WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 751–800 of 1,456 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Responsive Food and Drink Menu | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode |
≤ 2.3 |
CVE-2025-6378 |
Wordfence | |
| 6.4 Medium | TableOn – WordPress Posts Table Filterable | Cross-Site Scripting WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode |
≤ 1.0.4.1 |
CVE-2025-5143 |
Wordfence | |
| 6.5 Medium | Fyrebox Quizzes | Cross-Site Scripting |
≤ 3.1 |
CVE-2025-50035 |
Patchstack | |
| 6.5 Medium | WP Register Profile With Shortcode | Cross-Site Scripting |
≤ 3.6.3 |
CVE-2025-50042 |
Patchstack | |
| 6.4 Medium | Euro FxRef Currency Converter | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode |
≤ 2.0.2 |
CVE-2025-6257 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode |
≤ 3.3.18 |
CVE-2025-4367 |
Wordfence | |
| 6.4 Medium | Pixel Manager for WooCommerce (PRO) | Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via Shortcode |
≤ 1.49.0 |
CVE-2025-6201 |
Wordfence | |
| 6.5 Medium | Meks Flexible Shortcodes | Cross-Site Scripting |
≤ 1.3.7 Fixed in 1.3.8 |
CVE-2025-49855 |
Patchstack | |
| 6.5 Medium | Arconix Shortcodes | Cross-Site Scripting |
≤ 2.1.17 Fixed in 2.1.18 |
CVE-2025-49858 |
Patchstack | |
| 6.4 Medium | Master Slider | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes |
≤ 3.10.8 |
CVE-2025-5291 |
Wordfence | |
| 6.4 Medium | Simply Schedule Appointments | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 1.6.8.30 |
CVE-2025-4667 |
Wordfence | |
| 6.4 Medium | IRM Newsroom | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode |
≤ 1.2.19 |
CVE-2025-4586 |
Wordfence | |
| 6.4 Medium | IRM Newsroom | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode |
≤ 1.2.19 |
CVE-2025-4584 |
Wordfence | |
| 6.4 Medium | IRM Newsroom | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode |
≤ 1.2.19 |
CVE-2025-4585 |
Wordfence | |
| 4.3 Medium | Team Showcase | Arbitrary Shortcode Execution |
≤ 25.05.13 Fixed in 25.05.13 |
CVE-2025-49250 |
Patchstack | |
| 6.5 Medium | Shortcodes Ultimate | Cross-Site Scripting |
≤ 7.3.5 Fixed in 7.4.0 |
CVE-2025-49244 |
Patchstack | |
| 6.4 Medium | ESV Bible Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.0.2 |
CVE-2025-5534 |
Wordfence | |
| 6.4 Medium | Profile Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes |
≤ 3.13.8 |
CVE-2025-4671 |
Wordfence | |
| 6.4 Medium | Easy Digital Downloads | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode |
≤ 3.3.8.1 |
CVE-2025-4670 |
Wordfence | |
| 7.1 High | Arconix Shortcodes | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.1.16 Fixed in 2.1.17 |
CVE-2025-47673 |
Patchstack | |
| 6.4 Medium | Slim SEO | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode |
≤ 4.5.3 |
CVE-2025-4611 |
Wordfence | |
| 6.4 Medium | Raisely Donation Form | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode |
≤ 1.1 |
CVE-2025-3781 |
Wordfence | |
| 6.5 Medium | Enhanced Paypal Shortcodes | Cross-Site Scripting |
≤ 0.5a |
CVE-2025-46543 |
Patchstack | |
| 6.4 Medium | Booking Calendar | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode |
≤ 10.11.1 |
CVE-2025-4669 |
Wordfence | |
| 6.4 Medium | WP-Members | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode |
≤ 3.5.2 |
CVE-2025-4610 |
Wordfence | |
| 5.3 Medium | CURCY | Arbitrary Shortcode Execution No login needed |
≤ 2.3.7 |
CVE-2025-47563 |
Patchstack | |
| 5.3 Medium | MapSVG | Arbitrary Shortcode Execution No login needed |
≤ 8.6.9 Fixed in 8.6.10 |
CVE-2025-48120 |
Patchstack | |
| 5.4 Medium | PVN Auth Popup | Cross-Site Scripting Contributor+ XSS via Shortcode |
≤ 1.0.0 |
CVE-2024-6718 |
WPScan | |
| 5.4 Medium | If-So Dynamic Content Personalization | Cross-Site Scripting Contributor+ Shortcode Stored XSS |
< 1.8.0.3 Fixed in 1.8.0.3 |
CVE-2024-5440 |
WPScan | |
| 5.4 Medium | Twitter Bootstrap Collapse aka Accordian Shortcode | Cross-Site Scripting Stored XSS via Shortcode |
≤ 1.0 |
CVE-2024-12722 |
WPScan | |
| 5.4 Medium | Planning Center Online Giving | Cross-Site Scripting Contributor+ XSS via Shortcode |
≤ 1.0.0 |
CVE-2024-11502 |
WPScan | |
| 5.4 Medium | JSFiddle Shortcode | Cross-Site Scripting Contributor+ XSS via Shortcode |
< 1.1.3 Fixed in 1.1.3 |
CVE-2024-10818 |
WPScan | |
| 5.6 Medium | Jetpack | Arbitrary Shortcode Execution Unauthenticated Arbitrary Block & Shortcode Execution No login needed |
< 13.8 Fixed in 13.8 |
CVE-2024-10075 |
WPScan | |
| 7.2 High | File Manager Advanced Shortcode <= Multiple Versions | Local File Inclusion Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode |
≤ 2.5.4, ≤ 2.5.6 |
CVE-2024-13914 |
Wordfence | |
| 6.4 Medium | EG-Series | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.1.1 |
CVE-2025-4126 |
Wordfence | |
| 6.4 Medium | SMS Alert Order Notifications – WooCommerce | Cross-Site Scripting WooCommerce <= 3.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_verify Shortcode |
≤ 3.8.1 |
CVE-2025-3878 |
Wordfence | |
| 7.3 High | Wolmart | Multi-Vendor Marketplace WooCommerce | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmore No login needed |
≤ 1.8.11 |
CVE-2024-13793 |
Wordfence | |
| 6.5 Medium | Meks Flexible Shortcodes | Cross-Site Scripting |
≤ 1.3.6 Fixed in 1.3.7 |
CVE-2025-47621 |
Patchstack | |
| 6.4 Medium | Multiple Post Type Order | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode |
≤ 1.10.0 |
CVE-2025-4055 |
Wordfence | |
| 7.3 High | LayoutBoxx | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 0.3.1 |
CVE-2025-2802 |
Wordfence | |
| 7.3 High | Motors - Car Dealer, Rental & Listing | Arbitrary Shortcode Execution Car Dealer, Rental & Listing WordPress theme <= 5.6.65 - Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 5.6.65 |
CVE-2024-13738 |
Wordfence | |
| 6.4 Medium | WPML Multilingual CMS | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpml_language_switcher Shortcode |
3.6.0 – 4.7.3 |
CVE-2025-3488 |
Wordfence | |
| 6.4 Medium | tagDiv Composer | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 5.4 |
CVE-2025-3510 |
Wordfence | |
| 6.4 Medium | Taxonomy Chain Menu | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via pn_chain_menu Shortcode |
≤ 1.0.8 |
CVE-2025-3748 |
Wordfence | |
| 6.4 Medium | GmapsMania | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.1 |
CVE-2025-4131 |
Wordfence | |
| 6.4 Medium | WordPress Simple PayPal Shopping Cart | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 5.1.3 |
CVE-2025-3890 |
Wordfence | |
| 6.4 Medium | Nautic Pages | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.0 |
CVE-2025-4100 |
Wordfence | |
| 6.4 Medium | List Children | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 2.1 |
CVE-2025-4099 |
Wordfence | |
| 6.5 Medium | Anps Theme | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.1.1 |
CVE-2024-13812 |
Wordfence | |
| 7.3 High | Create custom forms for WordPress with a smart form plugin for smart businesses | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.2.4 |
CVE-2025-2801 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.