WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 651–700 of 2,544 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 14 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	WP Post Hide Plugin `wp-post-hide`	Cross-Site Request Forgery No login needed	`≤ 1.0.9` Fixed in `1.1.0`	Jul 16, 2025	`CVE-2025-54042`	Patchstack
4.3 Medium	Wallet System for WooCommerce Plugin `wallet-system-for-woocommerce`	Cross-Site Request Forgery No login needed	`≤ 2.6.7` Fixed in `2.6.8`	Jul 16, 2025	`CVE-2025-54041`	Patchstack
4.3 Medium	Animator Plugin `scroll-triggered-animations`	Cross-Site Request Forgery No login needed	`≤ 3.0.16` Fixed in `3.0.17`	Jul 16, 2025	`CVE-2025-54039`	Patchstack
5.4 Medium	Restaurant Menu by MotoPress Plugin `mp-restaurant-menu`	Cross-Site Request Forgery No login needed	`≤ 2.4.6` Fixed in `2.4.7`	Jul 16, 2025	`CVE-2025-54038`	Patchstack
4.3 Medium	Webba Booking Plugin `webba-booking-lite`	Cross-Site Request Forgery No login needed	`≤ 5.1.20` Fixed in `5.1.21`	Jul 16, 2025	`CVE-2025-54036`	Patchstack
4.3 Medium	Newsletters Plugin `newsletters-lite`	Cross-Site Request Forgery No login needed	`≤ 4.10` Fixed in `4.11`	Jul 16, 2025	`CVE-2025-54035`	Patchstack
6.5 Medium	Theme Builder For Elementor Plugin `theme-builder-for-elementor`	Cross-Site Request Forgery No login needed	`≤ 1.2.3` Fixed in `1.2.4`	Jul 16, 2025	`CVE-2025-54033`	Patchstack
4.3 Medium	WooCommerce Google Sheet Connector Plugin `wc-gsheetconnector`	Cross-Site Request Forgery No login needed	`≤ 1.3.20` Fixed in `1.4.0`	Jul 16, 2025	`CVE-2025-54030`	Patchstack
6.5 Medium	Coupon Affiliates Plugin `woo-coupon-usage`	Cross-Site Request Forgery No login needed	`≤ 6.4.0` Fixed in `6.4.1`	Jul 16, 2025	`CVE-2025-54022`	Patchstack
5.4 Medium	AntiSpam for Contact Form 7 Plugin `cf7-antispam`	Cross-Site Request Forgery No login needed	`≤ 0.6.3` Fixed in `0.6.4`	Jul 16, 2025	`CVE-2025-54020`	Patchstack
9.6 Critical	FluentSnippets Plugin `easy-code-manager`	Cross-Site Request Forgery No login needed	`≤ 10.50` Fixed in `10.51`	Jul 16, 2025	`CVE-2025-54010`	Patchstack
7.2 High	Allmart Plugin `allmart-core`	Server-Side Request Forgery No login needed	`≤ 1.0.0`	Jul 4, 2025	`CVE-2025-49418`	Patchstack
5.4 Medium	URL Shortener Plugin `exact-links`	Server-Side Request Forgery No login needed	`≤ 3.0.7`	Jul 4, 2025	`CVE-2025-28963`	Patchstack
4.3 Medium	Contact Form 7 reCAPTCHA Plugin `contact-form-7-recaptcha`	Cross-Site Request Forgery No login needed	`≤ 1.2.0`	Jul 4, 2025	`CVE-2025-23972`	Patchstack
4.3 Medium	Trust Payments Gateway for WooCommerce (JavaScript Library) Plugin `trust-payments-gateway-3ds2`	Cross-Site Request Forgery No login needed	`≤ 1.3.6` Fixed in `1.3.7`	Jul 4, 2025	`CVE-2025-53569`	Patchstack
4.3 Medium	Radio Station Plugin `radio-station`	Cross-Site Request Forgery No login needed	`≤ 2.5.12` Fixed in `2.5.13`	Jul 4, 2025	`CVE-2025-53568`	Patchstack
6.4 Medium	Portfolio for Elementor & Image Gallery \| PowerFolio Plugin `portfolio-elementor`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS	`≤ 3.2.0`	Jul 4, 2025	`CVE-2025-7046`	Wordfence
7.1 High	re.place Plugin `replace`	Cross-Site Request Forgery No login needed	`≤ 0.2.1`	Jun 27, 2025	`CVE-2025-53338`	Patchstack
7.1 High	Track Everything Plugin `track-everything`	Cross-Site Request Forgery No login needed	`≤ 2.0.1`	Jun 27, 2025	`CVE-2025-53332`	Patchstack
7.1 High	RSS Digest Plugin `rss-digest`	Cross-Site Request Forgery No login needed	`≤ 1.5`	Jun 27, 2025	`CVE-2025-53331`	Patchstack
7.1 High	Społecznościowa 6 PL 2013 Plugin `spolecznosciowa-6-pl-2013`	Cross-Site Request Forgery No login needed	`≤ 2.0.6`	Jun 27, 2025	`CVE-2025-53329`	Patchstack
4.3 Medium	Aioseo Multibyte Descriptions Plugin `aioseo-multibyte-descriptions`	Cross-Site Request Forgery No login needed	`≤ 0.0.6`	Jun 27, 2025	`CVE-2025-53327`	Patchstack
7.1 High	WPShapere - WordPress admin Plugin `wpshapere-lite`	Cross-Site Request Forgery No login needed	`≤ 1.4.1`	Jun 27, 2025	`CVE-2025-53317`	Patchstack
7.1 High	Relocate Upload Plugin `relocate-upload`	Cross-Site Request Forgery No login needed	`≤ 0.24.1`	Jun 27, 2025	`CVE-2025-53315`	Patchstack
9.6 Critical	WP Optimizer Plugin `wp-optimizer`	Cross-Site Request Forgery No login needed	`≤ 2.5.0`	Jun 27, 2025	`CVE-2025-53314`	Patchstack
7.1 High	Twitch TV Embed Suite Plugin `twitch-tv-embed-suite`	Cross-Site Request Forgery No login needed	`≤ 2.1.0`	Jun 27, 2025	`CVE-2025-53313`	Patchstack
7.1 High	OnionBuzz Plugin `onionbuzz-viral-quiz`	Cross-Site Request Forgery No login needed	`≤ 1.0.7`	Jun 27, 2025	`CVE-2025-53312`	Patchstack
7.1 High	Navayan Subscribe Plugin `navayan-subscribe`	Cross-Site Request Forgery No login needed	`≤ 1.13`	Jun 27, 2025	`CVE-2025-53311`	Patchstack
7.1 High	HidePost Plugin `hidepost`	Cross-Site Request Forgery No login needed	`≤ 2.3.8`	Jun 27, 2025	`CVE-2025-53310`	Patchstack
7.1 High	Image Slider With Description Plugin `image-slider-with-description`	Cross-Site Request Forgery No login needed	`≤ 9.2`	Jun 27, 2025	`CVE-2025-53308`	Patchstack
7.1 High	WP Forum Server Plugin `forum-server`	Cross-Site Request Forgery No login needed	`≤ 1.8.2`	Jun 27, 2025	`CVE-2025-53305`	Patchstack
8.8 High	IS-theme-companion Plugin `weblizar-companion`	Cross-Site Request Forgery No login needed	`≤ 1.59`	Jun 27, 2025	`CVE-2025-53277`	Patchstack
7.1 High	WP Permalink Translator Plugin `wp-permalink-translator`	Cross-Site Request Forgery No login needed	`≤ 1.7.6`	Jun 27, 2025	`CVE-2025-53274`	Patchstack
4.3 Medium	Slickstream Plugin `slick-engagement`	Cross-Site Request Forgery No login needed	`≤ 2.0.3` Fixed in `3.0.0`	Jun 27, 2025	`CVE-2025-53273`	Patchstack
4.3 Medium	Image Cleanup Plugin `image-cleanup`	Cross-Site Request Forgery No login needed	`≤ 1.9.2`	Jun 27, 2025	`CVE-2025-53272`	Patchstack
7.1 High	Additional Order Filters for WooCommerce Plugin `additional-order-filters-for-woocommerce`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.22` Fixed in `1.23`	Jun 27, 2025	`CVE-2025-53271`	Patchstack
4.3 Medium	WordPress CTA Plugin `easy-sticky-sidebar`	Cross-Site Request Forgery No login needed	`≤ 1.7.0` Fixed in `1.7.1`	Jun 27, 2025	`CVE-2025-53270`	Patchstack
4.3 Medium	My Wp Brand Plugin `my-wp-brand`	Cross-Site Request Forgery No login needed	`≤ 1.1.3` Fixed in `1.1.4`	Jun 27, 2025	`CVE-2025-53269`	Patchstack
4.3 Medium	Import external attachments Plugin `import-external-attachments`	Cross-Site Request Forgery No login needed	`≤ 1.5.12`	Jun 27, 2025	`CVE-2025-53268`	Patchstack
4.3 Medium	Hide Admin Bar From Front End Plugin `hide-admin-bar-from-front-end`	Cross-Site Request Forgery No login needed	`≤ 1.0.0`	Jun 27, 2025	`CVE-2025-53267`	Patchstack
5.4 Medium	Virusdie Plugin `virusdie`	Cross-Site Request Forgery No login needed	`≤ 1.1.3` Fixed in `1.1.4`	Jun 27, 2025	`CVE-2025-53265`	Patchstack
4.3 Medium	ONet Regenerate Thumbnails Plugin `onet-regenerate-thumbnails`	Cross-Site Request Forgery No login needed	`≤ 1.5`	Jun 27, 2025	`CVE-2025-53264`	Patchstack
5.4 Medium	Address Autocomplete via Google for Gravity Forms Plugin `gf-google-address-autocomplete`	Cross-Site Request Forgery No login needed	`≤ 1.3.4` Fixed in `1.3.5`	Jun 27, 2025	`CVE-2025-53263`	Patchstack
5.4 Medium	Writesonic Plugin `writesonic`	Cross-Site Request Forgery No login needed	`≤ 1.0.5` Fixed in `1.0.6`	Jun 27, 2025	`CVE-2025-53262`	Patchstack
4.3 Medium	WP YouTube Live Plugin `wp-youtube-live`	Cross-Site Request Forgery No login needed	`≤ 1.10.0` Fixed in `1.10.1`	Jun 27, 2025	`CVE-2025-53261`	Patchstack
4.3 Medium	Cyrlitera Plugin `cyrlitera`	Cross-Site Request Forgery No login needed	`≤ 1.3.0` Fixed in `1.3.1`	Jun 27, 2025	`CVE-2025-53254`	Patchstack
4.3 Medium	WooCommerce PDF Invoice Builder Plugin `woo-pdf-invoice-builder`	Cross-Site Request Forgery No login needed	`≤ 1.2.148` Fixed in `1.2.149`	Jun 27, 2025	`CVE-2025-53203`	Patchstack
4.3 Medium	Cookiebot Plugin `cookiebot`	Cross-Site Request Forgery No login needed	`≤ 4.5.8` Fixed in `4.5.9`	Jun 27, 2025	`CVE-2025-53197`	Patchstack
4.3 Medium	Burst Statistics Plugin `burst-statistics`	Cross-Site Request Forgery No login needed	`≤ 2.0.6` Fixed in `2.0.8`	Jun 27, 2025	`CVE-2025-53193`	Patchstack
4.3 Medium	DarkMySite Plugin `darkmysite`	Cross-Site Request Forgery No login needed	`≤ 1.2.8` Fixed in `1.2.9`	Jun 27, 2025	`CVE-2025-32281`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.