WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 11,751–11,800 of 29,758 vulnerabilities

Known WordPress vulnerabilities, page 236 of 596
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Masterstudy Theme masterstudy Local File Inclusion ≤ 4.8.126 Fixed in 4.8.126 CVE-2025-64364 Patchstack
7.5 High Kleo Plugin kleo Local File Inclusion ≤ 5.5.0 Fixed in 5.5.0 CVE-2025-64363 Patchstack
6.5 Medium K Elements Plugin k-elements Cross-Site Scripting ≤ 5.5.0 Fixed in 5.5.0 CVE-2025-64362 Patchstack
6.5 Medium Consulting Elementor Widgets Plugin consulting-elementor-widgets Cross-Site Scripting ≤ 1.4.2 Fixed in 1.4.3 CVE-2025-64361 Patchstack
7.5 High Consulting Elementor Widgets Plugin consulting-elementor-widgets Local File Inclusion ≤ 1.4.2 Fixed in 1.4.3 CVE-2025-64360 Patchstack
7.5 High Consulting Theme consulting Local File Inclusion ≤ 6.7.5 Fixed in 6.7.5 CVE-2025-64359 Patchstack
4.3 Medium Smart Coupons for WooCommerce Plugin wt-smart-coupons-for-woocommerce Broken Access Control ≤ 2.2.3 Fixed in 2.2.4 CVE-2025-64358 Patchstack
4.3 Medium Advanced Database Cleaner Plugin advanced-database-cleaner Cross-Site Request Forgery No login needed ≤ 3.1.6 Fixed in 3.1.7 CVE-2025-64357 Patchstack
4.3 Medium Insert PHP Code Snippet Plugin insert-php-code-snippet Broken Access Control ≤ 1.4.3 Fixed in 1.4.4 CVE-2025-64356 Patchstack
6.5 Medium Gutenberg Plugin gutenberg Cross-Site Scripting ≤ 21.8.2 Fixed in 21.9.0 CVE-2025-64354 Patchstack
8.8 High Polylang Plugin polylang PHP Object Injection Deserialization of untrusted data ≤ 3.7.3 Fixed in 3.7.4 CVE-2025-64353 Patchstack
2.7 Low Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Broken Access Control ≤ 6.2.4 Fixed in 6.3.0 CVE-2025-64352 Patchstack
4.3 Medium Rank Math SEO Plugin seo-by-rank-math Information Disclosure Sensitive Data Exposure ≤ 1.0.252.1 Fixed in 1.0.253 CVE-2025-64351 Patchstack
3.8 Low Rank Math SEO Plugin seo-by-rank-math Broken Access Control ≤ 1.0.252.1 Fixed in 1.0.253 CVE-2025-64350 Patchstack
7.5 High WPC Name Your Price for WooCommerce Plugin wpc-name-your-price Broken Access Control Unauthenticated Price Alteration No login needed ≤ 2.1.9 CVE-2025-12115 Wordfence
5.3 Medium ERI File Library Plugin eri-file-library Broken Access Control Missing Authorization to Unauthenticated Protected File Download No login needed ≤ 1.1.0 CVE-2025-12041 Wordfence
5.3 Medium OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) Plugin oopspam-anti-spam Other Unauthenticated IP Header Spoofing No login needed ≤ 1.2.53 Fixed in 1.2.54 CVE-2025-12094 Wordfence
4.3 Medium Depicter Plugin depicter Cross-Site Request Forgery No login needed ≤ 4.0.4 CVE-2025-8383 Wordfence
4.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure ≤ 6.15.9 Fixed in 6.15.10 CVE-2025-12175 Wordfence
6.8 Medium Zombify Plugin Path Traversal Authenticated (Subscriber+) Path Traversal to Arbitrary File Read ≤ 1.7.5 CVE-2025-8385 Wordfence
8.6 High WooCommerce Designer Pro Theme Path Traversal Unauthenticated Arbitrary File Read No login needed ≤ 1.9.28 CVE-2025-10897 Wordfence
8.8 High WordPress User Extra Fields Plugin Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function ≤ 16.7 CVE-2025-7846 Wordfence
9.8 Critical King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor Plugin king-addons Privilege Escalation Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation No login needed ≤ 51.1.14 Fixed in 51.1.35 CVE-2025-8489 Wordfence
9.8 Critical Jobmonster - Job Board Theme Authentication Bypass Job Board WordPress Theme <= 4.8.1 - Authentication Bypass No login needed ≤ 4.8.1 CVE-2025-5397 Wordfence
5.3 Medium RealPress Plugin realpress Broken Access Control Unauthenticated Content Creation/Email Sending via REST No login needed < 1.1.0 Fixed in 1.1.0 CVE-2025-11191 WPScan
6.4 Medium Qzzr Shortcode Plugin qzzr-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2025-11806 Wordfence
4.3 Medium FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) Plugin fusewp Broken Access Control WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation ≤ 1.1.23.0 Fixed in 1.1.23.1 CVE-2025-11975 Wordfence
5.3 Medium AppPresser – Mobile App Framework Plugin apppresser Broken Access Control Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure No login needed ≤ 4.5.0 CVE-2025-11881 Wordfence
3.5 Low NS Maintenance Mode for WP Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.3.1 CVE-2025-10636 WPScan
6.5 Medium Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue Plugin site-checkup Denial of Service Unauthenticated Log File Poisoning No login needed ≤ 1.47 CVE-2025-11627 Wordfence
5.3 Medium Translate WordPress and go Multilingual – Weglot Plugin weglot Broken Access Control Weglot <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion No login needed ≤ 5.1 CVE-2025-10008 Wordfence
6.4 Medium Blocksy Companion Plugin blocksy-companion Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.1.14 Fixed in 2.1.15 CVE-2025-12475 Wordfence
4.3 Medium Call Now Button Plugin call-now-button Broken Access Control Authenticated (Subscriber+) Missing Authorization to Multiple Functions ≤ 1.5.4 CVE-2025-11632 Wordfence
4.3 Medium Call Now Button Plugin call-now-button Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update ≤ 1.5.3 CVE-2025-11587 Wordfence
6.1 Medium LiteSpeed Cache Plugin litespeed-cache Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 7.5.0.1 CVE-2025-12450 Wordfence
4.9 Medium Easy Testimonial Slider and Form Plugin easy-testimonial-rotator SQL Injection Authenticated (Admin+) SQL injection ≤ 1.0.2 CVE-2015-10147 Wordfence
4.9 Medium Thumbnail Slider With Lightbox Plugin wp-responsive-slider-with-lightbox SQL Injection Authenticated (Admin+) SQL Injection ≤ 1.0.4 CVE-2015-10146 Wordfence
5.9 Medium Premmerce User Roles Plugin premmerce-user-roles Cross-Site Scripting ≤ 1.0.13 Fixed in 1.0.14 CVE-2025-64291 Patchstack
4.3 Medium Premmerce Product Search for WooCommerce Plugin premmerce-search Cross-Site Request Forgery No login needed ≤ 2.2.4 Fixed in 2.2.5 CVE-2025-64290 Patchstack
5.9 Medium Premmerce Product Search for WooCommerce Plugin premmerce-search Cross-Site Scripting ≤ 2.2.7 CVE-2025-64289 Patchstack
4.3 Medium Premmerce Plugin premmerce Cross-Site Request Forgery No login needed ≤ 1.3.19 Fixed in 1.3.20 CVE-2025-64288 Patchstack
4.3 Medium WP Rentals Plugin wprentals Cross-Site Request Forgery No login needed ≤ 3.13.1 CVE-2025-64286 Patchstack
5.4 Medium Premmerce Wholesale Pricing for WooCommerce Plugin premmerce-woocommerce-wholesale-pricing Broken Access Control ≤ 1.1.10 Fixed in 1.1.11 CVE-2025-64285 Patchstack
7.5 High Majestic Support Plugin majestic-support Local File Inclusion ≤ 1.0.7 Fixed in 1.0.8 CVE-2025-64284 Patchstack
6.5 Medium RTMKit Plugin rometheme-for-elementor Broken Access Control Insecure Direct Object References (IDOR) ≤ 1.6.7 Fixed in 1.6.8 CVE-2025-64283 Patchstack
4.3 Medium Evergreen Content Poster Plugin evergreen-content-poster Broken Access Control ≤ 1.4.5 Fixed in 1.4.6 CVE-2025-64234 Patchstack
4.3 Medium Client Invoicing by Sprout Invoices Plugin sprout-invoices Broken Access Control ≤ 20.8.7 Fixed in 20.8.8 CVE-2025-64229 Patchstack
4.3 Medium SUMO Affiliates Pro Plugin affs Information Disclosure Sensitive Data Exposure ≤ 11.0.0 Fixed in 11.1.0 CVE-2025-64228 Patchstack
4.3 Medium Stockie Extra Plugin stockie-extra Cross-Site Request Forgery No login needed ≤ 1.2.11 Fixed in 1.2.12 CVE-2025-64226 Patchstack
6.5 Medium Rey Core Plugin rey-core Cross-Site Scripting ≤ 3.1.8 Fixed in 3.1.9 CVE-2025-64220 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only