WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 14,101–14,150 of 29,758 vulnerabilities

Known WordPress vulnerabilities, page 283 of 596
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium Welcart e-Commerce Plugin usc-e-shop Cross-Site Scripting ≤ 2.11.16 Fixed in 2.11.17 CVE-2025-54013 Patchstack
4.3 Medium SMTP2GO Plugin smtp2go Broken Access Control ≤ 1.12.1 Fixed in 1.12.2 CVE-2025-54011 Patchstack
9.6 Critical FluentSnippets Plugin easy-code-manager Cross-Site Request Forgery No login needed ≤ 10.50 Fixed in 10.51 CVE-2025-54010 Patchstack
6.5 Medium JetSmartFilters Plugin jet-smart-filters Cross-Site Scripting ≤ 3.6.8 Fixed in 3.6.8.1 CVE-2025-54009 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.4.1 Fixed in 5.4.2 CVE-2025-54006 Patchstack
4.3 Medium Houzez Plugin houzez Broken Access Control ≤ 4.0.4 Fixed in 4.1.1 CVE-2025-53997 Patchstack
6.5 Medium JetSearch Plugin jet-search Cross-Site Scripting ≤ 3.5.10.1 Fixed in 3.5.11 CVE-2025-53996 Patchstack
6.5 Medium JetPopup Plugin jet-popup Cross-Site Scripting ≤ 2.0.15.1 Fixed in 2.0.16 CVE-2025-53995 Patchstack
6.5 Medium JetPopup Plugin jet-popup Cross-Site Scripting ≤ 2.0.15 Fixed in 2.0.15.1 CVE-2025-53994 Patchstack
6.5 Medium JetTricks Plugin jet-tricks Cross-Site Scripting ≤ 1.5.4.1 Fixed in 1.5.4.2 CVE-2025-53991 Patchstack
7.2 High JetFormBuilder Plugin jetformbuilder PHP Object Injection ≤ 3.5.1.2 Fixed in 3.5.2 CVE-2025-53990 Patchstack
6.5 Medium JetBlocks For Elementor Plugin jet-blocks Cross-Site Scripting ≤ 1.3.19 Fixed in 1.3.19.1 CVE-2025-53989 Patchstack
5.3 Medium Hestia Plugin hestia Broken Access Control No login needed ≤ 3.2.10 Fixed in 3.2.11 CVE-2025-53986 Patchstack
6.5 Medium JetTabs Plugin jet-tabs Cross-Site Scripting ≤ 2.2.9 Fixed in 2.2.9.1 CVE-2025-53984 Patchstack
6.5 Medium JetElements For Elementor Plugin jet-elements Cross-Site Scripting ≤ 2.7.7 Fixed in 2.7.7.1 CVE-2025-53982 Patchstack
6.4 Medium Media Library Assistant Plugin media-library-assistant Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes ≤ 3.26 CVE-2025-7035 Wordfence
7.5 High Ultimate WP Mail Plugin ultimate-wp-mail Broken Access Control Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function 1.0.17 – 1.3.6 CVE-2025-6993 Wordfence
6.4 Medium Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Plugin master-addons Cross-Site Scripting Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.8.2 CVE-2025-5284 Wordfence
6.4 Medium Avada (Fusion) Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.12.1 CVE-2025-6747 Wordfence
8.1 High Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal Plugin wp-malware-removal Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion ≤ 17.0 CVE-2025-6043 Wordfence
6.4 Medium Affiliate Reviews Plugin affiliate-reviews Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter ≤ 1.0.6 CVE-2025-5845 Wordfence
8.2 High Counter live visitors for WooCommerce Plugin counter-visitor-for-woocommerce Arbitrary File Deletion Unauthenticated Arbitrary File Deletion in wcvisitor_get_block No login needed ≤ 1.3.6 CVE-2025-7359 Wordfence
6.4 Medium Brandfolder Plugin brandfolder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 5.0.19 Fixed in 5.0.20 CVE-2025-5843 Wordfence
4.4 Medium WP Event Manager Plugin wp-event-manager Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 3.1.49 CVE-2025-2799 Wordfence
7.2 High WP Event Manager Plugin wp-event-manager Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'organizer_name' No login needed ≤ 3.1.50 CVE-2025-2800 Wordfence
6.1 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function No login needed ≤ 5.9.5.4 CVE-2025-6977 Wordfence
8.1 High Restrict File Access Plugin restrict-file-access Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary File Deletion No login needed ≤ 1.1.2 CVE-2025-7667 Wordfence
5.5 Medium Companion Auto Update Plugin companion-auto-update Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter ≤ 3.9.2 CVE-2025-4369 Wordfence
9.8 Critical HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. Plugin ht-contactform Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 2.2.1 Fixed in 2.2.2 CVE-2025-7340 Wordfence
6.4 Medium Strong Testimonials Plugin strong-testimonials Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields ≤ 3.2.11 CVE-2025-7367 Wordfence
9.1 Critical HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. Plugin ht-contactform Path Traversal Directory Traversal to Arbitrary File Move No login needed ≤ 2.2.1 Fixed in 2.2.2 CVE-2025-7360 Wordfence
9.1 Critical HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. Plugin ht-contactform Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 2.2.1 Fixed in 2.2.2 CVE-2025-7341 Wordfence
9.8 Critical Alone – Charity Multipurpose Non-profit Theme Broken Access Control Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation No login needed ≤ 7.8.3 CVE-2025-5394 Wordfence
9.1 Critical Alone – Charity Multipurpose Non-profit Theme Broken Access Control Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion No login needed ≤ 7.8.5 CVE-2025-5393 Wordfence
9.8 Critical AIT CSV import/export Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 3.0.3 CVE-2020-36849 Wordfence
5.9 Medium Modern Events Calendar Lite Plugin modern-events-calendar-lite SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.3.0 CVE-2021-4458 Wordfence
7.5 High Total Upkeep by BoldGrid Plugin boldgrid-backup Information Disclosure Unauthenticated Backup Download No login needed ≤ 1.14.9 Fixed in 1.14.10 CVE-2020-36848 Wordfence
4.9 Medium RSFirewall! Plugin rsfirewall Path Traversal Authenticated (Admin+) Arbitrary File Read ≤ 1.1.42 CVE-2025-7518 Wordfence
9.8 Critical Simple File List Plugin simple-file-list Remote Code Execution No login needed < 4.2.3 Fixed in 4.2.3 CVE-2020-36847 Wordfence
7.5 High Friends Plugin friends PHP Object Injection Authenticated (Subscriber+) PHP Object Injection 3.5.1 Fixed in 3.5.2 CVE-2025-7504 Wordfence
8.8 High BeeTeam368 Extensions Plugin Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload ≤ 2.3.5 CVE-2025-6423 Wordfence
8.8 High Nokri - Job Board Theme Privilege Escalation Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover ≤ 1.6.3 CVE-2025-1313 Wordfence
8.8 High WPBookit Plugin wpbookit Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload ≤ 1.0.4 Fixed in 1.0.5 CVE-2025-6057 Wordfence
9.8 Critical WPBookit Plugin wpbookit Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.0.4 Fixed in 1.0.5 CVE-2025-6058 Wordfence
4.1 Medium Broken Link Notifier Plugin broken-link-notifier Content Injection Authenticated (Contributor+) CSV Injection ≤ 1.3.0 CVE-2025-6838 Wordfence
7.2 High Broken Link Notifier Plugin broken-link-notifier Server-Side Request Forgery Unauthenticated Server-Side Request Forgery No login needed ≤ 1.3.0 CVE-2025-6851 Wordfence
7.5 High WPGYM - Wordpress Gym Management System Plugin SQL Injection Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injection No login needed < 67.8.0 Fixed in 67.8.0 CVE-2025-7442 Wordfence
6.4 Medium FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel Plugin foogallery Cross-Site Scripting Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.31 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.4.31 Fixed in 2.4.32 CVE-2025-6068 Wordfence
6.4 Medium WPC Smart Compare for WooCommerce Plugin woo-smart-compare Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.4.6 Fixed in 6.4.7 CVE-2025-5530 Wordfence
5.3 Medium WoodMart Plugin Information Disclosure Unauthenticated Post Disclosure No login needed ≤ 8.2.5 CVE-2025-6745 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only