WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 751–800 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 16 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Uix Shortcodes Plugin uix-shortcodes Cross-Site Scripting ≤ 2.0.4 Fixed in 2.0.5 CVE-2025-39574 Patchstack
6.5 Medium Themify Shortcodes Plugin themify-shortcodes Cross-Site Scripting ≤ 2.1.3 Fixed in 2.1.4 CVE-2025-39581 Patchstack
6.4 Medium User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Plugin profile-builder Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.13.6 CVE-2025-2314 Wordfence
6.5 Medium Sign-up Sheets Plugin sign-up-sheets Content Injection Shortcode Injection No login needed ≤ 2.3.0.1 Fixed in 2.3.1 CVE-2025-26996 Patchstack
5.4 Medium Everest Forms Plugin everest-forms Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 3.1.1 CVE-2025-3422 Wordfence
6.4 Medium ZoomSounds Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 6.91 CVE-2025-0839 Wordfence
6.5 Medium DobsonDev Shortcodes Plugin dobsondev-shortcodes Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 2.1.12 CVE-2025-31754 Patchstack
6.5 Medium Author Bio Shortcode Plugin author-bio-shortcode Cross-Site Scripting ≤ 2.5.3 CVE-2025-31731 Patchstack
6.4 Medium Contempo Real Estate Core Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.6.3 CVE-2025-2906 Wordfence
4.8 Medium SP Blog Designer Plugin sp-blog-designer Arbitrary Shortcode Execution No login needed ≤ 1.0.0 CVE-2025-31606 Patchstack
6.5 Medium WP Date and Time Shortcode Plugin wp-date-and-time-shortcode Cross-Site Scripting ≤ 2.6.7 Fixed in 2.6.8 CVE-2025-31590 Patchstack
6.5 Medium Shortcodes by United Themes Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 5.1.6 CVE-2024-13557 Wordfence
5.4 Medium PDF for WPForms Plugin pdf-for-wpforms Arbitrary Shortcode Execution ≤ 5.3.0 Fixed in 5.3.1 CVE-2025-30767 Patchstack
6.4 Medium Advanced Woo Search Plugin advanced-woo-search Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via aws_search_terms Shortcode ≤ 3.28 CVE-2025-2302 Wordfence
6.4 Medium DesignThemes Core Features Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.8 CVE-2025-0845 Wordfence
6.5 Medium IG Shortcodes Plugin ig-shortcodes Cross-Site Scripting WordPress IG Shortcodes plugin <= 3.1 Cross Site Scripting (XSS) ≤ 3.1 CVE-2025-30597 Patchstack
4.3 Medium Info Boxes Shortcode and Widget Plugin info-boxes-shortcode-and-widget Cross-Site Request Forgery No login needed ≤ 1.15 CVE-2025-30541 Patchstack
6.5 Medium Ohio Extra Plugin ohio-extra Content Injection Shortcode Injection No login needed ≤ 3.4.7 CVE-2025-26924 Patchstack
6.4 Medium CC-IMG-Shortcode Plugin cc-img-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.0 CVE-2025-1559 Wordfence
4.3 Medium Page Builder: Pagelayer – Drag and Drop website builder Plugin pagelayer Information Disclosure Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode ≤ 1.9.8 CVE-2024-13430 Wordfence
6.3 Medium WP-Recall – Registration, Profile, Commerce & More Plugin wp-recall Broken Access Control Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction ≤ 16.26.10 CVE-2025-1325 Wordfence
6.4 Medium WP-Recall – Registration, Profile, Commerce & More Plugin wp-recall Cross-Site Scripting Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 16.26.10 CVE-2025-1324 Wordfence
4.3 Medium Code Snippets CPT Plugin code-snippets-cpt Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 2.1.0 CVE-2024-13895 Wordfence
6.5 Medium Shortcode Cleaner Lite Plugin shortcode-cleaner-lite Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export ≤ 1.0.9 CVE-2025-1481 Wordfence
6.4 Medium Master Slider – Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode ≤ 3.10.7 CVE-2024-11731 Wordfence
6.5 Medium Listingo - Business Listing and Directory Theme Arbitrary Shortcode Execution Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 3.2.7 CVE-2024-13815 Wordfence
6.4 Medium Master Slider – Responsive Touch Slider Plugin master-slider Cross-Site Scripting Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode ≤ 3.10.6 CVE-2024-13757 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter ≤ 7.3.3 CVE-2025-0370 Wordfence
6.4 Medium Structured Content (JSON-LD) #wpsc Plugin structured-content Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode ≤ 1.6.3 CVE-2025-0512 Wordfence
6.5 Medium Authors List Plugin authors-list Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.0.6 CVE-2024-13806 Wordfence
6.4 Medium TemplatesNext ToolKit Plugin templatesnext-toolkit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.9 CVE-2024-13559 Wordfence
6.4 Medium SecuPress Free — WordPress Security Plugin secupress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form Shortcode ≤ 2.2.5.3 CVE-2024-9019 Wordfence
6.4 Medium Product Catalog Simple Plugin post-type-x Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode ≤ 1.7.11 CVE-2025-1405 Wordfence
6.4 Medium WordPress Portfolio Builder – Portfolio Gallery Plugin uber-grid Cross-Site Scripting Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.7 CVE-2025-1757 Wordfence
6.4 Medium ThemeMakers Stripe Checkout Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-1690 Wordfence
6.4 Medium ThemeMakers PayPal Express Checkout Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.9 CVE-2025-1689 Wordfence
6.4 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes ≤ 3.6.0 CVE-2025-1517 Wordfence
5.4 Medium WooCommerce Cart Count Shortcode Plugin Cross-Site Scripting Contributor+ XSS < 1.1.0 Fixed in 1.1.0 CVE-2024-10563 WPScan
6.5 Medium EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Scripting ≤ 5.21.35 Fixed in 5.25.08 CVE-2025-26887 Patchstack
4.8 Medium WP-Asambleas Plugin wp-asambleas Arbitrary Shortcode Execution No login needed ≤ 2.85.0 CVE-2025-27294 Patchstack
6.4 Medium Rife Elementor Extensions & Templates Plugin rife-elementor-extensions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode ≤ 1.2.5 CVE-2024-13564 Wordfence
6.4 Medium Frontend Content Forms for User Submissions (UGC) Plugin buddyforms Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode ≤ 2.8.15 CVE-2024-12038 Wordfence
6.4 Medium WP-Appbox Plugin wp-appbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode ≤ 4.5.4 CVE-2025-1489 Wordfence
6.4 Medium Events Calendar Made Simple – Pie Calendar Plugin pie-calendar Cross-Site Scripting Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode ≤ 1.2.5 CVE-2025-1410 Wordfence
6.4 Medium Newpost Catch Plugin newpost-catch Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode ≤ 1.3.19 CVE-2025-1406 Wordfence
6.4 Medium AMO Team Showcase Plugin amo-team-showcase Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode ≤ 1.1.4 CVE-2025-1407 Wordfence
6.4 Medium Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin embed-any-document Server-Side Request Forgery Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode ≤ 2.7.5 CVE-2025-1043 Wordfence
4.3 Medium Prime Addons for Elementor Plugin prime-addons-for-elementor Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode ≤ 2.0.1 CVE-2024-13855 Wordfence
6.4 Medium Modal Window Plugin modal-window Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode ≤ 6.1.5 CVE-2025-0897 Wordfence
6.4 Medium Login/Signup Popup ( Inline Form + Woocommerce ) Plugin easy-login-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode ≤ 2.8.5 CVE-2025-1064 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only