WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 11,751–11,800 of 17,051 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 236 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Slides & Presentations Plugin slide Cross-Site Scripting ≤ 0.0.39 CVE-2025-22511 Patchstack
6.5 Medium Metadata SEO Plugin metadata-seo Cross-Site Scripting ≤ 2.3 CVE-2025-22516 Patchstack
6.5 Medium Show Google Analytics widget Plugin show-google-analytics-widget Cross-Site Scripting ≤ 1.5.4 CVE-2025-22515 Patchstack
6.5 Medium Justified Image Gallery Plugin justified-image-gallery Cross-Site Scripting ≤ 1.0 CVE-2025-22518 Patchstack
6.5 Medium List Pages at Depth Plugin list-pages-at-depth Cross-Site Scripting ≤ 1.5 CVE-2025-22517 Patchstack
8.5 High eDoc Easy Tables Plugin edoc-easy-tables SQL Injection ≤ 1.29 CVE-2025-22519 Patchstack
7.1 High Tock Widget Plugin tock-widget Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.1 Fixed in 1.2 CVE-2025-22520 Patchstack
7.1 High SingSong Plugin singsong Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.2 CVE-2025-22522 Patchstack
6.5 Medium فرم ساز فرم افزار Plugin formafzar Cross-Site Scripting ≤ 2.0 Fixed in 2.1 CVE-2025-22524 Patchstack
6.5 Medium Huurkalender WP Plugin huurkalender-wp Cross-Site Scripting ≤ 1.5.6 Fixed in 1.6.0 CVE-2025-22528 Patchstack
6.5 Medium Donation Block For PayPal Plugin donations-block Cross-Site Scripting ≤ 2.2.0 Fixed in 2.3.1 CVE-2025-22525 Patchstack
6.5 Medium WE Blocks Plugin we-blocks Cross-Site Scripting ≤ 1.3.5 CVE-2025-22529 Patchstack
6.5 Medium Urdu Formatter – Shamil Plugin urdu-formatter-shamil Cross-Site Scripting Shamil plugin <= 0.1 - Cross Site Scripting (XSS) ≤ 0.1 CVE-2025-22531 Patchstack
6.5 Medium 아임포트 결제버튼 생성 플러그인 Plugin iamport-payment Cross-Site Scripting ≤ 1.1.19 CVE-2025-22530 Patchstack
7.6 High WOOEXIM Plugin wooexim SQL Injection ≤ 5.0.0 CVE-2025-22533 Patchstack
6.5 Medium Simple Photo Sphere Plugin simple-photo-sphere Cross-Site Scripting ≤ 0.0.10 CVE-2025-22532 Patchstack
5.4 Medium Slides & Presentations Plugin slide Broken Access Control ≤ 0.0.39 CVE-2025-22534 Patchstack
7.1 High Virtual Bot Plugin virtual-bot Cross-Site Request Forgery CSRF Cross Site Scripting (XSS) No login needed ≤ 1.0.0 CVE-2025-22538 Patchstack
7.6 High WP Music Player Plugin wp-music-player SQL Injection ≤ 1.3 CVE-2025-22536 Patchstack
5.4 Medium WP Delete Post Copies Plugin etruel-del-post-copies Broken Access Control ≤ 5.5 Fixed in 6.0 CVE-2025-22541 Patchstack
6.5 Medium Mind Doodle Visual Sitemaps & Tasks Plugin mind-doodle-sitemap Cross-Site Scripting ≤ 1.6 CVE-2025-22544 Patchstack
5.4 Medium ST Gallery WP Plugin st-gallery-wp Broken Access Control Settings Change ≤ 1.0.8 CVE-2025-22543 Patchstack
6.5 Medium jQuery TwentyTwenty Plugin js-twentytwenty Cross-Site Scripting ≤ 1.0 CVE-2025-22546 Patchstack
6.5 Medium iframe to embed Plugin iframe-to-embed Cross-Site Scripting ≤ 1.2 CVE-2025-22545 Patchstack
7.1 High JK Html To Pdf Plugin jk-html-to-pdf Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.0.0 CVE-2025-22547 Patchstack
6.5 Medium WP Github Plugin wp-github Cross-Site Scripting ≤ 1.3.3 CVE-2025-22549 Patchstack
7.1 High ldap_login_password_and_role_manager Plugin ldap-login-password-and-role-manager Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.0.12 CVE-2025-22548 Patchstack
6.5 Medium AddFunc Mobile Detect Plugin addfunc-mobile-detect Cross-Site Scripting ≤ 3.1 CVE-2025-22550 Patchstack
7.1 High Affiliate Disclosure Statement Plugin affiliate-disclosure-statement Information Disclosure CSRF to Stored XSS No login needed ≤ 0.3 CVE-2025-22552 Patchstack
6.5 Medium Boot-Modal Plugin boot-modal Cross-Site Scripting ≤ 1.9.1 Fixed in 1.10 CVE-2025-22551 Patchstack
6.5 Medium Video Embed Optimizer Plugin video-embed-optimizer Cross-Site Scripting ≤ 1.0.0 CVE-2025-22554 Patchstack
7.1 High Norse Rune Oracle Plugin norse-runes-oracle Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.4.2 Fixed in 1.4.3 CVE-2025-22556 Patchstack
7.1 High Smoothness Slider Shortcode Plugin smoothness-slider-shortcode Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ v1.2.2 CVE-2025-22555 Patchstack
7.1 High News Publisher Autopilot Plugin wpm-news-api Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 2.1.4 CVE-2025-22557 Patchstack
7.1 High TubePress.NET Plugin tubepressnet Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 4.0.1 CVE-2025-22559 Patchstack
6.5 Medium mcjh button shortcode Plugin mcjh-button-shortcode Cross-Site Scripting ≤ 1.6.4 CVE-2025-22558 Patchstack
4.3 Medium Title Experiments Free Plugin wp-experiments-free Cross-Site Request Forgery No login needed ≤ 9.0.4 CVE-2025-22562 Patchstack
5.3 Medium Saoshyant Page Builder Plugin saoshyant-page-builder Broken Access Control No login needed ≤ 3.8 CVE-2025-22560 Patchstack
4.3 Medium Pretty Url Plugin pretty-url Cross-Site Request Forgery No login needed ≤ 1.5.5 CVE-2025-22563 Patchstack
6.5 Medium Legacy ePlayer Plugin sportspress-tv Cross-Site Scripting ≤ 0.9.9 CVE-2025-22572 Patchstack
7.1 High Instabot Plugin instabot Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.10 Fixed in 1.11 CVE-2025-22571 Patchstack
6.5 Medium ICS Button Plugin ics-button Cross-Site Scripting ≤ 0.6 CVE-2025-22574 Patchstack
6.5 Medium Icons Enricher Plugin icons-enricher Cross-Site Scripting ≤ 1.0.8 CVE-2025-22573 Patchstack
6.5 Medium Able Player Plugin wp-able-player Cross-Site Scripting ≤ 1.0 CVE-2025-22577 Patchstack
5.9 Medium WP Header Notification Plugin wp-header-notification Cross-Site Scripting ≤ 1.2.7 CVE-2025-22579 Patchstack
5.9 Medium WP Cookie Plugin wp-cookie Cross-Site Scripting ≤ 1.0.0 CVE-2025-22578 Patchstack
6.5 Medium Biltorvet Dealer Tools Plugin biltorvet-dealer-tools Cross-Site Scripting ≤ 1.0.22 CVE-2025-22580 Patchstack
7.1 High Uptime Robot Plugin uptime-robot Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 0.1.3 CVE-2025-22582 Patchstack
6.5 Medium Arcade Ready Plugin arcadeready Cross-Site Scripting ≤ 1.1 CVE-2025-22581 Patchstack
6.5 Medium Ultimate Image Hover Effects Plugin ultimate-image-hover-effects Cross-Site Scripting ≤ 1.1.2 CVE-2025-22585 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only