WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 10,451–10,500 of 17,051 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 210 of 342
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
8.1 High	WP Vehicle Manager Plugin `js-vehicle-manager`	Local File Inclusion No login needed	`≤ 3.1`	Mar 3, 2025	`CVE-2025-25109`	Patchstack
7.1 High	SW Plus Plugin `shalom-world-media-gallery`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.1`	Mar 3, 2025	`CVE-2025-25108`	Patchstack
7.1 High	Yahoo BOSS Plugin `yahoo-boss`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.7`	Mar 3, 2025	`CVE-2025-25102`	Patchstack
7.1 High	Appointment Buddy Widget Plugin `appointment-buddy-online-appointment-booking-by-accrete`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 1.2`	Mar 3, 2025	`CVE-2025-25099`	Patchstack
7.1 High	All push notification for WP Plugin `all-push-notification`	Cross-Site Scripting No login needed	`≤ 1.5.3`	Mar 3, 2025	`CVE-2025-25092`	Patchstack
7.1 High	Dreamstime Stock Photos Plugin `dreamstime-stock-photos`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 4.1` Fixed in `4.2`	Mar 3, 2025	`CVE-2025-25090`	Patchstack
7.1 High	Image Rotator Plugin `appten-image-rotator`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0`	Mar 3, 2025	`CVE-2025-25089`	Patchstack
7.1 High	seekXL Snapr Plugin `seekxl-snapr`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0.6`	Mar 3, 2025	`CVE-2025-25087`	Patchstack
6.5 Medium	UniTimetable Plugin `unitimetable`	Cross-Site Scripting	`≤ 1.1`	Mar 3, 2025	`CVE-2025-25084`	Patchstack
7.1 High	EP4 More Embeds Plugin `ep4-more-embeds`	Cross-Site Scripting Stored Cross Site Scripting (XSS) No login needed	`≤ 1.0.0`	Mar 3, 2025	`CVE-2025-25083`	Patchstack
7.1 High	Album Reviewer Plugin `albumreviewer`	Cross-Site Scripting No login needed	`≤ 2.0.2`	Mar 3, 2025	`CVE-2025-25070`	Patchstack
7.1 High	CM Map Locations Plugin `cm-map-locations`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0.8` Fixed in `2.0.9`	Mar 3, 2025	`CVE-2025-24758`	Patchstack
7.1 High	CM Pop-Up banners Plugin `cm-pop-up-banners`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.7.6` Fixed in `1.7.7`	Mar 3, 2025	`CVE-2025-24694`	Patchstack
7.1 High	WP Easy Post Mailer Plugin `wp-mailer`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.64`	Mar 3, 2025	`CVE-2025-23956`	Patchstack
7.5 High	Popliup Plugin `popliup`	Local File Inclusion	`≤ 1.1.1`	Mar 3, 2025	`CVE-2025-23945`	Patchstack
7.1 High	Rebrand Fluent Forms Plugin `rebrand-fluent-forms`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-23904`	Patchstack
7.1 High	Local Shipping Labels for WooCommerce Plugin `local-shipping-labels-for-woocommerce`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.0`	Mar 3, 2025	`CVE-2025-23903`	Patchstack
7.1 High	Stray Random Quotes Plugin `stray-quotes`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.9.9`	Mar 3, 2025	`CVE-2025-23883`	Patchstack
7.1 High	LJ Custom Menu Links Plugin `lj-custom-menu-links`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.5`	Mar 3, 2025	`CVE-2025-23881`	Patchstack
7.1 High	Easy Automatic Newsletter Lite Plugin `easy-automatic-newsletter`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.2.0`	Mar 3, 2025	`CVE-2025-23879`	Patchstack
7.1 High	First Comment Redirect Plugin `first-comment-redirect`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.3`	Mar 3, 2025	`CVE-2025-23852`	Patchstack
7.1 High	Mojo Under Construction Plugin `mojo-under-construction`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1.2`	Mar 3, 2025	`CVE-2025-23850`	Patchstack
7.1 High	Site Launcher Plugin `site-launcher`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.9.4`	Mar 3, 2025	`CVE-2025-23847`	Patchstack
7.1 High	WP-HR Manager: The Human Resources Plugin `wp-hr-manager`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.0` Fixed in `3.2.0`	Mar 3, 2025	`CVE-2025-23843`	Patchstack
6.5 Medium	Woo Update Variations In Cart Plugin `woo-update-variations-in-cart`	Cross-Site Scripting	`≤ 0.0.9`	Mar 3, 2025	`CVE-2025-23829`	Patchstack
7.1 High	CRUDLab Like Box Plugin `crudlab-facebook-like-box`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0.9`	Mar 3, 2025	`CVE-2025-23814`	Patchstack
7.1 High	Guten Free Options Plugin `guten-free-options`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.9.7`	Mar 3, 2025	`CVE-2025-23813`	Patchstack
6.5 Medium	WAH Forms Plugin `wah-forms`	Information Disclosure Sensitive Data Exposure	`≤ 1.0`	Mar 3, 2025	`CVE-2025-23763`	Patchstack
7.1 High	DsgnWrks Twitter Importer Plugin `dsgnwrks-twitter-importer`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1.4`	Mar 3, 2025	`CVE-2025-23762`	Patchstack
7.1 High	DN Sitemap Control Plugin `dn-sitemap-control`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.6`	Mar 3, 2025	`CVE-2025-23753`	Patchstack
7.1 High	Notifications Center Plugin `notifications-center`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5.2`	Mar 3, 2025	`CVE-2025-23741`	Patchstack
7.1 High	Easy School Registration Plugin `easy-school-registration`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.9.8`	Mar 3, 2025	`CVE-2025-23740`	Patchstack
7.1 High	WP Ultimate Reviews FREE Plugin `wp-ultimate-reviews-free`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.2`	Mar 3, 2025	`CVE-2025-23739`	Patchstack
7.1 High	Ps Ads Pro Plugin `ps-ads-pro`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.0`	Mar 3, 2025	`CVE-2025-23738`	Patchstack
7.1 High	Form To JSON Plugin `form-to-json`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-23736`	Patchstack
7.1 High	Tax Report for WooCommerce Plugin `tax-report-for-woocommerce`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.2`	Mar 3, 2025	`CVE-2025-23731`	Patchstack
7.1 High	ComparePress Plugin `comparepress`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0.8`	Mar 3, 2025	`CVE-2025-23726`	Patchstack
7.1 High	Mobigate Plugin `mobigatevn`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.3`	Mar 3, 2025	`CVE-2025-23721`	Patchstack
7.1 High	Mancx AskMe Widget Plugin `mancx-askme-widget`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.3`	Mar 3, 2025	`CVE-2025-23718`	Patchstack
7.1 High	Login Watchdog Plugin `login-watchdog`	Cross-Site Scripting No login needed	`≤ 1.0.4`	Mar 3, 2025	`CVE-2025-23716`	Patchstack
7.1 High	Cobwebo URL Plugin `cobwebo-url`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-23688`	Patchstack
7.1 High	4 author cheer up donate Plugin `4-author-cheer-up-donate`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.3`	Mar 3, 2025	`CVE-2025-23670`	Patchstack
7.1 High	ChatGPT Open AI Images & Content for WooCommerce Plugin `glasses-for-woocommerce`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.2.0`	Mar 3, 2025	`CVE-2025-23668`	Patchstack
7.1 High	Contexto Plugin `contexto`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0`	Mar 3, 2025	`CVE-2025-23663`	Patchstack
7.1 High	新淘客WordPress插件 Plugin `wp-xintaoke`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1.2`	Mar 3, 2025	`CVE-2025-23637`	Patchstack
7.1 High	ePermissions Plugin `epermissions`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2`	Mar 3, 2025	`CVE-2025-23635`	Patchstack
7.1 High	Catch Duplicate Switcher Plugin `catch-duplicate-switcher`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.0`	Mar 3, 2025	`CVE-2025-23619`	Patchstack
7.1 High	Canalplan Plugin `canalplan-ac`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.31`	Mar 3, 2025	`CVE-2025-23616`	Patchstack
6.5 Medium	Interactive Page Hierarchy Plugin `interactive-page-hierarchy`	Broken Access Control	`≤ 1.0.1`	Mar 3, 2025	`CVE-2025-23615`	Patchstack
6.5 Medium	WP Journal Plugin `wpjournal`	Broken Access Control	`≤ 1.1`	Mar 3, 2025	`CVE-2025-23613`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.