WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,802 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 7,651–7,700 of 17,220 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 154 of 345
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Melapress File Monitor Plugin website-file-changes-monitor Broken Access Control ≤ 2.2.0 Fixed in 2.2.0 CVE-2025-3702 Patchstack
6.5 Medium Gutenberg Blocks Plugin advanced-gutenberg Cross-Site Scripting ≤ 3.3.1 Fixed in 3.3.2 CVE-2025-49032 Patchstack
6.5 Medium Mollie Payments for WooCommerce Plugin mollie-payments-for-woocommerce Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 8.0.2 Fixed in 8.0.3 CVE-2025-39362 Patchstack
9.8 Critical Education Center | LMS & Online Courses Theme PHP Object Injection No login needed ≤ 3.6.10 CVE-2024-13786 Wordfence
7.5 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin SQL Injection Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id' No login needed ≤ 4.89 CVE-2025-5339 Wordfence
7.5 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin SQL Injection Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oid No login needed ≤ 4.89 CVE-2025-6437 Wordfence
8.8 High Home Villas | Real Estate Theme Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion ≤ 2.8 CVE-2025-5014 Wordfence
8.1 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin Local File Inclusion Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion No login needed ≤ 4.89 CVE-2025-4380 Wordfence
8.8 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin Cross-Site Request Forgery Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate No login needed ≤ 4.89 CVE-2025-6459 Wordfence
9.8 Critical Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin Local File Inclusion Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution No login needed ≤ 4.89 CVE-2025-4689 Wordfence
7.5 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin SQL Injection Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection No login needed ≤ 4.89 CVE-2025-4381 Wordfence
5.4 Medium The Plus Addons for Elementor Pro Plugin theplus_elementor_addon Broken Access Control Pro Plugin < 6.3.7 - Broken Access Control < 6.3.7 Fixed in 6.3.7 CVE-2025-46259 Patchstack
9.1 Critical Custom Login And Signup Widget Plugin custom-login-and-signup-widget Remote Code Execution Arbitrary Code Execution ≤ 1.0 CVE-2025-49029 Patchstack
6.4 Medium WP VR – 360 Panorama and Free Virtual Tour Builder Plugin wpvr Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.5.32 Fixed in 8.5.33 CVE-2025-6350 Wordfence
7.5 High Devnex Addons For Elementor Plugin devnex-addons-for-elementor Local File Inclusion ≤ 1.0.9 CVE-2025-53339 Patchstack
7.1 High re.place Plugin replace Cross-Site Request Forgery No login needed ≤ 0.2.1 CVE-2025-53338 Patchstack
6.5 Medium My Resume Builder Plugin my-resume-builder Cross-Site Scripting ≤ 1.0.3 CVE-2025-53336 Patchstack
7.1 High Track Everything Plugin track-everything Cross-Site Request Forgery No login needed ≤ 2.0.1 CVE-2025-53332 Patchstack
7.1 High RSS Digest Plugin rss-digest Cross-Site Request Forgery No login needed ≤ 1.5 CVE-2025-53331 Patchstack
7.1 High Społecznościowa 6 PL 2013 Plugin spolecznosciowa-6-pl-2013 Cross-Site Request Forgery No login needed ≤ 2.0.6 CVE-2025-53329 Patchstack
4.3 Medium Aioseo Multibyte Descriptions Plugin aioseo-multibyte-descriptions Cross-Site Request Forgery No login needed ≤ 0.0.6 CVE-2025-53327 Patchstack
5.9 Medium Beauty Contact Popup Form Plugin beauty-contact-popup-form Cross-Site Scripting ≤ 6.0 CVE-2025-53325 Patchstack
4.3 Medium Pre-Publish Post Checklist Plugin pre-publish-post-checklist Broken Access Control ≤ 3.1 CVE-2025-53323 Patchstack
5.3 Medium Accept Authorize.NET Payments Using Contact Form 7 Plugin accept-authorize-net-payments-using-contact-form-7 Information Disclosure Sensitive Data Exposure No login needed ≤ 2.5 Fixed in 2.6 CVE-2025-53322 Patchstack
6.5 Medium Raise The Money Plugin raise-the-money Cross-Site Scripting ≤ 5.2 CVE-2025-53321 Patchstack
6.5 Medium Free Downloads EDD Plugin free-downloads-edd Cross-Site Scripting ≤ 1.0.4 CVE-2025-53320 Patchstack
5.4 Medium WP DB Booster Plugin wp-db-booster Broken Access Control ≤ 1.0.1 CVE-2025-53318 Patchstack
7.1 High WPShapere - WordPress admin Plugin wpshapere-lite Cross-Site Request Forgery No login needed ≤ 1.4.1 CVE-2025-53317 Patchstack
7.1 High Relocate Upload Plugin relocate-upload Cross-Site Request Forgery No login needed ≤ 0.24.1 CVE-2025-53315 Patchstack
9.6 Critical WP Optimizer Plugin wp-optimizer Cross-Site Request Forgery No login needed ≤ 2.5.0 CVE-2025-53314 Patchstack
7.1 High Twitch TV Embed Suite Plugin twitch-tv-embed-suite Cross-Site Request Forgery No login needed ≤ 2.1.0 CVE-2025-53313 Patchstack
7.1 High OnionBuzz Plugin onionbuzz-viral-quiz Cross-Site Request Forgery No login needed ≤ 1.0.7 CVE-2025-53312 Patchstack
7.1 High Navayan Subscribe Plugin navayan-subscribe Cross-Site Request Forgery No login needed ≤ 1.13 CVE-2025-53311 Patchstack
7.1 High HidePost Plugin hidepost Cross-Site Request Forgery No login needed ≤ 2.3.8 CVE-2025-53310 Patchstack
5.3 Medium Accept Stripe Payments Using Contact Form 7 Plugin accept-stripe-payments-using-contact-form-7 Information Disclosure Sensitive Data Exposure No login needed ≤ 3.0 Fixed in 3.1 CVE-2025-53309 Patchstack
7.1 High Image Slider With Description Plugin image-slider-with-description Cross-Site Request Forgery No login needed ≤ 9.2 CVE-2025-53308 Patchstack
7.6 High WP Forum Server Plugin forum-server SQL Injection ≤ 1.8.2 CVE-2025-53306 Patchstack
7.1 High WP Forum Server Plugin forum-server Cross-Site Request Forgery No login needed ≤ 1.8.2 CVE-2025-53305 Patchstack
5.3 Medium Contact Form – 7 : Hide Success Message Plugin contact-form-7-hide-success-message Broken Access Control No login needed ≤ 1.1.4 CVE-2025-53304 Patchstack
6.5 Medium Theme Junkie Team Content Plugin theme-junkie-team-content Cross-Site Scripting ≤ 0.1.1 CVE-2025-53301 Patchstack
6.5 Medium Podcast Feed Player Widget and Shortcode Plugin podcast-feed-player-widget Cross-Site Scripting ≤ 2.2.0 CVE-2025-53300 Patchstack
4.9 Medium Plugin Inspector Plugin plugin-inspector Path Traversal Arbitrary File Download ≤ 1.5 CVE-2025-53298 Patchstack
5.9 Medium EC Stars Rating Plugin ec-stars-rating Cross-Site Scripting ≤ 1.0.11 CVE-2025-53296 Patchstack
5.3 Medium iCount Payment Gateway Plugin icount Broken Access Control No login needed ≤ 2.0.7 CVE-2025-53295 Patchstack
6.5 Medium Smart Agenda Plugin smart-agenda-prise-de-rendez-vous-en-ligne Cross-Site Scripting ≤ 4.9 Fixed in 5.0 CVE-2025-53294 Patchstack
4.3 Medium Dashboard Widget Sidebar Plugin dashboard-widget-sidebar Broken Access Control ≤ 1.2.3 CVE-2025-53293 Patchstack
6.5 Medium WP DataTable Plugin wp-datatable Cross-Site Scripting ≤ 0.2.7 CVE-2025-53292 Patchstack
6.5 Medium WP Visual Sitemap Plugin wp-visual-sitemap Cross-Site Scripting ≤ 1.0.2 CVE-2025-53290 Patchstack
4.3 Medium PlatiOnline Payments Plugin plationline Broken Access Control ≤ 7.0.0 Fixed in 7.0.1 CVE-2025-53288 Patchstack
5.9 Medium Quick Favicon Plugin quick-favicon Cross-Site Scripting ≤ 0.22.8 CVE-2025-53287 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only