WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 9,751–9,800 of 17,051 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 196 of 342
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.5 High	JS Help Desk Plugin `js-support-ticket`	Path Traversal Arbitrary File Download No login needed	`≤ 2.9.1` Fixed in `2.9.2`	Apr 1, 2025	`CVE-2025-30882`	Patchstack
7.5 High	JS Help Desk Plugin `js-support-ticket`	Broken Access Control No login needed	`≤ 2.9.2` Fixed in `2.9.3`	Apr 1, 2025	`CVE-2025-30880`	Patchstack
8.6 High	JS Help Desk Plugin `js-support-ticket`	Arbitrary File Deletion No login needed	`≤ 2.9.2` Fixed in `2.9.3`	Apr 1, 2025	`CVE-2025-30878`	Patchstack
9.3 Critical	Ads by WPQuads Plugin `quick-adsense-reloaded`	SQL Injection No login needed	`≤ 2.0.87.1` Fixed in `2.0.88`	Apr 1, 2025	`CVE-2025-30876`	Patchstack
8.1 High	WP Travel Engine Plugin `wp-travel-engine`	Local File Inclusion No login needed	`≤ 6.3.5` Fixed in `6.3.6`	Apr 1, 2025	`CVE-2025-30870`	Patchstack
7.1 High	Image Wall Plugin `image-wall`	Cross-Site Scripting No login needed	`≤ 3.0` Fixed in `3.1`	Apr 1, 2025	`CVE-2025-30869`	Patchstack
8.1 High	Essential Real Estate Plugin `essential-real-estate`	Local File Inclusion No login needed	`≤ 5.2.0` Fixed in `5.2.1`	Apr 1, 2025	`CVE-2025-30849`	Patchstack
7.1 High	Hostel Plugin `hostel`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1.5` Fixed in `1.1.5.5`	Apr 1, 2025	`CVE-2025-30848`	Patchstack
7.1 High	xili-dictionary Plugin `xili-dictionary`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.12.5` Fixed in `2.12.5.1`	Apr 1, 2025	`CVE-2025-30840`	Patchstack
7.1 High	WooCommerce Fattureincloud Plugin `woo-fattureincloud`	Cross-Site Scripting No login needed	`≤ 2.6.7` Fixed in `2.6.8`	Apr 1, 2025	`CVE-2025-30837`	Patchstack
7.5 High	Bit Assist Plugin `bit-assist`	Path Traversal No login needed	`≤ 1.5.4` Fixed in `1.5.5`	Apr 1, 2025	`CVE-2025-30834`	Patchstack
7.1 High	WP2LEADS Plugin `wp2leads`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.4.5` Fixed in `3.4.7`	Apr 1, 2025	`CVE-2025-30827`	Patchstack
7.1 High	About Author Plugin `about-author`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.6.2` Fixed in `1.6.3`	Apr 1, 2025	`CVE-2025-30808`	Patchstack
4.3 Medium	Our Team Members Plugin `our-team-members`	Information Disclosure Sensitive Data Exposure	`≤ 2.2` Fixed in `2.3`	Apr 1, 2025	`CVE-2025-30802`	Patchstack
7.1 High	Better WishList API Plugin `better-wlm-api`	Cross-Site Scripting No login needed	`≤ 1.1.4` Fixed in `1.1.5`	Apr 1, 2025	`CVE-2025-30798`	Patchstack
7.5 High	Greek Multi Tool – Fix peralinks, accents, auto create menus and more Plugin `greek-multi-tool`	Broken Access Control Fix peralinks, accents, auto create menus and more plugin <= 2.3.1 - Broken Access Control No login needed	`≤ 2.3.1` Fixed in `2.3.2`	Apr 1, 2025	`CVE-2025-30797`	Patchstack
7.1 High	The Ultimate WordPress Toolkit – WP Extended Plugin `wpextended`	Cross-Site Scripting WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) No login needed	`≤ 3.0.14` Fixed in `3.0.15`	Apr 1, 2025	`CVE-2025-30796`	Patchstack
7.1 High	Event Tickets Plugin `event-tickets`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.20.0` Fixed in `5.20.1`	Apr 1, 2025	`CVE-2025-30794`	Patchstack
7.5 High	Houzez Property Feed Plugin `houzez-property-feed`	Path Traversal Arbitrary File Download No login needed	`≤ 2.5.4` Fixed in `2.5.5`	Apr 1, 2025	`CVE-2025-30793`	Patchstack
7.5 High	Subscribe to Download Lite Plugin `subscribe-to-download-lite`	Local File Inclusion	`≤ 1.2.9` Fixed in `1.3.0`	Apr 1, 2025	`CVE-2025-30782`	Patchstack
8.2 High	Quiz Maker Plugin `quiz-maker`	SQL Injection No login needed	`≤ 6.6.8.7` Fixed in `6.6.8.8`	Apr 1, 2025	`CVE-2025-30774`	Patchstack
9.3 Critical	PostMash Plugin `postmash-custom`	SQL Injection No login needed	`≤ 1.0.3`	Apr 1, 2025	`CVE-2025-30622`	Patchstack
7.1 High	Google Font Fix Plugin `google-font-fix`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.3.1`	Apr 1, 2025	`CVE-2025-30614`	Patchstack
6.5 Medium	Nmedia MailChimp Plugin `nmedia-mailchimp-widget`	Cross-Site Scripting	`≤ 5.4`	Apr 1, 2025	`CVE-2025-30613`	Patchstack
7.1 High	Quick Localization Plugin `quick-localization`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.1.0`	Apr 1, 2025	`CVE-2025-30607`	Patchstack
6.5 Medium	Include URL Plugin `include-url`	Path Traversal WordPress Include URL plugin <= 0.3.5 Arbitrary File Download	`≤ 0.3.5`	Apr 1, 2025	`CVE-2025-30594`	Patchstack
8.5 High	Flickr set slideshows Plugin `flickr-set-slideshows`	SQL Injection	`≤ 0.9`	Apr 1, 2025	`CVE-2025-30589`	Patchstack
7.1 High	Pesapal Gateway for Woocommerce Plugin `pesapal-for-woocommerce`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.1.0`	Apr 1, 2025	`CVE-2025-30579`	Patchstack
7.1 High	Tidekey Plugin `tidekey`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1`	Apr 1, 2025	`CVE-2025-30563`	Patchstack
7.1 High	Kento WordPress Stats Plugin `kento-wp-stats`	Cross-Site Scripting No login needed	`≤ 1.1`	Apr 1, 2025	`CVE-2025-30559`	Patchstack
7.1 High	Advanced Post Search Plugin `advanced-post-search`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1.0`	Apr 1, 2025	`CVE-2025-30548`	Patchstack
7.1 High	WP Cards Plugin `wp-cards`	Cross-Site Scripting No login needed	`≤ 1.5.1`	Apr 1, 2025	`CVE-2025-30547`	Patchstack
7.1 High	OK Poster Group Plugin `ok-poster-group`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1`	Apr 1, 2025	`CVE-2025-30544`	Patchstack
7.1 High	Breezing Forms Plugin `breezing-forms`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2.8.11`	Apr 1, 2025	`CVE-2025-30520`	Patchstack
7.5 High	Awesome Support – WordPress HelpDesk & Support Plugin `awesome-support`	Information Disclosure WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory No login needed	`≤ 6.3.1`	Apr 1, 2025	`CVE-2024-13567`	Wordfence
6.5 Medium	Infusionsoft Web Form JavaScript Plugin `infusionsoft-web-form-javascript`	Cross-Site Scripting	`≤ 1.1.1`	Mar 31, 2025	`CVE-2025-31629`	Patchstack
5.9 Medium	Media LIbrary Assistant Plugin `media-library-assistant`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 3.24` Fixed in `3.25`	Mar 31, 2025	`CVE-2025-31627`	Patchstack
7.1 High	Useinfluence Plugin `useinfluence`	Cross-Site Request Forgery No login needed	`≤ 1.0.8`	Mar 31, 2025	`CVE-2025-31625`	Patchstack
6.5 Medium	Processing Projects Plugin `processing-projects`	Cross-Site Scripting	`≤ 1.0.2`	Mar 31, 2025	`CVE-2025-31624`	Patchstack
7.1 High	Rich Text Editor Plugin `richtexteditor`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.0.1`	Mar 31, 2025	`CVE-2025-31623`	Patchstack
6.5 Medium	byBrick Accordion Plugin `bybrick-accordion`	Cross-Site Scripting	`≤ 1.0`	Mar 31, 2025	`CVE-2025-31621`	Patchstack
6.5 Medium	CoverManager Plugin `covermanager`	Cross-Site Scripting	`≤ 0.0.1`	Mar 31, 2025	`CVE-2025-31620`	Patchstack
5.3 Medium	Connector to CiviCRM with CiviMcRestFace Plugin `connector-civicrm-mcrestface`	Broken Access Control No login needed	`≤ 1.0.10` Fixed in `1.0.11`	Mar 31, 2025	`CVE-2025-31618`	Patchstack
7.1 High	PostmarkApp Email Integrator Plugin `postmarkapp-email-integrator`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 2.4` Fixed in `2.5.0`	Mar 31, 2025	`CVE-2025-31617`	Patchstack
7.1 High	Varnish Plugin `varnish-wp`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.7`	Mar 31, 2025	`CVE-2025-31616`	Patchstack
7.1 High	Simple Contact Forms Plugin `simple-contact-forms`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.6.4`	Mar 31, 2025	`CVE-2025-31615`	Patchstack
6.5 Medium	Terms Before Download Plugin `terms-before-download`	Cross-Site Scripting	`≤ 1.0.5`	Mar 31, 2025	`CVE-2025-31614`	Patchstack
7.1 High	AB Google Map Travel Plugin `ab-google-map-travel`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 4.6`	Mar 31, 2025	`CVE-2025-31613`	Patchstack
4.3 Medium	Auto Post After Image Upload Plugin `auto-post-after-image-upload`	Broken Access Control	`≤ 1.6`	Mar 31, 2025	`CVE-2025-31611`	Patchstack
5.9 Medium	Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any Plugin `gp-notification-bar`	Cross-Site Scripting	`≤ 1.1`	Mar 31, 2025	`CVE-2025-31610`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.