WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,802 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 7,201–7,250 of 17,220 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 145 of 345
Severity Component Vulnerability Affected versions Published CVE Source
8.1 High Simple Login Log Plugin simple-login-log PHP Object Injection No login needed ≤ 1.1.3 CVE-2025-49438 Patchstack
8.1 High Anotte Plugin anotte-wp Local File Inclusion No login needed ≤ 1.8 Fixed in 1.9 CVE-2025-49436 Patchstack
9.8 Critical Organic Beauty Theme organic-beauty PHP Object Injection No login needed ≤ 1.4.6 CVE-2025-49890 Patchstack
8.1 High Edge CPT Plugin edge-cpt Local File Inclusion No login needed ≤ 1.4 CVE-2025-49889 Patchstack
8.1 High Uxper Booking Plugin uxper-booking Local File Inclusion No login needed ≤ 1.3.3 CVE-2025-49892 Patchstack
8.5 High Uxper Booking Plugin uxper-booking SQL Injection ≤ 1.3.3 CVE-2025-49891 Patchstack
8.1 High Nuss Plugin nuss Local File Inclusion No login needed ≤ 1.3.3 CVE-2025-49894 Patchstack
7.1 High Nuss Plugin nuss Cross-Site Scripting No login needed ≤ 1.3.3 CVE-2025-49893 Patchstack
5.3 Medium WP Discord Post Plus – Supports Unlimited Channels Plugin wp-discord-post-plus Cross-Site Request Forgery Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.0.2 CVE-2025-49896 Patchstack
8.8 High Bookify Plugin bookify Privilege Escalation ≤ 1.0.9 Fixed in 1.0.10 CVE-2025-48142 Patchstack
10.0 Critical StoreKeeper for WooCommerce Plugin storekeeper-for-woocommerce Arbitrary File Upload No login needed ≤ 14.4.4 Fixed in 14.4.5 CVE-2025-48148 Patchstack
7.1 High CM Map Locations Plugin cm-map-locations Cross-Site Scripting No login needed ≤ 2.1.6 Fixed in 2.1.7 CVE-2025-48151 Patchstack
8.1 High Cook&Meal Plugin cookandmeal Local File Inclusion No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-48149 Patchstack
7.1 High Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin lbg_vp_youtube_vimeo_addon_visual_composer Cross-Site Scripting No login needed ≤ 2.1 Fixed in 2.2 CVE-2025-48154 Patchstack
7.1 High Rentsyst Plugin rentsyst Cross-Site Scripting No login needed ≤ 2.0.100 Fixed in 2.0.101 CVE-2025-48152 Patchstack
8.6 High BuddyPress XProfile Custom Image Field Plugin buddypress-xprofile-image-field Arbitrary File Deletion No login needed ≤ 3.0.1 Fixed in 3.1.0 CVE-2025-48158 Patchstack
8.1 High Formality Plugin formality Local File Inclusion No login needed ≤ 1.5.9 Fixed in 1.5.10 CVE-2025-48157 Patchstack
7.1 High Youtube Vimeo Video Player and Slider WP Plugin video-player-youtube-vimeo Cross-Site Scripting No login needed ≤ 3.8 Fixed in 3.9 CVE-2025-48159 Patchstack
7.1 High Simple Business Directory Pro Plugin simple-business-directory-pro Cross-Site Scripting No login needed ≤ 15.5.1 Fixed in 15.5.2 CVE-2025-48162 Patchstack
8.1 High Caliris Plugin caliris-wp Local File Inclusion No login needed ≤ 1.5 Fixed in 1.6 CVE-2025-48160 Patchstack
8.8 High SureDash Plugin suredash Privilege Escalation ≤ 1.0.3 Fixed in 1.1.0 CVE-2025-48164 Patchstack
7.1 High SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support Plugin lbg-audio8-html5-radio-ads Cross-Site Scripting HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Cross Site Scripting (XSS) No login needed ≤ 3.5.4 Fixed in 3.5.5 CVE-2025-48163 Patchstack
7.1 High Apollo - Sticky Full Width HTML5 Audio Player Plugin lbg-audio5-html5-shoutcast-sticky Cross-Site Scripting Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) No login needed ≤ 3.4 Fixed in 3.6.4 CVE-2025-48168 Patchstack
8.8 High DELUCKS SEO Plugin delucks-seo Privilege Escalation ≤ 2.6.0 Fixed in 2.6.1 CVE-2025-48165 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-48170 Patchstack
9.9 Critical Code Engine Plugin code-engine Remote Code Execution ≤ 0.3.3 Fixed in 0.3.4 CVE-2025-48169 Patchstack
7.1 High UpStore Plugin upstore Cross-Site Scripting No login needed ≤ 1.7.0 Fixed in 1.7.1 CVE-2025-48296 Patchstack
8.1 High Cena Store Plugin cena Local File Inclusion No login needed ≤ 2.11.26 Fixed in 2.11.27 CVE-2025-48171 Patchstack
7.1 High Simple Link Directory Plugin qc-simple-link-directory Cross-Site Scripting No login needed ≤ 14.8.1 Fixed in 14.8.1 CVE-2025-48297 Patchstack
7.5 High FundEngine Plugin wp-fundraising-donation Local File Inclusion ≤ 1.7.4 Fixed in 1.7.5 CVE-2025-48302 Patchstack
7.5 High SEOPress for MainWP Plugin seopress-for-mainwp Local File Inclusion No login needed ≤ 1.4 Fixed in 1.5 CVE-2025-48298 Patchstack
6.5 Medium JetEngine Plugin jet-engine Cross-Site Scripting ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53195 Patchstack
8.5 High JetEngine Plugin jet-engine Remote Code Execution ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53194 Patchstack
8.1 High Houzez Plugin houzez Local File Inclusion No login needed ≤ 4.0.4 Fixed in 4.0.8 CVE-2025-53198 Patchstack
6.5 Medium JetEngine Plugin jet-engine Information Disclosure Sensitive Data Exposure ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53196 Patchstack
8.1 High eventlist Plugin eventlist Local File Inclusion No login needed ≤ 1.9.2 Fixed in 2.0.2 CVE-2025-53204 Patchstack
7.1 High Jobmonster Theme noo-jobmonster Cross-Site Scripting No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2025-53201 Patchstack
8.1 High WP Travel Gutenberg Blocks Plugin wp-travel-blocks Local File Inclusion No login needed ≤ 3.9.0 Fixed in 3.9.1 CVE-2025-53207 Patchstack
7.1 High Radio Player Shoutcast & Icecast Plugin lbg-audio4-html5-shoutcast Cross-Site Scripting No login needed ≤ 4.4.7 Fixed in 4.4.8 CVE-2025-53205 Patchstack
7.5 High ZoloBlocks Plugin zoloblocks Local File Inclusion ≤ 2.3.2 Fixed in 2.3.3 CVE-2025-53210 Patchstack
7.5 High Maya Business Plugin paymaya-checkout-for-woocommerce Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.2.0 Fixed in 1.3.0 CVE-2025-53208 Patchstack
9.9 Critical ReachShip WooCommerce Multi-Carrier & Conditional Shipping Plugin elex-reachship-multi-carrier-conditional-shipping Arbitrary File Upload ≤ 4.3.1 Fixed in 4.3.2 CVE-2025-53213 Patchstack
7.1 High Revolution Video Player With Bottom Playlist Plugin revolution-video-player Cross-Site Scripting No login needed ≤ 2.9.2 Fixed in 2.9.3 CVE-2025-53212 Patchstack
7.1 High Comments Capcha Box Plugin comments-capcha-box Cross-Site Scripting No login needed ≤ 1.1 CVE-2025-53226 Patchstack
7.1 High Raptive Ads Plugin adthrive-ads Cross-Site Scripting No login needed ≤ 3.8.0 Fixed in 3.9.0 CVE-2025-53319 Patchstack
9.8 Critical ThemeMakers Visual Content Composer Plugin tmm_content_composer PHP Object Injection No login needed ≤ 1.5.8 CVE-2025-53299 Patchstack
8.8 High Noisa Plugin noisa PHP Object Injection ≤ 2.6.0 Fixed in 2.6.2 CVE-2025-53560 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53559 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg_universal_video_player_addon_visual_composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53562 Patchstack
6.5 Medium Prevent files / folders access Plugin prevent-file-access Path Traversal ≤ 2.6.0 Fixed in 2.6.1 CVE-2025-53561 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only