WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 51–100 of 144 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.5 Medium	All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Plugin `aio-time-clock-lite`	Broken Access Control Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure No login needed	`≤ 2.0.3`	Nov 4, 2025	`CVE-2025-11758`	Wordfence
6.5 Medium	MapSVG Plugin `mapsvg-lite-interactive-vector-maps`	Cross-Site Scripting	`≤ 8.7.22` Fixed in `8.7.23`	Oct 27, 2025	`CVE-2025-62930`	Patchstack
4.3 Medium	Referral Link Tracker Plugin `referral-link-tracker`	Broken Access Control	`≤ 1.1.4`	Oct 27, 2025	`CVE-2025-62906`	Patchstack
5.3 Medium	User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Plugin `userfeedback-lite`	Broken Access Control Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure No login needed	`≤ 1.8.0`	Oct 25, 2025	`CVE-2025-10694`	Wordfence
5.9 Medium	WP Tesseract Plugin `wp-tesseract`	Cross-Site Scripting	`≤ 1.0.2`	Oct 22, 2025	`CVE-2025-60176`	Patchstack
4.3 Medium	All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Plugin `aio-time-clock-lite`	Broken Access Control Tracking Employee Time Has Never Been Easier <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out	`≤ 2.0`	Oct 22, 2025	`CVE-2025-6833`	Wordfence
4.9 Medium	Email Tracker Plugin `email-tracker`	SQL Injection Authenticated (Admin+) SQL Injection	`≤ 5.3.15`	Oct 22, 2025	`CVE-2025-10047`	Wordfence
5.5 Medium	Interactive Medical Drawing of Human Body Plugin `interactive-medical-drawing-of-human-body`	Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting	`≤ 2.6`	Oct 3, 2025	`CVE-2025-9332`	Wordfence
4.3 Medium	MasterStudy LMS Plugin `masterstudy-lms-learning-management-system`	Other Race Condition	`≤ 3.6.20` Fixed in `3.6.21`	Sep 22, 2025	`CVE-2025-59577`	Patchstack
5.9 Medium	Goracash Plugin `goracash`	Cross-Site Scripting	`≤ 1.1`	Sep 22, 2025	`CVE-2025-53458`	Patchstack
6.5 Medium	Adverts Plugin `adverts-click-tracker`	Cross-Site Scripting	`≤ 1.4`	Sep 22, 2025	`CVE-2025-57911`	Patchstack
5.3 Medium	3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin `interactive-3d-flipbook-powered-physics-engine`	Information Disclosure PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure No login needed	`≤ 1.16.16` Fixed in `1.16.17`	Sep 22, 2025	`CVE-2025-58226`	Patchstack
4.3 Medium	Interact: Embed A Quiz On Your Site Plugin `interact-quiz-embed`	Cross-Site Request Forgery No login needed	`≤ 3.1` Fixed in `3.2`	Sep 22, 2025	`CVE-2025-58675`	Patchstack
5.9 Medium	Simple Matomo Tracking Code Plugin `simple-matomo-tracking-code`	Cross-Site Scripting	`≤ 1.1.0` Fixed in `1.1.1`	Sep 3, 2025	`CVE-2025-58630`	Patchstack
5.9 Medium	Goal Tracker for Patreon Plugin `goal-tracker-for-patreon`	Cross-Site Scripting	`≤ 0.4.6`	Aug 28, 2025	`CVE-2025-48305`	Patchstack
5.3 Medium	AfterShip Tracking Plugin `aftership-woocommerce-tracking`	Broken Access Control No login needed	`≤ 1.17.17` Fixed in `1.17.18`	Aug 27, 2025	`CVE-2025-58201`	Patchstack
5.3 Medium	myCred Plugin `mycred`	Other Race Condition No login needed	`≤ 2.9.4.3` Fixed in `2.9.4.4`	Aug 14, 2025	`CVE-2025-54667`	Patchstack
6.1 Medium	All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier Plugin `aio-time-clock-lite`	Cross-Site Scripting Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting No login needed	`≤ 2.0`	Aug 2, 2025	`CVE-2025-6832`	Wordfence
4.3 Medium	Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship Plugin `biteship`	Broken Access Control Biteship <= 3.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) View Order Tracking Details	`≤ 3.2.0`	Jul 18, 2025	`CVE-2025-5816`	Wordfence
6.4 Medium	FL3R Accessibility Suite Plugin `fl3r-accessibility-suite`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode	`≤ 1.4`	Jun 27, 2025	`CVE-2025-6689`	Wordfence
6.4 Medium	WP SoundSystem Plugin `wp-soundsystem`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode	`≤ 3.4.2`	Jun 26, 2025	`CVE-2025-6258`	Wordfence
6.4 Medium	Tournament Bracket Generator Plugin `tournament-bracket-generator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode	`≤ 1.0.0`	Jun 26, 2025	`CVE-2025-6290`	Wordfence
6.4 Medium	3D FlipBook - Lite Edition Plugin `interactive-3d-flipbook-powered-physics-engine`	Cross-Site Scripting Lite Edition <= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parameters	`≤ 1.16.15`	Jun 21, 2025	`CVE-2025-5289`	Wordfence
6.4 Medium	Pixel Manager for WooCommerce (PRO) Plugin `woocommerce-google-adwords-conversion-tracking-tag`	Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via Shortcode	`≤ 1.49.0`	Jun 19, 2025	`CVE-2025-6201`	Wordfence
5.3 Medium	Interactive Regional Map of Florida Plugin `interactive-map-of-florida`	Broken Access Control No login needed	`≤ 1.0`	Jun 6, 2025	`CVE-2025-49441`	Patchstack
4.3 Medium	Interactive UK Regional Map Plugin `interactive-uk-regional-map`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed	`≤ 2.0`	Jun 6, 2025	`CVE-2025-49445`	Patchstack
4.3 Medium	Interactive Regional Map of Africa Plugin `interactive-map-of-africa`	Cross-Site Request Forgery No login needed	`≤ 1.0`	Jun 6, 2025	`CVE-2025-49449`	Patchstack
6.1 Medium	Affiliate Sales in Google Analytics and other tools Plugin `wecantrack`	Open Redirect No login needed	`≤ 2.0.0`	May 21, 2025	`CVE-2024-12561`	Wordfence
5.3 Medium	MapSVG Plugin `mapsvg-lite-interactive-vector-maps`	Arbitrary Shortcode Execution No login needed	`≤ 8.6.9` Fixed in `8.6.10`	May 16, 2025	`CVE-2025-48120`	Patchstack
5.3 Medium	User Activity Tracking and Log Plugin `user-activity-tracking-and-log`	Authentication Bypass IP Spoofing No login needed	`< 4.1.4` Fixed in `4.1.4`	May 15, 2025	`CVE-2024-0970`	WPScan
4.8 Medium	Tracking Code Manager Plugin `tracking-code-manager`	Cross-Site Scripting Tracking Code Manager < 2.3.0- Admin+ Stored Cross-Site Scripting	`< 2.3.0` Fixed in `2.3.0`	May 15, 2025	`CVE-2024-6335`	WPScan
6.5 Medium	Spiraclethemes Site Library Plugin `spiraclethemes-site-library`	Cross-Site Scripting	`≤ 1.5.4` Fixed in `1.5.5`	May 7, 2025	`CVE-2025-47656`	Patchstack
4.3 Medium	Awin – Advertiser Tracking for WooCommerce Plugin `awin-advertiser-tracking`	Cross-Site Request Forgery Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration No login needed	`≤ 2.0.0` Fixed in `2.0.1`	May 7, 2025	`CVE-2025-47633`	Patchstack
5.9 Medium	Submission DOM tracking for Contact Form 7 Plugin `cf7-submission-dom-tracking`	Cross-Site Scripting	`≤ 2.1` Fixed in `2.2`	May 7, 2025	`CVE-2025-47626`	Patchstack
5.3 Medium	Poll Maker Plugin `poll-maker`	Other Race Condition No login needed	`≤ 5.7.7` Fixed in `5.7.8`	May 7, 2025	`CVE-2025-47545`	Patchstack
4.3 Medium	Basic Interactive World Map Plugin `basic-interactive-world-map`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed	`≤ 2.7`	Apr 16, 2025	`CVE-2025-39517`	Patchstack
6.5 Medium	MapSVG Plugin `mapsvg-lite-interactive-vector-maps`	Cross-Site Scripting	`≤ 8.6.6` Fixed in `8.6.7`	Apr 9, 2025	`CVE-2025-32683`	Patchstack
5.0 Medium	MapSVG Plugin `mapsvg-lite-interactive-vector-maps`	Broken Access Control	`≤ 8.6.4` Fixed in `8.6.5`	Apr 9, 2025	`CVE-2025-32684`	Patchstack
6.5 Medium	Norse Rune Oracle Plugin `norse-runes-oracle`	Cross-Site Scripting	`≤ 1.4.3` Fixed in `1.4.4`	Apr 1, 2025	`CVE-2025-31884`	Patchstack
5.3 Medium	Adverts Plugin `adverts-click-tracker`	Broken Access Control No login needed	`≤ 1.4`	Apr 1, 2025	`CVE-2025-31848`	Patchstack
4.3 Medium	WPCargo Track & Trace Plugin `wpcargo`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 8.0.2`	Mar 31, 2025	`CVE-2025-31609`	Patchstack
6.5 Medium	Trackserver Plugin `trackserver`	Cross-Site Scripting	`≤ 5.1.0` Fixed in `5.1.1`	Mar 31, 2025	`CVE-2025-30961`	Patchstack
5.4 Medium	Simple Trackback Disabler Plugin `simple-trackback-disabler`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Mar 28, 2025	`CVE-2025-31448`	Patchstack
6.5 Medium	WP Online Contract Plugin	Broken Access Control Missing Authorization to Unauthenticated Settings Import No login needed	`≤ 5.1.4`	Mar 5, 2025	`CVE-2025-0954`	Wordfence
6.5 Medium	Interactive Page Hierarchy Plugin `interactive-page-hierarchy`	Broken Access Control	`≤ 1.0.1`	Mar 3, 2025	`CVE-2025-23615`	Patchstack
6.4 Medium	Mini Course Generator \| Embed mini-courses and interactive content Plugin `mini-course-generator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 1.0.5`	Feb 21, 2025	`CVE-2024-13672`	Wordfence
4.7 Medium	Track Logins Plugin	SQL Injection Admin+ SQL Injection	`≤ 1.0`	Feb 17, 2025	`CVE-2024-13608`	WPScan
5.4 Medium	Infusionsoft Analytics Plugin `infusionsoft-web-tracker`	Cross-Site Request Forgery No login needed	`≤ 2.0`	Feb 7, 2025	`CVE-2025-25145`	Patchstack
6.5 Medium	Graceful Email Obfuscation Plugin `graceful-email-obfuscation`	Cross-Site Scripting	`≤ 0.2.2`	Feb 7, 2025	`CVE-2025-25076`	Patchstack
5.9 Medium	Tracking Code Manager Plugin `tracking-code-manager`	Cross-Site Scripting Contributor+ Stored XSS	`< 2.4.0` Fixed in `2.4.0`	Jan 30, 2025	`CVE-2024-10309`	WPScan

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.