WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 8,351–8,400 of 17,220 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 168 of 345
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
9.8 Critical	ZoomSounds Plugin `dzs-zoomsounds`	PHP Object Injection No login needed	`≤ 6.91`	May 23, 2025	`CVE-2025-47568`	Patchstack
7.1 High	User Meta Plugin `user-meta`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.2`	May 23, 2025	`CVE-2025-47611`	Patchstack
7.5 High	belingoGeo Plugin `belingogeo`	Path Traversal Arbitrary File Download No login needed	`≤ 1.12.0` Fixed in `1.12.1`	May 23, 2025	`CVE-2025-47603`	Patchstack
7.1 High	BMI Adult & Kid Calculator Plugin `bmi-adultkid-calculator`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2.2`	May 23, 2025	`CVE-2025-47618`	Patchstack
7.1 High	School Management Plugin `school-management`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 92.0.0`	May 23, 2025	`CVE-2025-47613`	Patchstack
8.8 High	Hospital Management System Plugin `hospital-management`	Privilege Escalation	`47.0(20 – 11`	May 23, 2025	`CVE-2025-47631`	Patchstack
6.5 Medium	6Storage Rentals Plugin `6storage-rentals`	Broken Access Control	`≤ 2.20.2`	May 23, 2025	`CVE-2025-47619`	Patchstack
10.0 Critical	STAGGS Plugin `staggs`	Arbitrary File Upload No login needed	`≤ 2.11.0` Fixed in `2.12.0`	May 23, 2025	`CVE-2025-47637`	Patchstack
10.0 Critical	Printcart Web to Print Product Designer for WooCommerce Plugin `printcart-integration`	Arbitrary File Upload No login needed	`≤ 2.3.9` Fixed in `2.4.0`	May 23, 2025	`CVE-2025-47641`	Patchstack
9.3 Critical	Printcart Web to Print Product Designer for WooCommerce Plugin `printcart-integration`	SQL Injection No login needed	`≤ 2.4.0` Fixed in `2.4.1`	May 23, 2025	`CVE-2025-47640`	Patchstack
9.9 Critical	ELEX WordPress HelpDesk & Customer Ticketing System Plugin `elex-helpdesk-customer-support-ticket-system`	Arbitrary File Upload	`≤ 3.2.9` Fixed in `3.3.0`	May 23, 2025	`CVE-2025-47658`	Patchstack
9.8 Critical	PSW Front-end Login & Registration Plugin `psw-login-and-registration`	Authentication Bypass Broken Authentication No login needed	`≤ 1.13`	May 23, 2025	`CVE-2025-47646`	Patchstack
10.0 Critical	Ajar in5 Embed Plugin `ajar-productions-in5-embed`	Arbitrary File Upload No login needed	`≤ 3.1.5`	May 23, 2025	`CVE-2025-47642`	Patchstack
9.9 Critical	Hospital Management System Plugin `hospital-management`	Arbitrary File Upload	`47.0(20 – 11`	May 23, 2025	`CVE-2025-47663`	Patchstack
8.8 High	WC Affiliate Plugin `wc-affiliate`	PHP Object Injection	`≤ 2.16` Fixed in `2.17`	May 23, 2025	`CVE-2025-47660`	Patchstack
7.6 High	Binary MLM Plan Plugin `binary-mlm-plan`	SQL Injection	`≤ 3.0` Fixed in `5.0`	May 23, 2025	`CVE-2025-47671`	Patchstack
8.1 High	WordPress Social Login and Register Plugin `miniorange-login-openid`	Local File Inclusion No login needed	`≤ 7.6.10` Fixed in `7.7.0`	May 23, 2025	`CVE-2025-47670`	Patchstack
7.1 High	Arconix Shortcodes Plugin `arconix-shortcodes`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.1.16` Fixed in `2.1.17`	May 23, 2025	`CVE-2025-47673`	Patchstack
8.1 High	miniOrange Discord Integration Plugin `miniorange-discord-integration`	Local File Inclusion No login needed	`≤ 2.2.2`	May 23, 2025	`CVE-2025-47672`	Patchstack
7.1 High	xili-tidy-tags Plugin `xili-tidy-tags`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.12.06`	May 23, 2025	`CVE-2025-47680`	Patchstack
7.1 High	FunnelCockpit Plugin `funnelcockpit`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.4.3` Fixed in `1.4.4`	May 23, 2025	`CVE-2025-47678`	Patchstack
8.8 High	Lead Form Data Collection to CRM Plugin `wp-leads-builder-any-crm`	Privilege Escalation Arbitrary Option Update to Privilege Escalation	`≤ 3.1` Fixed in `3.2`	May 23, 2025	`CVE-2025-47690`	Patchstack
10.0 Critical	StoreKeeper for WooCommerce Plugin `storekeeper-for-woocommerce`	Arbitrary File Upload No login needed	`≤ 14.4.4` Fixed in `14.4.5`	May 23, 2025	`CVE-2025-47687`	Patchstack
7.1 High	Quick Contact Form Plugin `quick-contact-form`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 8.2.1` Fixed in `8.2.2`	May 23, 2025	`CVE-2025-48245`	Patchstack
7.1 High	Verge3D Plugin `verge3d`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 4.9.3` Fixed in `4.9.4`	May 23, 2025	`CVE-2025-48241`	Patchstack
7.5 High	WP Job Portal Plugin `wp-job-portal`	Path Traversal Arbitrary File Download No login needed	`≤ 2.3.2` Fixed in `2.3.3`	May 23, 2025	`CVE-2025-48273`	Patchstack
6.5 Medium	Leadinfo Plugin `leadinfo`	Broken Access Control Settings Change No login needed	`≤ 1.1` Fixed in `2.1`	May 23, 2025	`CVE-2025-48271`	Patchstack
7.1 High	ReDi Restaurant Reservation Plugin `redi-restaurant-reservation`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 24.1209` Fixed in `25.0513`	May 23, 2025	`CVE-2025-48286`	Patchstack
9.3 Critical	Majestic Support Plugin `majestic-support`	SQL Injection No login needed	`≤ 1.1.0` Fixed in `1.1.1`	May 23, 2025	`CVE-2025-48283`	Patchstack
6.5 Medium	Visual Header Plugin `visual-header`	Broken Access Control No login needed	`≤ 1.3` Fixed in `1.5`	May 23, 2025	`CVE-2025-48275`	Patchstack
9.8 Critical	Kids Planet Theme `kidsplanet`	PHP Object Injection No login needed	`≤ 2.2.14` Fixed in `2.2.14.1`	May 23, 2025	`CVE-2025-48289`	Patchstack
9.8 Critical	Pix 4x sem juros - Pagaleve Plugin `wc-pagaleve`	PHP Object Injection Pagaleve plugin <= 1.6.9 - PHP Object Injection No login needed	`≤ 1.6.9` Fixed in `1.6.10`	May 23, 2025	`CVE-2025-48287`	Patchstack
8.1 High	Tourmaster Plugin `tourmaster`	Local File Inclusion No login needed	`≤ 5.3.8` Fixed in `5.3.9`	May 23, 2025	`CVE-2025-48292`	Patchstack
6.4 Medium	MapSVG - All Kinds of Maps and Store Locator Plugin	Cross-Site Scripting All Kinds of Maps and Store Locator for WordPress <= 8.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 8.6.4`	May 22, 2025	`CVE-2024-9544`	Wordfence
9.8 Critical	Madara – Responsive and modern WordPress theme for manga sites Theme	Local File Inclusion Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion No login needed	`≤ 2.2.2`	May 21, 2025	`CVE-2025-4524`	Wordfence
9.8 Critical	User Profile Meta Manager Plugin `user-profile-meta`	Cross-Site Request Forgery CSRF to Privilege Escalation No login needed	`≤ 1.02`	May 19, 2025	`CVE-2025-48340`	Patchstack
7.1 High	Tiger Theme `tiger`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0`	May 19, 2025	`CVE-2025-31027`	Patchstack
8.5 High	Revy Plugin `revy`	SQL Injection	`≤ 2.1`	May 19, 2025	`CVE-2025-32924`	Patchstack
8.3 High	SUMO Reward Points Plugin `rewardsystem`	Local File Inclusion No login needed	`≤ 30.7.0`	May 19, 2025	`CVE-2025-32925`	Patchstack
9.8 Critical	Grand Restaurant Plugin `grandrestaurant`	Path Traversal Path Traversal to PHP Object Injection No login needed	`≤ 7.0`	May 19, 2025	`CVE-2025-32926`	Patchstack
9.8 Critical	FoodBakery Plugin `wp-foodbakery`	PHP Object Injection No login needed	`≤ 3.3`	May 19, 2025	`CVE-2025-32927`	Patchstack
9.8 Critical	Altair Theme `altair`	PHP Object Injection No login needed	`≤ 5.2.2`	May 19, 2025	`CVE-2025-32928`	Patchstack
9.8 Critical	Grand Restaurant Plugin `grandrestaurant`	PHP Object Injection No login needed	`≤ 7.0`	May 19, 2025	`CVE-2025-39348`	Patchstack
9.8 Critical	CiyaShop Theme `ciyashop`	PHP Object Injection No login needed	`≤ 4.18.0`	May 19, 2025	`CVE-2025-39349`	Patchstack
8.2 High	wProject Theme `wproject`	Broken Access Control Unauthenticated Post/Comment/Attachment Modification/Deletion No login needed	`< 5.8.0` Fixed in `5.8.0`	May 19, 2025	`CVE-2025-39350`	Patchstack
8.2 High	Grand Restaurant Plugin `grandrestaurant`	Broken Access Control Arbitrary Options Deletion No login needed	`≤ 7.0`	May 19, 2025	`CVE-2025-39352`	Patchstack
9.8 Critical	Grand Conference Plugin `grandconference`	PHP Object Injection No login needed	`≤ 5.3`	May 19, 2025	`CVE-2025-39354`	Patchstack
8.5 High	FAT Services Booking Plugin `fat-services-booking`	SQL Injection	`≤ 5.6`	May 19, 2025	`CVE-2025-39355`	Patchstack
9.8 Critical	Foodbakery Sticky Cart Plugin `foodbakery-sticky-cart`	PHP Object Injection No login needed	`≤ 3.2`	May 19, 2025	`CVE-2025-39356`	Patchstack
8.5 High	Hospital Management System Plugin `hospital-management`	SQL Injection	`≤ 47.0(20-11-2023)`	May 19, 2025	`CVE-2025-39357`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.