WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.
Showing 11,001–11,050 of 29,758 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors | Cross-Site Request Forgery WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion No login needed |
≤ 2.6.4 Fixed in 2.6.4.1 |
CVE-2025-12130 |
Wordfence | |
| 4.3 Medium | ARK Related Posts | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 2.19 |
CVE-2025-13684 |
Wordfence | |
| 7.5 High | My auctions allegro | SQL Injection Unauthenticated SQL Injection via auction_id No login needed |
≤ 3.6.32 Fixed in 3.6.33 |
CVE-2025-12850 |
Wordfence | |
| 6.1 Medium | Nouri.sh Newsletter | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 1.0.1.3 |
CVE-2025-13515 |
Wordfence | |
| 9.8 Critical | Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification | Authentication Bypass User Verification <= 2.0.44 - Authentication Bypass to Account Takeover No login needed |
≤ 2.0.44 |
CVE-2025-12374 |
Wordfence | |
| 5.3 Medium | Payaza | Broken Access Control Missing Authorization to Unauthenticated Order Status Update No login needed |
≤ 0.3.8 |
CVE-2025-12355 |
Wordfence | |
| 5.3 Medium | Voidek Employee Portal | Broken Access Control Missing Authorization No login needed |
≤ 1.0.7 Fixed in 1.0.8 |
CVE-2025-12093 |
Wordfence | |
| 4.3 Medium | Torod – The smart shipping and delivery portal for e-shops and retailers | Cross-Site Request Forgery The smart shipping and delivery portal for e-shops and retailers <= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification No login needed |
≤ 1.9 |
CVE-2025-12373 |
Wordfence | |
| 4.3 Medium | Live CSS Preview | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Update |
≤ 2.1.4 Fixed in 2.1.5 |
CVE-2025-12354 |
Wordfence | |
| 4.4 Medium | Weekly Planner | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 1.0 |
CVE-2025-12186 |
Wordfence | |
| 6.4 Medium | Easy Jump Links Menus | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0.0 |
CVE-2025-13860 |
Wordfence | |
| 5.3 Medium | Feedback Modal for Website | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter No login needed |
≤ 1.0.1 |
CVE-2025-13528 |
Wordfence | |
| 8.8 High | Auto Thumbnailer | Arbitrary File Upload Authenticated (Contributor+) Arbitrary File Upload |
≤ 1.0 |
CVE-2025-12154 |
Wordfence | |
| 5.4 Medium | PDF Catalog for WooCommerce | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting |
≤ 1.1.18 |
CVE-2025-12191 |
Wordfence | |
| 4.3 Medium | Image Optimizer by wps.sk | Cross-Site Request Forgery Cross-Site Request Forgery to Bulk Image Optimization No login needed |
≤ 1.2.0 |
CVE-2025-12190 |
Wordfence | |
| 4.3 Medium | Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents | Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary File Upload No login needed |
≤ 7.11.1374 |
CVE-2025-12189 |
Wordfence | |
| 4.3 Medium | EPROLO Dropshipping | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification |
≤ 2.3.1 |
CVE-2025-12133 |
Wordfence | |
| 4.3 Medium | Hide Categories Or Products On Shop Page | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 1.0.7 |
CVE-2025-12128 |
Wordfence | |
| 6.1 Medium | Twitscription | Cross-Site Scripting Reflected Cross-Site Scripting via admin.php PATH_INFO No login needed |
≤ 0.1.1 |
CVE-2025-13623 |
Wordfence | |
| 4.3 Medium | Takeads | Broken Access Control Missing Authorization to Plugin Settings Deletion |
≤ 1.0.13 |
CVE-2025-12370 |
Wordfence | |
| 8.8 High | Featured Image via URL | Arbitrary File Upload Authenticated (Contributor+) Arbitrary FIle Upload |
≤ 0.1 |
CVE-2025-12153 |
Wordfence | |
| 6.1 Medium | Jabbernotification | Cross-Site Scripting Reflected Cross-Site Scripting via admin.php PATH_INFO No login needed |
≤ 0.99-RC2 |
CVE-2025-13622 |
Wordfence | |
| 4.3 Medium | Time Sheets | Cross-Site Request Forgery No login needed |
≤ 2.1.3 |
CVE-2025-10055 |
Wordfence | |
| 6.1 Medium | WP-SOS-Donate Donation Sidebar | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 0.9.2 |
CVE-2025-13625 |
Wordfence | |
| 8.8 High | ContentStudio | Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload |
≤ 1.3.7 |
CVE-2025-12181 |
Wordfence | |
| 4.3 Medium | Quantic Social Image Hover | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 1.0.8 |
CVE-2025-13360 |
Wordfence | |
| 6.4 Medium | Sermon Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.30.0 |
CVE-2025-12368 |
Wordfence | |
| 6.1 Medium | dream gallery | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action No login needed |
≤ 1.0 |
CVE-2025-13621 |
Wordfence | |
| 4.3 Medium | Webcake – Landing Page Builder | Broken Access Control Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update |
≤ 1.1 Fixed in 1.2 |
CVE-2025-12165 |
Wordfence | |
| 6.1 Medium | CoSign Single Signon | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 0.3.1 |
CVE-2025-13512 |
Wordfence | |
| 6.4 Medium | Omnipress | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting |
≤ 1.6.5 Fixed in 1.6.6 |
CVE-2025-12163 |
Wordfence | |
| 4.3 Medium | ContentStudio | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 1.3.7 |
CVE-2025-13144 |
Wordfence | |
| 4.4 Medium | FitVids | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 4.0.1 |
CVE-2025-12124 |
Wordfence | |
| 9.8 Critical | CRM Memberships | Broken Access Control Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint No login needed |
≤ 2.6 |
CVE-2025-13313 |
Wordfence | |
| 5.3 Medium | CRM Memberships | Broken Access Control Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action No login needed |
≤ 2.5 |
CVE-2025-13312 |
Wordfence | |
| 5.3 Medium | SurveyFunnel – Survey | Information Disclosure Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure No login needed |
≤ 1.1.5 |
CVE-2025-13006 |
Wordfence | |
| 5.3 Medium | SSP Debug | Information Disclosure Unauthenticated Sensitive Information Exposure No login needed |
≤ 1.0.0 |
CVE-2025-13494 |
Wordfence | |
| 4.3 Medium | Norby AI | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 1.0.3 |
CVE-2025-13362 |
Wordfence | |
| 6.4 Medium | SurveyFunnel – Survey | Cross-Site Scripting Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.1.5 |
CVE-2025-12417 |
Wordfence | |
| 8.8 High | Demo Importer Plus | Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass |
≤ 2.0.6 Fixed in 2.0.7 |
CVE-2025-13066 |
Wordfence | |
| 6.4 Medium | Booking Calendar | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode |
≤ 10.14.6 Fixed in 10.14.7 |
CVE-2025-12804 |
Wordfence | |
| 4.3 Medium | Backup, Restore and Migrate your sites with XCloner | Cross-Site Request Forgery Cross-Site Request Forgery in Xcloner_Remote_Storage:save() No login needed |
≤ 4.8.2 Fixed in 4.8.3 |
CVE-2025-11759 |
Wordfence | |
| 8.8 High | PostGallery | Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload |
≤ 1.12.5 |
CVE-2025-13543 |
Wordfence | |
| 4.8 Medium | Custom Post Type UI | Broken Access Control Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modification No login needed |
≤ 1.18.0 |
CVE-2025-12826 |
Wordfence | |
| 4.3 Medium | Beaver Builder – WordPress Page Builder | Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering |
≤ 2.9.4 Fixed in 2.9.4.1 |
CVE-2025-12782 |
Wordfence | |
| 6.1 Medium | Clik stats | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 0.8 |
CVE-2025-13513 |
Wordfence | |
| 7.2 High | Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto | Cross-Site Scripting Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.3.65 |
CVE-2025-11727 |
Wordfence | |
| 5.3 Medium | WebP Express | Information Disclosure Unauthenticated Information Exposure No login needed |
≤ 0.25.9 Fixed in 0.25.10 |
CVE-2025-11379 |
Wordfence | |
| 4.3 Medium | Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution | Broken Access Control The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management |
≤ 1.9.11 Fixed in 1.10.0 |
CVE-2025-13756 |
Wordfence | |
| 6.5 Medium | Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI | SQL Injection AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection |
≤ 3.40.1 |
CVE-2025-13359 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.