WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,802 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 7,651–7,700 of 17,889 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 154 of 358
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Print My Blog Plugin print-my-blog Cross-Site Scripting ≤ 3.27.9 Fixed in 3.27.10 CVE-2025-54740 Patchstack
6.5 Medium Shortcode Redirect Plugin shortcode-redirect Cross-Site Scripting ≤ 1.0.02 Fixed in 1.0.03 CVE-2025-54746 Patchstack
6.5 Medium JetProductGallery Plugin jet-woo-product-gallery Cross-Site Scripting ≤ 2.2.0.2 Fixed in 2.2.0.3 CVE-2025-54749 Patchstack
6.5 Medium Templatera Plugin templatera Cross-Site Scripting ≤ 2.3.0 Fixed in 2.4.0 CVE-2025-54747 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.15.0 Fixed in 45.15.0 CVE-2025-55709 Patchstack
4.3 Medium TaxoPress Plugin simple-tags Information Disclosure Sensitive Data Exposure ≤ 3.37.2 Fixed in 3.37.3 CVE-2025-55710 Patchstack
6.5 Medium WP Table Builder Plugin wp-table-builder Cross-Site Scripting ≤ 2.0.12 Fixed in 2.0.13 CVE-2025-55711 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Broken Access Control ≤ 6.3.13 Fixed in 6.3.14 CVE-2025-55712 Patchstack
5.9 Medium Blocksy Plugin blocksy Cross-Site Scripting ≤ 2.1.6 Fixed in 2.1.7 CVE-2025-55713 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Cross-Site Scripting ≤ 2.7.9 Fixed in 2.7.9.1 CVE-2025-55714 Patchstack
4.3 Medium WP Statistics Plugin wp-statistics Broken Access Control ≤ 14.15 Fixed in 14.15.2 CVE-2025-55716 Patchstack
6.5 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting ≤ 1.5 Fixed in 1.5.1 CVE-2024-37945 Patchstack
6.5 Medium Magical Posts Display Plugin magical-posts-display Cross-Site Scripting ≤ 1.2.52 Fixed in 1.2.53 CVE-2025-54706 Patchstack
4.3 Medium WpEvently Plugin mage-eventpress Broken Access Control ≤ 4.4.6 Fixed in 4.4.7 CVE-2025-54705 Patchstack
6.5 Medium Easy Elementor Addons Plugin easy-elementor-addons Cross-Site Scripting ≤ 2.2.6 Fixed in 2.2.7 CVE-2025-54704 Patchstack
4.3 Medium Integrate Google Drive Plugin integrate-google-drive Cross-Site Request Forgery No login needed ≤ 1.5.2 Fixed in 1.5.3 CVE-2025-54703 Patchstack
4.3 Medium Ebook Store Plugin ebook-store Cross-Site Request Forgery No login needed ≤ 5.8013 Fixed in 5.8014 CVE-2025-54702 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Cross-Site Scripting LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) ≤ 1.18.3 Fixed in 1.18.4 CVE-2025-54699 Patchstack
5.4 Medium Classified Listing Plugin classified-listing Content Injection ≤ 5.0.0 Fixed in 5.0.1 CVE-2025-54698 Patchstack
6.5 Medium WPFunnels Plugin wpfunnels Cross-Site Scripting ≤ 3.5.26 Fixed in 3.5.27 CVE-2025-54696 Patchstack
5.4 Medium HT Mega Plugin ht-mega-for-elementor Broken Access Control ≤ 2.9.0 Fixed in 2.9.1 CVE-2025-54695 Patchstack
4.3 Medium Button Block Plugin button-block Cross-Site Request Forgery No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2025-54694 Patchstack
5.3 Medium Motors Plugin motors-car-dealership-classified-listings Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.4.80 Fixed in 1.4.81 CVE-2025-54691 Patchstack
6.5 Medium JetEngine Plugin jet-engine Cross-Site Scripting ≤ 3.7.1.2 Fixed in 3.7.2 CVE-2025-54688 Patchstack
6.5 Medium JetTabs Plugin jet-tabs Cross-Site Scripting ≤ 2.2.9.1 Fixed in 2.2.9.2 CVE-2025-54687 Patchstack
6.5 Medium SureDash Plugin suredash Information Disclosure Sensitive Data Exposure ≤ 1.1.0 Fixed in 1.2.0 CVE-2025-54685 Patchstack
5.9 Medium Integration for Contact Form 7 and Constant Contact Plugin cf7-constant-contact Cross-Site Scripting ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-54684 Patchstack
5.9 Medium WP Modal Popup with Cookie Integration Plugin wp-modal-popup-with-cookie-integration Cross-Site Scripting ≤ 2.4 Fixed in 2.5 CVE-2025-54683 Patchstack
5.4 Medium Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets Cross-Site Request Forgery No login needed ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-54682 Patchstack
4.7 Medium Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets Open Redirect No login needed ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-54681 Patchstack
6.5 Medium Blogger Buzz Plugin blogger-buzz Cross-Site Scripting ≤ 1.2.6 Fixed in 1.2.7 CVE-2025-54680 Patchstack
6.5 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting ≤ 4.5.3 Fixed in 4.5.5 CVE-2025-54676 Patchstack
4.3 Medium YITH WooCommerce Popup Plugin yith-woocommerce-popup Cross-Site Request Forgery No login needed ≤ 1.48.0 Fixed in 1.48.1 CVE-2025-54675 Patchstack
5.4 Medium Product Configurator for WooCommerce Plugin product-configurator-for-woocommerce Cross-Site Request Forgery No login needed ≤ 1.4.4 Fixed in 1.5.0 CVE-2025-54674 Patchstack
4.3 Medium Chartify Plugin chart-builder Cross-Site Request Forgery No login needed ≤ 3.5.3 Fixed in 3.5.4 CVE-2025-54673 Patchstack
4.3 Medium Photo Engine Plugin wplr-sync Cross-Site Request Forgery No login needed ≤ 6.4.3 Fixed in 6.4.4 CVE-2025-54672 Patchstack
4.3 Medium oik Plugin oik Cross-Site Request Forgery No login needed ≤ 4.15.2 Fixed in 4.15.3 CVE-2025-54671 Patchstack
6.5 Medium myCred Plugin mycred Cross-Site Scripting ≤ 2.9.4.3 Fixed in 2.9.4.4 CVE-2025-54668 Patchstack
5.3 Medium myCred Plugin mycred Other Race Condition No login needed ≤ 2.9.4.3 Fixed in 2.9.4.4 CVE-2025-54667 Patchstack
6.5 Medium Advanced Google Universal Analytics Plugin advanced-google-universal-analytics Broken Access Control Broken Access Control to Sensitive Data Exposure ≤ 1.0.3 CVE-2025-28962 Patchstack
6.4 Medium PressForward Plugin pressforward Server-Side Request Forgery ≤ 5.9.5 CVE-2025-28987 Patchstack
6.5 Medium Thank You Page Customizer for WooCommerce Plugin woo-thank-you-page-customizer Broken Access Control Increase Your Sales <= 1.1.7 - Broken Access Control ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-30993 Patchstack
6.5 Medium Eventer Plugin eventer Content Injection No login needed ≤ 3.9.9.1 Fixed in 3.9.9.1 CVE-2025-39483 Patchstack
6.5 Medium WooCommerce Fortnox Integration Plugin woocommerce-fortnox-integration Cross-Site Scripting ≤ 4.5.6 Fixed in 4.5.7 CVE-2025-47610 Patchstack
5.9 Medium Inspectlet – User Session Recording and Heatmaps Plugin inspectlet-heatmaps-and-user-session-recording Cross-Site Scripting User Session Recording and Heatmaps plugin <= 2.0 - Cross Site Scripting (XSS) ≤ 2.0 Fixed in 3.0 CVE-2025-49048 Patchstack
5.9 Medium DigitalOcean Spaces Sync Plugin do-spaces-sync Cross-Site Scripting ≤ 2.2.1 CVE-2025-49047 Patchstack
4.3 Medium Netease Music Plugin netease-music Broken Access Control ≤ 3.2.1 CVE-2025-49052 Patchstack
6.5 Medium Hide Text Shortcode Plugin hide-text-shortcode Cross-Site Scripting ≤ 1.1 CVE-2025-49051 Patchstack
5.9 Medium WP Airdrop Manager Plugin airdrop Cross-Site Scripting ≤ 1.0.5 CVE-2025-49053 Patchstack
6.5 Medium Porn Videos Embed Plugin porn-videos-embed Cross-Site Scripting ≤ 0.9.1 CVE-2025-49061 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only