WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.
Showing 10,551–10,600 of 29,758 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | Easy Property Listings | Broken Access Control |
≤ 3.5.22 Fixed in 3.5.23 |
CVE-2025-64242 |
Patchstack | |
| 4.3 Medium | WP Coupons and Deals | Broken Access Control |
≤ 3.2.4 Fixed in 3.2.5 |
CVE-2025-64241 |
Patchstack | |
| 4.3 Medium | Freshchat | Cross-Site Request Forgery No login needed |
≤ 2.3.4 |
CVE-2025-64240 |
Patchstack | |
| 4.3 Medium | RTL Tester | Cross-Site Request Forgery No login needed |
≤ 1.2 |
CVE-2025-64239 |
Patchstack | |
| 4.3 Medium | WPS Bidouille | Broken Access Control |
≤ 1.33.1 Fixed in 1.33.2 |
CVE-2025-64238 |
Patchstack | |
| 4.3 Medium | Quick Interest Slider | Cross-Site Request Forgery No login needed |
≤ 3.1.5 Fixed in 3.1.6 |
CVE-2025-64237 |
Patchstack | |
| 4.3 Medium | Listify | Cross-Site Request Forgery No login needed |
≤ 3.2.5 |
CVE-2025-59009 |
Patchstack | |
| 4.3 Medium | Salient Core | Broken Access Control |
≤ 3.0.8 Fixed in 3.0.9 |
CVE-2025-59001 |
Patchstack | |
| 4.3 Medium | WP Attractive Donations System - Easy Stripe & Paypal donations | Cross-Site Request Forgery Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) No login needed |
≤ 1.25 |
CVE-2025-58999 |
Patchstack | |
| 4.3 Medium | CM On Demand Search And Replace | Broken Access Control |
≤ 1.5.5 |
CVE-2025-54045 |
Patchstack | |
| 4.3 Medium | SKT Page Builder | Broken Access Control |
≤ 4.9 Fixed in 5.0 |
CVE-2025-54005 |
Patchstack | |
| 2.7 Low | WCFM – Frontend Manager for WooCommerce | Broken Access Control Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control |
≤ 6.7.24 Fixed in 6.7.25 |
CVE-2025-54004 |
Patchstack | |
| 2.7 Low | Traveler Option Tree | Information Disclosure Sensitive Data Exposure |
≤ 2.8 |
CVE-2025-49300 |
Patchstack | |
| 5.3 Medium | JetFormBuilder | Broken Access Control Missing Authorization to Unauthenticated Form Generation No login needed |
≤ 3.5.3 |
CVE-2025-11991 |
Wordfence | |
| 5.9 Medium | Fancy Product Designer | WooCommerce | Information Disclosure Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter No login needed |
≤ 6.4.8 |
CVE-2025-13439 |
Wordfence | |
| 5.3 Medium | dokan pro | Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed |
≤ 4.1.3 |
CVE-2025-12809 |
Wordfence | |
| 4.3 Medium | Auto Featured Image | Broken Access Control Missing Authorization to Authenticated (Contributor+) Post Thumbnail Modification |
≤ 4.2.1 |
CVE-2025-13794 |
Wordfence | |
| 5.3 Medium | LearnPress – WordPress LMS | Broken Access Control WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure No login needed |
≤ 4.3.1 |
CVE-2025-13956 |
Wordfence | |
| 6.4 Medium | LearnPress – WordPress LMS | Cross-Site Scripting WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social |
≤ 4.3.1 |
CVE-2025-14387 |
Wordfence | |
| 9.8 Critical | Fox LMS – WordPress LMS | Privilege Escalation WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder' No login needed |
1.0.4.7 – 1.0.5.1 Fixed in 1.0.5.2 |
CVE-2025-14156 |
Wordfence | |
| 5.3 Medium | OneSignal – Web Push Notifications | Broken Access Control Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update No login needed |
≤ 3.6.1 |
CVE-2025-13950 |
Wordfence | |
| 6.4 Medium | FluentAuth - Auth Security | Cross-Site Scripting Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode |
≤ 2.0.3 Fixed in 2.1.0 |
CVE-2025-13728 |
Wordfence | |
| 7.5 High | Booking Calendar | SQL Injection Unauthenticated SQL Injection via dates_to_check No login needed |
≤ 10.14.8 Fixed in 10.14.9 |
CVE-2025-14383 |
Wordfence | |
| 4.3 Medium | FileBird – WordPress Media Library Folders & File Manager | Broken Access Control WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering |
≤ 6.5.1 |
CVE-2025-12900 |
Wordfence | |
| 4.3 Medium | Image Gallery – Photo Grid & Video Gallery | Broken Access Control Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification |
≤ 2.13.3 Fixed in 2.13.4 |
CVE-2025-14003 |
Wordfence | |
| 6.4 Medium | RegistrationMagic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode |
≤ 6.0.6.7 Fixed in 6.0.6.8 |
CVE-2025-13610 |
Wordfence | |
| 6.4 Medium | User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder | Cross-Site Scripting Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 4.4.6 Fixed in 4.4.7 |
CVE-2025-13367 |
Wordfence | |
| 6.4 Medium | CC Child Pages | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'child_pages' Shortcode |
≤ 2.0.0 Fixed in 2.0.1 |
CVE-2025-13608 |
Wordfence | |
| 7.1 High | URL Shortify | Cross-Site Scripting Reflected XSS No login needed |
< 1.11.4 Fixed in 1.11.4 |
CVE-2025-13355 |
WPScan | |
| 7.1 High | URL Shortify | Cross-Site Scripting Reflected XSS No login needed |
< 1.11.3 Fixed in 1.11.3 |
CVE-2025-12684 |
WPScan | |
| 5.3 Medium | Royal Elementor Addons and Templates | Arbitrary File Upload Unauthenticated Media File Upload No login needed |
< 1.7.1037 Fixed in 1.7.1037 |
CVE-2025-11363 |
WPScan | |
| 6.4 Medium | Lightweight Accordion | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.5.20 |
CVE-2025-13740 |
Wordfence | |
| 5.3 Medium | HelloLeads CRM Form Shortcode | Cross-Site Request Forgery Unauthenticated Settings Reset No login needed |
≤ 1.0 |
CVE-2025-12696 |
WPScan | |
| 6.4 Medium | Addon Elements for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.14.3 Fixed in 1.14.4 |
CVE-2025-12537 |
Wordfence | |
| 7.5 High | wpForo Forum | SQL Injection Unauthenticated SQL Injection No login needed |
≤ 2.4.12 |
CVE-2025-13126 |
Wordfence | |
| 6.4 Medium | Popup Builder – Create highly converting, mobile friendly marketing popups. | Cross-Site Scripting Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.4.1 |
CVE-2025-9856 |
Wordfence | |
| 6.4 Medium | Livemesh SiteOrigin Widgets | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table Widgets |
≤ 3.9.1 |
CVE-2025-8780 |
Wordfence | |
| 6.4 Medium | Enter Addons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets |
≤ 2.2.7 Fixed in 2.2.8 |
CVE-2025-8687 |
Wordfence | |
| 6.4 Medium | MarqueeAddons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widget |
≤ 2.4.3 |
CVE-2025-8199 |
Wordfence | |
| 6.4 Medium | JetWidgets For Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets |
≤ 1.0.20 Fixed in 1.0.21 |
CVE-2025-8195 |
Wordfence | |
| 6.4 Medium | King Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 51.1.39 |
CVE-2025-7960 |
Wordfence | |
| 6.5 Medium | Brizy – Page Builder | Information Disclosure Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function |
≤ 2.7.16 |
CVE-2025-0969 |
Wordfence | |
| 5.9 Medium | Filter & Grids | SQL Injection Unauthenticated SQL Injection No login needed |
≤ 3.2.0 |
CVE-2025-10289 |
Wordfence | |
| 6.4 Medium | All-in-One Addons for Elementor – WidgetKit | Cross-Site Scripting WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets |
≤ 2.5.6 Fixed in 2.5.7 |
CVE-2025-8779 |
Wordfence | |
| 5.3 Medium | TI WooCommerce Wishlist | Content Injection Unauthenticated HTML Injection No login needed |
≤ 2.10.0 Fixed in 2.11.0 |
CVE-2025-9207 |
Wordfence | |
| 9.8 Critical | URL Shortener | SQL Injection Unauthenticated SQL Injection No login needed |
≤ 3.0.7 |
CVE-2025-10738 |
Wordfence | |
| 5.8 Medium | WPS Visitor Counter | Cross-Site Scripting Reflected XSS via $_SERVER['REQUEST_URI'] No login needed |
≤ 1.4.8 |
CVE-2025-9116 |
WPScan | |
| 5.3 Medium | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program | Broken Access Control Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval No login needed |
≤ 2.9.7 Fixed in 2.9.7.1 |
CVE-2025-12362 |
Wordfence | |
| 5.4 Medium | Popup Builder | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset |
≤ 1.1.37 |
CVE-2025-14446 |
Wordfence | |
| 9.8 Critical | Export WP Page to Static HTML & PDF | Information Disclosure Unauthenticated Cookie Exposure via Log File No login needed |
≤ 4.3.4 |
CVE-2025-11693 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.