WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 51–98 of 98 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Blaze Demo Importer Plugin `blaze-demo-importer`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install	`≤ 1.0.12`	Sep 16, 2025	`CVE-2025-8446`	Wordfence
8.1 High	Inspiro Theme `inspiro`	Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Plugin Installation No login needed	`≤ 2.1.2`	Aug 21, 2025	`CVE-2025-8592`	Wordfence
5.4 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions No login needed	`≤ 3.5.0`	Aug 20, 2025	`CVE-2025-8102`	Wordfence
4.3 Medium	ColorMag Theme `colormag`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation	`≤ 4.0.19`	Aug 20, 2025	`CVE-2025-9202`	Wordfence
4.3 Medium	OceanWP Theme `oceanwp`	Cross-Site Request Forgery Cross-Site Request Forgery to Ocean Extra Plugin Installation No login needed	`4.0.9 – 4.1.1`	Aug 13, 2025	`CVE-2025-8891`	Wordfence
8.8 High	B Slider- Gutenberg Slider Block for WP Plugin `b-slider`	Broken Access Control Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation	`≤ 1.1.30`	Aug 12, 2025	`CVE-2025-8418`	Wordfence
4.3 Medium	Memory Usage Plugin `wp-memory`	Cross-Site Request Forgery Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function No login needed	`≤ 3.98`	Jul 27, 2025	`CVE-2025-8104`	Wordfence
9.8 Critical	Alone – Charity Multipurpose Non-profit Theme	Broken Access Control Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation No login needed	`≤ 7.8.3`	Jul 15, 2025	`CVE-2025-5394`	Wordfence
9.8 Critical	Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit Plugin `wp-marketing-automations`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Installation No login needed	`≤ 3.5.3`	Jun 18, 2025	`CVE-2025-1562`	Wordfence
5.4 Medium	Splitit Plugin `splitit-installment-payments`	Broken Access Control Missing Authorization to Multiple Administrative Actions	`≤ 4.2.8`	May 21, 2025	`CVE-2025-4105`	Wordfence
8.8 High	NewsBlogger Theme `newsblogger`	Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Plugin Installation No login needed	`≤ 0.2.5.4`	May 1, 2025	`CVE-2025-1305`	Wordfence
4.3 Medium	SecuPress Free Plugin `secupress`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 2.3.9`	Apr 29, 2025	`CVE-2025-3452`	Wordfence
9.6 Critical	Anant Addons for Elementor Plugin `anant-addons-for-elementor`	Cross-Site Request Forgery CSRF to Arbitrary Plugin Installation No login needed	`≤ 1.1.8` Fixed in `1.1.9`	Apr 9, 2025	`CVE-2025-32641`	Patchstack
8.8 High	Motors – Car Dealership & Classified Listings Plugin `motors-car-dealership-classified-listings`	Broken Access Control Car Dealership & Classified Listings Plugin <= 1.4.64 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 1.4.64`	Apr 8, 2025	`CVE-2025-2807`	Wordfence
9.9 Critical	RTMKit Plugin `rometheme-for-elementor`	Remote Code Execution Arbitrary Plugin Installation/Activation to RCE	`≤ 1.5.4` Fixed in `1.5.5`	Apr 1, 2025	`CVE-2025-30911`	Patchstack
8.8 High	Animation Addons for Elementor Pro Plugin	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation	`≤ 1.6`	Mar 4, 2025	`CVE-2025-1639`	Wordfence
9.6 Critical	Munk Sites Plugin `munk-sites`	Cross-Site Request Forgery CSRF to Arbitrary Plugin Installation No login needed	`≤ 1.0.7`	Feb 7, 2025	`CVE-2025-25101`	Patchstack
9.6 Critical	OneStore Sites Plugin `onestore-sites`	Cross-Site Request Forgery CSRF to Arbitrary Plugin Installation No login needed	`≤ 0.1.1`	Feb 7, 2025	`CVE-2025-25107`	Patchstack
9.6 Critical	Starter Templates by FancyWP Plugin `starter-templates`	Cross-Site Request Forgery CSRF to Arbitrary Plugin Installation No login needed	`≤ 2.0.0`	Feb 7, 2025	`CVE-2025-25106`	Patchstack
4.3 Medium	Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates Plugin `sastra-essential-addons-for-elementor`	Broken Access Control Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install	`≤ 1.0.14`	Jan 24, 2025	`CVE-2024-13335`	Wordfence
5.4 Medium	Scratch & Win – Giveaways and Contests Plugin `scratch-win-giveaways-for-website-facebook`	Cross-Site Request Forgery Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function No login needed	`≤ 2.7.1`	Jan 4, 2025	`CVE-2024-12545`	Wordfence
9.8 Critical	Hunk Companion Plugin `hunk-companion`	Broken Access Control Unauthenticated Plugin Installation No login needed	`< 1.9.0` Fixed in `1.9.0`	Dec 31, 2024	`CVE-2024-11972`	WPScan
4.3 Medium	File Manager Pro – Filester Plugin `filester`	Broken Access Control Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation	`≤ 1.8.6`	Dec 19, 2024	`CVE-2024-12331`	Wordfence
9.1 Critical	Zita Site Builder Plugin `ai-site-builder`	Broken Access Control Arbitrary Plugin Installation and Activation No login needed	`≤ 1.0.2`	Dec 16, 2024	`CVE-2024-54369`	Patchstack
4.3 Medium	WP Crowdfunding Plugin `wp-crowdfunding`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation	`≤ 2.1.12`	Dec 13, 2024	`CVE-2024-11911`	Wordfence
9.8 Critical	Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce Plugin `vayu-blocks`	Broken Access Control Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation No login needed	`≤ 1.1.1`	Dec 12, 2024	`CVE-2024-10124`	Wordfence
8.8 High	Pubnews Theme `pubnews`	Broken Access Control Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 1.0.7`	Dec 6, 2024	`CVE-2024-10578`	Wordfence
9.8 Critical	Spam protection, Anti-Spam, FireWall by CleanTalk Plugin `cleantalk-spam-protect`	Broken Access Control Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation No login needed	`≤ 6.43.2`	Nov 26, 2024	`CVE-2024-10542`	Wordfence
8.1 High	Spam protection, Anti-Spam, FireWall by CleanTalk Plugin `cleantalk-spam-protect`	Broken Access Control Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation No login needed	`≤ 6.44`	Nov 26, 2024	`CVE-2024-10781`	Wordfence
6.5 Medium	Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera Plugin `wp-website-creator`	Cross-Site Scripting	`≤ 4.0`	Nov 18, 2024	`CVE-2024-52347`	Patchstack
9.9 Critical	WP Quick Setup Plugin `wp-quick-setup`	Remote Code Execution Arbitrary Plugin and Theme Installation to Remote Code Execution	`≤ 2.0`	Nov 18, 2024	`CVE-2024-52429`	Patchstack
8.8 High	PostX Plugin `ultimate-post`	Broken Access Control Missing Authorization to Arbitrary Plugin Installation/Activation	`≤ 4.1.16`	Nov 16, 2024	`CVE-2024-10728`	Wordfence
4.3 Medium	WP Chat App Plugin `wp-whatsapp`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation	`≤ 3.6.8`	Nov 16, 2024	`CVE-2024-10533`	Wordfence
4.3 Medium	Tutor LMS Elementor Addons Plugin `tutor-lms-elementor-addons`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation	`≤ 2.1.5`	Nov 15, 2024	`CVE-2024-10897`	Wordfence
8.8 High	Th Shop Mania Theme `th-shop-mania`	Broken Access Control Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation	`≤ 1.4.9`	Nov 9, 2024	`CVE-2024-10674`	Wordfence
8.8 High	Top Store Theme `top-store`	Broken Access Control Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation	`≤ 1.5.4`	Nov 9, 2024	`CVE-2024-10673`	Wordfence
9.8 Critical	Hunk Companion Plugin `hunk-companion`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation No login needed	`≤ 1.8.4`	Oct 11, 2024	`CVE-2024-9707`	Wordfence
4.3 Medium	YITH Essential Kit for WooCommerce #1 Plugin `yith-essential-kit-for-woocommerce-1`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation	`≤ 2.34.0`	Jul 19, 2024	`CVE-2024-6799`	Wordfence
8.8 High	Pie Register - Basic Plugin `pie-register`	Broken Access Control Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 3.8.3.4`	Jul 9, 2024	`CVE-2024-6069`	Wordfence
7.6 High	Crafthemes Demo Import Plugin `crafthemes-demo-import`	Broken Access Control Arbitrary plugin Installation	`≤ 3.3` Fixed in `4.0`	Jun 10, 2024	`CVE-2024-34800`	Patchstack
8.8 High	Finale Lite Plugin `finale-woocommerce-sales-countdown-timer-discount`	Broken Access Control Subscriber+ Arbitrary Plugin Installation/Activation	`≤ 2.18.0` Fixed in `2.18.1`	Jun 9, 2024	`CVE-2024-30485`	Patchstack
8.8 High	NextMove Lite Plugin `woo-thank-you-page-nextmove-lite`	Broken Access Control Subscriber+ Arbitrary Plugin Installation/Activation	`≤ 2.17.0` Fixed in `2.18.0`	Jun 9, 2024	`CVE-2024-25092`	Patchstack
4.3 Medium	PropertyHive Plugin `propertyhive`	Broken Access Control Missing Authorization to Non-Arbitrary Plugin Installation	`≤ 2.0.6` Fixed in `2.0.7`	Mar 26, 2024	`CVE-2024-24718`	Patchstack
4.3 Medium	Colibri WP Theme `colibri-wp`	Cross-Site Request Forgery Cross-Site Request Forgery to Limited Plugin Installation No login needed	`≤ 1.0.94`	Feb 23, 2024	`CVE-2024-1360`	Wordfence
4.7 Medium	Database Reset Plugin `wordpress-database-reset`	Cross-Site Request Forgery Cross-Site Request Forgery to WP Reset Plugin Installation No login needed	`≤ 3.22`	Feb 21, 2024	`CVE-2024-1501`	Wordfence
6.5 Medium	10Web AI Assistant – AI content writing assistant Plugin `ai-assistant-by-10web`	Broken Access Control AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation	`≤ 1.0.18`	Feb 5, 2024	`CVE-2023-6985`	Wordfence
6.5 Medium	ColorMag Theme `colormag`	Broken Access Control Missing Authorization to Arbitrary Plugin Installation	`≤ 3.1.2`	Jan 20, 2024	`CVE-2024-0679`	Wordfence
4.3 Medium	GiveWP Plugin `give`	Cross-Site Request Forgery Cross-Site Request Forgery to plugin installation No login needed	`≤ 2.33.3`	Jan 11, 2024	`CVE-2023-4246`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.