WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,802 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 7,351–7,400 of 17,220 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 148 of 345
Severity Component Vulnerability Affected versions Published CVE Source
8.1 High Unicamp Plugin unicamp Local File Inclusion No login needed ≤ 2.6.3 Fixed in 2.6.4 CVE-2025-54701 Patchstack
8.1 High Makeaholic Plugin makeaholic Local File Inclusion No login needed ≤ 1.8.4 Fixed in 1.8.5 CVE-2025-54700 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Cross-Site Scripting LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) ≤ 1.18.3 Fixed in 1.18.4 CVE-2025-54699 Patchstack
5.4 Medium Classified Listing Plugin classified-listing Content Injection ≤ 5.0.0 Fixed in 5.0.1 CVE-2025-54698 Patchstack
7.2 High Kadence WooCommerce Email Designer Plugin kadence-woocommerce-email-designer Privilege Escalation ≤ 1.5.16 Fixed in 1.5.17 CVE-2025-54697 Patchstack
6.5 Medium WPFunnels Plugin wpfunnels Cross-Site Scripting ≤ 3.5.26 Fixed in 3.5.27 CVE-2025-54696 Patchstack
5.4 Medium HT Mega Plugin ht-mega-for-elementor Broken Access Control ≤ 2.9.0 Fixed in 2.9.1 CVE-2025-54695 Patchstack
4.3 Medium Button Block Plugin button-block Cross-Site Request Forgery No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2025-54694 Patchstack
9.0 Critical Form Block Plugin form-block Arbitrary File Upload No login needed ≤ 1.5.5 Fixed in 1.5.6 CVE-2025-54693 Patchstack
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control No login needed ≤ 2.9.0 Fixed in 3.0.0 CVE-2025-54692 Patchstack
5.3 Medium Motors Plugin motors-car-dealership-classified-listings Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.4.80 Fixed in 1.4.81 CVE-2025-54691 Patchstack
8.1 High Xinterio Plugin xinterio Local File Inclusion No login needed ≤ 4.2 Fixed in 4.3 CVE-2025-54690 Patchstack
8.1 High Urna Plugin urna Local File Inclusion No login needed ≤ 2.5.7 Fixed in 2.5.8 CVE-2025-54689 Patchstack
6.5 Medium JetEngine Plugin jet-engine Cross-Site Scripting ≤ 3.7.1.2 Fixed in 3.7.2 CVE-2025-54688 Patchstack
6.5 Medium JetTabs Plugin jet-tabs Cross-Site Scripting ≤ 2.2.9.1 Fixed in 2.2.9.2 CVE-2025-54687 Patchstack
9.8 Critical Exertio Plugin exertio PHP Object Injection No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2025-54686 Patchstack
6.5 Medium SureDash Plugin suredash Information Disclosure Sensitive Data Exposure ≤ 1.1.0 Fixed in 1.2.0 CVE-2025-54685 Patchstack
5.9 Medium Integration for Contact Form 7 and Constant Contact Plugin cf7-constant-contact Cross-Site Scripting ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-54684 Patchstack
5.9 Medium WP Modal Popup with Cookie Integration Plugin wp-modal-popup-with-cookie-integration Cross-Site Scripting ≤ 2.4 Fixed in 2.5 CVE-2025-54683 Patchstack
5.4 Medium Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets Cross-Site Request Forgery No login needed ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-54682 Patchstack
4.7 Medium Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets Open Redirect No login needed ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-54681 Patchstack
6.5 Medium Blogger Buzz Plugin blogger-buzz Cross-Site Scripting ≤ 1.2.6 Fixed in 1.2.7 CVE-2025-54680 Patchstack
7.5 High Neon Channel Product Customizer Free Plugin neon-channel-product-customizer-free Broken Access Control Arbitrary Content Deletion No login needed ≤ 2.0 Fixed in 3.0 CVE-2025-54679 Patchstack
9.3 Critical Easy Form Builder Plugin easy-form-builder SQL Injection No login needed ≤ 3.8.15 Fixed in 3.8.16 CVE-2025-54678 Patchstack
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting ≤ 4.5.3 Fixed in 4.5.5 CVE-2025-54676 Patchstack
4.3 Medium YITH WooCommerce Popup Plugin yith-woocommerce-popup Cross-Site Request Forgery No login needed ≤ 1.48.0 Fixed in 1.48.1 CVE-2025-54675 Patchstack
5.4 Medium Product Configurator for WooCommerce Plugin product-configurator-for-woocommerce Cross-Site Request Forgery No login needed ≤ 1.4.4 Fixed in 1.5.0 CVE-2025-54674 Patchstack
4.3 Medium Chartify Plugin chart-builder Cross-Site Request Forgery No login needed ≤ 3.5.3 Fixed in 3.5.4 CVE-2025-54673 Patchstack
4.3 Medium Photo Engine Plugin wplr-sync Cross-Site Request Forgery No login needed ≤ 6.4.3 Fixed in 6.4.4 CVE-2025-54672 Patchstack
4.3 Medium oik Plugin oik Cross-Site Request Forgery No login needed ≤ 4.15.2 Fixed in 4.15.3 CVE-2025-54671 Patchstack
9.3 Critical MapSVG Plugin mapsvg SQL Injection No login needed ≤ 8.7.4 Fixed in 8.7.4 CVE-2025-54669 Patchstack
6.5 Medium myCred Plugin mycred Cross-Site Scripting ≤ 2.9.4.3 Fixed in 2.9.4.4 CVE-2025-54668 Patchstack
5.3 Medium myCred Plugin mycred Other Race Condition No login needed ≤ 2.9.4.3 Fixed in 2.9.4.4 CVE-2025-54667 Patchstack
7.5 High CSS & JavaScript Toolbox Plugin css-javascript-toolbox Local File Inclusion ≤ 12.0.3 Fixed in 12.0.3 CVE-2025-3703 Patchstack
9.9 Critical Forms Plugin forms-by-made-it Arbitrary File Upload ≤ 2.9.0 CVE-2025-24775 Patchstack
7.5 High News Magazine X Plugin news-magazine-x Local File Inclusion No login needed ≤ 1.2.37 Fixed in 1.2.38 CVE-2025-24766 Patchstack
10.0 Critical BeeTeam368 Extensions Plugin beeteam368-extensions Local File Inclusion No login needed ≤ 1.9.4 CVE-2025-25174 Patchstack
8.1 High VidMov Theme vidmov Local File Inclusion No login needed ≤ 1.9.4 CVE-2025-25172 Patchstack
7.1 High Alike - WordPress Custom Post Comparison Plugin alike Cross-Site Scripting WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) No login needed ≤ 3.0.1 CVE-2025-28975 Patchstack
6.5 Medium Advanced Google Universal Analytics Plugin advanced-google-universal-analytics Broken Access Control Broken Access Control to Sensitive Data Exposure ≤ 1.0.3 CVE-2025-28962 Patchstack
8.1 High WP Pipes Plugin wp-pipes Local File Inclusion No login needed ≤ 1.4.3 CVE-2025-28979 Patchstack
7.1 High WooCommerce Shop Page Builder Plugin dzs-wootable Cross-Site Scripting No login needed ≤ 2.27.7 CVE-2025-28999 Patchstack
6.4 Medium PressForward Plugin pressforward Server-Side Request Forgery ≤ 5.9.5 CVE-2025-28987 Patchstack
7.1 High FoodMenu Plugin dzs-restaurantmenu Cross-Site Scripting No login needed ≤ 1.20 CVE-2025-29014 Patchstack
8.1 High IDonatePro Plugin idonate-pro Local File Inclusion No login needed ≤ 2.1.9 CVE-2025-30635 Patchstack
7.1 High Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin lbg_vp_youtube_vimeo_addon_visual_composer Cross-Site Scripting No login needed ≤ 2.1 CVE-2025-30626 Patchstack
6.5 Medium Thank You Page Customizer for WooCommerce Plugin woo-thank-you-page-customizer Broken Access Control Increase Your Sales <= 1.1.7 - Broken Access Control ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-30993 Patchstack
7.5 High IDonatePro Plugin idonate-pro Broken Access Control No login needed ≤ 2.1.9 CVE-2025-30639 Patchstack
7.1 High Billplz Addon for Contact Form 7 Plugin billplz-for-contact-form-7 Cross-Site Scripting No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2025-31007 Patchstack
8.5 High WP Links Page Plugin wp-links-page SQL Injection ≤ 4.9.6 Fixed in 5.0 CVE-2025-30998 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only