7.1 High	Doliconnect Plugin `doliconnect`	Cross-Site Request Forgery No login needed	`≤ 9.5.7` Fixed in `9.6.2`	Sep 22, 2025	`CVE-2025-58690`	Patchstack
8.8 High	StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Plugin `storeengine`	Arbitrary File Upload Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload	`≤ 1.5.0`	Sep 17, 2025	`CVE-2025-9216`	Wordfence
6.5 Medium	StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Plugin `storeengine`	Path Traversal Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download	`≤ 1.5.0`	Sep 17, 2025	`CVE-2025-9215`	Wordfence
4.3 Medium	WP Blast \| SEO & Performance Booster Plugin `wpblast`	Cross-Site Request Forgery Cross-Site Request Forgery to Cache Clearing No login needed	`≤ 1.8.6`	Sep 10, 2025	`CVE-2025-9622`	Wordfence
4.3 Medium	Advanced Settings Plugin `advanced-settings`	Cross-Site Request Forgery No login needed	`≤ 3.1.1` Fixed in `3.2.0`	Sep 9, 2025	`CVE-2025-58975`	Patchstack
4.9 Medium	WP eBay Product Feeds Plugin `ebay-feeds-for-wordpress`	Server-Side Request Forgery	`≤ 3.4.8` Fixed in `3.4.9`	Sep 9, 2025	`CVE-2025-58977`	Patchstack
7.1 High	WooCommerce Booking Bundle Hours Plugin `woo-booking-bundle-hours`	Cross-Site Request Forgery No login needed	`≤ 0.7.4` Fixed in `0.7.5`	Sep 9, 2025	`CVE-2025-58991`	Patchstack
9.6 Critical	Mow Plugin `mow`	Cross-Site Request Forgery No login needed	`≤ 4.10` Fixed in `4.11`	Sep 9, 2025	`CVE-2025-58997`	Patchstack
7.2 High	Ultimate Video Player Plugin `fwduvp`	Server-Side Request Forgery No login needed	`≤ 10.1`	Sep 9, 2025	`CVE-2025-49430`	Patchstack
6.4 Medium	LiteSpeed Cache Plugin `litespeed-cache`	Server-Side Request Forgery	`≤ 7.0.1` Fixed in `7.1`	Sep 9, 2025	`CVE-2025-47437`	Patchstack
8.6 High	Ditty Plugin `ditty-news-ticker`	Server-Side Request Forgery Unauthenticated SSRF No login needed	`< 3.1.58` Fixed in `3.1.58`	Sep 8, 2025	`CVE-2025-8085`	WPScan
4.3 Medium	Quick Paypal Payments Plugin `quick-paypal-payments`	Cross-Site Request Forgery No login needed	`≤ 5.7.46` Fixed in `5.7.47`	Sep 5, 2025	`CVE-2025-27003`	Patchstack
7.1 High	Floating Window Music Player Plugin `floating-window-music-player`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 3.4.2`	Sep 5, 2025	`CVE-2025-48104`	Patchstack
6.5 Medium	Woocommerce Gifts Product Plugin `woo-gift-product`	Cross-Site Request Forgery No login needed	`≤ 1.0.0`	Sep 5, 2025	`CVE-2025-58878`	Patchstack
6.5 Medium	SimaCookie Plugin `simasicher-dsgvo-cookie`	Cross-Site Request Forgery	`≤ 1.3.2`	Sep 5, 2025	`CVE-2025-58869`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.