WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 601–650 of 1,456 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Inline frame – Iframe | Cross-Site Scripting Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 0.1 |
CVE-2025-12645 |
Wordfence | |
| 6.4 Medium | WP Shortcodes Plugin — Shortcodes Ultimate | Server-Side Request Forgery Authenticated (Administrator+) Server-Side Request Forgery |
≤ 7.4.5 |
CVE-2025-12800 |
Wordfence | |
| 6.4 Medium | Cookie Notice & Compliance for GDPR / CCPA | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.5.8 |
CVE-2025-11186 |
Wordfence | |
| 4.3 Medium | Arconix Shortcodes | Broken Access Control |
≤ 2.1.18 Fixed in 2.1.19 |
CVE-2025-66085 |
Patchstack | |
| 6.4 Medium | FluentCRM - Marketing Automation | Cross-Site Scripting Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode |
≤ 2.9.84 |
CVE-2025-12935 |
Wordfence | |
| 6.4 Medium | Shortcode for Google Street View | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 0.5.7 |
CVE-2025-11808 |
Wordfence | |
| 6.4 Medium | WP Company Info | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.9.0 |
CVE-2025-11826 |
Wordfence | |
| 6.4 Medium | WPSite Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.2 |
CVE-2025-11803 |
Wordfence | |
| 6.4 Medium | Bulma Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.0 |
CVE-2025-11802 |
Wordfence | |
| 6.4 Medium | Surbma | MiniCRM Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.0 |
CVE-2025-11800 |
Wordfence | |
| 6.4 Medium | Display Pages Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.1 |
CVE-2025-11763 |
Wordfence | |
| 6.4 Medium | Shortcodes Bootstrap | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.1 |
CVE-2025-11764 |
Wordfence | |
| 6.4 Medium | BrightTALK WordPress Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.4.0 |
CVE-2025-11770 |
Wordfence | |
| 6.4 Medium | Tips Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 0.2.1 |
CVE-2025-11767 |
Wordfence | |
| 6.4 Medium | Pollcaster Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2025-12661 |
Wordfence | |
| 6.4 Medium | Padlet Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.3 |
CVE-2025-12660 |
Wordfence | |
| 6.4 Medium | FunnelKit – Funnel Builder for WooCommerce Checkout | Cross-Site Scripting Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode |
≤ 3.13.1.2 |
CVE-2025-12878 |
Wordfence | |
| 6.4 Medium | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.14.8 |
CVE-2025-13054 |
Wordfence | |
| 6.4 Medium | Pet-Manager – Petfinder | Cross-Site Scripting Petfinder <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via kwm-petfinder Shortcode |
≤ 3.6.1 |
CVE-2025-12710 |
Wordfence | |
| 6.4 Medium | Local Syndication | Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via Shortcode |
≤ 1.5a |
CVE-2025-12962 |
Wordfence | |
| 5.4 Medium | Classified Listing – Classified ads & Business Directory | Arbitrary Shortcode Execution Classified ads & Business Directory Plugin <= 5.0.3 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Listing Description |
≤ 5.0.3 |
CVE-2025-7711 |
Wordfence | |
| 6.4 Medium | Save as PDF Button | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode |
≤ 1.9.2 |
CVE-2025-8397 |
Wordfence | |
| 6.4 Medium | GitHub Gist Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 0.2 |
CVE-2025-12667 |
Wordfence | |
| 6.4 Medium | Live Photos on | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 0.1 |
CVE-2025-12651 |
Wordfence | |
| 6.4 Medium | Coon Google Maps | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2025-12662 |
Wordfence | |
| 6.4 Medium | Jeba Cute forkit | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2025-12663 |
Wordfence | |
| 6.4 Medium | Preload Current Images | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.3 |
CVE-2025-12658 |
Wordfence | |
| 6.4 Medium | Woocommerce – Products By Custom Tax | Cross-Site Scripting Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.2 |
CVE-2025-11821 |
Wordfence | |
| 6.4 Medium | Paypal Donation Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 0.1 |
CVE-2025-11859 |
Wordfence | |
| 6.4 Medium | Chart Expert | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2025-12753 |
Wordfence | |
| 6.4 Medium | Share to Google Classroom | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google Shortcode |
≤ 1.0 |
CVE-2025-12711 |
Wordfence | |
| 6.4 Medium | Geopost | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.2 |
CVE-2025-12754 |
Wordfence | |
| 6.5 Medium | Authors List | Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode |
≤ 2.0.6.1 |
CVE-2025-12010 |
Wordfence | |
| 6.4 Medium | Skip to Timestamp | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.4.4 |
CVE-2025-11805 |
Wordfence | |
| 6.4 Medium | Ungapped Widgets | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1 |
CVE-2025-12652 |
Wordfence | |
| 6.4 Medium | WP Bootstrap Tabs | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.4 |
CVE-2025-11822 |
Wordfence | |
| 6.4 Medium | Saphali LiqPay for donate | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.2 |
CVE-2025-12643 |
Wordfence | |
| 4.3 Medium | Strong Testimonials | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 3.2.16 |
CVE-2025-11268 |
Wordfence | |
| 6.4 Medium | Visual Link Preview | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode |
≤ 2.2.7 |
CVE-2025-11987 |
Wordfence | |
| 6.4 Medium | Reuse Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.7 |
CVE-2025-11812 |
Wordfence | |
| 6.4 Medium | TablePress – Tables in WordPress made easy | Cross-Site Scripting Tables in WordPress made easy <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 3.2.4 |
CVE-2025-12324 |
Wordfence | |
| 8.8 High | WPCOM Member | Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode |
≤ 1.7.14 |
CVE-2025-11920 |
Wordfence | |
| 6.4 Medium | Qzzr Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.1 |
CVE-2025-11806 |
Wordfence | |
| 6.5 Medium | Links shortcode | Cross-Site Scripting |
≤ 1.8.3 |
CVE-2025-62898 |
Patchstack | |
| 6.3 Medium | Discussion Board – WordPress Forum | Arbitrary Shortcode Execution WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution |
≤ 2.5.5 |
CVE-2025-8483 |
Wordfence | |
| 6.4 Medium | Open Source Genesis Framework | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 3.6.0 |
CVE-2025-10737 |
Wordfence | |
| 6.4 Medium | Listeo | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode |
≤ 2.0.8 |
CVE-2025-8413 |
Wordfence | |
| 6.4 Medium | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution | Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.2.4 |
CVE-2025-11823 |
Wordfence | |
| 6.4 Medium | Simple Excel Pricelist for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.13 |
CVE-2025-12096 |
Wordfence | |
| 7.1 High | Shortcode Generator | Cross-Site Scripting No login needed |
≤ 1.1 |
CVE-2025-49945 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.