Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,324 High 9,486 Medium 18,376 Low 376 Not scored 1

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.

Showing 751–800 of 1,531 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 16 of 31
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical smart SEO Theme smartseo Privilege Escalation No login needed ≤ 4.0 CVE-2025-49401 Patchstack
9.1 Critical Bulk Featured Image Plugin bulk-featured-image Arbitrary File Upload ≤ 1.2.4 CVE-2025-58819 Patchstack
9.8 Critical RealHomes Plugin realhomes Privilege Escalation No login needed ≤ 4.3.6 Fixed in 4.3.7 CVE-2024-32444 Patchstack
9.9 Critical School Management Plugin school-management Arbitrary File Upload ≤ 1.93.1 (02-07-2025) CVE-2025-31100 Patchstack
9.8 Critical Login with phone number Plugin login-with-phone-number Broken Access Control No login needed ≤ 1.6.93 Fixed in 1.6.94 CVE-2024-32832 Patchstack
9.8 Critical Jobmonster Theme noo-jobmonster Authentication Bypass Broken Authentication No login needed ≤ 4.7.9 Fixed in 4.8.0 CVE-2025-54738 Patchstack
9.8 Critical Golo Plugin golo Authentication Bypass Broken Authentication No login needed ≤ 1.7.0 Fixed in 1.7.1 CVE-2025-54725 Patchstack
9.3 Critical Nest Addons Plugin nest-addons SQL Injection No login needed ≤ 1.6.3 Fixed in 1.6.4 CVE-2025-54720 Patchstack
9.8 Critical WP Funnel Manager Plugin wp-funnel-manager PHP Object Injection No login needed ≤ 1.4.0 CVE-2025-52761 Patchstack
9.8 Critical Miraculous Core Plugin miraculouscore Privilege Escalation No login needed ≤ 2.0.7 Fixed in 2.0.8 CVE-2025-49388 Patchstack
10.0 Critical Drag and Drop File Upload for Elementor Forms Plugin drag-and-drop-file-upload-for-elementor-forms Arbitrary File Upload No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2025-49387 Patchstack
9.1 Critical bidorbuy Store Integrator Plugin bidorbuystoreintegrator Remote Code Execution ≤ 2.12.0 CVE-2025-48100 Patchstack
9.3 Critical WooBeWoo Product Filter Pro Plugin woofilter-pro SQL Injection No login needed < 2.9.6 Fixed in 2.9.6 CVE-2025-39496 Patchstack
9.9 Critical Pin WP Theme pin-wp Arbitrary File Upload ≤ 7.2 Fixed in 7.2 CVE-2025-53251 Patchstack
9.6 Critical ads.txt Guru Connect Plugin adstxt-guru-connect Cross-Site Request Forgery No login needed ≤ 1.1.1 Fixed in 1.1.2 CVE-2025-49381 Patchstack
9.8 Critical WP Visitor Statistics (Real Time Traffic) Plugin wp-stats-manager Cross-Site Scripting No login needed ≤ 8.2 Fixed in 8.3 CVE-2025-49400 Patchstack
10.0 Critical Templately Plugin templately Information Disclosure Sensitive Data Exposure No login needed ≤ 3.2.7 Fixed in 3.2.8 CVE-2025-49408 Patchstack
9.8 Critical SensorPress Plugin sensorpress-uptime-monitoring Cross-Site Scripting No login needed ≤ 1.0 CVE-2025-49409 Patchstack
10.0 Critical TC Testimonials Plugin tc-testimonial Cross-Site Scripting No login needed ≤ 1.1.1 CVE-2025-49410 Patchstack
9.8 Critical Support Ticket Plugin support-ticket Privilege Escalation No login needed ≤ 1.9 CVE-2025-49422 Patchstack
9.8 Critical Cars4Rent Theme cars4rent PHP Object Injection No login needed ≤ 1.4.2 CVE-2025-49434 Patchstack
9.8 Critical Organic Beauty Theme organic-beauty PHP Object Injection No login needed ≤ 1.4.6 CVE-2025-49890 Patchstack
10.0 Critical StoreKeeper for WooCommerce Plugin storekeeper-for-woocommerce Arbitrary File Upload No login needed ≤ 14.4.4 Fixed in 14.4.5 CVE-2025-48148 Patchstack
9.9 Critical Code Engine Plugin code-engine Remote Code Execution ≤ 0.3.3 Fixed in 0.3.4 CVE-2025-48169 Patchstack
9.9 Critical ReachShip WooCommerce Multi-Carrier & Conditional Shipping Plugin elex-reachship-multi-carrier-conditional-shipping Arbitrary File Upload ≤ 4.3.1 Fixed in 4.3.2 CVE-2025-53213 Patchstack
9.8 Critical ThemeMakers Visual Content Composer Plugin tmm_content_composer PHP Object Injection No login needed ≤ 1.5.8 CVE-2025-53299 Patchstack
10.0 Critical Global DNS Plugin global-dns Remote Code Execution No login needed ≤ 3.1.0 Fixed in 3.1.1 CVE-2025-53577 Patchstack
9.8 Critical Simple Business Directory Pro Plugin simple-business-directory-pro Privilege Escalation No login needed ≤ 15.6.9 Fixed in 15.6.9 CVE-2025-53580 Patchstack
9.8 Critical MediCenter - Health Medical Clinic Plugin medicenter PHP Object Injection Health Medical Clinic <= 15.1 - PHP Object Injection No login needed ≤ 15.1 Fixed in 15.2 CVE-2025-54014 Patchstack
9.3 Critical Custom API for WP Plugin custom-api-for-wp SQL Injection No login needed ≤ 4.2.2 Fixed in 4.2.3 CVE-2025-54048 Patchstack
9.9 Critical Custom API for WP Plugin custom-api-for-wp Privilege Escalation ≤ 4.2.2 Fixed in 4.2.3 CVE-2025-54049 Patchstack
9.1 Critical Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Arbitrary File Upload ≤ 4.5.3 Fixed in 4.5.5 CVE-2025-54677 Patchstack
9.3 Critical JS Archive List Plugin jquery-archive-list-widget SQL Injection No login needed ≤ 6.1.6 Fixed in 6.1.6 CVE-2025-54726 Patchstack
9.8 Critical Taxi Booking Manager for WooCommerce Plugin ecab-taxi-booking-manager Authentication Bypass Broken Authentication No login needed ≤ 1.3.0 Fixed in 1.3.1 CVE-2025-54713 Patchstack
9.8 Critical Real Spaces - WordPress Properties Directory Theme Privilege Escalation WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register' No login needed ≤ 3.6 CVE-2025-6758 Wordfence
9.3 Critical MDTF Plugin wp-meta-data-filter-and-taxonomy-filter SQL Injection No login needed ≤ 1.3.3.7 Fixed in 1.3.3.8 CVE-2025-54707 Patchstack
9.0 Critical Form Block Plugin form-block Arbitrary File Upload No login needed ≤ 1.5.5 Fixed in 1.5.6 CVE-2025-54693 Patchstack
9.8 Critical Exertio Plugin exertio PHP Object Injection No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2025-54686 Patchstack
9.3 Critical Easy Form Builder Plugin easy-form-builder SQL Injection No login needed ≤ 3.8.15 Fixed in 3.8.16 CVE-2025-54678 Patchstack
9.3 Critical MapSVG Plugin mapsvg SQL Injection No login needed ≤ 8.7.4 Fixed in 8.7.4 CVE-2025-54669 Patchstack
9.9 Critical Forms Plugin forms-by-made-it Arbitrary File Upload ≤ 2.9.0 CVE-2025-24775 Patchstack
10.0 Critical BeeTeam368 Extensions Plugin beeteam368-extensions Local File Inclusion No login needed ≤ 1.9.4 CVE-2025-25174 Patchstack
9.8 Critical Geo Mashup Plugin geo-mashup Local File Inclusion No login needed ≤ 1.13.16 Fixed in 1.13.17 CVE-2025-48293 Patchstack
9.3 Critical CleverReach® WP Plugin cleverreach-wp SQL Injection No login needed ≤ 1.5.20 Fixed in 1.5.21 CVE-2025-49059 Patchstack
9.9 Critical Product XML Feed Manager for WooCommerce Plugin product-xml-feeds-for-woocommerce Remote Code Execution ≤ 2.9.3 Fixed in 2.9.4 CVE-2025-49887 Patchstack
9.3 Critical Super Store Finder Plugin superstorefinder-wp SQL Injection No login needed ≤ 7.5 Fixed in 7.6 CVE-2025-52720 Patchstack
9.3 Critical WordPress Plugin wp-property Arbitrary File Upload WordPress Plugin WP-Property <= 1.35.0 PHP File Upload No login needed ≤ 1.35.0 CVE-2012-10027 VulnCheck
10.0 Critical asset-manager Plugin asset-manager Arbitrary File Upload WordPress Plugin Asset-Manager <= 2.0 PHP File Upload No login needed ≤ 2.0 CVE-2012-10026 VulnCheck
10.0 Critical WordPress Plugin advanced-custom-fields Local File Inclusion WordPress Plugin Advanced Custom Fields <= 3.5.1 Remote File Inclusion No login needed ≤ 3.5.1 CVE-2012-10025 VulnCheck
9.8 Critical LoginPress Pro Plugin Authentication Bypass Authentication Bypass via WordPress.com OAuth provider No login needed ≤ 5.0.1 CVE-2025-7444 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only