WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.
Showing 10,951–11,000 of 29,758 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | Simple Folio | Cross-Site Request Forgery No login needed |
≤ 1.1.0 Fixed in 1.1.1 |
CVE-2025-64256 |
Patchstack | |
| 2.7 Low | Admin and Site Enhancements (ASE) | Broken Access Control |
≤ 8.0.8 Fixed in 8.1.0 |
CVE-2025-64255 |
Patchstack | |
| 2.7 Low | Photo Block | Broken Access Control |
≤ 1.5.1 Fixed in 1.6.0 |
CVE-2025-64254 |
Patchstack | |
| 4.3 Medium | Beaver Builder – WordPress Page Builder | Information Disclosure WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure |
≤ 2.9.4 |
CVE-2025-12558 |
Wordfence | |
| 7.2 High | Social Reviews & Recommendations | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Social Media Reviews No login needed |
≤ 2.5 |
CVE-2025-12705 |
Wordfence | |
| 7.1 High | Custom Admin Menu | Cross-Site Scripting Reflected XSS No login needed |
≤ 1.0.0 |
CVE-2025-13071 |
WPScan | |
| 6.6 Medium | CSV to SortTable | Local File Inclusion Contributor+ LFI |
≤ 4.2 |
CVE-2025-13070 |
WPScan | |
| 5.9 Medium | WPeMatico RSS Feed Fetcher | Cross-Site Scripting Contributor+ Stored XSS |
< 2.8.13 Fixed in 2.8.13 |
CVE-2025-13031 |
WPScan | |
| 7.2 High | Login Security, FireWall, Malware removal by CleanTalk | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Page URL No login needed |
≤ 2.168 |
CVE-2025-13604 |
Wordfence | |
| 8.8 High | Starter Templates | Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass |
≤ 4.4.41 Fixed in 4.4.42 |
CVE-2025-13065 |
Wordfence | |
| 8.8 High | All-in-One Video Gallery | Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload via Import ZIP |
4.5.4 – 4.5.7 Fixed in 4.6.4 |
CVE-2025-12966 |
Wordfence | |
| 7.2 High | Rich Shortcodes for Google Reviews | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Google Review No login needed |
≤ 6.8 Fixed in 6.8.1 |
CVE-2025-12499 |
Wordfence | |
| 9.6 Critical | 10Web Booster | Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache |
≤ 2.32.7 Fixed in 2.32.11 |
CVE-2025-13377 |
Wordfence | |
| 5.3 Medium | Fluent Forms | Broken Access Control Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id No login needed |
≤ 6.1.7 Fixed in 6.1.8 |
CVE-2025-13748 |
Wordfence | |
| 5.3 Medium | Accessiy By CodeConfig Accessibility | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation |
≤ 1.0.0 |
CVE-2025-13358 |
Wordfence | |
| 6.1 Medium | CSV Sumotto | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.0 |
CVE-2025-13894 |
Wordfence | |
| 4.3 Medium | Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters | Broken Access Control Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings |
≤ 1.0.2 |
CVE-2025-13309 |
Wordfence | |
| 6.4 Medium | Yet Another WebClap | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.2 |
CVE-2025-13857 |
Wordfence | |
| 4.3 Medium | Search, Filters & Merchandising for WooCommerce | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation |
≤ 3.0.67 |
CVE-2025-12091 |
Wordfence | |
| 6.4 Medium | Extra Post Images | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0 |
CVE-2025-13856 |
Wordfence | |
| 6.4 Medium | CSS3 Buttons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.1 |
CVE-2025-13907 |
Wordfence | |
| 6.4 Medium | RevInsite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.1.0 |
CVE-2025-13863 |
Wordfence | |
| 6.4 Medium | List Attachments Shortcode | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode |
≤ 0.4.1a |
CVE-2025-12717 |
Wordfence | |
| 4.3 Medium | Listar – Directory Listing & Classifieds | Broken Access Control Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update |
≤ 3.0.0 |
CVE-2025-12577 |
Wordfence | |
| 6.4 Medium | Canadian Nutrition Facts Label | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Nutrition Label Custom Post Type |
≤ 3.0 |
CVE-2025-12715 |
Wordfence | |
| 6.4 Medium | Cute News Ticker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute |
≤ 1.0 |
CVE-2025-13656 |
Wordfence | |
| 6.4 Medium | TR Timthumb | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0.4 |
CVE-2025-13899 |
Wordfence | |
| 5.3 Medium | Helloprint | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Order Status Modification No login needed |
≤ 2.1.2 |
CVE-2025-13666 |
Wordfence | |
| 5.4 Medium | Application Passwords | Cross-Site Scripting Reflected Cross-Site Scripting via reject_url |
≤ 0.1.3 |
CVE-2025-13308 |
Wordfence | |
| 4.3 Medium | WP Landing Page | Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Meta Update No login needed |
≤ 0.9.3 |
CVE-2025-13629 |
Wordfence | |
| 5.3 Medium | g-FFL Cockpit | Broken Access Control Improper Authorization to Unauthenticated Product Deletion No login needed |
≤ 1.7.1 |
CVE-2025-12720 |
Wordfence | |
| 9.8 Critical | Flex QR Code Generator | Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed |
≤ 1.2.7 |
CVE-2025-12673 |
Wordfence | |
| 4.3 Medium | Listar – Directory Listing & Classifieds | Broken Access Control Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion |
≤ 3.0.0 |
CVE-2025-12574 |
Wordfence | |
| 6.4 Medium | Social Feed Gallery Portfolio | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
≤ 1.3 |
CVE-2025-13896 |
Wordfence | |
| 5.3 Medium | g-FFL Cockpit | Broken Access Control Missing Authorization to Unauthenticated Information Exposure No login needed |
≤ 1.7.1 |
CVE-2025-12721 |
Wordfence | |
| 6.4 Medium | Ultra Skype Button | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute |
≤ 1.0 |
CVE-2025-13898 |
Wordfence | |
| 6.1 Medium | Live Sales Notification for Woocommerce – Woomotiv | Cross-Site Scripting Woomotiv <= 3.6.3 - Reflected Cross-Site Scripting No login needed |
≤ 3.6.3 |
CVE-2025-13137 |
Wordfence | |
| 6.1 Medium | myLCO | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 0.8.1 |
CVE-2025-13626 |
Wordfence | |
| 6.5 Medium | Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI | SQL Injection AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause |
≤ 3.40.1 Fixed in 3.41.0 |
CVE-2025-13922 |
Wordfence | |
| 5.4 Medium | weDocs | Broken Access Control Missing Authorization to Settings Update |
≤ 2.1.14 Fixed in 2.1.15 |
CVE-2025-12505 |
Wordfence | |
| 7.2 High | Widgets for Google Reviews | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Google Reviews No login needed |
≤ 13.2.4 Fixed in 13.2.9 |
CVE-2025-12510 |
Wordfence | |
| 6.1 Medium | Link Whisper Free | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 0.8.8 Fixed in 0.8.9 |
CVE-2025-11263 |
Wordfence | |
| 5.3 Medium | Wp Social Login and Register Social Counter | Broken Access Control Missing Authorization in Cache REST Endpoints to Social Counter Tampering No login needed |
≤ 3.1.3 Fixed in 3.1.4 |
CVE-2025-13620 |
Wordfence | |
| 4.4 Medium | Trail Manager | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 1.0.0 |
CVE-2025-13682 |
Wordfence | |
| 6.4 Medium | Thai Lottery Widget | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 2.5 |
CVE-2025-13678 |
Wordfence | |
| 8.1 High | Cool Tag Cloud | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.29 |
CVE-2025-13614 |
Wordfence | |
| 6.4 Medium | CryptX | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.0.5 Fixed in 4.0.6 |
CVE-2025-13739 |
Wordfence | |
| 8.8 High | User Generator and Importer | Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation No login needed |
≤ 1.2.2 |
CVE-2025-12879 |
Wordfence | |
| 5.3 Medium | Projectopia – WordPress Project Management | Broken Access Control WordPress Project Management <= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed |
≤ 5.1.19 Fixed in 5.1.20 |
CVE-2025-12876 |
Wordfence | |
| 8.1 High | My auctions allegro | Local File Inclusion Unauthenticated Local File Inclusion via controller No login needed |
≤ 3.6.32 Fixed in 3.6.33 |
CVE-2025-12851 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.