WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 51–100 of 162 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High MonsterInsights Plugin google-analytics-for-wordpress Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset ≤ 10.1.2 CVE-2026-5371 Wordfence
6.1 Medium Royal WordPress Backup & Restore Plugin royal-backup-reset Cross-Site Scripting Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter No login needed ≤ 1.0.16 CVE-2026-4305 Wordfence
4.3 Medium Aruba HiSpeed Cache Plugin aruba-hispeed-cache Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Reset No login needed ≤ 3.0.4 CVE-2026-1924 Wordfence
4.3 Medium Blog2Social: Social Media Auto Post & Scheduler Plugin blog2social Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action ≤ 8.8.2 CVE-2026-4331 Wordfence
5.3 Medium Smarter Analytics Plugin smarter-analytics Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter No login needed ≤ 2.0 CVE-2026-3570 Wordfence
4.3 Medium Membership Plugin – Restrict Content Plugin restrict-content Authentication Bypass Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect No login needed ≤ 3.2.24 CVE-2026-4136 Wordfence
4.3 Medium Dealia – Request a quote Plugin dealia-request-a-quote Broken Access Control Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset ≤ 1.0.7 CVE-2026-2504 Wordfence
6.5 Medium OpenPix Plugin openpix-for-woocommerce Broken Access Control Subscriber+ Payment Gateway Settings Reset ≤ 2.13.3 CVE-2025-15400 WPScan
9.8 Critical User Profile Builder Plugin profile-builder Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed 1.1.27 – < 3.15.2 Fixed in 3.15.2 CVE-2025-15030 WPScan
8.1 High Custom Login Page Customizer Plugin login-customizer Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed 2.1.1 – < 2.5.4 Fixed in 2.5.4 CVE-2025-14975 WPScan
4.3 Medium NotificationX Plugin notificationx Broken Access Control Missing Authorization to Authenticated (Contributor+) Analytics Reset ≤ 3.1.11 CVE-2026-0554 Wordfence
6.5 Medium Flaming Password Reset Plugin flaming-password-reset Cross-Site Scripting ≤ 1.0.3 CVE-2025-68875 Patchstack
4.3 Medium xShare Plugin xshare Cross-Site Request Forgery Cross-Site Request Forgery to 'rs_plugin_reset' Parameter No login needed ≤ 1.0.1 CVE-2025-13527 Wordfence
4.3 Medium Easy Digital Downloads Plugin easy-digital-downloads Authentication Bypass Unvalidated Redirect in Password Reset Flow via edd_redirect No login needed ≤ 3.6.2 CVE-2025-14783 Wordfence
7.5 High PowerPack Pro for Elementor Plugin powerpack-elements Broken Access Control Unauthenticated Plugin Settings Reset No login needed ≤ 2.10.6 Fixed in 2.10.8 CVE-2024-24844 Patchstack
8.8 High Demo Importer Plus Plugin demo-importer-plus Broken Access Control Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation ≤ 2.0.8 CVE-2025-14364 Wordfence
6.4 Medium FluentAuth - Auth Security Plugin fluent-security Cross-Site Scripting Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode ≤ 2.0.3 CVE-2025-13728 Wordfence
5.3 Medium HelloLeads CRM Form Shortcode Plugin Cross-Site Request Forgery Unauthenticated Settings Reset No login needed ≤ 1.0 CVE-2025-12696 WPScan
5.4 Medium Popup Builder Plugin easy-notify-lite Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset ≤ 1.1.37 CVE-2025-14446 Wordfence
4.3 Medium Rabbit Hole Plugin rabbit-hole Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset No login needed ≤ 1.1 CVE-2025-13366 Wordfence
8.1 High Blaze Demo Importer Plugin blaze-demo-importer Broken Access Control Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion 1.0.0 – 1.0.13 CVE-2025-13334 Wordfence
9.8 Critical CRM Memberships Plugin crm-memberships Broken Access Control Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint No login needed ≤ 2.6 CVE-2025-13313 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification ≤ 2.9.4 CVE-2025-11726 Wordfence
5.3 Medium Reuters Direct Plugin reuters-direct Broken Access Control Missing Authorization to Unauthenticated Settings Reset No login needed ≤ 3.0.0 CVE-2025-12579 Wordfence
4.3 Medium Reuters Direct Plugin reuters-direct Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.0.0 CVE-2025-12578 Wordfence
5.3 Medium SiteSEO – SEO Simplified Plugin siteseo Broken Access Control SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset No login needed ≤ 1.3.2 CVE-2025-12814 Wordfence
4.3 Medium WSChat – WordPress Live Chat Plugin wschat-live-chat Broken Access Control WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset ≤ 3.1.6 CVE-2025-12751 Wordfence
4.3 Medium Private Google Calendars Plugin private-google-calendars Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Reset ≤ 20250811 CVE-2025-12526 Wordfence
4.3 Medium Contact Form 7 AWeber Extension Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Log Reset ≤ 0.1.42 CVE-2025-12167 Wordfence
4.3 Medium Features Plugin features Broken Access Control Missing Authorization to Authenticated (Subscriber+) Option Reset ≤ 0.0.2 CVE-2025-12582 Wordfence
5.3 Medium Simple User Capabilities Plugin simple-user-capabilities Broken Access Control Missing Authorization to Unauthenticated Capability Reset No login needed ≤ 1.0 CVE-2025-12157 Wordfence
4.3 Medium FileBird Plugin filebird Broken Access Control Improper Authorization to Authenticated (Author+) Settings Reset ≤ 6.4.9 CVE-2025-11510 Wordfence
5.3 Medium WP Reset Plugin wp-reset Information Disclosure Unauthenticated Sensitive Information Exposure via wf-licensing.log No login needed ≤ 2.05 CVE-2025-10645 Wordfence
4.3 Medium Optimize More! – CSS Plugin optimize-more-css Cross-Site Request Forgery CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset No login needed ≤ 1.0.3 CVE-2025-9945 Wordfence
9.8 Critical Appy Pie Connect for WooCommerce Plugin appy-pie-connect-for-woocommerce Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password No login needed ≤ 1.1.2 CVE-2025-9286 Wordfence
4.3 Medium Emergency Password Reset Plugin emergency-password-reset Cross-Site Request Forgery No login needed ≤ 9.3 Fixed in 9.4 CVE-2025-57942 Patchstack
9.8 Critical Password Reset with Code Plugin bdvs-password-reset Privilege Escalation Insecure Password Reset Code Creation No login needed < 0.0.17 Fixed in 0.0.17 CVE-2025-5305 WPScan
4.3 Medium CBX Restaurant Booking Plugin Cross-Site Request Forgery Plugin Reset via CSRF No login needed ≤ 1.2.1 CVE-2025-7965 WPScan
8.8 High Hydra Booking Plugin hydra-booking Broken Access Control Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function 1.1.0 – 1.1.18 CVE-2025-7689 Wordfence
8.8 High Dataverse Integration Plugin integration-cds Broken Access Control Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route 2.77 – 2.81 CVE-2025-7695 Wordfence
9.8 Critical Sala - Startup & SaaS Theme Privilege Escalation Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover No login needed ≤ 1.1.4 CVE-2025-4606 Wordfence
4.3 Medium MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin paid-membership Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.2.0 CVE-2025-5937 Wordfence
9.8 Critical DWT - Directory & Listing Theme Privilege Escalation Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset No login needed ≤ 3.3.6 CVE-2024-12827 Wordfence
9.8 Critical WP Email Debug Plugin wp-email-debug Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via Password Reset No login needed 1.0 – 1.1.0 CVE-2025-5486 Wordfence
4.3 Medium GamiPress - Reset User Plugin Cross-Site Request Forgery Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF No login needed < 1.0.1 Fixed in 1.0.1 CVE-2024-8245 WPScan
4.3 Medium Widgets Reset Plugin Cross-Site Request Forgery Settings Update via CSRF No login needed ≤ 0.1 CVE-2024-8082 WPScan
4.3 Medium Nokaut Offers Box Plugin Cross-Site Request Forgery Plugin Reset via CSRF No login needed ≤ 1.4.0 CVE-2024-10634 WPScan
8.8 High Frontend Login and Registration Blocks Plugin frontend-login-and-registration-blocks Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Password Reset ≤ 1.0.8 CVE-2025-3607 Wordfence
4.3 Medium Custom Twitter Feeds Plugin custom-twitter-feeds Cross-Site Request Forgery Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function No login needed ≤ 2.2.5 CVE-2025-1314 Wordfence
8.8 High BoomBox Theme Extensions Plugin Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password ≤ 1.8.0 CVE-2024-12295 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only