WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 651–700 of 1,456 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 14 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Simple Tableau Viz Plugin simple-tableau-viz Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.0 CVE-2025-11817 Wordfence
6.4 Medium WP-Thumbnail Plugin wp-thumbnail Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1 CVE-2025-11819 Wordfence
6.4 Medium Responsive iframe GoogleMap Plugin responsive-iframe-googlemap Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.2 CVE-2025-11813 Wordfence
6.4 Medium Simple Youtube Shortcode Plugin simple-youtube-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.3 CVE-2025-11811 Wordfence
6.4 Medium WP Responsive Meet The Team Plugin wp-responsive-meet-the-team Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-11818 Wordfence
6.4 Medium Print Button Shortcode Plugin print-button-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-11810 Wordfence
6.4 Medium Mixlr Shortcode Plugin mixlr-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-11807 Wordfence
6.4 Medium WP-Force Images Download Plugin wp-force-images-download Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.8 CVE-2025-11809 Wordfence
6.4 Medium Redirection for Contact Form 7 Plugin wpcf7-redirect Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode ≤ 3.2.6 CVE-2025-9562 Wordfence
6.5 Medium Memberlite Shortcodes Plugin memberlite-shortcodes Cross-Site Scripting ≤ 1.4.1 CVE-2025-48087 Patchstack
6.5 Medium TARIFFUXX Plugin tariffuxx SQL Injection Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode ≤ 1.4 CVE-2025-10682 Wordfence
6.4 Medium Shortcode Button Plugin shortcode-button Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.9 CVE-2025-10194 Wordfence
6.5 Medium WP jQuery Pager Plugin wp-jquery-pdf-paged SQL Injection Authenticated (Contributor+) SQL Injection via Shortcode ≤ 1.4.0 CVE-2025-10575 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Stored Cross-Site Scripting via vc_custom_heading Shortcode ≤ 8.6.1 CVE-2025-11161 Wordfence
6.4 Medium Ova Advent Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.7 CVE-2025-8561 Wordfence
6.4 Medium WordPress Live Webcam Widget & Shortcode Plugin wp-webcam-widget-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2 CVE-2025-10129 Wordfence
6.4 Medium Enable Media Replace Plugin enable-media-replace Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode ≤ 4.1.6 CVE-2025-9496 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode ≤ 1.0.334 CVE-2025-9560 Wordfence
6.4 Medium Flexi Plugin flexi Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode ≤ 4.28 CVE-2025-9129 Wordfence
6.3 Medium Schema Plugin For Divi, Gutenberg & Shortcodes Plugin wp-structured-data-schema PHP Object Injection Authenticated (Contributor+) Object Instantiation ≤ 4.3.2 CVE-2025-7825 Wordfence
6.4 Medium WP Photo Effects Plugin wp-photo-effects Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.2.4 CVE-2025-10192 Wordfence
6.4 Medium Unify Plugin unify Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode ≤ 3.4.7 CVE-2025-9130 Wordfence
6.4 Medium LatePoint Plugin latepoint Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 5.1.94 CVE-2025-6941 Wordfence
6.4 Medium WeedMaps Menu Plugin weedmaps-menu-embed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode ≤ 1.2.0 CVE-2025-8623 Wordfence
6.4 Medium Markdown Shortcode Plugin markdown-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 0.2.1 CVE-2025-10180 Wordfence
6.4 Medium TweetThis Shortcode Plugin tweetthis-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.8.0 CVE-2025-10136 Wordfence
6.5 Medium Penci Shortcodes & Performance Plugin penci-shortcodes Cross-Site Scripting ≤ 6.1 Fixed in 6.1 CVE-2025-59587 Patchstack
6.5 Medium WordPress Widgets Shortcode Plugin wp-widgets-shortcode Cross-Site Scripting ≤ 1.0.3 CVE-2025-57989 Patchstack
6.5 Medium ShortCode Plugin shortcode Cross-Site Scripting ≤ 0.8.1 CVE-2025-58022 Patchstack
6.5 Medium List Child Pages Shortcode Plugin list-child-pages-shortcode Cross-Site Scripting ≤ 1.3.1 Fixed in 1.4.0 CVE-2025-58021 Patchstack
6.5 Medium JSM file_get_contents() Shortcode Plugin wp-file-get-contents Cross-Site Scripting ≤ 2.7.1 CVE-2025-58653 Patchstack
6.5 Medium Last Updated Shortcode Plugin last-updated-shortcode Cross-Site Scripting ≤ 1.0.1 CVE-2025-58683 Patchstack
6.5 Medium Robcore Netatmo Plugin robcore-netatmo SQL Injection Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode ≤ 1.7 CVE-2025-10652 Wordfence
6.4 Medium Blocksy Companion Plugin blocksy-companion Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode ≤ 2.1.10 CVE-2025-9565 Wordfence
6.4 Medium Memberlite Shortcodes Plugin memberlite-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4 CVE-2025-10125 Wordfence
6.4 Medium Social Media Shortcodes Plugin social-media-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.1 CVE-2025-10166 Wordfence
6.4 Medium Productive Style Plugin productive-style Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb Shortcode ≤ 1.1.23 CVE-2025-8394 Wordfence
6.4 Medium azurecurve BBCode Plugin azurecurve-bbcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via url Shortcode ≤ 2.0.4 CVE-2025-8398 Wordfence
6.4 Medium WP Easy FAQs Plugin wp-easy-faqs Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via WP_EASY_FAQ Shortcode ≤ 1.0.5 CVE-2025-8686 Wordfence
6.4 Medium Workable API Plugin wrapper-for-workable-api Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via workable_jobs Shortcode ≤ 1.0.4 CVE-2025-8721 Wordfence
6.4 Medium Mikado Core Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.5.2 CVE-2025-9058 Wordfence
6.4 Medium Wilmer Core Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.4.5 CVE-2025-9061 Wordfence
5.0 Medium WP-Members Membership Plugin wp-members Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names ≤ 3.5.4.2 CVE-2025-9489 Wordfence
6.4 Medium Recent Posts Widget Extended Plugin recent-posts-widget-extended Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via rpwe Shortcode ≤ 2.0.2 CVE-2025-6757 Wordfence
7.3 High Rehub Theme Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via re_filterpost No login needed ≤ 19.9.7 CVE-2025-7366 Wordfence
6.4 Medium Biagiotti Core Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.1.3 CVE-2025-9057 Wordfence
6.5 Medium Translate This gTranslate Shortcode Plugin translate-this-google-translate-web-element-shortcode Cross-Site Scripting ≤ 1.0 CVE-2025-58880 Patchstack
6.5 Medium Aparat Video Shortcode Plugin aparat-shortcode Cross-Site Scripting ≤ 0.2.4 CVE-2025-58876 Patchstack
6.5 Medium Zoomify embed for WP Plugin zoom-image-shortcode Cross-Site Scripting ≤ 1.5.2 CVE-2025-58863 Patchstack
6.4 Medium Flatsome Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.20.0 CVE-2025-8684 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only