Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,700 vulnerabilities, 2,149 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,333 High 9,521 Medium 18,463 Low 382 Not scored 1

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 29, 2026.

Showing 7,601–7,650 of 17,602 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 153 of 353
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Simple Business Directory Pro Plugin simple-business-directory-pro Cross-Site Scripting No login needed ≤ 15.5.1 Fixed in 15.5.2 CVE-2025-48162 Patchstack
8.1 High Caliris Plugin caliris-wp Local File Inclusion No login needed ≤ 1.5 Fixed in 1.6 CVE-2025-48160 Patchstack
8.8 High SureDash Plugin suredash Privilege Escalation ≤ 1.0.3 Fixed in 1.1.0 CVE-2025-48164 Patchstack
7.1 High SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support Plugin lbg-audio8-html5-radio-ads Cross-Site Scripting HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Cross Site Scripting (XSS) No login needed ≤ 3.5.4 Fixed in 3.5.5 CVE-2025-48163 Patchstack
7.1 High Apollo - Sticky Full Width HTML5 Audio Player Plugin lbg-audio5-html5-shoutcast-sticky Cross-Site Scripting Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) No login needed ≤ 3.4 Fixed in 3.6.4 CVE-2025-48168 Patchstack
8.8 High DELUCKS SEO Plugin delucks-seo Privilege Escalation ≤ 2.6.0 Fixed in 2.6.1 CVE-2025-48165 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-48170 Patchstack
9.9 Critical Code Engine Plugin code-engine Remote Code Execution ≤ 0.3.3 Fixed in 0.3.4 CVE-2025-48169 Patchstack
7.1 High UpStore Plugin upstore Cross-Site Scripting No login needed ≤ 1.7.0 Fixed in 1.7.1 CVE-2025-48296 Patchstack
8.1 High Cena Store Plugin cena Local File Inclusion No login needed ≤ 2.11.26 Fixed in 2.11.27 CVE-2025-48171 Patchstack
7.1 High Simple Link Directory Plugin qc-simple-link-directory Cross-Site Scripting No login needed ≤ 14.8.1 Fixed in 14.8.1 CVE-2025-48297 Patchstack
7.5 High FundEngine Plugin wp-fundraising-donation Local File Inclusion ≤ 1.7.4 Fixed in 1.7.5 CVE-2025-48302 Patchstack
7.5 High SEOPress for MainWP Plugin seopress-for-mainwp Local File Inclusion No login needed ≤ 1.4 Fixed in 1.5 CVE-2025-48298 Patchstack
6.5 Medium JetEngine Plugin jet-engine Cross-Site Scripting ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53195 Patchstack
8.5 High JetEngine Plugin jet-engine Remote Code Execution ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53194 Patchstack
8.1 High Houzez Plugin houzez Local File Inclusion No login needed ≤ 4.0.4 Fixed in 4.0.8 CVE-2025-53198 Patchstack
6.5 Medium JetEngine Plugin jet-engine Information Disclosure Sensitive Data Exposure ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53196 Patchstack
8.1 High eventlist Plugin eventlist Local File Inclusion No login needed ≤ 1.9.2 Fixed in 2.0.2 CVE-2025-53204 Patchstack
7.1 High Jobmonster Theme noo-jobmonster Cross-Site Scripting No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2025-53201 Patchstack
8.1 High WP Travel Gutenberg Blocks Plugin wp-travel-blocks Local File Inclusion No login needed ≤ 3.9.0 Fixed in 3.9.1 CVE-2025-53207 Patchstack
7.1 High Radio Player Shoutcast & Icecast Plugin lbg-audio4-html5-shoutcast Cross-Site Scripting No login needed ≤ 4.4.7 Fixed in 4.4.8 CVE-2025-53205 Patchstack
7.5 High ZoloBlocks Plugin zoloblocks Local File Inclusion ≤ 2.3.2 Fixed in 2.3.3 CVE-2025-53210 Patchstack
7.5 High Maya Business Plugin paymaya-checkout-for-woocommerce Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.2.0 Fixed in 1.3.0 CVE-2025-53208 Patchstack
9.9 Critical ReachShip WooCommerce Multi-Carrier & Conditional Shipping Plugin elex-reachship-multi-carrier-conditional-shipping Arbitrary File Upload ≤ 4.3.1 Fixed in 4.3.2 CVE-2025-53213 Patchstack
7.1 High Revolution Video Player With Bottom Playlist Plugin revolution-video-player Cross-Site Scripting No login needed ≤ 2.9.2 Fixed in 2.9.3 CVE-2025-53212 Patchstack
7.1 High Comments Capcha Box Plugin comments-capcha-box Cross-Site Scripting No login needed ≤ 1.1 CVE-2025-53226 Patchstack
7.1 High Raptive Ads Plugin adthrive-ads Cross-Site Scripting No login needed ≤ 3.8.0 Fixed in 3.9.0 CVE-2025-53319 Patchstack
9.8 Critical ThemeMakers Visual Content Composer Plugin tmm_content_composer PHP Object Injection No login needed ≤ 1.5.8 CVE-2025-53299 Patchstack
8.8 High Noisa Plugin noisa PHP Object Injection ≤ 2.6.0 Fixed in 2.6.2 CVE-2025-53560 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53559 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg_universal_video_player_addon_visual_composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53562 Patchstack
6.5 Medium Prevent files / folders access Plugin prevent-file-access Path Traversal ≤ 2.6.0 Fixed in 2.6.1 CVE-2025-53561 Patchstack
7.1 High HTML5 Radio Player - WPBakery Page Builder Addon Plugin lbg_radio_player_addon_visual_composer Cross-Site Scripting WPBakery Page Builder Addon <= 2.5 - Cross Site Scripting (XSS) No login needed ≤ 2.5 Fixed in 2.5.2 CVE-2025-53564 Patchstack
7.1 High Youtube Vimeo Video Player and Slider Plugin video_player_youtube_vimeo Cross-Site Scripting No login needed ≤ 3.8 Fixed in 3.9 CVE-2025-53563 Patchstack
8.1 High Ghost Kit Plugin ghostkit Local File Inclusion No login needed ≤ 3.4.1 Fixed in 3.4.2 CVE-2025-53567 Patchstack
8.1 High Widget for Google Reviews Plugin business-reviews-wp Local File Inclusion No login needed ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-53565 Patchstack
10.0 Critical Global DNS Plugin global-dns Remote Code Execution No login needed ≤ 3.1.0 Fixed in 3.1.1 CVE-2025-53577 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Information Disclosure Sensitive Data Exposure ≤ 2.7.7 Fixed in 2.7.7.1 CVE-2025-53983 Patchstack
9.8 Critical Simple Business Directory Pro Plugin simple-business-directory-pro Privilege Escalation No login needed ≤ 15.6.9 Fixed in 15.6.9 CVE-2025-53580 Patchstack
6.5 Medium JetMenu Plugin jet-menu Information Disclosure Sensitive Data Exposure ≤ 2.4.11.1 Fixed in 2.4.11.2 CVE-2025-53987 Patchstack
6.5 Medium JetTabs Plugin jet-tabs Information Disclosure Sensitive Data Exposure ≤ 2.2.9 Fixed in 2.2.9.1 CVE-2025-53985 Patchstack
6.5 Medium JetTricks Plugin jet-tricks Information Disclosure Sensitive Data Exposure ≤ 1.5.4.1 Fixed in 1.5.4.2 CVE-2025-53992 Patchstack
6.5 Medium JetBlocks For Elementor Plugin jet-blocks Information Disclosure Sensitive Data Exposure ≤ 1.3.18 Fixed in 1.3.19 CVE-2025-53988 Patchstack
6.5 Medium JetPopup Plugin jet-popup Information Disclosure Sensitive Data Exposure ≤ 2.0.15 Fixed in 2.0.15.1 CVE-2025-53993 Patchstack
8.8 High Post Grid and Gutenberg Blocks Plugin post-grid PHP Object Injection ≤ 2.3.11 Fixed in 2.3.12 CVE-2025-54007 Patchstack
6.5 Medium JetWooBuilder Plugin jet-woo-builder Information Disclosure Sensitive Data Exposure ≤ 2.1.20 Fixed in 2.1.20.1 CVE-2025-53998 Patchstack
7.2 High Welcart e-Commerce Plugin usc-e-shop PHP Object Injection ≤ 2.11.16 Fixed in 2.11.17 CVE-2025-54012 Patchstack
6.5 Medium JetSmartFilters Plugin jet-smart-filters Information Disclosure Sensitive Data Exposure ≤ 3.6.7 Fixed in 3.6.7.1 CVE-2025-54008 Patchstack
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions Local File Inclusion No login needed ≤ 2.15.4 Fixed in 2.15.5 CVE-2025-54017 Patchstack
9.8 Critical MediCenter - Health Medical Clinic Plugin medicenter PHP Object Injection Health Medical Clinic <= 15.1 - PHP Object Injection No login needed ≤ 15.1 Fixed in 15.2 CVE-2025-54014 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only