WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,802 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.
Showing 9,601–9,650 of 29,694 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.1 Medium | Stumble! | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 1.1.1 |
CVE-2025-14128 |
Wordfence | |
| 6.1 Medium | Testimonial Master | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 0.2.1 |
CVE-2025-14127 |
Wordfence | |
| 6.4 Medium | WP Recipe Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'Skill Level' Input Field |
≤ 1.0.0 |
CVE-2025-13667 |
Wordfence | |
| 6.4 Medium | AH Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'column' Shortcode Attribute |
≤ 1.0.2 |
CVE-2025-14109 |
Wordfence | |
| 6.4 Medium | Travel Bucket List | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.5.2 |
CVE-2025-14053 |
Wordfence | |
| 5.3 Medium | AA Block country | Other Unauthenticated IP Address Spoofing via X-Forwarded-For Header No login needed |
≤ 1.0.1 |
CVE-2025-13694 |
Wordfence | |
| 6.4 Medium | PhotoFade | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.2.1 |
CVE-2025-13847 |
Wordfence | |
| 9.8 Critical | Optional Email | Privilege Escalation Unauthenticated Privilege Escalation to Account Takeover No login needed |
≤ 1.3.11 |
CVE-2025-15018 |
Wordfence | |
| 4.3 Medium | WP Status Notifier | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 1.0 |
CVE-2025-13521 |
Wordfence | |
| 8.8 High | WP Enable WebP | Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload |
≤ 1.0 |
CVE-2025-15158 |
Wordfence | |
| 6.4 Medium | Recras | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'recrasname' Shortcode Attribute |
≤ 6.4.1 |
CVE-2025-13497 |
Wordfence | |
| 4.3 Medium | MTCaptcha | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 2.7.2 |
CVE-2025-13520 |
Wordfence | |
| 5.3 Medium | Moosend Landing Pages | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Option Deletion |
≤ 1.1.6 |
CVE-2025-13496 |
Wordfence | |
| 4.3 Medium | xShare | Cross-Site Request Forgery Cross-Site Request Forgery to 'rs_plugin_reset' Parameter No login needed |
≤ 1.0.1 |
CVE-2025-13527 |
Wordfence | |
| 7.5 High | Latest Registered Users | Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export No login needed |
≤ 1.4 |
CVE-2025-13493 |
Wordfence | |
| 2.7 Low | Rankology SEO and Analytics Tool | Broken Access Control Incorrect Authorization to Authenticated (Editor+) Header & Footer Code Creation |
≤ 2.0 Fixed in 2.1 |
CVE-2025-12958 |
Wordfence | |
| 4.3 Medium | Latest Tabs | Cross-Site Request Forgery Cross-Site Request Forgery to Plugin's Settings Update No login needed |
≤ 1.5 |
CVE-2025-14999 |
Wordfence | |
| 5.3 Medium | Unify | Broken Access Control Missing Authorization to Unauthenticated Option Deletion via 'unify_plugin_downgrade' Parameter No login needed |
≤ 3.4.9 |
CVE-2025-13529 |
Wordfence | |
| 4.7 Medium | ShareThis Dashboard for Google Analytics | Information Disclosure Unauthenticated Google Analytics Data Exposure No login needed |
≤ 3.2.4 |
CVE-2025-12540 |
Wordfence | |
| 4.3 Medium | ACF to REST API | Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification |
≤ 3.3.4 |
CVE-2025-12030 |
Wordfence | |
| 6.4 Medium | Stylish Order Form Builder | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter |
≤ 1.0 |
CVE-2025-13531 |
Wordfence | |
| 6.1 Medium | SVG Map | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update and Stored Cross-Site Scripting No login needed |
≤ 1.0.0 |
CVE-2025-13519 |
Wordfence | |
| 4.4 Medium | Page Keys | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'page_key' Parameter |
≤ 1.3.3 |
CVE-2025-15000 |
Wordfence | |
| 7.5 High | User Activity Log | Broken Access Control Unauthenticated Limited Options Update via Failed Login No login needed |
≤ 2.2 |
CVE-2025-11877 |
Wordfence | |
| 4.4 Medium | Key Figures | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render |
≤ 1.1 |
CVE-2025-14792 |
Wordfence | |
| 5.4 Medium | aBlocks – WordPress Gutenberg Blocks | Broken Access Control WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification |
≤ 2.4.0 Fixed in 2.8.0 |
CVE-2025-12449 |
Wordfence | |
| 5.4 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.3.2.2 - Insecure Direct Object Reference to Authenticated (Instructor+) Teacher Material Deletion |
≤ 4.3.2.1 Fixed in 4.3.2.2 |
CVE-2025-14802 |
Wordfence | |
| 6.1 Medium | Premmerce WooCommerce Customers Manager | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.1.14 |
CVE-2025-13369 |
Wordfence | |
| 6.5 Medium | Flashcard | Path Traversal Authenticated (Contributor+) Arbitrary File Read via Path Traversal |
≤ 0.9 |
CVE-2025-14867 |
Wordfence | |
| 8.2 High | iPaymu Payment Gateway for WooCommerce | Price Manipulation Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure No login needed |
≤ 2.0.2 Fixed in 2.0.3 |
CVE-2026-0656 |
Wordfence | |
| 6.1 Medium | Drag and Drop Multiple File Upload – Contact Form 7 | Arbitrary File Upload Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload No login needed |
≤ 1.3.9.2 Fixed in 1.3.9.3 |
CVE-2025-14842 |
Wordfence | |
| 8.6 High | Money Space | Information Disclosure Unauthenticated Sensitive Information Exposure No login needed |
≤ 2.13.9 Fixed in 3.1.1 |
CVE-2025-13371 |
Wordfence | |
| 4.3 Medium | NS IE Compatibility Fixer | Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed |
≤ 2.1.5 |
CVE-2025-14845 |
Wordfence | |
| 4.4 Medium | Simple User Meta Editor | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field |
≤ 1.0.0 |
CVE-2025-14888 |
Wordfence | |
| 4.4 Medium | twinklesmtp – Email Service Provider | Cross-Site Scripting Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings |
≤ 1.03 |
CVE-2025-14887 |
Wordfence | |
| 4.3 Medium | HelpDesk contact form | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update via handle_query_args No login needed |
≤ 1.1.5 |
CVE-2025-13657 |
Wordfence | |
| 6.1 Medium | HBLPAY Payment Gateway for WooCommerce | Cross-Site Scripting Reflected Cross-Site Scripting via 'cusdata' Parameter No login needed |
≤ 5.0.0 |
CVE-2025-14875 |
Wordfence | |
| 4.3 Medium | Quote Comments | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update |
≤ 3.0.0 |
CVE-2025-14370 |
Wordfence | |
| 4.3 Medium | Newsletter Email Subscribe | Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed |
≤ 2.4 |
CVE-2025-14904 |
Wordfence | |
| 6.5 Medium | Bit Form – Contact Form | Broken Access Control Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay No login needed |
≤ 2.21.6 Fixed in 2.21.7 |
CVE-2025-14901 |
Wordfence | |
| 7.7 High | Frontend File Manager | Arbitrary File Deletion Subscriber+ Arbitrary File Deletion |
< 23.5 Fixed in 23.5 |
CVE-2025-14804 |
WPScan | |
| 4.9 Medium | Relevanssi (Free | SQL Injection Contributor+ SQLi |
< 4.26.0, < 2.29.0 Fixed in 4.26.0 |
CVE-2025-14719 |
WPScan | |
| 7.1 High | WP Photo Album Plus | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 9.1.05.008 Fixed in 9.1.06.009 |
CVE-2025-14835 |
Wordfence | |
| 4.3 Medium | AMP for WP – Accelerated Mobile Pages | Cross-Site Request Forgery Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission No login needed |
≤ 1.1.9 Fixed in 1.1.10 |
CVE-2025-14468 |
Wordfence | |
| 6.4 Medium | Customer Reviews for WooCommerce | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter |
≤ 5.93.1 Fixed in 5.94.0 |
CVE-2025-14891 |
Wordfence | |
| 6.5 Medium | EmailKit | Path Traversal Authenticated (Author+) Arbitrary File Read via Path Traversal |
≤ 1.6.1 Fixed in 1.6.2 |
CVE-2025-14059 |
Wordfence | |
| 5.3 Medium | WP-Members Membership | Information Disclosure Unauthenticated Information Exposure via Unprotected Files No login needed |
≤ 3.5.4.4 Fixed in 3.5.4.5 |
CVE-2025-12648 |
Wordfence | |
| 7.1 High | WPCHURCH | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.7.0 |
CVE-2025-31642 |
Patchstack | |
| 5.3 Medium | Plant - Gardening & Houseplants | Information Disclosure Gardening & Houseplants WordPress Theme <= 1.0.0 - Sensitive Data Exposure No login needed |
≤ 1.0.0 |
CVE-2025-31051 |
Patchstack | |
| 9.9 Critical | Themify Sidepane | Arbitrary File Upload Arbitrary File Upload Vulnerability in WordPress themes by Themify |
≤ 1.9.8, ≤ 1.9.9, ≤ 1.9.6, … |
CVE-2025-30996 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.