WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,802 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 8,151–8,200 of 17,889 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 164 of 358
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Gutenberg Blocks – ACF Blocks Suite Plugin acf-blocks Cross-Site Scripting ACF Blocks Suite plugin <= 2.6.11 - Cross Site Scripting (XSS) ≤ 2.6.11 CVE-2025-50041 Patchstack
6.5 Medium Anant Addons for Elementor Plugin anant-addons-for-elementor Cross-Site Scripting ≤ 1.2.8 CVE-2025-50038 Patchstack
6.5 Medium Real Estate Manager Plugin real-estate-manager Cross-Site Request Forgery No login needed ≤ 7.3 CVE-2025-50044 Patchstack
6.5 Medium Code Engine Plugin code-engine Cross-Site Scripting ≤ 0.3.2 Fixed in 0.3.3 CVE-2025-50043 Patchstack
6.5 Medium WPComplete Plugin wpcomplete Cross-Site Scripting ≤ 2.9.5 Fixed in 2.9.5.1 CVE-2025-50046 Patchstack
6.5 Medium Related Products Manager for WooCommerce Plugin related-products-manager-woocommerce Cross-Site Scripting ≤ 1.6.2 Fixed in 1.6.3 CVE-2025-50045 Patchstack
6.5 Medium Automatically Hierarchic Categories in Menu Plugin automatically-hierarchic-categories-in-menu Cross-Site Scripting ≤ 2.0.9 Fixed in 2.0.10 CVE-2025-50048 Patchstack
6.5 Medium Sitekit Plugin sitekit Cross-Site Scripting ≤ 1.9 Fixed in 2.0 CVE-2025-50047 Patchstack
6.5 Medium Jobs Plugin job-postings Cross-Site Scripting ≤ 2.7.14 Fixed in 2.7.15 CVE-2025-50050 Patchstack
6.5 Medium Modern Footnotes Plugin modern-footnotes Cross-Site Scripting ≤ 1.4.19 Fixed in 1.4.20 CVE-2025-50049 Patchstack
6.5 Medium WP-Members Plugin wp-members Cross-Site Scripting ≤ 3.5.4 Fixed in 3.5.4.1 CVE-2025-50051 Patchstack
6.5 Medium ANON::form embedded secure form Plugin anonform-embedded-secure-form Cross-Site Scripting ≤ 1.7 Fixed in 1.8 CVE-2025-52733 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Information Disclosure Full Path Disclosure (FPD) ≤ 5.9.5.2 Fixed in 5.9.5.3 CVE-2025-52719 Patchstack
6.4 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Server-Side Request Forgery Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) ≤ 1.27.8 Fixed in 1.27.9 CVE-2025-52713 Patchstack
4.3 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Cross-Site Request Forgery Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.27.8 Fixed in 1.27.9 CVE-2025-52711 Patchstack
5.9 Medium File Manager Pro Plugin filester Cross-Site Scripting ≤ 1.8.8 Fixed in 1.8.9 CVE-2025-52710 Patchstack
6.5 Medium Firelight Lightbox Plugin easy-fancybox Cross-Site Scripting ≤ 2.3.16 Fixed in 2.3.17 CVE-2025-52707 Patchstack
6.4 Medium Euro FxRef Currency Converter Plugin euro-fxref-currency-converter Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode ≤ 2.0.2 CVE-2025-6257 Wordfence
4.8 Medium Custom Post Carousels with Owl Plugin dd-post-carousel Cross-Site Scripting Contributor+ Stored XSS < 1.4.12 Fixed in 1.4.12 CVE-2025-5125 WPScan
6.4 Medium Gutenverse News Plugin gutenverse-news Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via elementId Parameter ≤ 1.0.4 Fixed in 2.0.0 CVE-2025-5234 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder ≤ 8.4.1 CVE-2025-4965 Wordfence
5.4 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Broken Access Control Donation Plugin and Fundraising Platform <= 4.3.0 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification ≤ 4.3.0 CVE-2025-4571 Wordfence
5.5 Medium Football Pool Plugin football-pool Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 2.12.4 Fixed in 2.12.5 CVE-2025-5490 Wordfence
4.9 Medium OceanWP Theme oceanwp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Select HTML Tag ≤ 4.0.9 CVE-2025-5524 Wordfence
6.4 Medium ElementsKit Lite Plugin elementskit-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget ≤ 3.5.2 Fixed in 3.5.3 CVE-2025-4479 Wordfence
6.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Author+) Stored Cross-site Scripting via wpdm_user_dashboard Shortcode ≤ 3.3.18 Fixed in 3.3.19 CVE-2025-4367 Wordfence
6.4 Medium Pixel Manager for WooCommerce (PRO) Plugin woocommerce-google-adwords-conversion-tracking-tag Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via Shortcode ≤ 1.49.0 Fixed in 1.49.1 CVE-2025-6201 Wordfence
4.3 Medium Breeze Plugin breeze Broken Access Control ≤ 2.2.13 Fixed in 2.2.14 CVE-2025-23999 Patchstack
6.4 Medium Target Video Easy Publish Plugin brid-video-easy-publish Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter ≤ 3.8.5 CVE-2025-5237 Wordfence
4.7 Medium tarteaucitron.io Plugin tarteaucitronjs Cross-Site Scripting Contributor+ Stored XSS < 1.9.5 Fixed in 1.9.5 CVE-2025-4955 WPScan
4.3 Medium YITH PayPal Express Checkout for WooCommerce Plugin yith-paypal-express-checkout-for-woocommerce Cross-Site Request Forgery No login needed ≤ 1.49.0 Fixed in 1.49.1 CVE-2025-48111 Patchstack
6.5 Medium WP Dummy Content Generator Plugin wp-dummy-content-generator Broken Access Control Arbitrary User Deletion ≤ 3.4.6 Fixed in 4.0.0 CVE-2025-49234 Patchstack
4.3 Medium myCred Plugin mycred Broken Access Control ≤ 2.9.4.2 Fixed in 2.9.4.3 CVE-2025-49857 Patchstack
4.3 Medium Responsive Plus Plugin responsive-add-ons Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed ≤ 3.2.2 Fixed in 3.2.3 CVE-2025-49856 Patchstack
6.5 Medium Meks Flexible Shortcodes Plugin meks-flexible-shortcodes Cross-Site Scripting ≤ 1.3.7 Fixed in 1.3.8 CVE-2025-49855 Patchstack
6.5 Medium Arconix Shortcodes Plugin arconix-shortcodes Cross-Site Scripting ≤ 2.1.17 Fixed in 2.1.18 CVE-2025-49858 Patchstack
6.5 Medium Kama Click Counter Plugin kama-clic-counter Cross-Site Scripting ≤ 4.0.3 Fixed in 4.0.4 CVE-2025-49861 Patchstack
6.5 Medium WP Views Counter Plugin wpecounter Cross-Site Scripting ≤ 2.0.3 Fixed in 2.0.4 CVE-2025-49859 Patchstack
6.5 Medium Advanced Sermons Plugin advanced-sermons Cross-Site Scripting ≤ 3.6 Fixed in 3.7 CVE-2025-49863 Patchstack
5.9 Medium Ebook Store Plugin ebook-store Cross-Site Scripting ≤ 5.8008 Fixed in 5.8009 CVE-2025-49862 Patchstack
4.7 Medium FunnelKit Automations Plugin wp-marketing-automations Open Redirect No login needed ≤ 3.6.0 Fixed in 3.6.1 CVE-2025-49868 Patchstack
4.3 Medium Advanced Settings Plugin advanced-settings Cross-Site Request Forgery No login needed ≤ 3.0.1 Fixed in 3.0.2 CVE-2025-49865 Patchstack
5.3 Medium AFS Analytics Plugin addfreestats Broken Access Control No login needed ≤ 4.21 Fixed in 4.22 CVE-2025-49864 Patchstack
5.3 Medium myCred Plugin mycred Broken Access Control No login needed ≤ 2.9.4.2 Fixed in 2.9.4.3 CVE-2025-49872 Patchstack
5.9 Medium Noptin Plugin newsletter-optin-box Cross-Site Scripting ≤ 3.8.7 Fixed in 4.0.0 CVE-2025-49871 Patchstack
6.5 Medium If-So Dynamic Content Personalization Plugin if-so Cross-Site Scripting ≤ 1.9.3.1 Fixed in 1.9.3.2 CVE-2025-49875 Patchstack
4.3 Medium Arconix FAQ Plugin arconix-faq Broken Access Control ≤ 1.9.6 Fixed in 1.9.7 CVE-2025-49874 Patchstack
6.5 Medium WPAdverts Plugin wpadverts Cross-Site Scripting ≤ 2.2.4 Fixed in 2.2.5 CVE-2025-49878 Patchstack
4.9 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Server-Side Request Forgery ≤ 5.9.5.2 Fixed in 5.9.5.3 CVE-2025-49877 Patchstack
4.3 Medium CubeWP Forms Plugin cubewp-forms Broken Access Control ≤ 1.1.5 Fixed in 1.1.6 CVE-2025-49880 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only