WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,789 vulnerabilities, 1,850 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 13, 2026.
Showing 13,601–13,650 of 29,789 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.1 High | Druco | Cross-Site Scripting No login needed |
≤ 1.5.2 Fixed in 1.5.3 |
CVE-2025-54055 |
Patchstack | |
| 6.6 Medium | Groundhogg | PHP Object Injection |
≤ 4.2.2 Fixed in 4.2.2.1 |
CVE-2025-54053 |
Patchstack | |
| 7.1 High | oik | Cross-Site Scripting No login needed |
≤ 4.15.2 Fixed in 4.15.3 |
CVE-2025-54670 |
Patchstack | |
| 7.1 High | Responsive HTML5 Audio Player PRO With Playlist | Cross-Site Scripting No login needed |
≤ 3.5.8 Fixed in 3.5.9 |
CVE-2025-54056 |
Patchstack | |
| 9.1 Critical | Online Booking & Scheduling Calendar for WordPress by vcita | Arbitrary File Upload |
≤ 4.5.3 Fixed in 4.5.5 |
CVE-2025-54677 |
Patchstack | |
| 9.3 Critical | JS Archive List | SQL Injection No login needed |
≤ 6.1.6 Fixed in 6.1.6 |
CVE-2025-54726 |
Patchstack | |
| 9.8 Critical | Taxi Booking Manager for WooCommerce | Authentication Bypass Broken Authentication No login needed |
≤ 1.3.0 Fixed in 1.3.1 |
CVE-2025-54713 |
Patchstack | |
| 7.5 High | Funnel Builder by FunnelKit | Local File Inclusion No login needed |
≤ 3.11.1 Fixed in 3.12.0 |
CVE-2025-54750 |
Patchstack | |
| 8.8 High | CubeWP | Privilege Escalation |
≤ 1.1.24 Fixed in 1.1.25 |
CVE-2025-54735 |
Patchstack | |
| 7.5 High | Otter - Gutenberg Block | Information Disclosure Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure No login needed |
≤ 3.1.0 Fixed in 3.1.1 |
CVE-2025-55715 |
Patchstack | |
| 4.3 Medium | ColorMag | Broken Access Control Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation |
≤ 4.0.19 Fixed in 4.0.20 |
CVE-2025-9202 |
Wordfence | |
| 6.4 Medium | WPC Smart Quick View for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode |
≤ 4.2.1 |
CVE-2025-8618 |
Wordfence | |
| 7.5 High | Redirection for Contact Form 7 | PHP Object Injection Unauthenticated PHP Object Injection via PHAR Deserialization No login needed |
≤ 3.2.4 |
CVE-2025-8289 |
Wordfence | |
| 8.8 High | Redirection for Contact Form 7 | Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed |
≤ 3.2.4 |
CVE-2025-8141 |
Wordfence | |
| 8.8 High | Redirection for Contact Form 7 | PHP Object Injection Unauthenticated PHP Object Injection No login needed |
≤ 3.2.4 |
CVE-2025-8145 |
Wordfence | |
| 4.4 Medium | Contact Manager | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'title' |
≤ 8.6.5 |
CVE-2025-8783 |
Wordfence | |
| 6.4 Medium | Nexter Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 4.5.4 |
CVE-2025-8567 |
Wordfence | |
| 6.4 Medium | Flexible Maps | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Flexible Maps Shortcode |
≤ 1.18.0 |
CVE-2025-8622 |
Wordfence | |
| 7.5 High | JS Archive List | SQL Injection Unauthenticated SQL Injection via build_sql_where Function No login needed |
≤ 6.1.5 |
CVE-2025-7670 |
Wordfence | |
| 8.8 High | Multiple Plugins By FunnelKit <= (Various Versions) | Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library |
≤ 3.6.3, ≤ 3.11.0.2 |
CVE-2025-7654 |
Wordfence | |
| 9.8 Critical | Cloudflare Image Resizing | Remote Code Execution Missing Authentication to Unauthenticated Remote Code Execution via rest_pre_dispatch Hook No login needed |
≤ 1.5.6 |
CVE-2025-8723 |
Wordfence | |
| 9.8 Critical | Real Spaces - WordPress Properties Directory | Privilege Escalation WordPress Properties Directory Theme <= 3.6 - Unauthenticated Privilege Escalation to Administrator via 'imic_agent_register' No login needed |
≤ 3.6 |
CVE-2025-6758 |
Wordfence | |
| 8.8 High | Real Spaces - WordPress Properties Directory | Privilege Escalation WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member' |
≤ 3.5 |
CVE-2025-8218 |
Wordfence | |
| 4.3 Medium | Media Library Assistant | Arbitrary File Deletion Authenticated (Author+) Limited File Deletion |
≤ 3.27 Fixed in 3.28 |
CVE-2025-8357 |
Wordfence | |
| 6.4 Medium | WPC Smart Compare for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 6.4.7 |
CVE-2025-7496 |
Wordfence | |
| 6.5 Medium | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress | Arbitrary Shortcode Execution ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 4.16.4 |
CVE-2025-8878 |
Wordfence | |
| 6.4 Medium | Soledad | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h' |
≤ 8.6.7 |
CVE-2025-8143 |
Wordfence | |
| 7.3 High | Soledad | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 8.6.7 |
CVE-2025-8105 |
Wordfence | |
| 8.8 High | Soledad | Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'header_layout' |
≤ 8.6.7 |
CVE-2025-8142 |
Wordfence | |
| 6.4 Medium | Translate This - Google Translate Web Element Shortcode | Cross-Site Scripting Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter |
≤ 1.0 |
CVE-2025-8719 |
Wordfence | |
| 5.3 Medium | BetterDocs | Broken Access Control Missing Authorization to Private And Password-Protected Posts Information Disclosure No login needed |
≤ 4.1.1 |
CVE-2025-7499 |
Wordfence | |
| 5.3 Medium | Drag and Drop Multiple File Upload for Contact Form 7 | Path Traversal Directory Traversal via `wpcf7_guest_user_id` Cookie No login needed |
≤ 1.3.9.0 Fixed in 1.3.9.1 |
CVE-2025-8464 |
Wordfence | |
| 9.8 Critical | Taxi Booking Manager for Woocommerce | E-cab | Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover No login needed |
≤ 1.3.0 Fixed in 1.3.1 |
CVE-2025-8898 |
Wordfence | |
| 6.4 Medium | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting |
≤ 3.14.3 |
CVE-2025-8896 |
Wordfence | |
| 5.4 Medium | Advanced iFrame | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2025.6 Fixed in 2025.10 |
CVE-2025-8089 |
Wordfence | |
| 6.1 Medium | Ebook Store | Cross-Site Scripting Reflected XSS via $_SERVER['REQUEST_URI'] No login needed |
< 5.8015 Fixed in 5.8015 |
CVE-2025-8113 |
WPScan | |
| 6.4 Medium | Intl DateTime Calendar | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter |
≤ 1.0.1 |
CVE-2025-8293 |
Wordfence | |
| 6.1 Medium | weichuncai(WP伪春菜) | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed |
≤ 1.5 |
CVE-2025-7686 |
Wordfence | |
| 6.4 Medium | Anber Elementor Addon | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link |
≤ 1.0.1 |
CVE-2025-7439 |
Wordfence | |
| 8.8 High | School Management System | Arbitrary File Upload Authenticated (Student+) Arbitrary File Upload |
≤ 93.2.0 |
CVE-2025-6079 |
Wordfence | |
| 6.6 Medium | Woocommerce Blocks – Woolook | Local File Inclusion Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion |
≤ 1.7.0 |
CVE-2024-8393 |
Wordfence | |
| 6.1 Medium | LatestCheckins | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed |
≤ 1 |
CVE-2025-7683 |
Wordfence | |
| 9.8 Critical | StoryChief | Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed |
≤ 1.0.42 |
CVE-2025-7441 |
Wordfence | |
| 6.1 Medium | Linux Promotional | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed |
≤ 1.4 |
CVE-2025-7668 |
Wordfence | |
| 7.5 High | Al Pack | Broken Access Control Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function No login needed |
≤ 1.1.1 |
CVE-2025-7664 |
Wordfence | |
| 8.8 High | WPGYM | Broken Access Control Missing Authorization to Admin Account Creation |
≤ 67.7.0 |
CVE-2025-6080 |
Wordfence | |
| 6.4 Medium | Surbma | Recent Comments Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 2.0 |
CVE-2025-7649 |
Wordfence | |
| 6.4 Medium | Anber Elementor Addon | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link |
≤ 1.0.1 |
CVE-2025-7440 |
Wordfence | |
| 8.8 High | WPGYM - Wordpress Gym Management System | Local File Inclusion Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update |
≤ 67.7.0 |
CVE-2025-3671 |
Wordfence | |
| 6.1 Medium | Last.fm Recent Album Artwork | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed |
≤ 1.0.2 |
CVE-2025-7684 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.