WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,789 vulnerabilities, 1,850 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,251 Medium 17,927 Low 348

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 13, 2026.

Showing 13,551–13,600 of 29,789 vulnerabilities

Known WordPress vulnerabilities, page 272 of 596
Severity Component Vulnerability Affected versions Published CVE Source
8.5 High JetEngine Plugin jet-engine Remote Code Execution ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53194 Patchstack
8.1 High Houzez Plugin houzez Local File Inclusion No login needed ≤ 4.0.4 Fixed in 4.0.8 CVE-2025-53198 Patchstack
6.5 Medium JetEngine Plugin jet-engine Information Disclosure Sensitive Data Exposure ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53196 Patchstack
8.1 High eventlist Plugin eventlist Local File Inclusion No login needed ≤ 1.9.2 Fixed in 2.0.2 CVE-2025-53204 Patchstack
7.1 High Jobmonster Theme noo-jobmonster Cross-Site Scripting No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2025-53201 Patchstack
8.1 High WP Travel Gutenberg Blocks Plugin wp-travel-blocks Local File Inclusion No login needed ≤ 3.9.0 Fixed in 3.9.1 CVE-2025-53207 Patchstack
7.1 High Radio Player Shoutcast & Icecast Plugin lbg-audio4-html5-shoutcast Cross-Site Scripting No login needed ≤ 4.4.7 Fixed in 4.4.8 CVE-2025-53205 Patchstack
7.5 High ZoloBlocks Plugin zoloblocks Local File Inclusion ≤ 2.3.2 Fixed in 2.3.3 CVE-2025-53210 Patchstack
7.5 High Maya Business Plugin paymaya-checkout-for-woocommerce Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.2.0 Fixed in 1.3.0 CVE-2025-53208 Patchstack
9.9 Critical ReachShip WooCommerce Multi-Carrier & Conditional Shipping Plugin elex-reachship-multi-carrier-conditional-shipping Arbitrary File Upload ≤ 4.3.1 Fixed in 4.3.2 CVE-2025-53213 Patchstack
7.1 High Revolution Video Player With Bottom Playlist Plugin revolution-video-player Cross-Site Scripting No login needed ≤ 2.9.2 Fixed in 2.9.3 CVE-2025-53212 Patchstack
7.1 High Comments Capcha Box Plugin comments-capcha-box Cross-Site Scripting No login needed ≤ 1.1 CVE-2025-53226 Patchstack
7.1 High Raptive Ads Plugin adthrive-ads Cross-Site Scripting No login needed ≤ 3.8.0 Fixed in 3.9.0 CVE-2025-53319 Patchstack
9.8 Critical ThemeMakers Visual Content Composer Plugin tmm_content_composer PHP Object Injection No login needed ≤ 1.5.8 CVE-2025-53299 Patchstack
8.8 High Noisa Plugin noisa PHP Object Injection ≤ 2.6.0 Fixed in 2.6.2 CVE-2025-53560 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53559 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg_universal_video_player_addon_visual_composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53562 Patchstack
6.5 Medium Prevent files / folders access Plugin prevent-file-access Path Traversal ≤ 2.6.0 Fixed in 2.6.1 CVE-2025-53561 Patchstack
7.1 High HTML5 Radio Player - WPBakery Page Builder Addon Plugin lbg_radio_player_addon_visual_composer Cross-Site Scripting WPBakery Page Builder Addon <= 2.5 - Cross Site Scripting (XSS) No login needed ≤ 2.5 Fixed in 2.5.2 CVE-2025-53564 Patchstack
7.1 High Youtube Vimeo Video Player and Slider Plugin video_player_youtube_vimeo Cross-Site Scripting No login needed ≤ 3.8 Fixed in 3.9 CVE-2025-53563 Patchstack
8.1 High Ghost Kit Plugin ghostkit Local File Inclusion No login needed ≤ 3.4.1 Fixed in 3.4.2 CVE-2025-53567 Patchstack
8.1 High Widget for Google Reviews Plugin business-reviews-wp Local File Inclusion No login needed ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-53565 Patchstack
10.0 Critical Global DNS Plugin global-dns Remote Code Execution No login needed ≤ 3.1.0 Fixed in 3.1.1 CVE-2025-53577 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Information Disclosure Sensitive Data Exposure ≤ 2.7.7 Fixed in 2.7.7.1 CVE-2025-53983 Patchstack
9.8 Critical Simple Business Directory Pro Plugin simple-business-directory-pro Privilege Escalation No login needed ≤ 15.6.9 Fixed in 15.6.9 CVE-2025-53580 Patchstack
6.5 Medium JetMenu Plugin jet-menu Information Disclosure Sensitive Data Exposure ≤ 2.4.11.1 Fixed in 2.4.11.2 CVE-2025-53987 Patchstack
6.5 Medium JetTabs Plugin jet-tabs Information Disclosure Sensitive Data Exposure ≤ 2.2.9 Fixed in 2.2.9.1 CVE-2025-53985 Patchstack
6.5 Medium JetTricks Plugin jet-tricks Information Disclosure Sensitive Data Exposure ≤ 1.5.4.1 Fixed in 1.5.4.2 CVE-2025-53992 Patchstack
6.5 Medium JetBlocks For Elementor Plugin jet-blocks Information Disclosure Sensitive Data Exposure ≤ 1.3.18 Fixed in 1.3.19 CVE-2025-53988 Patchstack
6.5 Medium JetPopup Plugin jet-popup Information Disclosure Sensitive Data Exposure ≤ 2.0.15 Fixed in 2.0.15.1 CVE-2025-53993 Patchstack
8.8 High Post Grid and Gutenberg Blocks Plugin post-grid PHP Object Injection ≤ 2.3.11 Fixed in 2.3.12 CVE-2025-54007 Patchstack
6.5 Medium JetWooBuilder Plugin jet-woo-builder Information Disclosure Sensitive Data Exposure ≤ 2.1.20 Fixed in 2.1.20.1 CVE-2025-53998 Patchstack
7.2 High Welcart e-Commerce Plugin usc-e-shop PHP Object Injection ≤ 2.11.16 Fixed in 2.11.17 CVE-2025-54012 Patchstack
6.5 Medium JetSmartFilters Plugin jet-smart-filters Information Disclosure Sensitive Data Exposure ≤ 3.6.7 Fixed in 3.6.7.1 CVE-2025-54008 Patchstack
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions Local File Inclusion No login needed ≤ 2.15.4 Fixed in 2.15.5 CVE-2025-54017 Patchstack
9.8 Critical MediCenter - Health Medical Clinic Plugin medicenter PHP Object Injection Health Medical Clinic <= 15.1 - PHP Object Injection No login needed ≤ 15.1 Fixed in 15.2 CVE-2025-54014 Patchstack
7.5 High Simple File List Plugin simple-file-list Path Traversal Arbitrary File Download No login needed ≤ 6.1.14 Fixed in 6.1.15 CVE-2025-54021 Patchstack
6.5 Medium Alone Plugin alone Remote Code Execution Arbitrary Code Execution No login needed ≤ 7.8.5 Fixed in 7.8.5 CVE-2025-54019 Patchstack
7.1 High Support Board Plugin supportboard Cross-Site Scripting No login needed ≤ 3.8.0 Fixed in 3.8.1 CVE-2025-54027 Patchstack
6.5 Medium Coupon Affiliates Plugin woo-coupon-usage Broken Access Control Settings Change No login needed ≤ 6.4.0 Fixed in 6.4.2 CVE-2025-54025 Patchstack
7.5 High CF7 WOW Styler Plugin cf7-styler Local File Inclusion No login needed ≤ 1.7.2 Fixed in 1.7.3 CVE-2025-54028 Patchstack
7.1 High Real Estate Manager Pro Plugin real-estate-manager-pro Cross-Site Scripting No login needed ≤ 12.7.3 Fixed in 12.7.4 CVE-2025-54032 Patchstack
8.1 High Support Board Plugin supportboard Local File Inclusion No login needed ≤ 3.8.0 Fixed in 3.8.1 CVE-2025-54031 Patchstack
6.5 Medium Webba Booking Plugin webba-booking-lite Broken Access Control No login needed ≤ 5.1.20 Fixed in 5.1.22 CVE-2025-54040 Patchstack
7.5 High Newsletters Plugin newsletters-lite Local File Inclusion No login needed ≤ 4.10 Fixed in 4.11 CVE-2025-54034 Patchstack
6.5 Medium Cost Calculator Plugin ql-cost-calculator Cross-Site Scripting ≤ 7.4 Fixed in 7 .5 CVE-2025-54046 Patchstack
7.1 High Elite Video Player Plugin elite-video-player Cross-Site Scripting No login needed ≤ 10.0.5 Fixed in 10.0.7 CVE-2025-54044 Patchstack
9.3 Critical Custom API for WP Plugin custom-api-for-wp SQL Injection No login needed ≤ 4.2.2 Fixed in 4.2.3 CVE-2025-54048 Patchstack
7.5 High Realtyna Organic IDX Plugin real-estate-listing-realtyna-wpl Local File Inclusion No login needed ≤ 5.0.0 Fixed in 5.0.1 CVE-2025-54052 Patchstack
9.9 Critical Custom API for WP Plugin custom-api-for-wp Privilege Escalation ≤ 4.2.2 Fixed in 4.2.3 CVE-2025-54049 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only