Halloween sale: up to 50% off any Must-Have plugin.Halloween sale: up to 50% off Every spin of our wheel wins a coupon, until October 31. Spin the wheel

WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,323 High 9,483 Medium 18,323 Low 369 Not scored 15

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.

Showing 51–82 of 82 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 2
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical WP Gravity Forms FreshDesk Plugin gf-freshdesk PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.3.5 Fixed in 1.3.6 CVE-2025-60089 Patchstack
9.8 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 1.1.7 CVE-2025-14344 Wordfence
9.8 Critical Gravity Forms Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'copy_post_image' No login needed ≤ 2.9.20 CVE-2025-12352 Wordfence
9.8 Critical WP Gravity Forms Keap/Infusionsoft Plugin gf-infusionsoft PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-58636 Patchstack
9.8 Critical Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Plugin tablesome Arbitrary File Upload Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload No login needed ≤ 1.1.32 Fixed in 1.1.33 CVE-2025-11499 Wordfence
9.8 Critical Everest Forms - Frontend Listing Plugin everest-forms-frontend-listing PHP Object Injection Frontend Listing plugin <= 1.0.5 - PHP Object Injection No login needed ≤ 1.0.5 CVE-2025-60210 Patchstack
9.8 Critical Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets PHP Object Injection No login needed ≤ 1.2.6 Fixed in 1.2.7 CVE-2025-60209 Patchstack
9.8 Critical RegistrationMagic - Custom Registration Forms Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection Custom Registration Forms <= 3.7.9.2 - PHP Object Injection No login needed < 3.7.9.3 Fixed in 3.7.9.3 CVE-2017-20208 Wordfence
9.8 Critical Ninja-forms Plugin PHP Object Injection Unauthenticated PHP Objection No login needed < 3.11.1 Fixed in 3.11.1 CVE-2025-9083 WPScan
10.0 Critical Drag and Drop File Upload for Elementor Forms Plugin drag-and-drop-file-upload-for-elementor-forms Arbitrary File Upload No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2025-49387 Patchstack
9.9 Critical Forms Plugin forms-by-made-it Arbitrary File Upload ≤ 2.9.0 CVE-2025-24775 Patchstack
9.8 Critical Database for Contact Form 7, WPforms, Elementor forms Plugin contact-form-entries PHP Object Injection Unauthenticated PHP Object Injection to Arbitrary File Deletion No login needed ≤ 1.4.3 CVE-2025-7384 Wordfence
9.8 Critical Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin integration-for-contact-form-7-and-google-sheets PHP Object Injection Unauthenticated PHP Object Injection via verify_field_val Function No login needed ≤ 1.1.1 CVE-2025-7697 Wordfence
9.8 Critical Integration for Pipedrive and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin integration-for-contact-form-7-and-pipedrive PHP Object Injection Unauthenticated PHP Object Injection via verify_field_val Function No login needed ≤ 1.2.3 CVE-2025-7696 Wordfence
9.8 Critical GB Forms DB Plugin gb-forms-db Remote Code Execution Unauthenticated Remote Code Execution No login needed ≤ 1.0.2 Fixed in 2.0.0 CVE-2025-5392 Wordfence
9.8 Critical Everest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder Plugin everest-forms PHP Object Injection Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection No login needed ≤ 3.1.1 CVE-2025-3439 Wordfence
9.3 Critical Salesmate Add-On for Gravity Forms Plugin gf-salesmate-add-on SQL Injection No login needed ≤ 2.0.3 Fixed in 2.0.4 CVE-2025-31551 Patchstack
9.8 Critical Everest Forms Plugin everest-forms Arbitrary File Upload Unauthenticated Arbitrary File Upload, Read, and Deletion No login needed ≤ 3.0.9.4 Fixed in 3.0.9.5 CVE-2025-1128 Wordfence
9.8 Critical Keap Official Opt-in Forms Plugin infusionsoft-official-opt-in-forms Local File Inclusion Unauthenticated Limited Local File Inclusion No login needed ≤ 2.0.1 CVE-2024-13725 Wordfence
9.0 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Arbitrary File Upload No login needed ≤ 1.1.3 Fixed in 1.1.5 CVE-2025-23921 Patchstack
10.0 Critical 4ECPS Web Forms Plugin 4ecps-webforms Arbitrary File Upload No login needed ≤ 0.2.18 CVE-2025-22504 Patchstack
10.0 Critical Forms Plugin forms-by-made-it Arbitrary File Upload No login needed ≤ 2.8.0 Fixed in 2.8.1 CVE-2024-51791 Patchstack
9.8 Critical RegistrationMagic – User Registration Plugin with Custom Registration Forms Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery No login needed ≤ 6.0.2.6 Fixed in 6.0.2.7 CVE-2024-10508 Wordfence
9.8 Critical Donation Forms by Charitable – Donations Plugin & Fundraising Platform Plugin charitable Broken Access Control Donations Plugin & Fundraising Platform for WordPress <= 1.8.1.14 - Insecure Direct Object Reference to Account Takeover and Privilege Escalation No login needed ≤ 1.8.1.14 Fixed in 1.8.1.15 CVE-2024-8791 Wordfence
9.3 Critical FormLift for Infusionsoft Web Forms Plugin formlift SQL Injection Unauthenticated Blind SQL Injection No login needed ≤ 7.5.17 Fixed in 7.5.18 CVE-2024-38773 Patchstack
9.8 Critical Gutenberg Forms Plugin forms-gutenberg Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 2.2.9 CVE-2024-6313 Wordfence
9.8 Critical ArForms Plugin Remote Code Execution Unauthenticated RCE No login needed < 6.6 Fixed in 6.6 CVE-2024-4620 WPScan
9.1 Critical Startklar Elementor Addons Plugin startklar-elmentor-forms-extwidgets Path Traversal Unauthenticated Path Traversal to Arbitrary Directory Deletion No login needed ≤ 1.7.15 CVE-2024-5153 Wordfence
9.8 Critical Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Settings Update and Limited Privilege Escalation No login needed ≤ 5.1.16 Fixed in 5.1.17 CVE-2024-2771 Wordfence
9.1 Critical Startklar Elementor Addons Plugin startklar-elmentor-forms-extwidgets Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 1.7.13 CVE-2024-4346 Wordfence
9.8 Critical Startklar Elementor Addons Plugin startklar-elmentor-forms-extwidgets Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.7.13 CVE-2024-4345 Wordfence
9.3 Critical CRM Perks Forms Plugin crm-perks-forms SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.1.4 Fixed in 1.1.5 CVE-2024-30498 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only