WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 10,401–10,450 of 17,051 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 209 of 342
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.1 High	Variable Inspector Plugin `variable-inspector`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.6.2` Fixed in `2.6.3`	Mar 3, 2025	`CVE-2025-26914`	Patchstack
7.2 High	WordPress Assistant Plugin `assistant`	PHP Object Injection	`≤ 1.5.1` Fixed in `1.5.1.1`	Mar 3, 2025	`CVE-2025-26885`	Patchstack
7.1 High	s2Member Plugin `s2member`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 241216` Fixed in `250214`	Mar 3, 2025	`CVE-2025-26879`	Patchstack
7.1 High	Flashfader Plugin `flashfader`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1.1`	Mar 3, 2025	`CVE-2025-27279`	Patchstack
7.1 High	AcuGIS Leaflet Maps Plugin `mapfig-premium-leaflet-map-maker`	Cross-Site Scripting Multiple Cross Site Scripting (XSS) vulnerabilities No login needed	`≤ 5.1.1.0`	Mar 3, 2025	`CVE-2025-27278`	Patchstack
7.1 High	WOO Codice Fiscale Plugin `woo-codice-fiscale`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.6.3`	Mar 3, 2025	`CVE-2025-27275`	Patchstack
4.9 Medium	GPX Viewer Plugin `gpx-viewer`	Path Traversal	`≤ 2.2.11` Fixed in `2.2.12`	Mar 3, 2025	`CVE-2025-27274`	Patchstack
5.8 Medium	Affiliate Links Manager Plugin `affiliate-links-manager`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-27273`	Patchstack
7.1 High	DB Tables Import/Export Plugin `db-tables-importexport`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.1`	Mar 3, 2025	`CVE-2025-27271`	Patchstack
9.8 Critical	Residential Address Detection Plugin `residential-address-detection`	Privilege Escalation Arbitrary Option Update to Privilege Escalation No login needed	`≤ 2.5.4` Fixed in `2.5.5`	Mar 3, 2025	`CVE-2025-27270`	Patchstack
7.1 High	.htaccess Login block Plugin `htaccess-login-block`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.9a`	Mar 3, 2025	`CVE-2025-27269`	Patchstack
9.3 Critical	Small Package Quotes – Worldwide Express Edition Plugin `small-package-quotes-wwe-edition`	SQL Injection Worldwide Express Edition Plugin <= 5.2.18 - SQL Injection No login needed	`≤ 5.2.18` Fixed in `5.2.19`	Mar 3, 2025	`CVE-2025-27268`	Patchstack
7.5 High	Doctor Appointment Booking Plugin `doctor-appointment-booking`	Local File Inclusion	`≤ 1.0.0`	Mar 3, 2025	`CVE-2025-27264`	Patchstack
8.5 High	Doctor Appointment Booking Plugin `doctor-appointment-booking`	SQL Injection	`≤ 1.0.0`	Mar 3, 2025	`CVE-2025-27263`	Patchstack
7.1 High	IE CSS3 Support Plugin `ie-css3-support`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0.1`	Mar 3, 2025	`CVE-2025-26589`	Patchstack
7.1 High	TTT Crop Plugin `ttt-crop`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-26588`	Patchstack
7.1 High	sidebarTabs Plugin `sidebartabs`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1`	Mar 3, 2025	`CVE-2025-26587`	Patchstack
7.1 High	Events Planner Plugin `events-planner`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.3.10`	Mar 3, 2025	`CVE-2025-26586`	Patchstack
7.1 High	DL Leadback Plugin `dl-leadback`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2.1`	Mar 3, 2025	`CVE-2025-26585`	Patchstack
7.1 High	Mobile Plugin `rocket-wp-mobile`	Cross-Site Scripting No login needed	`≤ 1.3.3`	Mar 3, 2025	`CVE-2025-26563`	Patchstack
7.1 High	ViperBar Plugin `viperbar`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0`	Mar 3, 2025	`CVE-2025-26557`	Patchstack
7.7 High	Helloprint Plugin `helloprint`	Arbitrary File Deletion	`≤ 2.0.7` Fixed in `2.1.0`	Mar 3, 2025	`CVE-2025-26540`	Patchstack
9.3 Critical	Bitcoin / AltCoin Payment Gateway for WooCommerce Plugin `woo-altcoin-payment-gateway`	SQL Injection No login needed	`≤ 1.7.6`	Mar 3, 2025	`CVE-2025-26535`	Patchstack
8.6 High	Helloprint Plugin `helloprint`	Arbitrary File Deletion No login needed	`≤ 2.0.7` Fixed in `2.1.0`	Mar 3, 2025	`CVE-2025-26534`	Patchstack
7.1 High	Migrate Posts Plugin `migrate-post`	Cross-Site Scripting Post Based Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-25170`	Patchstack
7.1 High	Authors Autocomplete Meta Box Plugin `authors-autocomplete-meta-box`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2`	Mar 3, 2025	`CVE-2025-25169`	Patchstack
7.1 High	Staff Directory Plugin: Company Directory Plugin `staff-directory-pro`	Cross-Site Scripting No login needed	`≤ 4.3`	Mar 3, 2025	`CVE-2025-25165`	Patchstack
7.1 High	Meta Accelerator Plugin `meta-accelerator`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.4`	Mar 3, 2025	`CVE-2025-25164`	Patchstack
7.1 High	Sports Rankings and Lists Plugin `sports-rankings-lists`	Path Traversal Arbitrary File Download No login needed	`≤ 1.0.2`	Mar 3, 2025	`CVE-2025-25162`	Patchstack
7.1 High	WP Find Your Nearest Plugin `wp-find-your-nearest`	Cross-Site Request Forgery CSRF to Settings Change No login needed	`≤ 0.3.1`	Mar 3, 2025	`CVE-2025-25161`	Patchstack
7.1 High	Uncomplicated SEO Plugin `uncomplicated-seo`	Cross-Site Scripting No login needed	`≤ 1.2`	Mar 3, 2025	`CVE-2025-25158`	Patchstack
7.1 High	WP Church Center Plugin `wp-church-center`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.3.3`	Mar 3, 2025	`CVE-2025-25157`	Patchstack
9.3 Critical	uListing Plugin `ulisting`	SQL Injection No login needed	`≤ 2.1.6` Fixed in `2.1.7`	Mar 3, 2025	`CVE-2025-25150`	Patchstack
7.1 High	WP Less Compiler Plugin `wp-less-compiler`	Cross-Site Scripting No login needed	`≤ 1.3.0`	Mar 3, 2025	`CVE-2025-25142`	Patchstack
6.5 Medium	Social Links Plugin `social-links`	Cross-Site Scripting Stored Cross-Site Scripting	`≤ 1.0.11`	Mar 3, 2025	`CVE-2025-25137`	Patchstack
7.1 High	WP Frontend Submit Plugin `wp-frontend-submit`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 1.1.0`	Mar 3, 2025	`CVE-2025-25133`	Patchstack
7.1 High	Visitor Details Plugin `visitors-details`	Cross-Site Scripting No login needed	`≤ 1.0.1`	Mar 3, 2025	`CVE-2025-25132`	Patchstack
6.5 Medium	RJ Quickcharts Plugin `rj-quickcharts`	Cross-Site Scripting	`≤ 0.6.1`	Mar 3, 2025	`CVE-2025-25131`	Patchstack
7.5 High	Delete Comments By Status Plugin `delete-comments-by-status`	Local File Inclusion No login needed	`≤ 2.1.1`	Mar 3, 2025	`CVE-2025-25130`	Patchstack
7.1 High	Callback Request Plugin `callback-request`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.4`	Mar 3, 2025	`CVE-2025-25129`	Patchstack
7.1 High	Contact Us By Lord Linus Plugin `contact-us-by-lord-linus`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.6`	Mar 3, 2025	`CVE-2025-25127`	Patchstack
7.1 High	Status Updater Plugin `fb-status-updater`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.9.2`	Mar 3, 2025	`CVE-2025-25124`	Patchstack
8.1 High	WizShop Plugin `wizshop`	Local File Inclusion No login needed	`≤ 3.0.2`	Mar 3, 2025	`CVE-2025-25122`	Patchstack
5.4 Medium	Theme Options Z Plugin `theme-options-z`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Mar 3, 2025	`CVE-2025-25121`	Patchstack
7.1 High	Woocommerce osCommerce Sync Plugin `woo-oscommerce-sync`	Cross-Site Scripting No login needed	`≤ 2.0.20`	Mar 3, 2025	`CVE-2025-25119`	Patchstack
7.1 High	Top Bar – PopUps – by WPOptin Plugin `wpoptin`	Cross-Site Scripting No login needed	`≤ 2.0.8`	Mar 3, 2025	`CVE-2025-25118`	Patchstack
6.5 Medium	Like dislike plus counter Plugin `like-dislike-plus-counter`	Cross-Site Scripting	`≤ 1.0`	Mar 3, 2025	`CVE-2025-25115`	Patchstack
7.1 High	User Role Plugin `user-roles`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-25114`	Patchstack
7.1 High	Implied Cookie Consent Plugin `implied-cookie-consent`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.3`	Mar 3, 2025	`CVE-2025-25113`	Patchstack
7.6 High	Social Links Plugin `social-links`	SQL Injection	`≤ 1.2`	Mar 3, 2025	`CVE-2025-25112`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.