WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 11,551–11,600 of 29,758 vulnerabilities

Known WordPress vulnerabilities, page 232 of 596
Severity Component Vulnerability Affected versions Published CVE Source
10.0 Critical Support Ticket System for WooCommerce (Premium) Plugin support-ticket-system-for-woocommerce Arbitrary File Upload No login needed ≤ 2.0.7 CVE-2025-60235 Patchstack
10.0 Critical Custom User Registration Fields for WooCommerce Plugin user-registration-plugin-for-woocommerce Arbitrary File Upload No login needed ≤ 2.1.2 CVE-2025-60207 Patchstack
7.5 High WooCommerce Store Toolkit Plugin woocommerce-store-toolkit Local File Inclusion No login needed ≤ 2.4.3 Fixed in 2.4.4 CVE-2025-60204 Patchstack
7.5 High Store Exporter Plugin woocommerce-exporter Local File Inclusion No login needed ≤ 2.7.6 Fixed in 2.7.7 CVE-2025-60203 Patchstack
7.5 High Favorites Plugin favorites Local File Inclusion No login needed ≤ 2.3.6 CVE-2025-60202 Patchstack
7.5 High WP Customer Area Plugin customer-area Local File Inclusion No login needed < 8.3.4 Fixed in 8.3.4 CVE-2025-60201 Patchstack
7.5 High LearnPress Export Import Plugin learnpress-import-export Local File Inclusion No login needed ≤ 4.1.2 Fixed in 4.1.3 CVE-2025-60200 Patchstack
8.1 High InHype - Blog & Magazine Plugin inhype Local File Inclusion Blog & Magazine WordPress Theme theme <= 1.5.2 - Local File Inclusion No login needed ≤ 1.5.2 CVE-2025-60199 Patchstack
8.1 High Saxon - Viral Content Blog & Magazine Marketing Plugin saxon Local File Inclusion Viral Content Blog & Magazine Marketing WordPress Theme theme <= 1.9.3 - Local File Inclusion No login needed ≤ 1.9.3 CVE-2025-60198 Patchstack
8.1 High Simple Contact Forms Plugin simple-contact-forms Local File Inclusion No login needed ≤ 1.6.4 CVE-2025-60197 Patchstack
7.5 High Clearblue® Ovulation Calculator Plugin clearblue-ovulation-calculator Local File Inclusion No login needed ≤ 1.2.4 CVE-2025-60196 Patchstack
9.8 Critical Atarim Plugin atarim-visual-collaboration Privilege Escalation No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2025-60195 Patchstack
7.5 High Premmerce Product Search for WooCommerce Plugin premmerce-search Local File Inclusion No login needed ≤ 2.2.4 Fixed in 2.2.5 CVE-2025-60194 Patchstack
7.5 High Premmerce User Roles Plugin premmerce-user-roles Local File Inclusion No login needed ≤ 1.0.13 Fixed in 1.0.14 CVE-2025-60193 Patchstack
7.5 High Premmerce Wholesale Pricing for WooCommerce Plugin premmerce-woocommerce-wholesale-pricing Local File Inclusion No login needed ≤ 1.1.10 Fixed in 1.1.11 CVE-2025-60192 Patchstack
7.5 High Premmerce Wishlist for WooCommerce Plugin premmerce-woocommerce-wishlist Local File Inclusion No login needed ≤ 1.1.10 Fixed in 1.1.11 CVE-2025-60191 Patchstack
8.1 High Immocaster Plugin immocaster Local File Inclusion No login needed ≤ 1.3.6 CVE-2025-60190 Patchstack
7.5 High PoloPag – Pix Automático para Woocommerce Plugin wc-polo-payments Local File Inclusion Pix Automático para Woocommerce plugin <= 2.0.9 - Local File Inclusion No login needed ≤ 2.0.9 Fixed in 3.0.0 CVE-2025-60189 Patchstack
7.5 High Atarim Plugin atarim-visual-collaboration Information Disclosure Sensitive Data Exposure No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2025-60188 Patchstack
4.8 Medium Atarim Plugin atarim-visual-collaboration Arbitrary File Upload No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2025-60187 Patchstack
7.5 High Lazy Load Optimizer Plugin lazy-load-optimizer Local File Inclusion No login needed ≤ 1.4.7 CVE-2025-60074 Patchstack
7.5 High Responsive Sidebar Plugin responsive-sidebar Local File Inclusion No login needed ≤ 1.2.2 CVE-2025-60073 Patchstack
7.1 High GoStore Plugin gostore Cross-Site Scripting No login needed ≤ 1.6.4 Fixed in 1.6.4 CVE-2025-59556 Patchstack
9.8 Critical s2Member Plugin s2member PHP Object Injection No login needed ≤ 250701 Fixed in 250905 CVE-2025-58998 Patchstack
9.1 Critical Advanced Settings Plugin advanced-settings Arbitrary File Upload ≤ 3.1.1 Fixed in 3.2.0 CVE-2025-58996 Patchstack
8.1 High Leblix Theme leblix Local File Inclusion No login needed ≤ 2.4 Fixed in 2.5 CVE-2025-58995 Patchstack
8.1 High Greenify Plugin greenify Local File Inclusion No login needed ≤ 2.2 Fixed in 2.3 CVE-2025-58994 Patchstack
6.5 Medium Jock On Air Now (JOAN) Plugin joan Broken Access Control ≤ 6.0.4 Fixed in 6.0.5 CVE-2025-58986 Patchstack
7.2 High Barcode Scanner with Inventory & Order Manager Plugin barcode-scanner-lite-pos-to-manage-products-inventory-and-orders Path Traversal ≤ 1.10.4 Fixed in 1.10.5 CVE-2025-58972 Patchstack
7.1 High Enzy Plugin enzy Cross-Site Scripting No login needed ≤ 1.6.4 Fixed in 1.6.4 CVE-2025-58964 Patchstack
7.1 High Institutions Directory Plugin institutions-directory Cross-Site Scripting No login needed ≤ 1.3.3 Fixed in 1.3.4 CVE-2025-58638 Patchstack
9.8 Critical WP Gravity Forms Keap/Infusionsoft Plugin gf-infusionsoft PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-58636 Patchstack
7.5 High Miraculous Plugin miraculous Broken Access Control Arbitrary Content Deletion No login needed ≤ 2.0.9 Fixed in 2.0.9 CVE-2025-58629 Patchstack
9.8 Critical Miraculous Core Plugin miraculouscore Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 2.0.9 Fixed in 2.0.9 CVE-2025-58627 Patchstack
8.8 High Falang multilanguage Plugin falang PHP Object Injection No login needed ≤ 1.3.65 Fixed in 1.3.66 CVE-2025-58619 Patchstack
5.3 Medium All In One Login Plugin change-wp-admin-login Authentication Bypass Bypass Vulnerability No login needed ≤ 2.0.8 Fixed in 2.0.9 CVE-2025-58595 Patchstack
8.1 High TranslatePress Plugin translatepress-multilingual PHP Object Injection Deserialization of untrusted data No login needed ≤ 2.10.2 Fixed in 2.10.3 CVE-2025-58592 Patchstack
5.3 Medium imEvent Plugin imevent Broken Access Control No login needed ≤ 3.4.0 CVE-2025-58243 Patchstack
8.2 High Ai Image Alt Text Generator for WP Plugin ai-image-alt-text-generator-for-wp Broken Access Control No login needed ≤ 1.1.5 Fixed in 1.1.6 CVE-2025-58207 Patchstack
5.3 Medium VikBooking Hotel Booking Engine & PMS Plugin vikbooking Broken Access Control No login needed ≤ 1.8.2 Fixed in 1.8.3 CVE-2025-5803 Patchstack
7.1 High Jobmonster Theme noo-jobmonster Cross-Site Scripting No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2025-54737 Patchstack
7.1 High WooTour Plugin woo-tour Cross-Site Scripting No login needed ≤ 3.6.3 Fixed in 3.6.4 CVE-2025-54722 Patchstack
7.1 High Resca Theme resca Cross-Site Scripting No login needed ≤ 3.0.2 Fixed in 3.0.3 CVE-2025-54721 Patchstack
8.8 High Yogi - Health Beauty & Yoga Plugin noo-yogi PHP Object Injection Health Beauty & Yoga Theme <= 2.9.2 - Deserialization of untrusted data ≤ 2.9.2 Fixed in 2.9.3 CVE-2025-54719 Patchstack
7.1 High Yogi - Health Beauty & Yoga Plugin noo-yogi Cross-Site Scripting Health Beauty & Yoga theme <= 2.9.2 - Cross Site Scripting (XSS) No login needed ≤ 2.9.2 Fixed in 2.9.3 CVE-2025-54718 Patchstack
7.1 High Info Cards Plugin info-cards Broken Access Control ≤ 1.0.11 Fixed in 2.0.0 CVE-2025-54711 Patchstack
8.8 High WeMusic Plugin noo-wemusic PHP Object Injection ≤ 1.9.1 Fixed in 1.9.2 CVE-2025-53586 Patchstack
7.1 High WeMusic Plugin noo-wemusic Cross-Site Scripting No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2025-53585 Patchstack
7.1 High Doliconnect Plugin doliconnect Cross-Site Scripting No login needed ≤ 9.3.2 Fixed in 9.4.2 CVE-2025-53574 Patchstack
7.1 High Epic Review Plugin epic-review Cross-Site Scripting No login needed ≤ 1.0.2 Fixed in 1.0.3 CVE-2025-53573 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only