WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,789 vulnerabilities, 1,850 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,251 Medium 17,927 Low 348

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 13, 2026.

Showing 12,801–12,850 of 29,789 vulnerabilities

Known WordPress vulnerabilities, page 257 of 596
Severity Component Vulnerability Affected versions Published CVE Source
3.8 Low CP Multi View Event Calendar Plugin cp-multi-view-calendar Broken Access Control ≤ 1.4.35 CVE-2025-58009 Patchstack
6.4 Medium Content Mask Plugin content-mask Server-Side Request Forgery ≤ 1.8.5.2 Fixed in 1.8.5.3 CVE-2025-58011 Patchstack
4.3 Medium SV Proven Expert Plugin sv-provenexpert Cross-Site Request Forgery No login needed ≤ 2.0.06 CVE-2025-58010 Patchstack
3.8 Low Content Mask Plugin content-mask Broken Access Control Insecure Direct Object References (IDOR) ≤ 1.8.5.3 CVE-2025-58012 Patchstack
8.8 High CouponXxL Plugin couponxxl Cross-Site Request Forgery No login needed ≤ 4.5.0 CVE-2025-58013 Patchstack
5.3 Medium Quiz Maker Plugin quiz-maker Information Disclosure Sensitive Data Exposure No login needed ≤ 6.7.0.65 Fixed in 6.7.0.66 CVE-2025-58015 Patchstack
4.3 Medium Quiz Maker Plugin quiz-maker Cross-Site Request Forgery No login needed ≤ 6.7.0.64 Fixed in 6.7.0.65 CVE-2025-58014 Patchstack
4.3 Medium CF7 Submissions Plugin cf7-submissions Broken Access Control ≤ 0.26 CVE-2025-58016 Patchstack
6.5 Medium Ultimate Store Kit Elementor Addons Plugin ultimate-store-kit Cross-Site Scripting ≤ 2.8.6 Fixed in 2.8.7 CVE-2025-58017 Patchstack
6.5 Medium Search Atlas SEO Plugin metasync Cross-Site Scripting ≤ 2.5.4 Fixed in 2.5.5 CVE-2025-58019 Patchstack
6.5 Medium Mail Subscribe List Plugin mail-subscribe-list Cross-Site Scripting ≤ 2.1.10 CVE-2025-58018 Patchstack
6.5 Medium Theater Plugin theatre Cross-Site Scripting ≤ 0.18.8 Fixed in 0.19 CVE-2025-58020 Patchstack
6.5 Medium ShortCode Plugin shortcode Cross-Site Scripting ≤ 0.8.1 CVE-2025-58022 Patchstack
6.5 Medium List Child Pages Shortcode Plugin list-child-pages-shortcode Cross-Site Scripting ≤ 1.3.1 Fixed in 1.4.0 CVE-2025-58021 Patchstack
6.5 Medium Genealogical Tree Plugin genealogical-tree Cross-Site Scripting ≤ 2.2.7 CVE-2025-58023 Patchstack
6.5 Medium Termageddon: Cookie Consent & Privacy Compliance Plugin termageddon-usercentrics Cross-Site Scripting ≤ 1.8.1 Fixed in 1.8.2 CVE-2025-58026 Patchstack
6.5 Medium Master Slider Plugin master-slider Cross-Site Scripting ≤ 3.11.0 CVE-2025-58025 Patchstack
6.5 Medium NGG Smart Image Search Plugin ngg-smart-image-search Cross-Site Scripting ≤ 3.4.3 CVE-2025-58027 Patchstack
6.5 Medium Designil PDPA Thailand Plugin pdpa-thailand Cross-Site Scripting ≤ 2.0.1 CVE-2025-58028 Patchstack
6.5 Medium Page-list Plugin page-list Cross-Site Scripting ≤ 5.8 Fixed in 5.9 CVE-2025-58030 Patchstack
5.3 Medium Classic Widgets with Block-based Widgets Plugin classic-widgets-with-block-based-widgets Broken Access Control No login needed ≤ 1.0.1 CVE-2025-58029 Patchstack
6.5 Medium Nextend Facebook Connect Plugin nextend-facebook-connect Cross-Site Scripting ≤ 3.1.19 Fixed in 3.1.20 CVE-2025-58031 Patchstack
5.9 Medium Draft Plugin website-builder Cross-Site Scripting ≤ 3.0.9 CVE-2025-58033 Patchstack
4.3 Medium WP Compiler Plugin wp-compiler Cross-Site Request Forgery No login needed ≤ 1.0.0 CVE-2025-58032 Patchstack
4.3 Medium Fastly Plugin fastly Cross-Site Request Forgery No login needed ≤ 1.2.28 Fixed in 1.2.29 CVE-2025-58199 Patchstack
4.3 Medium Flexible FAQ Plugin flexible-faq Cross-Site Request Forgery No login needed ≤ 0.2 CVE-2025-58200 Patchstack
6.5 Medium Card Elements for WPBakery Plugin card-elements-for-wpbakery Cross-Site Scripting ≤ 1.0.8 CVE-2025-58220 Patchstack
4.3 Medium Show Pages List Plugin show-pages-list Cross-Site Request Forgery No login needed ≤ 1.2.0 CVE-2025-58219 Patchstack
4.3 Medium PilotPress Plugin pilotpress Broken Access Control ≤ 2.0.36 CVE-2025-58221 Patchstack
5.3 Medium Team Manager Plugin wp-team-manager Broken Access Control No login needed ≤ 2.6.8 CVE-2025-58222 Patchstack
5.4 Medium Printeers Print & Ship Plugin invition-print-ship Cross-Site Request Forgery No login needed ≤ 1.17.0 CVE-2025-58224 Patchstack
5.9 Medium VoucherPress Plugin voucherpress Cross-Site Scripting ≤ 1.5.7 CVE-2025-58223 Patchstack
5.3 Medium 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin interactive-3d-flipbook-powered-physics-engine Information Disclosure PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure No login needed ≤ 1.16.16 Fixed in 1.16.17 CVE-2025-58226 Patchstack
6.5 Medium Quick View for WooCommerce Plugin woo-quickview Cross-Site Scripting ≤ 2.2.16 Fixed in 2.2.17 CVE-2025-58228 Patchstack
6.5 Medium Podlove Subscribe button Plugin podlove-subscribe-button Cross-Site Scripting ≤ 1.3.11 Fixed in 1.3.12 CVE-2025-58227 Patchstack
6.5 Medium Sitekit Plugin sitekit Cross-Site Scripting ≤ 2.0 CVE-2025-58229 Patchstack
6.5 Medium ZoloBlocks Plugin zoloblocks Cross-Site Scripting ≤ 2.3.12 Fixed in 2.3.13 CVE-2025-58230 Patchstack
6.5 Medium Bitly Plugin wp-bitly Cross-Site Scripting ≤ 2.8.0 CVE-2025-58231 Patchstack
6.5 Medium SQL Chart Builder Plugin sql-chart-builder Cross-Site Scripting ≤ 2.3.7.2 CVE-2025-58233 Patchstack
6.5 Medium Image Editor by Pixo Plugin image-editor-by-pixo Cross-Site Scripting ≤ 2.3.8 CVE-2025-58232 Patchstack
6.5 Medium JS Job Manager Plugin js-jobs Cross-Site Scripting ≤ 2.0.2 CVE-2025-58234 Patchstack
4.3 Medium Force Update Translations Plugin force-update-translations Cross-Site Request Forgery No login needed ≤ 0.5 Fixed in 0.6.0 CVE-2025-58236 Patchstack
6.5 Medium Front End Users Plugin front-end-only-users Cross-Site Scripting ≤ 3.2.35 CVE-2025-58235 Patchstack
6.5 Medium LC Wizard Plugin ghl-wizard Cross-Site Scripting ≤ 2.2.4 CVE-2025-58237 Patchstack
6.5 Medium WP Category Dropdown Plugin wp-category-dropdown Cross-Site Scripting ≤ 1.9 CVE-2025-58239 Patchstack
6.5 Medium PilotPress Plugin pilotpress Cross-Site Scripting ≤ 2.0.36 CVE-2025-58238 Patchstack
6.5 Medium xili-tidy-tags Plugin xili-tidy-tags Cross-Site Scripting ≤ 1.12.06 CVE-2025-58240 Patchstack
6.5 Medium SnapWidget Social Photo Feed Widget Plugin snapwidget-wp-instagram-widget Cross-Site Scripting ≤ 1.1.0 CVE-2025-58241 Patchstack
6.5 Medium Bg Church Memos Plugin bg-church-memos Cross-Site Scripting ≤ 1.1 CVE-2025-58242 Patchstack
5.9 Medium Portfolio Plugin portfolio Cross-Site Scripting ≤ 2.58 CVE-2025-58245 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only