Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,324 High 9,486 Medium 18,376 Low 376 Not scored 1

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.

Showing 851–900 of 1,531 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 18 of 31
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Spare Theme spare PHP Object Injection No login needed ≤ 1.7 CVE-2025-31919 Patchstack
10.0 Critical Ovatheme Events Manager Plugin ova-events-manager Arbitrary File Upload No login needed ≤ 1.8.4 Fixed in 1.8.5 CVE-2025-32510 Patchstack
9.3 Critical Smart Notification Plugin smio-push-notification SQL Injection No login needed ≤ 10.3 CVE-2025-39479 Patchstack
9.9 Critical WP VR Plugin wpvr Arbitrary File Upload ≤ 8.5.26 Fixed in 8.5.27 CVE-2025-47452 Patchstack
9.9 Critical MapSVG Plugin mapsvg Arbitrary File Upload ≤ 8.7.4 Fixed in 8.7.4 CVE-2025-47559 Patchstack
9.3 Critical School Management Plugin school-management SQL Injection No login needed ≤ 92.0.0 CVE-2025-47573 Patchstack
9.3 Critical WP Job Portal Plugin wp-job-portal SQL Injection No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2025-48274 Patchstack
9.8 Critical Integration for Contact Form 7 and Zoho CRM, Bigin Plugin cf7-zoho PHP Object Injection No login needed ≤ 1.3.0 Fixed in 1.3.1 CVE-2025-49330 Patchstack
10.0 Critical Reformer for Elementor Plugin reformer-elementor Arbitrary File Upload No login needed ≤ 1.0.5 CVE-2025-49444 Patchstack
10.0 Critical FW Food Menu Plugin fw-food-menu Arbitrary File Upload No login needed ≤ 6.0.0 CVE-2025-49447 Patchstack
9.3 Critical WordPress-WPJobBoard Plugin click-pledge-wpjobboard SQL Injection No login needed ≤ 25.07010000-WP6.8.1-JB5.11.5 Fixed in 25.09000000-WP6.8.2-JB5.12.0 CVE-2025-49455 Patchstack
9.8 Critical CozyStay Theme cozystay PHP Object Injection No login needed ≤ 1.7.1 Fixed in 1.7.1 CVE-2025-49507 Patchstack
9.3 Critical TicketBAI Facturas para WooCommerce Plugin wp-ticketbai SQL Injection No login needed ≤ 3.19 Fixed in 3.21 CVE-2025-24767 Patchstack
9.8 Critical PayU India Plugin payu-india Privilege Escalation Account Takeover No login needed ≤ 3.8.8 Fixed in 3.8.8 CVE-2025-31022 Patchstack
9.1 Critical Category Icon Plugin category-icon XML External Entity ≤ 1.0.3 CVE-2025-31039 Patchstack
9.8 Critical The Fashion - Model Agency One Page Beauty Plugin nrgfashion PHP Object Injection Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data No login needed ≤ 1.4.4 CVE-2025-31052 Patchstack
9.3 Critical WBW Product Table PRO Plugin woo-producttables-pro SQL Injection No login needed ≤ 2.2.6 Fixed in 2.2.7 CVE-2025-31059 Patchstack
9.8 Critical PIMP - Creative MultiPurpose Theme pimp PHP Object Injection Creative MultiPurpose <= 1.7 - Deserialization of untrusted data No login needed ≤ 1.7 CVE-2025-31398 Patchstack
9.8 Critical FLAP - Business Theme flap PHP Object Injection Business WordPress Theme <= 1.5 - PHP Object Injection No login needed ≤ 1.5 CVE-2025-31396 Patchstack
9.3 Critical WP Lead Capturing Pages Plugin leadcapture SQL Injection No login needed ≤ 2.6 Fixed in 2.6 CVE-2025-31424 Patchstack
9.8 Critical PressGrid - Frontend Publish Reaction & Multimedia Theme press-grid PHP Object Injection Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Deserialization of untrusted data No login needed ≤ 1.3.1 CVE-2025-31429 Patchstack
10.0 Critical SUMO Affiliates Pro Plugin affs Arbitrary File Upload No login needed ≤ 11.1.0 Fixed in 11.1.0 CVE-2025-32291 Patchstack
9.3 Critical Recover abandoned cart for WooCommerce Plugin recover-wc-abandoned-cart SQL Injection No login needed ≤ 2.5 CVE-2025-47608 Patchstack
9.3 Critical Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Plugin excel-like-price-change-for-woocommerce-and-wp-e-commerce-light SQL Injection Light plugin <= 2.4.37 - SQL Injection No login needed ≤ 2.4.37 CVE-2025-48122 Patchstack
10.0 Critical Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Plugin excel-like-price-change-for-woocommerce-and-wp-e-commerce-light Remote Code Execution Light plugin <= 2.4.37 - Remote Code Execution (RCE) No login needed ≤ 2.4.37 CVE-2025-48123 Patchstack
9.8 Critical Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Plugin excel-like-price-change-for-woocommerce-and-wp-e-commerce-light Privilege Escalation Light plugin <= 2.4.37 - Privilege Escalation No login needed ≤ 2.4.37 CVE-2025-48129 Patchstack
9.9 Critical MetalpriceAPI Plugin metalpriceapi Remote Code Execution ≤ 1.1.4 Fixed in 1.1.5 CVE-2025-48140 Patchstack
9.3 Critical Multi CryptoCurrency Payments Plugin multi-crypto-currency-payment SQL Injection No login needed ≤ 2.0.7 CVE-2025-48141 Patchstack
9.3 Critical MyStyle Custom Product Designer Plugin mystyle-custom-product-designer SQL Injection No login needed ≤ 3.21.1 Fixed in 3.21.2 CVE-2025-48281 Patchstack
9.8 Critical Mr. Murphy Theme mr-murphy PHP Object Injection No login needed ≤ 1.2.12.1 Fixed in 1.2.12.1 CVE-2025-49072 Patchstack
9.8 Critical Sweet Dessert Theme sweet-dessert PHP Object Injection No login needed ≤ 1.1.13 Fixed in 1.1.13 CVE-2025-49073 Patchstack
9.0 Critical Motors - Events Plugin stm-motors-events Local File Inclusion Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion No login needed ≤ 1.4.7 CVE-2025-47586 Patchstack
9.8 Critical Course Builder Plugin course-builder PHP Object Injection No login needed ≤ 3.6.6 Fixed in 3.6.6 CVE-2025-48336 Patchstack
9.8 Critical Dash Theme dash PHP Object Injection No login needed ≤ 1.3 CVE-2025-31049 Patchstack
9.3 Critical WhatsCart - Whatsapp Abandoned Cart Recovery, Order Notifications, Chat Box, OTP for WooCommerce Plugin whatscart-for-woocommerce SQL Injection No login needed ≤ 1.1.0 CVE-2025-31056 Patchstack
9.3 Critical Bus Ticket Booking with Seat Reservation for WooCommerce Plugin scw-bus-seat-reservation SQL Injection No login needed ≤ 1.7 CVE-2025-31397 Patchstack
9.8 Critical HotStar – Multi-Purpose Business Theme hotstar PHP Object Injection Multi-Purpose Business Theme <= 1.4 - PHP Object Injection No login needed ≤ 1.4 CVE-2025-31069 Patchstack
9.8 Critical The Business Theme nrgbusiness PHP Object Injection No login needed ≤ 1.6.1 CVE-2025-31430 Patchstack
9.8 Critical Umberto Theme umberto PHP Object Injection No login needed ≤ 1.2.8 CVE-2025-31423 Patchstack
9.8 Critical Fish House Theme fish-house PHP Object Injection No login needed ≤ 1.2.7 CVE-2025-31631 Patchstack
9.3 Critical Pixel WordPress Form BuilderPlugin & Autoresponder Plugin pixel-formbuilder SQL Injection No login needed ≤ 1.0.2 Fixed in 1.0.3 CVE-2025-31914 Patchstack
9.0 Critical JP Students Result Management System Premium Plugin jp-students-result-system-premium Arbitrary File Upload No login needed 1.1.7 CVE-2025-31916 Patchstack
9.8 Critical Simple Business Directory Pro Plugin simple-business-directory-pro Privilege Escalation No login needed ≤ 15.6.9 Fixed in 15.6.9 CVE-2025-31918 Patchstack
9.8 Critical Acerola Theme acerola PHP Object Injection No login needed ≤ 1.6.5 CVE-2025-31927 Patchstack
9.8 Critical Jarvis – Night Club, Concert, Festival Theme jarvis PHP Object Injection Night Club, Concert, Festival WordPress theme <= 1.8.11 - PHP Object Injection No login needed ≤ 1.8.11 CVE-2025-32292 Patchstack
9.8 Critical Grand Tour Plugin grandtour PHP Object Injection No login needed ≤ 5.6 CVE-2025-39485 Patchstack
9.8 Critical Car Dealer Theme cardealer PHP Object Injection No login needed ≤ 1.6.8 Fixed in 1.6.8 CVE-2025-39480 Patchstack
9.8 Critical CouponXL Theme couponxl Privilege Escalation No login needed ≤ 4.5.0 Fixed in 4.5.1 CVE-2025-39489 Patchstack
9.8 Critical Medicare Plugin medicare PHP Object Injection No login needed ≤ 2.1.0 Fixed in 2.1.1 CVE-2025-39499 Patchstack
9.8 Critical Avantage Plugin avantage PHP Object Injection No login needed ≤ 2.4.9 Fixed in 2.5.0 CVE-2025-39495 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only