WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 51–100 of 217 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Broken Access Control ≤ 1.27.9 Fixed in 1.27.10 CVE-2025-69345 Patchstack
6.5 Medium Post Grid and Gutenberg Blocks Plugin post-grid Cross-Site Scripting ≤ 2.3.23 CVE-2025-68605 Patchstack
6.4 Medium Image Photo Gallery Final Tiles Grid Plugin final-tiles-grid-gallery-lite Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'Custom Scripts' Setting ≤ 3.6.8 CVE-2025-13693 Wordfence
5.4 Medium Image Photo Gallery Final Tiles Grid Plugin final-tiles-grid-gallery-lite Broken Access Control Missing Authorization to Authenticated (Contributor+) Gallery Management ≤ 3.6.7 CVE-2025-14455 Wordfence
5.3 Medium Post Grid and Gutenberg Blocks Plugin post-grid Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 2.3.23 CVE-2025-63043 Patchstack
6.5 Medium Post Grid and Gutenberg Blocks Plugin post-grid Broken Access Control ≤ 2.3.17 Fixed in 2.3.18 CVE-2025-66058 Patchstack
6.5 Medium Stars Testimonials Plugin stars-testimonials-with-slider-and-masonry-grid Cross-Site Scripting ≤ 3.3.4 Fixed in 3.3.5 CVE-2025-67912 Patchstack
5.4 Medium Grider for Elementor Plugin grider-elementor Broken Access Control ≤ 1.0.8 CVE-2025-66161 Patchstack
4.3 Medium Image Gallery – Photo Grid & Video Gallery Plugin modula-best-grid-gallery Broken Access Control Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification ≤ 2.13.3 CVE-2025-14003 Wordfence
5.9 Medium Filter & Grids Plugin SQL Injection Unauthenticated SQL Injection No login needed ≤ 3.2.0 CVE-2025-10289 Wordfence
6.5 Medium Image Gallery – Photo Grid & Video Gallery (Modula) Plugin modula-best-grid-gallery Broken Access Control Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing ≤ 2.13.3 CVE-2025-13891 Wordfence
4.3 Medium Custom Layouts – Post + Product grids made easy Plugin custom-layouts Broken Access Control Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control ≤ 1.4.12 Fixed in 1.5.0 CVE-2025-62996 Patchstack
4.3 Medium Image Gallery – Photo Grid & Video Gallery Plugin modula-best-grid-gallery Arbitrary File Deletion Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move ≤ 2.12.28 CVE-2025-12494 Wordfence
6.5 Medium Post Grid and Gutenberg Blocks Plugin post-grid Broken Access Control ≤ 2.3.17 Fixed in 2.3.18 CVE-2025-62924 Patchstack
6.4 Medium Cinza Grid Plugin cinza-grid Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Skin Content Field ≤ 1.2.1 CVE-2025-11824 Wordfence
5.9 Medium Advance Portfolio Grid Plugin advance-portfolio-grid Cross-Site Scripting ≤ 1.07.6 Fixed in 1.07.7 CVE-2025-57982 Patchstack
4.3 Medium Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid Plugin blog-designer-for-elementor Cross-Site Request Forgery Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery No login needed ≤ 1.1.7 CVE-2025-8481 Wordfence
6.4 Medium Content Views Plugin content-views-query-and-display-post-page Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List Widgets ≤ 4.1 CVE-2025-8722 Wordfence
6.5 Medium Gallery PhotoBlocks Plugin photoblocks-grid-gallery Cross-Site Scripting ≤ 1.3.1 Fixed in 1.3.2 CVE-2025-58610 Patchstack
6.5 Medium Video Gallery – Vimeo and YouTube Gallery Plugin smart-grid-gallery Cross-Site Scripting Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) ≤ 1.1.7 CVE-2025-48349 Patchstack
4.2 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Path Traversal Visual Drag and Drop Editor <= 1.27.8 - Path Traversal ≤ 1.27.8 Fixed in 1.27.9 CVE-2025-52712 Patchstack
6.1 Medium Post Grid Master Plugin ajax-filter-posts Cross-Site Scripting Reflected Cross-Site Scripting via argsArray['read_more_text'] No login needed ≤ 3.4.13 CVE-2025-5084 Wordfence
6.4 Medium Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery Plugin Cross-Site Scripting Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.7 CVE-2025-7644 Wordfence
6.1 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function No login needed ≤ 5.9.5.4 CVE-2025-6977 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Information Disclosure Full Path Disclosure (FPD) ≤ 5.9.5.2 Fixed in 5.9.5.3 CVE-2025-52719 Patchstack
6.4 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Server-Side Request Forgery Visual Drag and Drop Editor plugin <= 1.27.8 - Server Side Request Forgery (SSRF) ≤ 1.27.8 Fixed in 1.27.9 CVE-2025-52713 Patchstack
4.3 Medium Post and Page Builder by BoldGrid Plugin post-and-page-builder Cross-Site Request Forgery Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.27.8 Fixed in 1.27.9 CVE-2025-52711 Patchstack
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder ≤ 8.4.1 CVE-2025-4965 Wordfence
4.9 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Server-Side Request Forgery ≤ 5.9.5.2 Fixed in 5.9.5.3 CVE-2025-49877 Patchstack
4.3 Medium Post Grid Master Plugin ajax-filter-posts Broken Access Control ≤ 3.4.17 CVE-2025-30974 Patchstack
5.4 Medium CSS3 Compare Pricing Tables Plugin css3_web_pricing_tables_grids Broken Access Control ≤ 11.6 Fixed in 11.7 CVE-2025-47556 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control ≤ 5.9.5.1 Fixed in 5.9.5.2 CVE-2025-48079 Patchstack
5.4 Medium Post Grid and Gutenberg Blocks Plugin Cross-Site Scripting Contributor+ Stored XSS < 2.2.93 Fixed in 2.2.93 CVE-2024-9645 WPScan
4.3 Medium Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor Plugin ultimate-store-kit Cross-Site Request Forgery Cross-Site Request Forgery to Limited User Meta Update No login needed ≤ 2.4.1 CVE-2025-2168 Wordfence
6.4 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.10.29 CVE-2025-1458 Wordfence
4.9 Medium Simple Google Photos Grid Plugin simple-google-photos-grid Server-Side Request Forgery ≤ 1.5 Fixed in 1.6 CVE-2025-46503 Patchstack
6.4 Medium Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) Plugin bdthemes-element-pack-lite Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 5.10.28 CVE-2025-1457 Wordfence
6.4 Medium Modula Image Gallery Plugin modula-best-grid-gallery Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library ≤ 2.10.1 CVE-2024-9416 Wordfence
4.3 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management ≤ 5.9.4.4 CVE-2025-1408 Wordfence
6.5 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection ≤ 5.9.4.7 CVE-2025-0723 Wordfence
6.5 Medium Featured Image Thumbnail Grid Plugin thumbnail-grid Cross-Site Scripting ≤ 6.8 Fixed in 6.9 CVE-2025-28918 Patchstack
6.4 Medium WordPress Portfolio Builder – Portfolio Gallery Plugin uber-grid Cross-Site Scripting Portfolio Gallery <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1.7 CVE-2025-1757 Wordfence
5.3 Medium Post Grid and Gutenberg Blocks – ComboBlocks Plugin post-grid Information Disclosure ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure No login needed ≤ 2.3.6 CVE-2024-13796 Wordfence
4.9 Medium Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid Plugin boldgrid-backup Server-Side Request Forgery WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery ≤ 1.16.8 CVE-2024-13907 Wordfence
6.4 Medium Image Photo Gallery Final Tiles Grid Plugin final-tiles-grid-gallery-lite Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 3.6.0 CVE-2024-6261 Wordfence
4.3 Medium RAYS Grid Plugin rays-grid Cross-Site Request Forgery No login needed ≤ 1.3.1 CVE-2025-27317 Patchstack
5.3 Medium Post Grid and Gutenberg Blocks – ComboBlocks Plugin Broken Access Control ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation No login needed ≤ 2.3.5 CVE-2024-13798 Wordfence
5.3 Medium WordPress Portfolio Builder – Portfolio Gallery Plugin uber-grid Broken Access Control Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update No login needed ≤ 1.1.7 CVE-2024-13231 Wordfence
4.3 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure ≤ 5.9.4.2 CVE-2024-13740 Wordfence
5.4 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Server-Side Request Forgery User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery ≤ 5.9.4.2 CVE-2024-13741 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only