WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.
Showing 11,451–11,500 of 29,758 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.4 Medium | Fleet Manager | Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting |
≤ 2.5.1 Fixed in 2.6.0 |
CVE-2025-12538 |
Wordfence | |
| 5.3 Medium | Find Unused Images | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed |
≤ 1.0.7 |
CVE-2025-11996 |
Wordfence | |
| 5.3 Medium | Crypto Tool | Arbitrary File Deletion Missing Authentication to Unauthenticated Limited File Deletion No login needed |
≤ 2.22 |
CVE-2025-11988 |
Wordfence | |
| 6.4 Medium | My Geo Posts Free | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.2 |
CVE-2025-11863 |
Wordfence | |
| 6.4 Medium | Ungapped Widgets | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1 |
CVE-2025-12652 |
Wordfence | |
| 6.4 Medium | Five9 Live Chat | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.1.2 |
CVE-2025-11829 |
Wordfence | |
| 5.4 Medium | Slippy Slider – Responsive Touch Navigation Slider | Cross-Site Scripting Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.0 |
CVE-2025-11874 |
Wordfence | |
| 6.4 Medium | WP BBCode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 1.8.1 |
CVE-2025-11873 |
Wordfence | |
| 8.8 High | Mementor Core | Privilege Escalation Authenticated (Subscriber+) Privilege Escalation |
≤ 2.2.5 |
CVE-2025-11168 |
Wordfence | |
| 5.3 Medium | Shelf Planner | Information Disclosure Unauthenticated Information Exposure via Log Files No login needed |
≤ 2.8.1 |
CVE-2025-11891 |
Wordfence | |
| 6.4 Medium | WP Bootstrap Tabs | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.4 |
CVE-2025-11822 |
Wordfence | |
| 5.3 Medium | Shelf Planner | Broken Access Control Missing Authorization to Unauthenticated Settings Update No login needed |
≤ 2.8.1 |
CVE-2025-11894 |
Wordfence | |
| 7.2 High | Alex Reservations: Smart Restaurant Booking | Arbitrary File Upload Authenticated (Admin+) Arbitrary File Upload |
≤ 2.2.3 |
CVE-2025-12399 |
Wordfence | |
| 7.2 High | Mail Mint | Arbitrary File Upload Authenticated (Admin+) Arbitrary File Upload |
≤ 1.18.10 Fixed in 1.18.11 |
CVE-2025-11967 |
Wordfence | |
| 4.3 Medium | Gallery Plugin for WordPress – Envira Photo Gallery | Broken Access Control Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion |
≤ 1.11.0 Fixed in 1.11.1 |
CVE-2025-11448 |
Wordfence | |
| 6.4 Medium | aThemes Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget |
≤ 1.1.5 Fixed in 1.1.6 |
CVE-2025-12837 |
Wordfence | |
| 6.4 Medium | Saphali LiqPay for donate | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0.2 Fixed in 1.0.3 |
CVE-2025-12643 |
Wordfence | |
| 6.5 Medium | CYAN Backup | Arbitrary File Deletion Authenticated (Admin+) Arbitrary File Deletion |
≤ 2.5.4 Fixed in 2.5.5 |
CVE-2025-12092 |
Wordfence | |
| 4.9 Medium | Quick Featured Images | SQL Injection Authenticated (Editor+) SQL Injection via delete_orphaned |
≤ 13.7.3 Fixed in 13.7.4 |
CVE-2025-11980 |
Wordfence | |
| 5.3 Medium | Academy LMS Pro | Information Disclosure Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script' No login needed |
≤ 3.3.8 |
CVE-2025-12098 |
Wordfence | |
| 7.2 High | Academy LMS – WordPress LMS Plugin for Complete eLearning Solution | PHP Object Injection WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses' |
≤ 3.3.8 |
CVE-2025-12099 |
Wordfence | |
| 5.3 Medium | Flexible Refund and Return Order for WooCommerce | Broken Access Control Incorrect Authorization to Authenticated (Contributor+) Refund Status Update |
≤ 1.0.42 Fixed in 1.0.43 |
CVE-2025-12621 |
Wordfence | |
| 4.3 Medium | EventPrime – Events Calendar, Bookings and Tickets | Broken Access Control Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation |
≤ 4.2.0.0 |
CVE-2025-12498 |
Wordfence | |
| 8.8 High | Better Find and Replace | Remote Code Execution Authenticated (Subscriber+) Limited Code Injection |
≤ 1.7.7 |
CVE-2025-9334 |
Wordfence | |
| 4.4 Medium | HTML Forms | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 1.5.5 |
CVE-2025-12125 |
Wordfence | |
| 6.4 Medium | Insert Headers and Footers Code – HT Script | Cross-Site Scripting HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting |
≤ 1.1.6 |
CVE-2025-12112 |
Wordfence | |
| 6.5 Medium | WPFunnels | Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal |
≤ 3.6.2 Fixed in 3.6.3 |
CVE-2025-12000 |
Wordfence | |
| 4.3 Medium | Groups | Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join |
≤ 3.7.0 Fixed in 3.8.0 |
CVE-2025-11748 |
Wordfence | |
| 6.1 Medium | Mang Board WP | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 2.3.1 |
CVE-2025-12193 |
Wordfence | |
| 8.8 High | Smart Auto Upload Images | Arbitrary File Upload Authenticated (Contributor+) Arbitrary File Upload |
≤ 1.2.0 Fixed in 1.2.1 |
CVE-2025-12161 |
Wordfence | |
| 4.9 Medium | Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI | SQL Injection AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection |
≤ 3.40.0 |
CVE-2025-11972 |
Wordfence | |
| 5.3 Medium | WPFunnels | Broken Access Control Unauthorized User Registration No login needed |
≤ 3.6.2 Fixed in 3.6.3 |
CVE-2025-12353 |
Wordfence | |
| 6.5 Medium | Ovatheme Events Manager | Broken Access Control Missing Authorization No login needed |
≤ 1.8.6 |
CVE-2025-7663 |
Wordfence | |
| 6.1 Medium | WP2Social Auto Publish | Cross-Site Scripting Reflected Cross-Site Scripting via PostMessage No login needed |
≤ 2.4.7 |
CVE-2025-12064 |
Wordfence | |
| 5.3 Medium | Course Booking System | Broken Access Control Missing Authorization to Unauthenticated Booking Data Export No login needed |
≤ 6.1.5 |
CVE-2025-12042 |
Wordfence | |
| 5.3 Medium | Download Manager | Broken Access Control Unauthenticated Cron Trigger due to Hardcoded Cron Key No login needed |
≤ 3.3.30 |
CVE-2025-12177 |
Wordfence | |
| 4.3 Medium | Contact Form 7 AWeber Extension | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Log Reset |
≤ 0.1.42 |
CVE-2025-12167 |
Wordfence | |
| 6.4 Medium | Simple Downloads List | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting |
≤ 1.4.3 Fixed in 1.5.0 |
CVE-2025-12583 |
Wordfence | |
| 7.5 High | Asgaros Forum | SQL Injection Unauthenticated SQL Injection No login needed |
≤ 3.1.0 |
CVE-2025-11452 |
Wordfence | |
| 4.3 Medium | Page & Post Notes | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion |
≤ 1.3.4 Fixed in 1.3.5 |
CVE-2025-12527 |
Wordfence | |
| 4.0 Medium | WP Airbnb Review Slider | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 4.2 |
CVE-2025-12520 |
Wordfence | |
| 6.5 Medium | IDonate | Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function |
2.0.0 – 2.1.9 Fixed in 2.1.10 |
CVE-2025-4522 |
Wordfence | |
| 8.8 High | IDonate | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function |
2.1.5 – 2.1.9 Fixed in 2.1.10 |
CVE-2025-4519 |
Wordfence | |
| 9.8 Critical | Gravity Forms | Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'copy_post_image' No login needed |
≤ 2.9.20 |
CVE-2025-12352 |
Wordfence | |
| 8.1 High | LC Wizard | Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation No login needed |
1.2.10 – 1.3.0 |
CVE-2025-5483 |
Wordfence | |
| 8.1 High | Alloggio - Hotel Booking | Local File Inclusion Hotel Booking Theme theme <= 1.8 - Local File Inclusion No login needed |
≤ 1.8 |
CVE-2025-64287 |
Patchstack | |
| 7.1 High | Import from YML | Cross-Site Scripting No login needed |
≤ 3.1.17 Fixed in 4.0.0 |
CVE-2025-64232 |
Patchstack | |
| 7.1 High | Grand Conference Theme Custom Post Type | Cross-Site Scripting No login needed |
≤ 2.6.4 Fixed in 2.6.4 |
CVE-2025-64224 |
Patchstack | |
| 7.1 High | Easy Social Share Buttons | Cross-Site Scripting No login needed |
≤ 10.7.1 Fixed in 10.7.1 |
CVE-2025-64198 |
Patchstack | |
| 7.1 High | Booster for WooCommerce | Cross-Site Scripting No login needed |
≤ 7.2.5 Fixed in 7.2.6 |
CVE-2025-64196 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.