WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 51–100 of 383 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Post Blocks & Tools | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'sliderStyle' Block Attribute |
≤ 1.3.0 |
CVE-2026-5711 |
Wordfence | |
| 6.4 Medium | Prime Slider | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter |
≤ 4.1.10 |
CVE-2026-4341 |
Wordfence | |
| 5.4 Medium | Smart Slider 3 | Broken Access Control Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation |
≤ 3.5.1.33 |
CVE-2026-4065 |
Wordfence | |
| 6.5 Medium | Smart Slider 3 | Path Traversal Authenticated (Subscriber+) Arbitrary File Read via actionExportAll |
≤ 3.5.1.33 |
CVE-2026-3098 |
Wordfence | |
| 6.5 Medium | WP Review Slider | Cross-Site Scripting |
≤ <= 13.9 Fixed in 14.0 |
CVE-2026-32491 |
Patchstack | |
| 6.5 Medium | WP TripAdvisor Review Slider | Cross-Site Scripting |
≤ <= 14.1 Fixed in 14.2 |
CVE-2026-32490 |
Patchstack | |
| 6.5 Medium | Product Slider for WooCommerce | Broken Access Control |
≤ 1.13.61 Fixed in 1.13.62 |
CVE-2026-25455 |
Patchstack | |
| 6.4 Medium | Sina Extension for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget` |
≤ 3.7.0 |
CVE-2025-6229 |
Wordfence | |
| 6.4 Medium | Logo Slider | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode |
≤ 4.9.0 |
CVE-2026-0609 |
Wordfence | |
| 6.4 Medium | Multi Post Carousel by Category | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute |
≤ 1.4 |
CVE-2026-1275 |
Wordfence | |
| 4.3 Medium | Lobot Slider Administrator | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 0.6.0 |
CVE-2026-3331 |
Wordfence | |
| 6.4 Medium | Any Post Slider | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute |
≤ 1.0.4 |
CVE-2026-1899 |
Wordfence | |
| 5.3 Medium | Image Slider by Ays | Broken Access Control No login needed |
≤ 2.7.1 Fixed in 2.7.2 |
CVE-2026-32402 |
Patchstack | |
| 6.5 Medium | Testimonial Slider | Broken Access Control |
≤ 2.0.15 |
CVE-2025-68000 |
Patchstack | |
| 4.4 Medium | Client Testimonial Slider | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting |
≤ 2.0 |
CVE-2026-2716 |
Wordfence | |
| 4.3 Medium | Serious Slider | Broken Access Control |
≤ 1.2.7 Fixed in 1.3.0 |
CVE-2026-25399 |
Patchstack | |
| 5.4 Medium | Accordion and Accordion Slider | Broken Access Control Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification |
≤ 1.4.5 |
CVE-2026-0727 |
Wordfence | |
| 6.4 Medium | Slideshow Wp | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute |
≤ 1.1 |
CVE-2026-1885 |
Wordfence | |
| 6.4 Medium | Wonka Slide | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.3.3 |
CVE-2026-1613 |
Wordfence | |
| 6.1 Medium | Subitem AL Slider | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 1.0.0 |
CVE-2026-1634 |
Wordfence | |
| 5.5 Medium | Post Slides | Local File Inclusion Contributor+ Local File Inclusion |
≤ 1.0.1 |
CVE-2025-15491 |
WPScan | |
| 5.9 Medium | Logo Slider | Cross-Site Scripting |
≤ 5.1.1 |
CVE-2026-24626 |
Patchstack | |
| 6.5 Medium | B Slider | Cross-Site Scripting |
≤ 2.0.6 Fixed in 2.0.7 |
CVE-2026-24383 |
Patchstack | |
| 6.5 Medium | Carousel Horizontal Posts Content Slider | Cross-Site Scripting |
≤ 3.3.2 |
CVE-2026-22347 |
Patchstack | |
| 6.5 Medium | Depicter Slider | Broken Access Control No login needed |
≤ 4.0.4 Fixed in 4.0.5 |
CVE-2025-68558 |
Patchstack | |
| 6.5 Medium | Slider Templates | Broken Access Control No login needed |
≤ 1.0.3 |
CVE-2025-68009 |
Patchstack | |
| 4.3 Medium | Responsive Accordion Slider | Broken Access Control Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images' |
≤ 1.2.2 |
CVE-2026-0635 |
Wordfence | |
| 4.4 Medium | Real Post Slider Lite | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Settings |
≤ 2.4 |
CVE-2026-0680 |
Wordfence | |
| 4.3 Medium | CP Image Store with Slideshow | Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import |
≤ 1.1.9 |
CVE-2026-0684 |
Wordfence | |
| 6.4 Medium | Client Testimonial Slider | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field |
≤ 2.0 |
CVE-2025-13897 |
Wordfence | |
| 4.3 Medium | Image Slider Slideshow | Broken Access Control Insecure Direct Object References (IDOR) |
≤ 1.8 |
CVE-2026-22489 |
Patchstack | |
| 6.5 Medium | Block Slider | Broken Access Control |
≤ 2.2.3 |
CVE-2026-22522 |
Patchstack | |
| 6.1 Medium | Logo Slider | Cross-Site Scripting Contributor+ Stored XSS No login needed |
< 4.9.0 Fixed in 4.9.0 |
CVE-2025-13153 |
WPScan | |
| 4.3 Medium | Accordion Slider Gallery | Broken Access Control |
≤ 2.7 |
CVE-2025-62130 |
Patchstack | |
| 5.9 Medium | Logo Slider , Logo Carousel , Logo showcase , Client Logo | Cross-Site Scripting |
≤ 1.8.1 |
CVE-2025-62121 |
Patchstack | |
| 6.5 Medium | SEO Slider | Cross-Site Scripting |
≤ 1.1.1 |
CVE-2025-62097 |
Patchstack | |
| 6.5 Medium | Wp Text Slider Widget | Cross-Site Scripting |
≤ 1.0 |
CVE-2025-68868 |
Patchstack | |
| 5.4 Medium | YITH Slider for page builders | Broken Access Control |
≤ 1.0.11 |
CVE-2025-68581 |
Patchstack | |
| 4.9 Medium | Prime Slider – Addons For Elementor | Server-Side Request Forgery Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) |
≤ 4.0.10 Fixed in 4.1.0 |
CVE-2025-68500 |
Patchstack | |
| 5.5 Medium | Responsive and Swipe slider | Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.2 |
CVE-2025-14721 |
Wordfence | |
| 4.3 Medium | Prime Slider – Addons for Elementor | Server-Side Request Forgery Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery |
≤ 4.0.9 |
CVE-2025-14277 |
Wordfence | |
| 6.5 Medium | Stars Testimonials | Cross-Site Scripting |
≤ 3.3.4 Fixed in 3.3.5 |
CVE-2025-67912 |
Patchstack | |
| 4.3 Medium | Quick Interest Slider | Cross-Site Request Forgery No login needed |
≤ 3.1.5 Fixed in 3.1.6 |
CVE-2025-64237 |
Patchstack | |
| 4.3 Medium | Image Slider by Ays- Responsive Slider and Carousel | Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Slider Deletion No login needed |
≤ 2.7.0 |
CVE-2025-14454 |
Wordfence | |
| 6.4 Medium | HT Slider for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.7.4 |
CVE-2025-14278 |
Wordfence | |
| 6.1 Medium | Simple AL Slider | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 1.2.10 |
CVE-2025-14137 |
Wordfence | |
| 6.4 Medium | Better Elementor Addons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget |
≤ 1.5.5 |
CVE-2025-12830 |
Wordfence | |
| 6.4 Medium | Simple Nivo Slider | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.5.6 |
CVE-2025-13889 |
Wordfence | |
| 5.3 Medium | Slider a SlidersPack | Broken Access Control No login needed |
< 2.3 Fixed in 2.3 |
CVE-2022-46845 |
Patchstack | |
| 6.5 Medium | Master Slider Pro | Cross-Site Scripting |
≤ 3.7.12 |
CVE-2025-63045 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.