WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 6,401–6,450 of 17,889 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 129 of 358
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Blog Designer PRO Plugin blog-designer-pro Broken Access Control No login needed ≤ 3.4.8 CVE-2025-58711 Patchstack
5.3 Medium WooCommerce Plugin woocommerce Information Disclosure Sensitive Information Exposure No login needed ≤ 7.8.2 CVE-2023-7320 Wordfence
6.5 Medium Doppler Forms Plugin Broken Access Control Subscriber+ Limited Plugin Installation ≤ 2.5.1 CVE-2025-9544 WPScan
5.9 Medium WooCommerce Plugin woocommerce Cross-Site Scripting ≤ 10.0.2 Fixed in 10.0.3 CVE-2025-49042 Patchstack
6.5 Medium Anti-Malware Security and Brute-Force Firewall Plugin gotmls Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read ≤ 4.23.81 CVE-2025-11705 Wordfence
5.3 Medium Facebook for WooCommerce Plugin facebook-for-woocommerce Broken Access Control Broken Access Control to Notice Dismissal No login needed ≤ 3.5.7 Fixed in 3.5.8 CVE-2025-64296 Patchstack
5.3 Medium Popup box Plugin ays-popup-box Cross-Site Request Forgery No login needed ≤ 5.5.4 Fixed in 5.5.5 CVE-2025-57931 Patchstack
5.4 Medium IDonate Plugin idonate Cross-Site Request Forgery Unauthenticated User Deletion < 2.1.13 Fixed in 2.1.13 CVE-2025-11154 WPScan
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting ≤ 3.21.1 Fixed in 3.21.1 CVE-2025-48088 Patchstack
4.3 Medium Entrada Theme entrada Cross-Site Request Forgery No login needed ≤ 5.7.7 CVE-2025-58918 Patchstack
4.9 Medium Slider Templates Plugin slider-templates Server-Side Request Forgery ≤ 1.0.3 CVE-2025-62988 Patchstack
6.5 Medium Builderall Builder Plugin builderall-cheetah-for-wp Cross-Site Scripting ≤ 3.0.1 CVE-2025-62987 Patchstack
6.5 Medium Simple Pull Quote Plugin simple-pull-quote Cross-Site Scripting ≤ 1.6.3 Fixed in 1.6.4 CVE-2025-62985 Patchstack
6.5 Medium WP AdCenter Plugin wpadcenter Cross-Site Scripting ≤ 2.6.1 CVE-2025-62984 Patchstack
6.5 Medium Posts By Tag Plugin posts-by-tag Cross-Site Scripting ≤ 3.2.1 CVE-2025-62983 Patchstack
5.9 Medium Dynamic User Directory Plugin dynamic-user-directory Cross-Site Scripting ≤ 2.3 Fixed in 2.4 CVE-2025-62982 Patchstack
4.7 Medium WP Gravity Forms Zoho CRM and Bigin Plugin gf-zoho Open Redirect No login needed ≤ 1.2.8 Fixed in 1.2.9 CVE-2025-62981 Patchstack
5.4 Medium Persian Admnin Fonts Plugin persian-admin-fonts Broken Access Control ≤ 4.1.03 Fixed in 4.1.05 CVE-2025-62980 Patchstack
5.3 Medium ACF to REST API Plugin acf-to-rest-api Information Disclosure Sensitive Data Exposure No login needed ≤ 3.3.4 CVE-2025-62979 Patchstack
4.3 Medium KiotViet Sync Plugin kiotvietsync Broken Access Control ≤ 1.8.5 CVE-2025-62978 Patchstack
5.3 Medium 百度站长SEO合集(支持百度/神马/Bing/头条推送) Plugin baiduseo Broken Access Control No login needed ≤ 2.1.4 Fixed in 2.1.5 CVE-2025-62977 Patchstack
5.3 Medium Sendle Shipping Plugin official-sendle-shipping-method Broken Access Control No login needed ≤ 6.02 Fixed in 6.03 CVE-2025-62976 Patchstack
4.3 Medium Raychat Plugin raychat Cross-Site Request Forgery No login needed ≤ 2.2.1 CVE-2025-62975 Patchstack
6.5 Medium Headline Analyzer Plugin headline-analyzer Cross-Site Scripting ≤ 1.3.7 CVE-2025-62974 Patchstack
5.3 Medium BuddyForms Plugin buddyforms Broken Access Control No login needed ≤ 2.10.2 Fixed in 2.10.4 CVE-2025-62973 Patchstack
4.3 Medium WebinarPress Plugin wp-webinarsystem Broken Access Control ≤ 1.33.28 CVE-2025-62972 Patchstack
6.5 Medium Attesa Extra Plugin attesa-extra Cross-Site Scripting ≤ 1.4.7 Fixed in 1.4.8 CVE-2025-62971 Patchstack
5.3 Medium Link Whisper Free Plugin link-whisper Broken Access Control No login needed ≤ 0.9.2 CVE-2025-62970 Patchstack
6.5 Medium NextMove Lite Plugin woo-thank-you-page-nextmove-lite Cross-Site Scripting ≤ 2.23.0 Fixed in 2.24.0 CVE-2025-62969 Patchstack
6.5 Medium WP Last Modified Info Plugin wp-last-modified-info Cross-Site Scripting ≤ 1.9.2 Fixed in 1.9.3 CVE-2025-62968 Patchstack
6.5 Medium DirectoryPress Plugin directorypress Cross-Site Scripting ≤ 3.6.25 Fixed in 3.6.26 CVE-2025-62967 Patchstack
5.4 Medium GoCache Plugin gocache-cdn Broken Access Control ≤ 1.3.6 CVE-2025-62966 Patchstack
4.3 Medium Admin Management Xtended Plugin admin-management-xtended Broken Access Control ≤ 2.5.1 Fixed in 2.5.2 CVE-2025-62965 Patchstack
5.3 Medium MDTF Plugin wp-meta-data-filter-and-taxonomy-filter Broken Access Control No login needed ≤ 1.3.6 CVE-2025-62964 Patchstack
6.5 Medium Estatik Plugin estatik Cross-Site Scripting ≤ 4.3.1 CVE-2025-62963 Patchstack
4.3 Medium Simple Content Templates for Blog Posts & Pages Plugin simple-post-template Cross-Site Request Forgery No login needed ≤ 2.2.61 CVE-2025-62958 Patchstack
4.3 Medium Revive Old Posts Plugin tweet-old-post Broken Access Control ≤ 9.3.3 Fixed in 9.3.4 CVE-2025-62954 Patchstack
4.3 Medium Welcart e-Commerce Plugin usc-e-shop Broken Access Control ≤ 2.11.24 Fixed in 2.11.25 CVE-2025-62953 Patchstack
4.3 Medium ChatBot Plugin chatbot Broken Access Control ≤ 7.7.3 Fixed in 7.7.4 CVE-2025-62952 Patchstack
6.5 Medium H5P Plugin h5p Cross-Site Scripting ≤ 1.16.0 Fixed in 1.16.1 CVE-2025-62951 Patchstack
6.5 Medium Activity Plus Reloaded for BuddyPress Plugin bp-activity-plus-reloaded Cross-Site Scripting ≤ 1.1.2 CVE-2025-62949 Patchstack
6.5 Medium Date counter Plugin date-counter Cross-Site Scripting ≤ 2.0.3 CVE-2025-62948 Patchstack
5.0 Medium Publitio Plugin publitio Information Disclosure Sensitive Data Exposure ≤ 2.2.5 CVE-2025-62947 Patchstack
5.3 Medium Everest Backup Plugin everest-backup Broken Access Control No login needed ≤ 2.3.8 Fixed in 2.3.9 CVE-2025-62946 Patchstack
5.3 Medium MSTW CSV EXPORTER Plugin mstw-csv-exporter Broken Access Control No login needed ≤ 1.4 CVE-2025-62944 Patchstack
6.5 Medium Next Page, Not Next Post Plugin next-page-not-next-post Cross-Site Scripting ≤ 0.3.0 CVE-2025-62943 Patchstack
6.5 Medium WP Mapbox GL JS Maps Plugin wp-mapbox-gl-js Cross-Site Scripting ≤ 3.0.1 CVE-2025-62942 Patchstack
6.5 Medium Events Maker by dFactory Plugin events-maker Cross-Site Scripting ≤ 1.6.14 CVE-2025-62941 Patchstack
6.5 Medium Blox Lite Plugin blox-lite Cross-Site Scripting ≤ 1.2.8 CVE-2025-62940 Patchstack
6.5 Medium Open Currency Converter Plugin artiss-currency-converter Cross-Site Scripting ≤ 1.5.0 CVE-2025-62939 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only