WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 51–100 of 104 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 3
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Payment Page | Payment Form for Stripe Plugin payment-page Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter ≤ 1.4.6 CVE-2026-0751 Wordfence
6.4 Medium Stripe Green Downloads Plugin Cross-Site Scripting Stripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via Settings 2.03 CVE-2022-50797 VulnCheck
5.3 Medium PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) Plugin peachpay-for-woocommerce Broken Access Control Missing Authorization to Unauthenticated Order Status Modification No login needed ≤ 1.119.8 CVE-2025-14978 Wordfence
7.5 High WP Attractive Donations System - Easy Stripe & Paypal donations Plugin wp_attractivedonationssystem Broken Access Control Easy Stripe & Paypal donations plugin <= 1.25 - Arbitrary Content Deletion No login needed ≤ 1.25 CVE-2025-22715 Patchstack
4.7 Medium Accept Donations with PayPal & Stripe Plugin easy-paypal-donation Open Redirect No login needed ≤ 1.5.2 Fixed in 1.5.3 CVE-2025-68602 Patchstack
4.3 Medium WP Attractive Donations System - Easy Stripe & Paypal donations Plugin wp_attractivedonationssystem Cross-Site Request Forgery Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.25 CVE-2025-58999 Patchstack
6.1 Medium Accept Stripe Payments Using Contact Form 7 Plugin accept-stripe-payments-using-contact-form-7 Cross-Site Scripting Reflected Cross-Site Scripting via failure_message No login needed ≤ 3.1 CVE-2025-12834 Wordfence
7.5 High Booking Calendar | Appointment Booking | Bookit Plugin bookit Broken Access Control Missing Authorization to Unauthenticated Stripe Connection No login needed ≤ 2.5.0 Fixed in 2.5.1 CVE-2025-12633 Wordfence
7.1 High Simple Stripe Plugin simple-stripe Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed ≤ 0.9.17 CVE-2025-48085 Patchstack
7.5 High Stripe Payment Forms Plugin stripe SQL Injection Unauthenticated SQL Injection No login needed ≤ 8.3.1 CVE-2025-9322 Wordfence
7.1 High Simple Stripe Checkout Plugin simple-stripe-checkout Cross-Site Scripting No login needed ≤ 1.1.28 CVE-2025-49963 Patchstack
4.3 Medium Contest Gallery – Upload, Vote & Sell with PayPal and Stripe Plugin contest-gallery Content Injection Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection No login needed ≤ 27.0.3 Fixed in 28.0.0 CVE-2025-11254 Wordfence
6.4 Medium Contest Gallery – Upload, Vote & Sell with PayPal and Stripe Plugin contest-gallery Cross-Site Scripting Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 27.0.2 Fixed in 27.0.3 CVE-2025-10383 Wordfence
7.1 High WP Attractive Donations System Plugin wp-attractive-donations-system-easy-stripe-paypal-donations Cross-Site Request Forgery No login needed ≤ 1.29 Fixed in 1.29 CVE-2025-58956 Patchstack
6.5 Medium Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net Plugin peachpay-for-woocommerce SQL Injection Authenticated (Contributor+) SQL Injection via order_by Parameter ≤ 1.117.5 Fixed in 1.117.6 CVE-2025-9463 Wordfence
7.6 High WP Full Stripe Free Plugin wp-full-stripe-free SQL Injection ≤ 8.2.5 Fixed in 8.2.6 CVE-2025-58789 Patchstack
7.2 High Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Plugin contest-gallery Cross-Site Scripting Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 26.1.0 CVE-2025-7725 Wordfence
10.0 Critical Easy Stripe Plugin easy-stripe Remote Code Execution No login needed ≤ 1.1 Fixed in 1.2 CVE-2025-49302 Patchstack
5.3 Medium Accept Stripe Payments Using Contact Form 7 Plugin accept-stripe-payments-using-contact-form-7 Information Disclosure Sensitive Data Exposure No login needed ≤ 3.0 Fixed in 3.1 CVE-2025-53309 Patchstack
5.9 Medium Contact Form 7 – PayPal & Stripe Add-on Plugin contact-form-7-paypal-add-on Cross-Site Scripting PayPal & Stripe Add-on plugin <= 2.3.4 - Cross Site Scripting (XSS) ≤ 2.3.4 Fixed in 2.4.1 CVE-2025-47518 Patchstack
7.1 High Accept Donations with PayPal & Stripe Plugin easy-paypal-donation Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.4.5 Fixed in 1.5 CVE-2025-47517 Patchstack
7.2 High Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Plugin contest-gallery Cross-Site Scripting Upload, Vote, Sell via PayPal, Social Share Buttons <= 26.0.0.1 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 26.0.0.1 CVE-2025-1513 Wordfence
6.4 Medium ThemeMakers Stripe Checkout Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-1690 Wordfence
7.1 High OM Stripe Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 02.00.00 CVE-2024-13631 WPScan
6.1 Medium Accept Donations with PayPal & Stripe Plugin easy-paypal-donation Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.4.4 CVE-2024-13728 Wordfence
6.4 Medium Online Payments – Get Paid with PayPal, Square & Stripe Plugin paypal-payment-button-by-vcita Cross-Site Scripting Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.20.0 Fixed in 3.30.0 CVE-2024-11895 Wordfence
6.5 Medium Online Payments – Get Paid with PayPal, Square & Stripe Plugin paypal-payment-button-by-vcita Cross-Site Scripting ≤ 3.20.0 Fixed in 3.30.0 CVE-2025-22661 Patchstack
7.6 High WP Simple Pay Lite Manager Plugin stripe-manager SQL Injection ≤ 1.4 CVE-2024-55989 Patchstack
5.3 Medium Accept Stripe Payments Using Contact Form 7 Plugin accept-stripe-payments-using-contact-form-7 Information Disclosure Unauthenticated Information Exposure No login needed ≤ 2.5 CVE-2024-12255 Wordfence
8.2 High Stripe Payments Plugin stripe-payments Broken Access Control No login needed ≤ 2.0.79 Fixed in 2.0.80 CVE-2023-48286 Patchstack
6.5 Medium Stripe Donation Plugin bin-stripe-donation Cross-Site Scripting ≤ 1.2.5 CVE-2024-53752 Patchstack
6.1 Medium Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net Plugin peachpay-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.112.0 Fixed in 1.114.0 CVE-2024-11362 Wordfence
6.5 Medium Sell Media File with Stripe Plugin sell-media-file Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.0.6 CVE-2024-51892 Patchstack
6.5 Medium Pay With Stripe Plugin payments-stripe-gateway Cross-Site Scripting ≤ 1.2.1 CVE-2024-51918 Patchstack
6.1 Medium Contact Form 7 - PayPal & Stripe Add-on Plugin contact-form-7-paypal-add-on Cross-Site Scripting PayPal & Stripe Add-on <= 2.3.1 - Reflected Cross-Site Scripting No login needed ≤ 2.3.1 CVE-2024-10683 Wordfence
9.8 Critical Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Plugin contest-gallery SQL Injection Upload, Vote, Sell via PayPal, Social Share Buttons <= 24.0.3 - Unauthenticated SQL Injection No login needed ≤ 24.0.3 Fixed in 24.0.4 CVE-2024-10687 Wordfence
5.3 Medium AidWP Plugin wp-stripe-donation Broken Access Control No login needed ≤ 3.2.3 Fixed in 3.2.4 CVE-2024-50459 Patchstack
7.1 High Contact Form 7 – PayPal & Stripe Add-on Plugin contact-form-7-paypal-add-on Cross-Site Scripting PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3 Fixed in 2.3.1 CVE-2024-48021 Patchstack
4.3 Medium Stripe Payments For WooCommerce by Checkout Plugin checkout-plugins-stripe-woo Cross-Site Request Forgery No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2024-43316 Patchstack
4.7 Medium Easy PayPal Buy Now Button Plugin wp-ecommerce-paypal Open Redirect No login needed ≤ 1.9 Fixed in 1.9.1 CVE-2024-43236 Patchstack
7.5 High Stripe Payments For WooCommerce by Checkout Plugin checkout-plugins-stripe-woo Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2024-43315 Patchstack
5.4 Medium Accept Stripe Payments Plugin stripe-payments Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via accept_stripe_payment_ng Shortcode ≤ 2.0.86 CVE-2024-7353 Wordfence
7.5 High WooCommerce Stripe Payment Gateway Plugin woocommerce-gateway-stripe Broken Access Control Unauthenticated Broken Access Control No login needed ≤ 7.4.0 Fixed in 7.4.1 CVE-2023-35049 Patchstack
5.3 Medium Stripe Payments Plugin stripe-payments Content Injection No login needed ≤ 2.0.79 Fixed in 2.0.80 CVE-2023-48285 Patchstack
6.5 Medium WP Stripe Checkout Plugin wp-stripe-checkout Cross-Site Scripting ≤ 1.2.2.41 Fixed in 1.2.2.42 CVE-2024-32571 Patchstack
5.4 Medium WooCommerce Stripe Payment Gateway Plugin woocommerce-gateway-stripe Cross-Site Request Forgery No login needed ≤ 7.6.0 Fixed in 7.6.1 CVE-2023-44999 Patchstack
7.1 High Contact Form 7 – PayPal & Stripe Add-on Plugin contact-form-7-paypal-add-on Cross-Site Scripting PayPal & Stripe Add-on plugin <= 2.0 - Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0 Fixed in 2.1 CVE-2024-29130 Patchstack
5.4 Medium Easy PayPal & Stripe Buy Now Button Plugin wp-ecommerce-paypal Cross-Site Request Forgery WordPress Easy PayPal Buy Now Button Plugin <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 1.8.1 Fixed in 1.8.2 CVE-2023-51683 Patchstack
4.3 Medium Easy PayPal & Stripe Buy Now Button Plugin wp-ecommerce-paypal Cross-Site Request Forgery PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Update No login needed ≤ 1.8.3, ≤ 2.1 CVE-2024-1719 Wordfence
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return No login needed ≤ 2.11.1 Fixed in 2.11.2 CVE-2024-1389 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only