WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 6,101–6,150 of 17,220 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 123 of 345
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium ACF to REST API Plugin acf-to-rest-api Information Disclosure Sensitive Data Exposure No login needed ≤ 3.3.4 CVE-2025-62979 Patchstack
4.3 Medium KiotViet Sync Plugin kiotvietsync Broken Access Control ≤ 1.8.5 CVE-2025-62978 Patchstack
5.3 Medium 百度站长SEO合集(支持百度/神马/Bing/头条推送) Plugin baiduseo Broken Access Control No login needed ≤ 2.1.4 Fixed in 2.1.5 CVE-2025-62977 Patchstack
5.3 Medium Sendle Shipping Plugin official-sendle-shipping-method Broken Access Control No login needed ≤ 6.02 Fixed in 6.03 CVE-2025-62976 Patchstack
4.3 Medium Raychat Plugin raychat Cross-Site Request Forgery No login needed ≤ 2.2.1 CVE-2025-62975 Patchstack
6.5 Medium Headline Analyzer Plugin headline-analyzer Cross-Site Scripting ≤ 1.3.7 CVE-2025-62974 Patchstack
5.3 Medium BuddyForms Plugin buddyforms Broken Access Control No login needed ≤ 2.10.2 Fixed in 2.10.4 CVE-2025-62973 Patchstack
4.3 Medium WebinarPress Plugin wp-webinarsystem Broken Access Control ≤ 1.33.28 CVE-2025-62972 Patchstack
6.5 Medium Attesa Extra Plugin attesa-extra Cross-Site Scripting ≤ 1.4.7 Fixed in 1.4.8 CVE-2025-62971 Patchstack
5.3 Medium Link Whisper Free Plugin link-whisper Broken Access Control No login needed ≤ 0.9.2 CVE-2025-62970 Patchstack
6.5 Medium NextMove Lite Plugin woo-thank-you-page-nextmove-lite Cross-Site Scripting ≤ 2.23.0 Fixed in 2.24.0 CVE-2025-62969 Patchstack
6.5 Medium WP Last Modified Info Plugin wp-last-modified-info Cross-Site Scripting ≤ 1.9.2 Fixed in 1.9.3 CVE-2025-62968 Patchstack
6.5 Medium DirectoryPress Plugin directorypress Cross-Site Scripting ≤ 3.6.25 Fixed in 3.6.26 CVE-2025-62967 Patchstack
5.4 Medium GoCache Plugin gocache-cdn Broken Access Control ≤ 1.3.6 CVE-2025-62966 Patchstack
4.3 Medium Admin Management Xtended Plugin admin-management-xtended Broken Access Control ≤ 2.5.1 Fixed in 2.5.2 CVE-2025-62965 Patchstack
5.3 Medium MDTF Plugin wp-meta-data-filter-and-taxonomy-filter Broken Access Control No login needed ≤ 1.3.6 CVE-2025-62964 Patchstack
6.5 Medium Estatik Plugin estatik Cross-Site Scripting ≤ 4.3.1 CVE-2025-62963 Patchstack
7.1 High CloudSearch Plugin cloud-search Cross-Site Request Forgery No login needed ≤ 3.0.0 CVE-2025-62962 Patchstack
9.1 Critical Paid Videochat Turnkey Site Plugin ppv-live-webcams Remote Code Execution ≤ 7.3.23 Fixed in 7.3.24 CVE-2025-62959 Patchstack
4.3 Medium Simple Content Templates for Blog Posts & Pages Plugin simple-post-template Cross-Site Request Forgery No login needed ≤ 2.2.61 CVE-2025-62958 Patchstack
7.1 High NikanWP WooCommerce Reporting Plugin wc-reports-lite Cross-Site Request Forgery No login needed ≤ 1.0.0 Fixed in 3.0.0 CVE-2025-62957 Patchstack
7.1 High Reloadly Plugin reloadly-topup-widget Cross-Site Request Forgery No login needed ≤ 2.0.1 CVE-2025-62956 Patchstack
4.3 Medium Revive Old Posts Plugin tweet-old-post Broken Access Control ≤ 9.3.3 Fixed in 9.3.4 CVE-2025-62954 Patchstack
4.3 Medium Welcart e-Commerce Plugin usc-e-shop Broken Access Control ≤ 2.11.24 Fixed in 2.11.25 CVE-2025-62953 Patchstack
4.3 Medium ChatBot Plugin chatbot Broken Access Control ≤ 7.7.3 Fixed in 7.7.4 CVE-2025-62952 Patchstack
6.5 Medium H5P Plugin h5p Cross-Site Scripting ≤ 1.16.0 Fixed in 1.16.1 CVE-2025-62951 Patchstack
6.5 Medium Activity Plus Reloaded for BuddyPress Plugin bp-activity-plus-reloaded Cross-Site Scripting ≤ 1.1.2 CVE-2025-62949 Patchstack
6.5 Medium Date counter Plugin date-counter Cross-Site Scripting ≤ 2.0.3 CVE-2025-62948 Patchstack
5.0 Medium Publitio Plugin publitio Information Disclosure Sensitive Data Exposure ≤ 2.2.5 CVE-2025-62947 Patchstack
5.3 Medium Everest Backup Plugin everest-backup Broken Access Control No login needed ≤ 2.3.8 Fixed in 2.3.9 CVE-2025-62946 Patchstack
7.1 High Did Prestashop Display Plugin did-prestashop-display Cross-Site Request Forgery No login needed ≤ 1.0.30 CVE-2025-62945 Patchstack
5.3 Medium MSTW CSV EXPORTER Plugin mstw-csv-exporter Broken Access Control No login needed ≤ 1.4 CVE-2025-62944 Patchstack
6.5 Medium Next Page, Not Next Post Plugin next-page-not-next-post Cross-Site Scripting ≤ 0.3.0 CVE-2025-62943 Patchstack
6.5 Medium WP Mapbox GL JS Maps Plugin wp-mapbox-gl-js Cross-Site Scripting ≤ 3.0.1 CVE-2025-62942 Patchstack
6.5 Medium Events Maker by dFactory Plugin events-maker Cross-Site Scripting ≤ 1.6.14 CVE-2025-62941 Patchstack
6.5 Medium Blox Lite Plugin blox-lite Cross-Site Scripting ≤ 1.2.8 CVE-2025-62940 Patchstack
6.5 Medium Open Currency Converter Plugin artiss-currency-converter Cross-Site Scripting ≤ 1.5.0 CVE-2025-62939 Patchstack
4.3 Medium Reoon Email Verifier Plugin reoon-email-verifier Broken Access Control ≤ 2.0.1 Fixed in 2.1.1 CVE-2025-62938 Patchstack
6.5 Medium Post List Featured Image Plugin post-list-featured-image Cross-Site Scripting ≤ 0.5.9 CVE-2025-62937 Patchstack
4.3 Medium xSmart Plugin xsmart Content Injection ≤ 1.2.9.4 CVE-2025-62936 Patchstack
4.3 Medium Open Close WooCommerce Store Plugin woc-open-close Broken Access Control ≤ 5.0.0 CVE-2025-62935 Patchstack
7.1 High WP Business Hours Plugin wp-business-hours Cross-Site Request Forgery No login needed ≤ 1.4 CVE-2025-62934 Patchstack
7.1 High Awesome Testimonials Plugin awesome-testimonials Cross-Site Request Forgery No login needed ≤ 2.2.1 CVE-2025-62933 Patchstack
4.3 Medium Table Block by RioVizual Plugin riovizual Broken Access Control ≤ 3.0.0 CVE-2025-62932 Patchstack
4.3 Medium MSN Partner Hub Plugin microsoft-start Broken Access Control ≤ 2.9 CVE-2025-62931 Patchstack
6.5 Medium MapSVG Plugin mapsvg-lite-interactive-vector-maps Cross-Site Scripting ≤ 8.7.22 Fixed in 8.7.23 CVE-2025-62930 Patchstack
6.5 Medium Testimonial Slider Plugin testimonial Broken Access Control ≤ 2.0.15 CVE-2025-62929 Patchstack
4.3 Medium SEO Meta Description Updater Plugin seo-meta-description-updater Broken Access Control ≤ 1.2.0 CVE-2025-62928 Patchstack
6.5 Medium Nelio Content Plugin nelio-content Broken Access Control ≤ 4.0.5 Fixed in 4.0.6 CVE-2025-62927 Patchstack
5.4 Medium Conversios.io Plugin enhanced-e-commerce-for-woocommerce-store Broken Access Control ≤ 7.2.13 Fixed in 7.2.14 CVE-2025-62925 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only