WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 6,401–6,450 of 17,220 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 129 of 345
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium Survey Maker Plugin survey-maker Cross-Site Scripting ≤ 5.1.8.8 Fixed in 5.1.8.9 CVE-2025-48095 Patchstack
7.1 High Password only login Plugin password-only-login Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.2 CVE-2025-48093 Patchstack
7.1 High Fix Multiple Redirects Plugin fix-multiple-redirects Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.3 CVE-2025-48092 Patchstack
8.5 High AnyComment Plugin anycomment SQL Injection ≤ 0.3.6 CVE-2025-48091 Patchstack
8.8 High Progress Planner Plugin progress-planner Privilege Escalation ≤ 1.8.0 Fixed in 1.8.1 CVE-2025-48082 Patchstack
7.1 High Terms Dictionary Plugin terms-dictionary Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.5.1 CVE-2025-39534 Patchstack
7.5 High Testimonial Slider And Showcase Pro Plugin testimonial-slider-showcase-pro Local File Inclusion ≤ 2.1.7 CVE-2025-32657 Patchstack
8.8 High Solar Energy Theme solar PHP Object Injection ≤ 3.5 CVE-2025-32283 Patchstack
8.8 High Insurance Theme insurance PHP Object Injection ≤ 3.5 CVE-2025-31634 Patchstack
7.5 High Tablesome Table Premium Plugin tablesome-premium Broken Access Control No login needed ≤ 1.1.23 CVE-2025-30944 Patchstack
6.5 Medium LearnPress – WordPress LMS Plugin learnpress Broken Access Control WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation No login needed ≤ 4.2.9.3 CVE-2025-11372 Wordfence
4.9 Medium GSpeech TTS – WordPress Text To Speech Plugin gspeech SQL Injection WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection ≤ 3.17.3 CVE-2025-10187 Wordfence
6.5 Medium Memberlite Shortcodes Plugin memberlite-shortcodes Cross-Site Scripting ≤ 1.4.1 CVE-2025-48087 Patchstack
7.2 High Find And Replace content Plugin find-and-replace-content Broken Access Control Missing Authorization to Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.1 CVE-2025-10313 Wordfence
7.3 High Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity Theme Privilege Escalation Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Unauthenticated Privilege Escalation to Editor No login needed ≤ 1.4.0 CVE-2025-6042 Wordfence
9.3 Critical is-human Plugin is-human Remote Code Execution WordPress Plugin is-human <= v1.4.2 Eval Injection RCE No login needed ≤ 1.4.2 CVE-2011-10033 VulnCheck
4.3 Medium SureForms – Drag and Drop Form Builder Plugin sureforms Broken Access Control Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure ≤ 1.12.1 CVE-2025-10732 Wordfence
6.4 Medium WordPress Live Webcam Widget & Shortcode Plugin wp-webcam-widget-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2 CVE-2025-10129 Wordfence
4.9 Medium NEX-Forms – Ultimate Forms Plugin nex-forms-express-wp-form-builder SQL Injection Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection ≤ 9.1.6 CVE-2025-10185 Wordfence
9.8 Critical Search & Go - Directory Theme Authentication Bypass Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover No login needed ≤ 2.7 CVE-2025-11522 Wordfence
8.8 High Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity Theme Privilege Escalation Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation ≤ 1.4.0 CVE-2025-6038 Wordfence
5.3 Medium Chartify – WordPress Chart Plugin chart-builder Authentication Bypass WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function No login needed ≤ 3.5.9 CVE-2025-11171 Wordfence
6.4 Medium Auto Bulb Finder Plugin auto-bulb-finder-for-wp-wc Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.0 CVE-2025-9858 Wordfence
6.1 Medium LockerPress – WordPress Security Plugin lockerpress-wordpress-security Cross-Site Request Forgery WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 1.0 CVE-2025-9946 Wordfence
6.4 Medium WeedMaps Menu Plugin weedmaps-menu-embed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode ≤ 1.2.0 CVE-2025-8623 Wordfence
8.1 High Bei Fen – WordPress Backup Plugin bei-fen Local File Inclusion WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion No login needed ≤ 1.4.2 CVE-2025-9993 Wordfence
10.0 Critical WooCommerce Designer Pro Plugin wc-designer-pro Arbitrary File Upload No login needed ≤ 1.9.24 CVE-2025-60219 Patchstack
5.9 Medium Google+ Comments Plugin google-plus-comments Cross-Site Scripting ≤ 1.0 CVE-2025-60186 Patchstack
5.9 Medium kontur Admin Style Plugin kontur-admin-style Cross-Site Scripting ≤ 1.0.4 Fixed in 1.0.5 CVE-2025-60185 Patchstack
5.9 Medium SEO Search Permalink Plugin seo-search-permalink Cross-Site Scripting ≤ 1.0.3 CVE-2025-60184 Patchstack
5.4 Medium Silencesoft RSS Reader Plugin external-rss-reader Server-Side Request Forgery No login needed ≤ 0.6 CVE-2025-60181 Patchstack
5.9 Medium Click & Tweet Plugin click-tweet Cross-Site Scripting ≤ 0.8.9 CVE-2025-60179 Patchstack
5.9 Medium Recaptcha – wp Plugin recaptcha-wp Cross-Site Scripting wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) ≤ 0.2.6 CVE-2025-60177 Patchstack
7.1 High GST for WooCommerce Plugin gst-for-woocommerce Cross-Site Request Forgery No login needed ≤ 2.0 CVE-2025-60173 Patchstack
7.1 High Flytedesk Digital Plugin flytedesk-digital Cross-Site Request Forgery No login needed ≤ 20181101 CVE-2025-60172 Patchstack
7.1 High Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin yourplugins-wc-conditional-cart-notices Cross-Site Request Forgery YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.2.10 CVE-2025-60171 Patchstack
7.1 High HTACCESS IP Blocker Plugin htaccess-ip-blocker Cross-Site Request Forgery No login needed ≤ 1.0 CVE-2025-60170 Patchstack
7.1 High W3SCloud Contact Form 7 to Zoho CRM Plugin w3s-cf7-zoho Cross-Site Request Forgery No login needed ≤ 3.2 CVE-2025-60169 Patchstack
4.3 Medium Page Manager for Elementor Plugin page-manager-for-elementor Information Disclosure Sensitive Data Exposure ≤ 2.0.5 CVE-2025-60167 Patchstack
4.3 Medium WP Subscription Forms PRO Plugin wp-subscription-forms-pro Broken Access Control Arbitrary Content Deletion ≤ 2.0.5 CVE-2025-60166 Patchstack
4.3 Medium Frames Plugin frames Broken Access Control ≤ 1.5.7 CVE-2025-60165 Patchstack
7.1 High NewsmanApp Plugin newsmanapp Cross-Site Request Forgery No login needed ≤ 2.7.7 Fixed in 3.0.0 CVE-2025-60164 Patchstack
6.5 Medium bbp topic count Plugin bbp-topic-count Cross-Site Scripting ≤ 3.2 CVE-2025-60163 Patchstack
6.5 Medium Job Board Manager Plugin job-board-manager Cross-Site Scripting ≤ 2.1.61 CVE-2025-60162 Patchstack
5.4 Medium ZoloBlocks Plugin zoloblocks Server-Side Request Forgery No login needed ≤ 2.3.11 Fixed in 2.3.12 CVE-2025-60161 Patchstack
5.9 Medium Smart Related Products Plugin ai-related-products Cross-Site Scripting ≤ 2.0.8 CVE-2025-60160 Patchstack
4.3 Medium Nota Fiscal Eletrônica WooCommerce Plugin nota-fiscal-eletronica-woocommerce Broken Access Control ≤ 3.4.0.9 Fixed in 3.4.1.0 CVE-2025-60159 Patchstack
5.9 Medium Nota Fiscal Eletrônica WooCommerce Plugin nota-fiscal-eletronica-woocommerce Cross-Site Scripting ≤ 3.4.0.9 Fixed in 3.4.1.0 CVE-2025-60158 Patchstack
6.5 Medium WP Ticket Customer Service Software & Support Ticket System Plugin wp-ticket Cross-Site Scripting ≤ 6.0.2 Fixed in 6.0.3 CVE-2025-60157 Patchstack
9.6 Critical AR Plugin ar-for-wordpress Cross-Site Request Forgery No login needed ≤ 8.34 CVE-2025-60156 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only