WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 10,551–10,600 of 17,889 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 212 of 358
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Easy Elementor Addons Plugin easy-elementor-addons Cross-Site Scripting ≤ 2.1.5 Fixed in 2.1.6 CVE-2025-26761 Patchstack
6.5 Medium Botnet Attack Blocker Plugin botnet-attack-blocker Cross-Site Scripting ≤ 2.0.0 CVE-2025-23975 Patchstack
6.5 Medium Forex Calculators Plugin fx-calculators Cross-Site Scripting ≤ 1.3.6 Fixed in 1.3.7 CVE-2025-22689 Patchstack
6.5 Medium AWS S3 for WordPress Plugin – Upcasted Plugin upcasted-s3-offload Cross-Site Scripting ≤ 3.0.3 Fixed in 3.0.4 CVE-2025-22676 Patchstack
5.3 Medium LTL Freight Quotes – Worldwide Express Edition Plugin ltl-freight-quotes-worldwide-express-edition Broken Access Control Worldwide Express Edition plugin <= 5.0.20 - Arbitrary Content Deletion No login needed ≤ 5.0.20 Fixed in 5.0.21 CVE-2025-22291 Patchstack
6.5 Medium LTL Freight Quotes – Unishippers Edition Plugin ltl-freight-quotes-unishippers-edition Broken Access Control Unishippers Edition plugin <= 2.5.8 - Broken Access Control No login needed ≤ 2.5.8 Fixed in 2.5.9 CVE-2025-22289 Patchstack
5.4 Medium Responsive Plus – Starter Templates, Advanced Features and Customizer Settings for Responsive Plugin responsive-add-ons Server-Side Request Forgery Starter Templates, Advanced Features and Customizer Settings for Responsive Theme <= 3.1.4 - Authenticated (Contributor+) Blind Server-Side Request Forgery via remote_request ≤ 3.1.4 CVE-2024-13834 Wordfence
6.5 Medium Bit Assist Plugin bit-assist Path Traversal Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter ≤ 1.5.2 CVE-2025-0822 Wordfence
6.5 Medium WP Project Manager Plugin wedevs-project-manager SQL Injection Authenticated (Subscriber+) SQL Injection via orderby Parameter ≤ 2.6.17 CVE-2024-13500 Wordfence
4.3 Medium Team – Team Members Showcase Plugin tlp-team Broken Access Control Team Members Showcase Plugin <= 4.4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 4.4.9 CVE-2024-13439 Wordfence
4.3 Medium DirectoryPress Frontend Plugin directorypress-frontend Cross-Site Request Forgery Cross-Site Request Forgery to Listing Status Update No login needed ≤ 2.7.9 CVE-2024-10581 Wordfence
6.5 Medium WP Project Manager Plugin wedevs-project-manager Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update ≤ 2.6.17 CVE-2024-13752 Wordfence
6.4 Medium ElementsKit Elementor addons Plugin elementskit-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Accordion Widget ≤ 3.4.0 CVE-2025-1005 Wordfence
6.5 Medium Customer Email Verification for WooCommerce Plugin emails-verification-for-woocommerce Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure ≤ 2.9.4 CVE-2024-13525 Wordfence
4.3 Medium Media Library Folders Plugin media-library-plus Broken Access Control Missing Authorization to Plugin Settings Change ≤ 8.3.0 CVE-2025-0935 Wordfence
6.4 Medium Front End Users Plugin front-end-only-users Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcode ≤ 3.2.30 CVE-2024-13563 Wordfence
4.3 Medium WP Google Map Plugin Cross-Site Scripting Admin+ Stored XSS < 1.9.4 Fixed in 1.9.4 CVE-2024-13306 WPScan
4.3 Medium WP Google Map Plugin Cross-Site Scripting Admin+ Stored XSS < 1.9.4 Fixed in 1.9.4 CVE-2024-13208 WPScan
6.3 Medium Photography Plugin photography Broken Access Control ≤ 7.7.2 CVE-2025-22702 Patchstack
6.3 Medium Accessibility Suite Plugin online-accessibility Broken Access Control Multiple Broken Access Control ≤ 4.18 Fixed in 4.19 CVE-2025-22698 Patchstack
5.8 Medium IdeaPush Plugin ideapush Broken Access Control No login needed ≤ 8.71 Fixed in 8.73 CVE-2025-24607 Patchstack
6.5 Medium WP Mailster Plugin wp-mailster Information Disclosure Sensitive Data Exposure ≤ 1.8.16.0 Fixed in 1.8.17.0 CVE-2025-24567 Patchstack
6.5 Medium Push Notification for Post and BuddyPress Plugin push-notification-for-post-and-buddypress Broken Access Control Settings Change No login needed ≤ 2.11 Fixed in 2.12 CVE-2025-23771 Patchstack
6.5 Medium OPSI Israel Domestic Shipments Plugin woo-ups-pickup Broken Access Control No login needed ≤ 2.8.2 CVE-2025-23766 Patchstack
6.5 Medium WPLingo Plugin wplingo Broken Access Control Arbitrary Content Deletion ≤ 1.1.2 CVE-2025-23534 Patchstack
6.5 Medium Bit Assist Plugin bit-assist SQL Injection Authenticated (Subscriber+) SQL Injection via id Parameter ≤ 1.5.2 CVE-2025-0821 Wordfence
4.9 Medium Bit Assist Plugin bit-assist Path Traversal Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function ≤ 1.5.2 CVE-2024-13791 Wordfence
6.4 Medium HurryTimer Plugin hurrytimer Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Campaign Name ≤ 2.11.2 CVE-2024-13735 Wordfence
6.5 Medium Qubely – Advanced Gutenberg Blocks Plugin qubely Cross-Site Scripting Advanced Gutenberg Blocks <= 1.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' and 'UniqueID' ≤ 1.8.12 CVE-2024-9601 Wordfence
4.8 Medium Forminator Plugin Cross-Site Scripting Admin+ Stored XSS < 1.38.3 Fixed in 1.38.3 CVE-2024-7052 WPScan
4.8 Medium Sensly Online Presence Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 0.6 CVE-2024-13493 WPScan
5.4 Medium Return Refund and Exchange For WooCommerce Plugin woo-refund-and-exchange-lite Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference ≤ 4.4.5 CVE-2024-13692 Wordfence
5.9 Medium Return Refund and Exchange For WooCommerce Plugin woo-refund-and-exchange-lite Information Disclosure Unauthenticated Sensitive Information Exposure Through Unprotected Directory No login needed ≤ 4.4.5 CVE-2024-13641 Wordfence
6.5 Medium Embed Google Map Plugin embed-google-map Cross-Site Scripting ≤ 3.2 CVE-2025-26539 Patchstack
6.5 Medium Prezi Embedder Plugin prezi-embedder Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 2.1 CVE-2025-26538 Patchstack
6.5 Medium Google Drive WP Media Plugin google-drive-wp-media Cross-Site Scripting ≤ 2.4.4 CVE-2025-26574 Patchstack
6.5 Medium Font Awesome WP Plugin font-awesome-wp Cross-Site Scripting ≤ 1.0 CVE-2025-26567 Patchstack
5.9 Medium Elfsight Yottie Lite Plugin yottie-lite Cross-Site Scripting ≤ 1.3.3 CVE-2025-26561 Patchstack
6.5 Medium Aparat Responsive Plugin aparat-responsive Cross-Site Scripting ≤ 1.3 CVE-2025-26558 Patchstack
6.1 Medium Listivo - Classified Ads Theme Cross-Site Scripting Classified Ads WordPress Theme <= 2.3.67 - Reflected Cross-Site Scripting No login needed ≤ 2.3.67 CVE-2024-13867 Wordfence
4.3 Medium Read More & Accordion Plugin expand-maker Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary 'Read More' Post Deletion ≤ 3.4.2 CVE-2024-13639 Wordfence
4.3 Medium DethemeKit For Elementor Plugin dethemekit-for-elementor Information Disclosure Authenticated (Contributor+) Protected Post Disclosure ≤ 2.1.8 CVE-2025-0661 Wordfence
4.8 Medium ProfilePress Plugin Cross-Site Scripting Admin+ Stored XSS < 4.15.20 Fixed in 4.15.20 CVE-2024-13120 WPScan
4.8 Medium ProfilePress Plugin Cross-Site Scripting Admin+ Stored XSS < 4.15.20 Fixed in 4.15.20 CVE-2024-13119 WPScan
6.1 Medium Chalet Montagne Com Tools Plugin Cross-Site Scripting Reflected XSS No login needed ≤ 2.7.8 CVE-2024-12586 WPScan
6.4 Medium Puzzles Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.2.6 CVE-2025-0837 Wordfence
4.3 Medium Rank Math SEO Plugin seo-by-rank-math Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion ≤ 1.0.235 CVE-2024-13229 Wordfence
6.4 Medium Rank Math SEO – AI SEO Tools to Dominate SEO Rankings Plugin seo-by-rank-math Cross-Site Scripting AI SEO Tools to Dominate SEO Rankings <= 1.0.235 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rank Math API ≤ 1.0.235 CVE-2024-13227 Wordfence
6.4 Medium DethemeKit For Elementor Plugin dethemekit-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via De Gallery Widget ≤ 2.1.8 CVE-2024-13644 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.6.8 CVE-2024-10322 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only