WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 9,151–9,200 of 17,900 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 184 of 358
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Themesflat Addons For Elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.2.5 Fixed in 2.2.6 CVE-2025-3275 Wordfence
6.4 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) Plugin bdthemes-element-pack-lite Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 5.10.28 Fixed in 5.10.29 CVE-2025-1457 Wordfence
4.3 Medium User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile Plugin Cross-Site Request Forgery Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion No login needed ≤ 5.1.3 CVE-2025-3284 Wordfence
6.4 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Table of Contents Widget ≤ 1.4.9 CVE-2025-3106 Wordfence
5.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 3.3.12 CVE-2025-3056 Wordfence
4.8 Medium MapPress Maps Plugin Cross-Site Scripting Admin+ Stored XSS 2.94.9 – < 2.94.10 Fixed in 2.94.10 CVE-2025-2162 WPScan
6.1 Medium Coupon Affiliates – Affiliate Plugin for WooCommerce Plugin woo-coupon-usage Cross-Site Scripting Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter No login needed ≤ 6.3.0 CVE-2025-3598 Wordfence
4.4 Medium Login Manager – Design Login Page, View Login Activity, Limit Login Attempts Plugin customized-login Cross-Site Scripting Design Login Page, View Login Activity, Limit Login Attempts <= 2.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom URL ≤ 2.0.5 CVE-2025-2613 Wordfence
6.4 Medium Piotnet Addons For Elementor Plugin piotnet-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.4.36 CVE-2024-13650 Wordfence
6.5 Medium Delete All Posts Plugin delele-all Broken Access Control No login needed ≤ 1.1.1 CVE-2025-23773 Patchstack
6.5 Medium WordPress Dashboard Tweeter Plugin wordpress-dashboard-twitter Broken Access Control Settings Change No login needed ≤ 1.3.2 CVE-2025-23906 Patchstack
6.5 Medium Editor Wysiwyg Background Color Plugin editor-wysiwyg-background-color Broken Access Control No login needed ≤ 1.0 CVE-2025-23958 Patchstack
6.5 Medium Job Manager Plugin job-manager-by-jobscore Cross-Site Scripting ≤ 2.2 Fixed in 2.3 CVE-2025-24550 Patchstack
6.5 Medium Instantio Plugin instantio Broken Access Control Settings Change No login needed ≤ 3.3.7 Fixed in 3.3.8 CVE-2025-24581 Patchstack
6.5 Medium Poll Maker Plugin poll-maker Broken Access Control No login needed ≤ 5.5.0 Fixed in 5.5.1 CVE-2025-24577 Patchstack
6.5 Medium 12 Step Meeting List Plugin 12-step-meeting-list Broken Access Control Settings Change No login needed ≤ 3.16.5 Fixed in 3.16.6 CVE-2025-24583 Patchstack
5.9 Medium WordPress Backup & Migration Plugin wp-migration-duplicator Information Disclosure Sensitive Data Exposure No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2025-24651 Patchstack
6.5 Medium WP Helper Premium Plugin wp-helper-lite Broken Access Control No login needed ≤ 4.6.1 Fixed in 4.6.2 CVE-2025-24737 Patchstack
6.5 Medium Theme File Duplicator Plugin theme-file-duplicator Path Traversal Arbitrary File Download ≤ 1.3 CVE-2025-27283 Patchstack
5.3 Medium MyTicket Events Plugin myticket-events Path Traversal Non-Arbitrary File Read No login needed ≤ 1.2.4 CVE-2025-27299 Patchstack
6.5 Medium Page and Post Lister Plugin page-and-post-lister Broken Access Control Arbitrary Content Deletion ≤ 1.2.1 CVE-2025-27310 Patchstack
6.5 Medium AI Text to Speech Plugin ai-text-to-speech Broken Access Control No login needed ≤ 3.0.3 Fixed in 3.0.4 CVE-2025-39554 Patchstack
6.5 Medium Bring Fraktguiden for WooCommerce Plugin bring-fraktguiden-for-woocommerce Broken Access Control ≤ 1.11.4 Fixed in 1.11.5 CVE-2025-39559 Patchstack
5.9 Medium Payment Form for PayPal Pro Plugin payment-form-for-paypal-pro Cross-Site Scripting ≤ 1.1.72 Fixed in 1.1.73 CVE-2025-39562 Patchstack
5.8 Medium Dashi Plugin dashi Broken Access Control No login needed ≤ 3.1.8 Fixed in 3.1.9 CVE-2025-39580 Patchstack
6.5 Medium Data Dash Plugin data-dash Cross-Site Scripting ≤ 1.2.3 CVE-2025-22340 Patchstack
6.5 Medium The Great Firewords of China Plugin sensitive-chinese-words-scanner Cross-Site Scripting ≤ 1.2 CVE-2025-22771 Patchstack
4.3 Medium Style Manager Plugin style-manager Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed ≤ 2.2.7 CVE-2025-39425 Patchstack
4.3 Medium illow – Cookies Consent Plugin lgpd-compliant-cookie-banner Cross-Site Request Forgery Cookies Consent plugin <= 0.2.0 - Cross Site Request Forgery (CSRF) No login needed ≤ 0.2.0 CVE-2025-39426 Patchstack
5.9 Medium WP Post to PDF Enhanced Plugin wp-post-to-pdf-enhanced Cross-Site Scripting ≤ 1.1.1 CVE-2025-39427 Patchstack
5.9 Medium Gravity Forms CSS Themes with Fontawesome and Placeholders Plugin gravity-forms-css-themes-with-fontawesome-and-placeholder-support Cross-Site Scripting ≤ 8.5 CVE-2025-39428 Patchstack
4.3 Medium Avatar Plugin avatar Broken Access Control Insecure Direct Object References (IDOR) ≤ 0.1.4 CVE-2025-39434 Patchstack
4.3 Medium Anthologize Plugin anthologize Cross-Site Request Forgery No login needed ≤ 0.8.3 CVE-2025-39437 Patchstack
4.3 Medium Theme Changer Plugin theme-changer Cross-Site Request Forgery No login needed ≤ 1.4 Fixed in 1.5 CVE-2025-39438 Patchstack
5.3 Medium wpLike2Get Plugin wplike2get Information Disclosure Sensitive Data Exposure No login needed ≤ 1.2.9 CVE-2025-39439 Patchstack
5.9 Medium MaxButtons Plugin maxbuttons Cross-Site Scripting ≤ 9.8.3 Fixed in 9.8.4 CVE-2025-39444 Patchstack
4.3 Medium Verge3D Plugin verge3d Cross-Site Request Forgery No login needed ≤ 4.9.0 Fixed in 4.9.3 CVE-2025-39443 Patchstack
4.3 Medium Advanced Dynamic Pricing for WooCommerce Plugin advanced-dynamic-pricing-for-woocommerce Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed ≤ 4.9.3 Fixed in 4.9.5 CVE-2025-39453 Patchstack
5.4 Medium WP Logger Plugin wp-data-logger Broken Access Control ≤ 2.2 Fixed in 2.2.1 CVE-2025-39456 Patchstack
5.3 Medium Booking and Rental Manager Plugin booking-and-rental-manager-for-woocommerce Broken Access Control No login needed ≤ 2.2.8 Fixed in 2.2.9 CVE-2025-39457 Patchstack
5.3 Medium Forminator Plugin forminator Other Order Replay No login needed ≤ 1.42.0 CVE-2025-3479 Wordfence
6.4 Medium Forminator Plugin forminator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' ≤ 1.42.0 CVE-2025-3487 Wordfence
5.3 Medium Password Protected – Password Protect your WordPress Site, Pages, & WooCommerce Products Plugin password-protected Information Disclosure Password Protect your WordPress Site, Pages, & WooCommerce Products <= 2.7.7 - Unauthenticated Sensitive Information Exposure No login needed ≤ 2.7.7 CVE-2025-3453 Wordfence
6.4 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.0.2 CVE-2025-3615 Wordfence
4.9 Medium WP Editor Plugin wp-editor Path Traversal Authenticated (Administrator+) Directory Traversal to Arbitrary File Read ≤ 1.2.9.1 CVE-2025-3295 Wordfence
4.3 Medium WooCommerce Social Login Plugin woo-social-login Cross-Site Request Forgery No login needed ≤ 2.8.3 Fixed in 2.8.3 CVE-2025-39472 Patchstack
4.3 Medium Bulk Term Editor Plugin bulk-term-editor Cross-Site Request Forgery No login needed ≤ 1.1.4 CVE-2025-39512 Patchstack
6.5 Medium Asgaros Forum Plugin asgaros-forum Cross-Site Scripting ≤ 3.2.1 Fixed in 3.3.0 CVE-2025-39514 Patchstack
5.3 Medium ActiveDEMAND Plugin activedemand Broken Access Control No login needed ≤ 0.2.46 Fixed in 0.2.47 CVE-2025-39513 Patchstack
6.5 Medium Author WIP Progress Bar Plugin author-work-in-progress-bar Cross-Site Scripting ≤ 1.0 CVE-2025-39516 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only