WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,789 vulnerabilities, 1,850 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,251 Medium 17,927 Low 348

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 13, 2026.

Showing 13,701–13,750 of 29,789 vulnerabilities

Known WordPress vulnerabilities, page 275 of 596
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium CM On Demand Search And Replace Plugin cm-on-demand-search-and-replace Cross-Site Scripting ≤ 1.5.2 Fixed in 1.5.3 CVE-2025-54727 Patchstack
5.4 Medium WP Membership Plugin wp-membership Broken Access Control Settings Change ≤ 1.6.3 Fixed in 1.6.4 CVE-2025-54717 Patchstack
4.3 Medium CM On Demand Search And Replace Plugin cm-on-demand-search-and-replace Cross-Site Request Forgery No login needed ≤ 1.5.2 Fixed in 1.5.3 CVE-2025-54728 Patchstack
5.9 Medium Webba Booking Plugin webba-booking-lite Cross-Site Scripting ≤ 6.0.5 Fixed in 6.0.6 CVE-2025-54729 Patchstack
5.3 Medium Embedder for Google Reviews Plugin embedder-for-google-reviews Broken Access Control No login needed ≤ 1.7.3 Fixed in 1.7.4 CVE-2025-54730 Patchstack
4.3 Medium WPDM – Premium Packages Plugin wpdm-premium-packages Cross-Site Request Forgery Premium Packages Plugin <= 6.0.2 - Cross Site Request Forgery (CSRF) No login needed ≤ 6.0.2 Fixed in 6.0.3 CVE-2025-54732 Patchstack
5.3 Medium Nexter Blocks Plugin the-plus-addons-for-block-editor Broken Access Control No login needed ≤ 4.5.4 Fixed in 4.5.5 CVE-2025-54739 Patchstack
5.3 Medium Savoy Theme savoy Information Disclosure Sensitive Data Exposure No login needed ≤ 3.0.8 Fixed in 3.0.9 CVE-2025-54736 Patchstack
6.5 Medium Print My Blog Plugin print-my-blog Cross-Site Scripting ≤ 3.27.9 Fixed in 3.27.10 CVE-2025-54740 Patchstack
6.5 Medium Shortcode Redirect Plugin shortcode-redirect Cross-Site Scripting ≤ 1.0.02 Fixed in 1.0.03 CVE-2025-54746 Patchstack
6.5 Medium JetProductGallery Plugin jet-woo-product-gallery Cross-Site Scripting ≤ 2.2.0.2 Fixed in 2.2.0.3 CVE-2025-54749 Patchstack
6.5 Medium Templatera Plugin templatera Cross-Site Scripting ≤ 2.3.0 Fixed in 2.4.0 CVE-2025-54747 Patchstack
8.5 High Quiz And Survey Master Plugin quiz-master-next SQL Injection ≤ 10.2.4 Fixed in 10.2.5 CVE-2025-55708 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.15.0 Fixed in 45.15.0 CVE-2025-55709 Patchstack
4.3 Medium TaxoPress Plugin simple-tags Information Disclosure Sensitive Data Exposure ≤ 3.37.2 Fixed in 3.37.3 CVE-2025-55710 Patchstack
6.5 Medium WP Table Builder Plugin wp-table-builder Cross-Site Scripting ≤ 2.0.12 Fixed in 2.0.13 CVE-2025-55711 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Broken Access Control ≤ 6.3.13 Fixed in 6.3.14 CVE-2025-55712 Patchstack
5.9 Medium Blocksy Plugin blocksy Cross-Site Scripting ≤ 2.1.6 Fixed in 2.1.7 CVE-2025-55713 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Cross-Site Scripting ≤ 2.7.9 Fixed in 2.7.9.1 CVE-2025-55714 Patchstack
4.3 Medium WP Statistics Plugin wp-statistics Broken Access Control ≤ 14.15 Fixed in 14.15.2 CVE-2025-55716 Patchstack
6.5 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting ≤ 1.5 Fixed in 1.5.1 CVE-2024-37945 Patchstack
9.3 Critical MDTF Plugin wp-meta-data-filter-and-taxonomy-filter SQL Injection No login needed ≤ 1.3.3.7 Fixed in 1.3.3.8 CVE-2025-54707 Patchstack
6.5 Medium Magical Posts Display Plugin magical-posts-display Cross-Site Scripting ≤ 1.2.52 Fixed in 1.2.53 CVE-2025-54706 Patchstack
4.3 Medium WpEvently Plugin mage-eventpress Broken Access Control ≤ 4.4.6 Fixed in 4.4.7 CVE-2025-54705 Patchstack
6.5 Medium Easy Elementor Addons Plugin easy-elementor-addons Cross-Site Scripting ≤ 2.2.6 Fixed in 2.2.7 CVE-2025-54704 Patchstack
4.3 Medium Integrate Google Drive Plugin integrate-google-drive Cross-Site Request Forgery No login needed ≤ 1.5.2 Fixed in 1.5.3 CVE-2025-54703 Patchstack
4.3 Medium Ebook Store Plugin ebook-store Cross-Site Request Forgery No login needed ≤ 5.8013 Fixed in 5.8014 CVE-2025-54702 Patchstack
8.1 High Unicamp Plugin unicamp Local File Inclusion No login needed ≤ 2.6.3 Fixed in 2.6.4 CVE-2025-54701 Patchstack
8.1 High Makeaholic Plugin makeaholic Local File Inclusion No login needed ≤ 1.8.4 Fixed in 1.8.5 CVE-2025-54700 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Cross-Site Scripting LMS Plugin plugin <= 1.18.3 - Cross Site Scripting (XSS) ≤ 1.18.3 Fixed in 1.18.4 CVE-2025-54699 Patchstack
5.4 Medium Classified Listing Plugin classified-listing Content Injection ≤ 5.0.0 Fixed in 5.0.1 CVE-2025-54698 Patchstack
7.2 High Kadence WooCommerce Email Designer Plugin kadence-woocommerce-email-designer Privilege Escalation ≤ 1.5.16 Fixed in 1.5.17 CVE-2025-54697 Patchstack
6.5 Medium WPFunnels Plugin wpfunnels Cross-Site Scripting ≤ 3.5.26 Fixed in 3.5.27 CVE-2025-54696 Patchstack
5.4 Medium HT Mega Plugin ht-mega-for-elementor Broken Access Control ≤ 2.9.0 Fixed in 2.9.1 CVE-2025-54695 Patchstack
4.3 Medium Button Block Plugin button-block Cross-Site Request Forgery No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2025-54694 Patchstack
9.0 Critical Form Block Plugin form-block Arbitrary File Upload No login needed ≤ 1.5.5 Fixed in 1.5.6 CVE-2025-54693 Patchstack
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control No login needed ≤ 2.9.0 Fixed in 3.0.0 CVE-2025-54692 Patchstack
5.3 Medium Motors Plugin motors-car-dealership-classified-listings Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.4.80 Fixed in 1.4.81 CVE-2025-54691 Patchstack
8.1 High Xinterio Plugin xinterio Local File Inclusion No login needed ≤ 4.2 Fixed in 4.3 CVE-2025-54690 Patchstack
8.1 High Urna Plugin urna Local File Inclusion No login needed ≤ 2.5.7 Fixed in 2.5.8 CVE-2025-54689 Patchstack
6.5 Medium JetEngine Plugin jet-engine Cross-Site Scripting ≤ 3.7.1.2 Fixed in 3.7.2 CVE-2025-54688 Patchstack
6.5 Medium JetTabs Plugin jet-tabs Cross-Site Scripting ≤ 2.2.9.1 Fixed in 2.2.9.2 CVE-2025-54687 Patchstack
9.8 Critical Exertio Plugin exertio PHP Object Injection No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2025-54686 Patchstack
6.5 Medium SureDash Plugin suredash Information Disclosure Sensitive Data Exposure ≤ 1.1.0 Fixed in 1.2.0 CVE-2025-54685 Patchstack
5.9 Medium Integration for Contact Form 7 and Constant Contact Plugin cf7-constant-contact Cross-Site Scripting ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-54684 Patchstack
5.9 Medium WP Modal Popup with Cookie Integration Plugin wp-modal-popup-with-cookie-integration Cross-Site Scripting ≤ 2.4 Fixed in 2.5 CVE-2025-54683 Patchstack
5.4 Medium Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets Cross-Site Request Forgery No login needed ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-54682 Patchstack
4.7 Medium Connector for Gravity Forms and Google Sheets Plugin wp-gravity-forms-spreadsheets Open Redirect No login needed ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-54681 Patchstack
6.5 Medium Blogger Buzz Plugin blogger-buzz Cross-Site Scripting ≤ 1.2.6 Fixed in 1.2.7 CVE-2025-54680 Patchstack
7.5 High Neon Channel Product Customizer Free Plugin neon-channel-product-customizer-free Broken Access Control Arbitrary Content Deletion No login needed ≤ 2.0 Fixed in 3.0 CVE-2025-54679 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only