WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 8,451–8,500 of 29,694 vulnerabilities

Known WordPress vulnerabilities, page 170 of 594
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High Orderable Plugin orderable Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation ≤ 1.20.0 CVE-2026-0974 Wordfence
2.7 Low OneClick Chat to Order Plugin oneclick-whatsapp-order Broken Access Control Missing Authorization to Authenticated (Editor+) Plugin Settings Update ≤ 1.0.9 CVE-2025-14270 Wordfence
4.3 Medium Remove Post Type Slug Plugin remove-post-type-slug Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0.2 CVE-2025-14167 Wordfence
6.4 Medium YaMaps Plugin yamaps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters ≤ 0.6.40 CVE-2025-14851 Wordfence
9.8 Critical Lizza LMS Pro Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.0.3 CVE-2025-13563 Wordfence
4.4 Medium Tennis Court Bookings Plugin tennis-court-bookings Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters ≤ 1.2.7 CVE-2026-1044 Wordfence
4.3 Medium Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Email MFA Update ≤ 21.0.9 CVE-2025-14427 Wordfence
4.3 Medium Virusdie Plugin virusdie Broken Access Control Missing Authorization to Authenticated (Subscriber+) API Key Disclosure ≤ 1.1.7 CVE-2025-14864 Wordfence
4.3 Medium Shopire Theme shopire Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install ≤ 1.0.57 CVE-2025-13091 Wordfence
4.4 Medium PostmarkApp Email Integrator Plugin postmarkapp-email-integrator Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings ≤ 2.4 CVE-2026-1043 Wordfence
8.8 High WP AUDIO GALLERY Plugin wp-audio-gallery Path Traversal Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation ≤ 2.0 CVE-2025-13603 Wordfence
4.3 Medium SEO Plugin by Squirrly SEO Plugin squirrly-seo Broken Access Control Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection ≤ 12.4.14 CVE-2025-14342 Wordfence
6.1 Medium iXML – Google XML sitemap generator Plugin ixml Cross-Site Scripting Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter No login needed ≤ 0.6 CVE-2025-14076 Wordfence
6.4 Medium Groups Plugin groups Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode ≤ 3.10.0 CVE-2026-0549 Wordfence
6.4 Medium Easy Table of Contents Plugin easy-table-of-contents Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.78 CVE-2025-13738 Wordfence
6.4 Medium XO Event Calendar Plugin xo-event-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode ≤ 3.2.10 CVE-2026-0556 Wordfence
4.3 Medium Page Title, Description & Open Graph Updater Plugin page-title-description-open-graph-updater Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Page Title Modification No login needed ≤ 1.02 CVE-2025-13438 Wordfence
4.4 Medium salavat counter Plugin salavat-counter Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter ≤ 0.9.5 CVE-2026-1047 Wordfence
5.3 Medium Breadcrumb NavXT Plugin breadcrumb-navxt Broken Access Control Missing Authorization to Sensitive Information Exposure No login needed ≤ 7.5.0 CVE-2025-13842 Wordfence
5.3 Medium Breeze – WordPress Cache Plugin breeze Broken Access Control WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion No login needed ≤ 2.2.21 CVE-2025-13864 Wordfence
6.4 Medium Apollo13 Framework Extension Plugin apollo13-framework-extensions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter ≤ 1.9.8 CVE-2025-13617 Wordfence
4.4 Medium Slidorion Plugin slidorion Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings ≤ 1.0.2 CVE-2026-2282 Wordfence
8.8 High IDonate Plugin idonate Broken Access Control Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function 2.1.5 – 2.1.9 CVE-2025-4521 Wordfence
8.8 High Toret Manager Plugin toret-manager Broken Access Control Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions ≤ 1.2.7 CVE-2026-0912 Wordfence
7.2 High CTX Feed – WooCommerce Product Feed Manager Plugin webappick-product-feed-for-woocommerce Broken Access Control WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation ≤ 6.6.11 CVE-2025-12975 Wordfence
9.8 Critical Slider Future Plugin slider-future Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.0.5 CVE-2026-1405 Wordfence
6.4 Medium Album and Image Gallery Plus Lightbox Plugin album-and-image-gallery-plus-lightbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode ≤ 2.1.7 CVE-2025-13612 Wordfence
6.4 Medium Advance Block Extend Plugin advance-block-extend Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute ≤ 1.0.4 CVE-2026-1646 Wordfence
5.3 Medium Checkout Field Manager (Checkout Manager) for WooCommerce Plugin woocommerce-checkout-manager Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed ≤ 7.8.5 CVE-2025-13930 Wordfence
7.2 High BackWPup Plugin backwpup Privilege Escalation Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update ≤ 5.6.2 CVE-2025-15041 Wordfence
5.3 Medium Razorpay for WooCommerce Plugin woo-razorpay Broken Access Control Missing Authentication to Unauthenticated Order Modification No login needed ≤ 4.7.8 CVE-2025-14294 Wordfence
6.4 Medium s2Member Plugin s2member Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 251005 CVE-2025-13732 Wordfence
4.3 Medium Country Blocker for AdSense Plugin country-blocker-for-adsense Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2025-13413 Wordfence
6.1 Medium xmlrpc attacks blocker Plugin xmlrpc-attacks-blocker Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' No login needed ≤ 1.0 CVE-2026-2502 Wordfence
6.5 Medium Two Factor (2FA) Authentication via Email Plugin two-factor-2fa-via-email Authentication Bypass Two-Factor Authentication Bypass via token ≤ 1.9.8 CVE-2025-13587 Wordfence
5.3 Medium Checkout Field Manager (Checkout Manager) for WooCommerce Plugin woocommerce-checkout-manager Arbitrary File Upload Unauthenticated Limited File Upload No login needed ≤ 7.8.1 CVE-2025-12500 Wordfence
6.4 Medium Official StatCounter Plugin official-statcounter-plugin-for-wordpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname ≤ 2.1.0 CVE-2025-13048 Wordfence
4.3 Medium ACF Photo Gallery Field Plugin navz-photo-gallery Broken Access Control Missing Authorization to Authenticated (Subscriber+) Attachment Metadata Modification ≤ 3.0 CVE-2025-12081 Wordfence
5.3 Medium Web Accessibility by accessiBe Plugin accessibe Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 2.11 CVE-2025-13113 Wordfence
6.4 Medium Renden Theme renden Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title ≤ 1.8.1 CVE-2025-12117 Wordfence
4.3 Medium Advanced Ads – Ad Manager & AdSense Plugin advanced-ads Broken Access Control Ad Manager & AdSense <= 2.0.14 - Missing Authorization to Authenticated (Subscriber+) Ad Placements Update ≤ 2.0.14 CVE-2025-12884 Wordfence
8.8 High Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Plugin tablesome Broken Access Control Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation 0.5.4 – 1.2.1 CVE-2025-12845 Wordfence
8.8 High NewsBlogger Theme newsblogger Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Plugin Installation No login needed 0.2.5.6 – 0.2.5.9 CVE-2025-12821 Wordfence
6.4 Medium Drift Theme drift Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title ≤ 1.5.0 CVE-2025-12116 Wordfence
9.8 Critical Clasifico Listing Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 2.0 CVE-2025-12882 Wordfence
7.5 High Library Management System Plugin library-management-system SQL Injection Unauthenticated SQL Injection No login needed ≤ 3.2.1 CVE-2025-12707 Wordfence
5.3 Medium Popup Builder - Create highly converting, mobile friendly marketing popups. Plugin popup-builder Broken Access Control Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens No login needed ≤ 4.4.2 CVE-2025-13079 Wordfence
6.4 Medium Printful Integration for WooCommerce Plugin printful-shipping-for-woocommerce Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery ≤ 2.2.11 CVE-2025-12375 Wordfence
4.4 Medium Easy SVG Support Plugin easy-svg Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 4.0 CVE-2025-12451 Wordfence
7.5 High Cookie Banner for GDPR / CCPA – WPLP Cookie Consent Plugin gdpr-cookie-consent Broken Access Control Missing Authorization to Sensitive Information Exposure No login needed ≤ 4.1.2 CVE-2025-11754 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only