WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 51–91 of 91 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Zoho Billing Plugin zoho-subscriptions Cross-Site Scripting ≤ 4.1 CVE-2025-57963 Patchstack
5.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Broken Access Control No login needed ≤ 2.15.9 Fixed in 2.16.0 CVE-2025-58600 Patchstack
6.5 Medium WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Plugin wc-frontend-manager Broken Access Control Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification No login needed ≤ 6.7.16 CVE-2025-3780 Wordfence
4.3 Medium MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin paid-membership Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.2.0 CVE-2025-5937 Wordfence
4.3 Medium Subscription Renewal Reminders for WooCommerce Plugin subscriptions-renewal-reminders Cross-Site Request Forgery No login needed ≤ 1.4.1 Fixed in 1.4.2 CVE-2025-28984 Patchstack
4.8 Medium Newsletter Plugin newsletter Cross-Site Scripting Admin+ Stored XSS via Subscription < 8.8.2 Fixed in 8.8.2 CVE-2025-3584 WPScan
6.1 Medium MemberSpace – Membership Plugin and Paid Subscriptions Plugin Cross-Site Scripting Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS No login needed < 2.1.14 Fixed in 2.1.14 CVE-2024-13727 WPScan
6.5 Medium tagDiv Opt-In Builder Plugin SQL Injection Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter ≤ 1.7 CVE-2025-2890 Wordfence
5.4 Medium WP Subscription Forms Plugin wp-subscription-forms Broken Access Control ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-39591 Patchstack
5.9 Medium ActiveCampaign Plugin activecampaign-subscription-forms Cross-Site Scripting ≤ 8.1.16 Fixed in 8.1.17 CVE-2025-32136 Patchstack
6.5 Medium Subscription Form for Feedblitz Plugin feedblitz-email-subscription Cross-Site Scripting ≤ 1.0.9 CVE-2025-31745 Patchstack
6.5 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Scripting ≤ 2.14.3 Fixed in 2.14.4 CVE-2025-31088 Patchstack
6.5 Medium Zoho Billing – Embed Payment Form Plugin zoho-subscriptions Cross-Site Scripting Embed Payment Form plugin <= 4.0 - Stored Cross Site Scripting (XSS) ≤ 4.0 Fixed in 4.1 CVE-2025-30900 Patchstack
5.3 Medium Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Plugin easy-digital-downloads Information Disclosure eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure No login needed ≤ 3.3.6.1 CVE-2025-2252 Wordfence
6.1 Medium Razorpay Subscription Button Elementor Plugin razorpay-subscription-button-elementor Cross-Site Scripting Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions No login needed ≤ 1.0.3 CVE-2024-13827 Wordfence
4.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Deletion No login needed ≤ 1.1.6 CVE-2024-13560 Wordfence
6.5 Medium Autoship Cloud for WooCommerce Subscription Products Plugin autoship-cloud Cross-Site Scripting ≤ 2.8.0.1 Fixed in 2.8.1 CVE-2025-26878 Patchstack
6.4 Medium Autoship Cloud for WooCommerce Subscription Products Plugin autoship-cloud Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.0 CVE-2024-13461 Wordfence
6.1 Medium s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin s2member Cross-Site Scripting Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting No login needed ≤ 241216 CVE-2024-11376 Wordfence
6.1 Medium MailUp Auto Subscription Plugin mailup-auto-subscribtion Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 1.1.0 CVE-2024-13521 Wordfence
4.4 Medium Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) Plugin Cross-Site Scripting Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title ≤ 3.3.2 CVE-2024-13517 Wordfence
6.4 Medium MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet Plugin Cross-Site Scripting Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.9.29 CVE-2024-13391 Wordfence
4.3 Medium WooCommerce Subscriptions Plugin woocommerce-subscriptions Broken Access Control < 5.8.0 Fixed in 5.8.0 CVE-2023-50850 Patchstack
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Information Disclosure Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.4 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed ≤ 2.13.4 CVE-2024-11291 Wordfence
6.1 Medium Newsletter Subscriptions Plugin newsletter-subscriptions Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.1 CVE-2024-11683 Wordfence
6.5 Medium Websand Subscription Form Plugin websand-subscription-form Cross-Site Scripting ≤ 1.0.3 CVE-2024-51923 Patchstack
6.4 Medium Email Subscription Popup Plugin email-subscribe Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode ≤ 1.2.22 CVE-2024-11195 Wordfence
5.4 Medium Contact Form 7 + Telegram Plugin cf7-telegram Broken Access Control Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse ≤ 0.8.5 CVE-2024-9629 Wordfence
5.4 Medium Paytium: Mollie payment forms & donations Plugin paytium Broken Access Control Missing Authorization in 'pt_cancel_subscription' ≤ 4.3.7 CVE-2023-7287 Wordfence
6.1 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Cross-Site Scripting Effortless Memberships, Recurring Payments & Content Restriction <= 2.12.8 - Reflected Cross-Site Scripting No login needed ≤ 2.12.8 CVE-2024-9222 Wordfence
6.1 Medium Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, and More Plugin woocommerce-exporter Cross-Site Scripting Export Products, Export Orders, Export Subscriptions, and More <= 2.7.2.1 - Reflected Cross-Site Scripting No login needed ≤ 2.7.2.1 CVE-2024-8793 Wordfence
4.4 Medium Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) Plugin easy-digital-downloads Cross-Site Scripting Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Currency Settings ≤ 3.3.2 CVE-2024-6691 Wordfence
6.5 Medium WooCommerce AWeber Newsletter Subscription Plugin Broken Access Control Unauthenticated Access Token Change/Reset No login needed ≤ 4.0.2 Fixed in 4.0.3 CVE-2024-33944 Patchstack
4.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Request Forgery No login needed ≤ 2.11.0 Fixed in 2.11.1 CVE-2024-32728 Patchstack
4.4 Medium ActiveCampaign Plugin activecampaign-subscription-forms Server-Side Request Forgery ≤ 8.1.14 Fixed in 8.1.15 CVE-2024-32430 Patchstack
5.3 Medium s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin s2member Information Disclosure Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information Exposure No login needed ≤ 230815 CVE-2024-0899 Wordfence
5.3 Medium Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) Plugin easy-digital-downloads Information Disclosure Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure No login needed ≤ 3.2.9 CVE-2024-2302 Wordfence
4.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Request Forgery No login needed ≤ 2.10.4 Fixed in 2.10.5 CVE-2023-51522 Patchstack
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_return No login needed ≤ 2.11.1 CVE-2024-1389 Wordfence
4.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_page ≤ 2.11.1 CVE-2024-1390 Wordfence
6.1 Medium Email Subscription Popup Plugin Cross-Site Scripting Reflected XSS No login needed < 1.2.20 Fixed in 1.2.20 CVE-2023-6555 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only