WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 51–100 of 143 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Element Pack Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute |
8.0.0 |
CVE-2025-5944 |
Wordfence | |
| 6.1 Medium | Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer | Cross-Site Scripting PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source' No login needed |
≤ 2.3.65 |
CVE-2025-5314 |
Wordfence | |
| 6.4 Medium | Royal Elementor Addons | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets |
≤ 1.7.1028 |
CVE-2025-5338 |
Wordfence | |
| 6.4 Medium | SiteOrigin Widgets Bundle | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute |
≤ 1.68.5 |
CVE-2025-5585 |
Wordfence | |
| 5.9 Medium | Better Random Redirect | Cross-Site Scripting |
≤ 1.3.20 |
CVE-2025-50021 |
Patchstack | |
| 6.4 Medium | Slider, Gallery, and Carousel by MetaSlider | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter |
≤ 3.98.0 |
CVE-2025-5337 |
Wordfence | |
| 6.4 Medium | Click to Chat | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter |
≤ 4.22 |
CVE-2025-5336 |
Wordfence | |
| 6.4 Medium | The Events Calendar | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 6.13.2 |
CVE-2025-5144 |
Wordfence | |
| 6.4 Medium | Domain For Sale | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter |
≤ 3.0.10 |
CVE-2025-5239 |
Wordfence | |
| 6.4 Medium | Forminator | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters |
≤ 1.44.1 |
CVE-2025-5341 |
Wordfence | |
| 6.4 Medium | Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder | Cross-Site Scripting Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 5.11.2 |
CVE-2025-5292 |
Wordfence | |
| 6.4 Medium | LA-Studio Element Kit for Elementor | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter |
≤ 1.5.2 |
CVE-2025-4943 |
Wordfence | |
| 6.4 Medium | TablePress | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters |
≤ 3.1.2 |
CVE-2025-5096 |
Wordfence | |
| 4.3 Medium | Hot Random Image | Path Traversal Path Traversal to Authenticated (Contributor+) Limited Arbitrary Image Access via path Parameter |
≤ 1.9.2 |
CVE-2025-4419 |
Wordfence | |
| 4.9 Medium | Hot Random Image | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter |
≤ 1.9.2 |
CVE-2025-4405 |
Wordfence | |
| 6.4 Medium | Multiple Plugins <= (Various Versions) | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via SimpleLightbox JavaScript Library |
≤ 2.14.4, ≤ 3.59.4 |
CVE-2024-5878 |
Wordfence | |
| 5.9 Medium | Submission DOM tracking for Contact Form 7 | Cross-Site Scripting |
≤ 2.1 Fixed in 2.2 |
CVE-2025-47626 |
Patchstack | |
| 5.9 Medium | Landing pages and Domain aliases | Cross-Site Scripting |
≤ 0.8 |
CVE-2025-46533 |
Patchstack | |
| 6.4 Medium | WP Import Export Lite | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 3.9.27 |
CVE-2025-2839 |
Wordfence | |
| 6.4 Medium | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 5.10.28 |
CVE-2025-1457 |
Wordfence | |
| 4.7 Medium | Listdom | Open Redirect No login needed |
≤ 4.0.0 Fixed in 4.1.0 |
CVE-2025-39599 |
Patchstack | |
| 6.4 Medium | Royal Elementor Addons and Templates | Cross-Site Scripting Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting |
≤ 1.7.1012 |
CVE-2025-1456 |
Wordfence | |
| 6.4 Medium | Modula Image Gallery | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library |
≤ 2.10.1 |
CVE-2024-9416 |
Wordfence | |
| 6.4 Medium | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) | Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module |
≤ 3.1.0 |
CVE-2025-1527 |
Wordfence | |
| 6.4 Medium | Finale Lite – Sales Countdown Timer & Discount for WooCommerce | Cross-Site Scripting Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer |
≤ 2.19.0 |
CVE-2024-12589 |
Wordfence | |
| 4.3 Medium | XV Random Quotes | Cross-Site Request Forgery Settings Reset via CSRF No login needed |
≤ 1.40 |
CVE-2024-13580 |
WPScan | |
| 6.4 Medium | HT Mega – Absolute Addons For Elementor | Cross-Site Scripting Absolute Addons For Elementor <= 2.8.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Countdown Widget |
≤ 2.8.2 |
CVE-2025-1261 |
Wordfence | |
| 6.4 Medium | Multiple Plugins <= (Various Versions) | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library |
≤ 1.3.4, ≤ 2.4.7 |
CVE-2024-5667 |
Wordfence | |
| 4.4 Medium | Counter Box: Add Engaging Countdowns, Timers & Counters to Your WordPress Site | Cross-Site Scripting Authenticated (Administrator+) DOM-Based Stored Cross-Site Scripting |
≤ 2.0.6 |
CVE-2024-13901 |
Wordfence | |
| 6.4 Medium | Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty | Cross-Site Scripting Chaty <= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 3.3.5 |
CVE-2025-1450 |
Wordfence | |
| 6.4 Medium | Image Photo Gallery Final Tiles Grid | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 3.6.0 |
CVE-2024-6261 |
Wordfence | |
| 6.5 Medium | OPSI Israel Domestic Shipments | Broken Access Control No login needed |
≤ 2.8.2 |
CVE-2025-23766 |
Patchstack | |
| 6.4 Medium | Rank Math SEO – AI SEO Tools to Dominate SEO Rankings | Cross-Site Scripting AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API |
≤ 1.0.235 |
CVE-2024-13227 |
Wordfence | |
| 6.1 Medium | Stray Random Quotes | Cross-Site Scripting Reflected XSS No login needed |
≤ 1.9.9 |
CVE-2024-13570 |
WPScan | |
| 6.4 Medium | ElementsKit Pro | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via url Parameter |
≤ 3.7.8 |
CVE-2025-0321 |
Wordfence | |
| 6.1 Medium | Quiz Maker Business, Developer, and Agency <= (Multiple Versions) | Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via content No login needed |
≤ 21.8.0, ≤ 31.8.0, ≤ 8.8.0 |
CVE-2024-10636 |
Wordfence | |
| 6.4 Medium | HTML5 Video Player – mp4 Video Player Plugin and Block | Cross-Site Scripting mp4 Video Player Plugin and Block <= 2.5.35 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via heading Parameter |
≤ 2.5.35 |
CVE-2024-13156 |
Wordfence | |
| 6.4 Medium | Booking Calendar | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode |
≤ 10.9.2 |
CVE-2024-13323 |
Wordfence | |
| 6.4 Medium | Dominion – Domain Checker for WPBakery | Cross-Site Scripting Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.3.0 |
CVE-2024-12520 |
Wordfence | |
| 6.4 Medium | Sina Extension for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ |
≤ 3.5.91 |
CVE-2024-12624 |
Wordfence | |
| 6.1 Medium | Jetpack | Cross-Site Scripting Unauthenticated DOM-XSS No login needed |
13.0 – < 14.1 Fixed in 14.1 |
CVE-2024-10858 |
WPScan | |
| 6.4 Medium | Listdom – Business Directory and Classified Ads Listings | Cross-Site Scripting Business Directory and Classified Ads Listings WordPress Plugin <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode Parameter |
≤ 3.7.0 |
CVE-2024-11854 |
Wordfence | |
| 6.4 Medium | Multiple Plugins <= (Various Versions) | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library |
≤ 1.0.286, ≤ 1.8.15, ≤ 1.9.12, … |
CVE-2024-5020 |
Wordfence | |
| 6.4 Medium | Element Pack Elementor Addons | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Lightbox Widget |
≤ 5.10.5 |
CVE-2024-9058 |
Wordfence | |
| 6.5 Medium | Random Banner | Cross-Site Scripting |
≤ 4.2.12 |
CVE-2024-53787 |
Patchstack | |
| 6.5 Medium | EndomondoWP | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 0.1.1 |
CVE-2024-50551 |
Patchstack | |
| 6.4 Medium | Royal Elementor Addons and Templates | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Form Builder Widget |
≤ 1.7.1001 |
CVE-2024-9682 |
Wordfence | |
| 6.4 Medium | Royal Elementor Addons and Template | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Google Maps Widget |
≤ 1.7.1001 |
CVE-2024-9059 |
Wordfence | |
| 6.5 Medium | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 5.10.2 |
CVE-2024-9657 |
Wordfence | |
| 6.4 Medium | Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Custom Gallery Widget |
≤ 5.10.1 |
CVE-2024-10310 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.