WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 851–900 of 1,457 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 18 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Structured Content (JSON-LD) #wpsc Plugin structured-content Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode ≤ 1.6.3 CVE-2025-0512 Wordfence
6.5 Medium Authors List Plugin authors-list Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.0.6 CVE-2024-13806 Wordfence
6.4 Medium TemplatesNext ToolKit Plugin templatesnext-toolkit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.9 CVE-2024-13559 Wordfence
6.4 Medium SecuPress Free — WordPress Security Plugin secupress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via secupress_check_ban_ips_form Shortcode ≤ 2.2.5.3 CVE-2024-9019 Wordfence
6.4 Medium Product Catalog Simple Plugin post-type-x Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via show_products Shortcode ≤ 1.7.11 CVE-2025-1405 Wordfence
6.4 Medium WordPress Portfolio Builder – Portfolio Gallery Plugin uber-grid Cross-Site Scripting Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.7 CVE-2025-1757 Wordfence
8.8 High Traveler Theme Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode ≤ 3.1.9 CVE-2024-12811 Wordfence
6.4 Medium ThemeMakers Stripe Checkout Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-1690 Wordfence
6.4 Medium ThemeMakers PayPal Express Checkout Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.9 CVE-2025-1689 Wordfence
6.4 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text, Countdown Widget, and Login Form Shortcodes ≤ 3.6.0 CVE-2025-1517 Wordfence
5.4 Medium WooCommerce Cart Count Shortcode Plugin Cross-Site Scripting Contributor+ XSS < 1.1.0 Fixed in 1.1.0 CVE-2024-10563 WPScan
6.5 Medium EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Scripting ≤ 5.21.35 Fixed in 5.25.08 CVE-2025-26887 Patchstack
4.8 Medium WP-Asambleas Plugin wp-asambleas Arbitrary Shortcode Execution No login needed ≤ 2.85.0 CVE-2025-27294 Patchstack
6.4 Medium Rife Elementor Extensions & Templates Plugin rife-elementor-extensions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode ≤ 1.2.5 CVE-2024-13564 Wordfence
6.4 Medium Frontend Content Forms for User Submissions (UGC) Plugin buddyforms Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'buddyforms_nav' Shortcode ≤ 2.8.15 CVE-2024-12038 Wordfence
7.3 High Custom Post Type Date Archives Plugin custom-post-type-date-archives Broken Access Control Missing Authorization to Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.7.1 CVE-2025-1510 Wordfence
7.3 High Show Me The Cookies Plugin show-me-the-cookies Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.0 CVE-2025-1509 Wordfence
6.4 Medium WP-Appbox Plugin wp-appbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode ≤ 4.5.4 CVE-2025-1489 Wordfence
6.4 Medium Events Calendar Made Simple – Pie Calendar Plugin pie-calendar Cross-Site Scripting Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode ≤ 1.2.5 CVE-2025-1410 Wordfence
6.4 Medium Newpost Catch Plugin newpost-catch Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode ≤ 1.3.19 CVE-2025-1406 Wordfence
6.4 Medium AMO Team Showcase Plugin amo-team-showcase Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode ≤ 1.1.4 CVE-2025-1407 Wordfence
6.4 Medium Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin embed-any-document Server-Side Request Forgery Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode ≤ 2.7.5 CVE-2025-1043 Wordfence
7.3 High WooCommerce Food - Restaurant Menu & Food ordering Plugin Arbitrary Shortcode Execution Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids No login needed ≤ 3.3.2 CVE-2024-13792 Wordfence
4.3 Medium Prime Addons for Elementor Plugin prime-addons-for-elementor Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode ≤ 2.0.1 CVE-2024-13855 Wordfence
6.4 Medium Modal Window Plugin modal-window Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode ≤ 6.1.5 CVE-2025-0897 Wordfence
6.4 Medium Login/Signup Popup ( Inline Form + Woocommerce ) Plugin easy-login-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode ≤ 2.8.5 CVE-2025-1064 Wordfence
4.3 Medium Education Addon for Elementor Plugin education-addon Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode ≤ 1.3.1 CVE-2024-13854 Wordfence
6.4 Medium Easypromos Plugin easypromos Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.8 CVE-2024-13443 Wordfence
6.4 Medium Wonder Video Embed Plugin wonderplugin-video-embed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.2 CVE-2024-13743 Wordfence
6.3 Medium Uncode Core Plugin Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias ≤ 2.9.1.6 CVE-2024-13689 Wordfence
7.3 High PressMart - Modern Elementor WooCommerce Theme Arbitrary Shortcode Execution Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.2.16 CVE-2024-13797 Wordfence
6.4 Medium WP-FormAssembly Plugin formassembly-web-forms Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.0.11 CVE-2024-13501 Wordfence
6.4 Medium Front End Users Plugin front-end-only-users Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode ≤ 3.2.30 CVE-2024-13563 Wordfence
7.1 High Contact Form With Shortcode Plugin contact-form-with-shortcode Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.2.5 Fixed in 4.2.6 CVE-2025-24564 Patchstack
7.3 High Avada Builder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 3.11.13 CVE-2024-13345 Wordfence
7.3 High Avada Theme Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 7.11.13 CVE-2024-13346 Wordfence
6.4 Medium Puzzles Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.2.6 CVE-2025-0837 Wordfence
7.5 High Customer Email Verification for WooCommerce Plugin emails-verification-for-woocommerce Authentication Bypass Authentication Bypass via Shortcode ≤ 2.9.5 CVE-2024-13528 Wordfence
5.4 Medium Global Gallery - WordPress Responsive Gallery Plugin Arbitrary Shortcode Execution WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 9.1.5 CVE-2024-13814 Wordfence
6.4 Medium DWT - Directory & Listing Theme Cross-Site Scripting Directory & Listing WordPress Theme <=3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.3.4 CVE-2025-0169 Wordfence
7.1 High Fyrebox Quizzes Plugin fyrebox-shortcode Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 3.1 CVE-2025-25125 Patchstack
4.8 Medium Embed RSS Plugin embed-rss Arbitrary Shortcode Execution ≤ 3.1 CVE-2025-25081 Patchstack
4.3 Medium Builder Shortcode Extras – WordPress Shortcodes Collection to Save You Time Plugin builder-shortcode-extras Information Disclosure WordPress Shortcodes Collection to Save You Time <= 1.0.0 - Authenticated (Contributor+) Post Disclosure ≤ 1.0.0 CVE-2024-13841 Wordfence
7.3 High CURCY – Multi Currency for WooCommerce Plugin woo-multi-currency Arbitrary Shortcode Execution Multi Currency for WooCommerce <= 2.2.5 - Unauthenticated Arbitrary Shortcode Execution via get_products_price Function No login needed ≤ 2.2.5 CVE-2024-13487 Wordfence
4.3 Medium B Slider- Gutenberg Slider Block for WP Plugin b-slider Information Disclosure Authenticated (Contributor+) Private Post Disclosure via bsb-slider Shortcode ≤ 1.1.23 CVE-2024-13514 Wordfence
4.3 Medium Medical Addon for Elementor Plugin medical-addon-for-elementor Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode ≤ 1.6.2 CVE-2024-12046 Wordfence
8.8 High BoomBox Theme Extensions Plugin Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Shortcode ≤ 1.8.0 CVE-2024-12859 Wordfence
6.4 Medium Eventer Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.9.9.4 CVE-2024-11132 Wordfence
4.8 Medium Uix Shortcodes Plugin uix-shortcodes Arbitrary Shortcode Execution No login needed ≤ 2.0.3 Fixed in 2.0.4 CVE-2025-22677 Patchstack
4.3 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Broken Access Control ≤ 2.17.4 Fixed in 2.17.5 CVE-2024-50500 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only