WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,575 vulnerabilities, 2,034 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 28, 2026.
Showing 11,601–11,650 of 17,576 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.1 High | CGD Arrange Terms | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.1.3 |
CVE-2025-23752 |
Patchstack | |
| 6.5 Medium | WP Smart Tooltip | Cross-Site Scripting |
≤ 1.0.0 |
CVE-2025-23669 |
Patchstack | |
| 6.5 Medium | Donate visa | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.0.0 |
CVE-2025-23656 |
Patchstack | |
| 7.1 High | CubePM | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0 |
CVE-2025-23574 |
Patchstack | |
| 7.1 High | RSVPMaker Volunteer Roles | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.5.1 |
CVE-2025-23531 |
Patchstack | |
| 6.5 Medium | Minterpress | Broken Access Control Arbitrary Content Deletion |
≤ 1.0.5 |
CVE-2025-23529 |
Patchstack | |
| 7.1 High | Simple Locator | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.0.4 |
CVE-2025-22513 |
Patchstack | |
| 4.3 Medium | Houzez | Broken Access Control |
≤ 3.4.0 Fixed in 3.4.2 |
CVE-2025-24754 |
Patchstack | |
| 8.1 High | Morkva UA Shipping | Local File Inclusion No login needed |
≤ 1.0.18 Fixed in 1.0.20 |
CVE-2025-24685 |
Patchstack | |
| 9.3 Critical | LTL Freight Quotes – Worldwide Express Edition | SQL Injection No login needed |
≤ 5.0.20 Fixed in 5.0.21 |
CVE-2025-24664 |
Patchstack | |
| 9.3 Critical | Shipping for Nova Poshta | SQL Injection No login needed |
≤ 1.19.6 Fixed in 1.19.7 |
CVE-2025-24612 |
Patchstack | |
| 9.8 Critical | FundPress | PHP Object Injection No login needed |
≤ 2.0.6 Fixed in 2.0.7 |
CVE-2025-24601 |
Patchstack | |
| 4.3 Medium | Ultimate Store Kit Elementor Addons | Broken Access Control |
≤ 2.3.0 Fixed in 2.3.1 |
CVE-2025-24584 |
Patchstack | |
| 5.4 Medium | Responsive Slider by MetaSlider | Cross-Site Request Forgery No login needed |
≤ 3.92.0 Fixed in 3.92.1 |
CVE-2025-24533 |
Patchstack | |
| 7.1 High | Passwordless WP – Login with your glance or fingerprint | Cross-Site Scripting Login with your glance or fingerprint Plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.1.6 |
CVE-2025-23792 |
Patchstack | |
| 7.1 High | Shipdeo | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.2.8 |
CVE-2025-23457 |
Patchstack | |
| 6.5 Medium | Social Share Buttons | Path Traversal Unauthenticated Image Upload & Path Traversal No login needed |
≤ 2.7 |
CVE-2024-13117 |
WPScan | |
| 7.5 High | Import WP – Export and Import CSV and XML files to | Information Disclosure Export and Import CSV and XML files to WordPress <= 2.14.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory No login needed |
≤ 2.14.5 |
CVE-2024-13562 |
Wordfence | |
| 6.5 Medium | Youzify – BuddyPress Community, User Profile, Social Network & Membership | Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update (save_addon_key_license) |
≤ 1.3.3 Fixed in 1.3.4 |
CVE-2024-13370 |
Wordfence | |
| 4.3 Medium | Youzify – BuddyPress Community, User Profile, Social Network & Membership | Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update |
≤ 1.3.4 Fixed in 1.3.5 |
CVE-2024-13368 |
Wordfence | |
| 4.3 Medium | Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs | Broken Access Control BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress By KaineLabs <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Review Deletion |
≤ 1.3.2 Fixed in 1.3.3 |
CVE-2024-12113 |
Wordfence | |
| 6.4 Medium | LearnPress – WordPress LMS | Cross-Site Scripting WordPress LMS Plugin <= 4.2.7.5 - Authenticated (LP Instructor+) Stored Cross-Site Scripting via Lesson Name |
≤ 4.2.7.5 |
CVE-2024-13599 |
Wordfence | |
| 6.4 Medium | WordPress SEO Friendly Accordion FAQ with AI assisted content generation | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.2.1 |
CVE-2024-13458 |
Wordfence | |
| 7.6 High | Email Subscription Popup | SQL Injection |
≤ 1.2.23 Fixed in 1.2.24 |
CVE-2025-24587 |
Patchstack | |
| 6.5 Medium | Popup Maker | Cross-Site Scripting |
≤ 1.20.2 Fixed in 1.20.3 |
CVE-2025-24746 |
Patchstack | |
| 4.3 Medium | Post Duplicator | Broken Access Control |
≤ 2.35 Fixed in 2.36 |
CVE-2025-24736 |
Patchstack | |
| 6.5 Medium | PDF Invoice Builder for WooCommerce | Cross-Site Scripting |
≤ 4.6.0 Fixed in 4.7.0 |
CVE-2025-24755 |
Patchstack | |
| 4.3 Medium | Gutenberg Blocks by Kadence Blocks | Broken Access Control |
≤ 3.3.1 Fixed in 3.3.2 |
CVE-2025-24753 |
Patchstack | |
| 4.3 Medium | CoBlocks | Broken Access Control |
≤ 3.1.13 Fixed in 3.1.14 |
CVE-2025-24751 |
Patchstack | |
| 5.4 Medium | ExactMetrics | Broken Access Control |
≤ 8.1.0 Fixed in 8.2.0 |
CVE-2025-24750 |
Patchstack | |
| 7.1 High | Roi Calculator | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.0 Fixed in 1.1 |
CVE-2025-24756 |
Patchstack | |
| 6.5 Medium | ElementInvader Addons for Elementor | Cross-Site Scripting |
≤ 1.3.3 Fixed in 1.3.4 |
CVE-2025-24729 |
Patchstack | |
| 6.5 Medium | Post Grid Master | Local File Inclusion |
≤ 3.4.12 Fixed in 3.4.13 |
CVE-2025-24733 |
Patchstack | |
| 6.5 Medium | Easy YouTube Gallery | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.0.4 Fixed in 1.0.5 |
CVE-2025-24721 |
Patchstack | |
| 6.5 Medium | HT Contact Form 7 | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.2.1 Fixed in 1.2.2 |
CVE-2025-24726 |
Patchstack | |
| 6.5 Medium | WP VR | Cross-Site Scripting |
≤ 8.5.14 Fixed in 8.5.15 |
CVE-2025-24730 |
Patchstack | |
| 4.3 Medium | Thim Elementor Kit | Broken Access Control |
≤ 1.2.8 Fixed in 1.2.9 |
CVE-2025-24725 |
Patchstack | |
| 4.3 Medium | Call Now Button | Cross-Site Request Forgery No login needed |
≤ 1.4.13 Fixed in 1.4.14 |
CVE-2025-24738 |
Patchstack | |
| 8.5 High | Bug Library | SQL Injection |
≤ 2.1.4 Fixed in 2.1.5 |
CVE-2025-24728 |
Patchstack | |
| 5.9 Medium | Booking Calendar Contact Form | Cross-Site Scripting Stored Cross Site Scripting (XSS) |
≤ 1.2.55 Fixed in 1.2.56 |
CVE-2025-24723 |
Patchstack | |
| 6.5 Medium | Widget Countdown | Cross-Site Scripting |
≤ 2.7.1 Fixed in 2.7.2 |
CVE-2025-24719 |
Patchstack | |
| 6.5 Medium | BookingPress | Cross-Site Scripting |
≤ 1.1.25 Fixed in 1.1.26 |
CVE-2025-24732 |
Patchstack | |
| 5.9 Medium | Download IP2Location Country Blocker | Cross-Site Scripting |
≤ 2.38.3 Fixed in 2.38.4 |
CVE-2025-24731 |
Patchstack | |
| 4.3 Medium | FluentSMTP | Cross-Site Request Forgery No login needed |
≤ 2.2.80 Fixed in 2.2.81 |
CVE-2025-24739 |
Patchstack | |
| 5.4 Medium | Side Menu Lite | Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed |
≤ 5.3.1 Fixed in 5.3.2 |
CVE-2025-24724 |
Patchstack | |
| 5.4 Medium | Herd Effects | Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed |
≤ 6.2.1 Fixed in 6.2.2 |
CVE-2025-24716 |
Patchstack | |
| 5.9 Medium | Contact Form Email | Cross-Site Scripting |
≤ 1.3.52 Fixed in 1.3.53 |
CVE-2025-24727 |
Patchstack | |
| 5.4 Medium | Modal Window | Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed |
≤ 6.1.4 Fixed in 6.1.5 |
CVE-2025-24717 |
Patchstack | |
| 4.4 Medium | Comment Edit Core – Simple Comment Editing | Server-Side Request Forgery Simple Comment Editing Plugin <= 3.0.33 - Server Side Request Forgery (SSRF) |
≤ 3.0.33 Fixed in 3.1.0 |
CVE-2025-24703 |
Patchstack | |
| 5.4 Medium | Counter Box | Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed |
≤ 2.0.5 Fixed in 2.0.6 |
CVE-2025-24715 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.