WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 14,151–14,200 of 29,758 vulnerabilities

Known WordPress vulnerabilities, page 284 of 596
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium WP Register Profile With Shortcode Plugin wp-register-profile-with-shortcode Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure ≤ 3.6.2 CVE-2025-4593 Wordfence
6.4 Medium Contest Gallery Plugin contest-gallery Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting ≤ 26.0.8 CVE-2025-6716 Wordfence
9.8 Critical GB Forms DB Plugin gb-forms-db Remote Code Execution Unauthenticated Remote Code Execution No login needed ≤ 1.0.2 Fixed in 2.0.0 CVE-2025-5392 Wordfence
5.9 Medium GeoDirectory Plugin geodirectory Cross-Site Scripting Contributor+ Stored XSS < 2.8.120 Fixed in 2.8.120 CVE-2025-6200 WPScan
4.3 Medium Order Delivery Date Pro for WooCommerce Plugin Information Disclosure Unauthenticated Arbitrary Post Title Disclosure No login needed 2.0 – < 12.6.0 Fixed in 12.6.0 CVE-2025-2942 WPScan
9.8 Critical Premium Age Verification / Restriction Plugin Path Traversal Unauthenticated Arbitrary File Read and Write via remote_tunnel.php No login needed ≤ 3.0.2 CVE-2025-7401 Wordfence
4.8 Medium Hostel Plugin hostel Cross-Site Scripting Admin+ Stored XSS < 1.1.5.9 Fixed in 1.1.5.9 CVE-2025-6236 WPScan
6.1 Medium Hostel Plugin hostel Cross-Site Scripting Reflected XSS No login needed < 1.1.5.8 Fixed in 1.1.5.8 CVE-2025-6234 WPScan
5.5 Medium Lana Downloads Manager Plugin lana-downloads-manager Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.10.0 Fixed in 1.11.0 CVE-2025-7387 Wordfence
6.1 Medium Gwolle Guestbook Plugin gwolle-gb Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter No login needed ≤ 4.9.2 CVE-2025-5807 Wordfence
5.4 Medium wpForo Forum Plugin wpforo Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar ≤ 2.4.5 CVE-2025-4406 Wordfence
6.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes ≤ 6.6.4.4, 7.0.1 – 7.0.3 CVE-2025-6976 Wordfence
6.1 Medium Event Manager Plugin events-manager Cross-Site Scripting Reflected Cross-Site Scripting via `calendar_header` Parameter No login needed ≤ 6.6.4.4, 7.0.1 – 7.0.3 CVE-2025-6975 Wordfence
7.5 High Events Manager Plugin events-manager SQL Injection Unauthenticated SQL Injection via `orderby` Parameter No login needed ≤ 6.6.4.4, 7.0.1 – 7.0.3 CVE-2025-6970 Wordfence
7.5 High SureForms – Drag and Drop Form Builder Plugin sureforms PHP Object Injection Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion No login needed 0.0 – 0.0.13, 1.0 – 1.0.6, 1.1 – 1.1.1, … CVE-2025-6742 Wordfence
8.1 High SureForms – Drag and Drop Form Builder Plugin sureforms Arbitrary File Deletion Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion No login needed 0.0 – 0.0.13, 1.0 – 1.0.6, 1.1 – 1.1.1, … CVE-2025-6691 Wordfence
9.8 Critical Sala - Startup & SaaS Theme Privilege Escalation Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover No login needed ≤ 1.1.4 CVE-2025-4606 Wordfence
6.4 Medium Simple Featured Image Plugin simple-featured-image Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter ≤ 1.3.1 CVE-2025-7059 Wordfence
6.4 Medium Kadence Blocks – Gutenberg Blocks for Page Builder Features Plugin kadence-blocks Cross-Site Scripting Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter ≤ 3.5.10 CVE-2025-5678 Wordfence
10.0 Critical Pie Register Plugin pie-register Authentication Bypass WordPress Pie Register Plugin ≤ 3.7.1.4 Authentication Bypass RCE No login needed ≤ 3.7.1.4 CVE-2025-34077 VulnCheck
9.8 Critical Support Board Plugin Broken Access Control Unauthenticated Authorization Bypass due to Use of Default Secret Key No login needed ≤ 3.8.0 CVE-2025-4855 Wordfence
9.8 Critical Support Board Plugin Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 3.8.0 CVE-2025-4828 Wordfence
6.5 Medium WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Plugin wc-frontend-manager Broken Access Control Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification No login needed ≤ 6.7.16 CVE-2025-3780 Wordfence
7.3 High Woodmart Theme Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 8.2.3 CVE-2025-6744 Wordfence
8.8 High WoodMart Plugin Local File Inclusion Authenticated (Contributor+) Local File Inclusion ≤ 8.2.3 CVE-2025-6746 Wordfence
6.4 Medium WoodMart Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.2.3 CVE-2025-6743 Wordfence
8.8 High Widget for Google Reviews Plugin Path Traversal Authenticated (Subscriber+) Directory Traversal to Local File Inclusion ≤ 1.0.15 CVE-2025-7327 Wordfence
5.3 Medium Guest Support – Complete customer support ticket system Plugin guest-support Broken Access Control Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion No login needed ≤ 1.2.2 CVE-2025-5957 Wordfence
6.4 Medium Lightbox & Modal Popup WordPress Plugin – FooBox Plugin foobox-image-lightbox Cross-Site Scripting FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 2.7.34 CVE-2025-5537 Wordfence
5.4 Medium AI Engine Plugin ai-engine Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter ≤ 2.8.4 CVE-2025-5570 Wordfence
6.4 Medium Essential Addons for Elementor – Popular Elementor Templates and Widgets Plugin Cross-Site Scripting Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets ≤ 6.1.19 CVE-2025-6244 Wordfence
7.1 High Zilom Plugin zilom Cross-Site Scripting No login needed ≤ 1.4.5 Fixed in 1.4.5 CVE-2024-43334 Patchstack
6.1 Medium Contact Form 7 Database Addon Plugin contact-form-cfdb7 Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via tmpD Parameter No login needed ≤ 1.3.1 CVE-2025-6740 Wordfence
7.1 High Content Manager Light Plugin content-manager-light Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.2 CVE-2025-24771 Patchstack
9.8 Critical Service Finder Booking Plugin sf-booking Privilege Escalation No login needed ≤ 6.1 CVE-2025-23970 Patchstack
7.1 High WP Wall Plugin wp-wall Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.7.3 CVE-2025-28968 Patchstack
8.5 High Printcart Web to Print Product Designer for WooCommerce Plugin printcart-integration SQL Injection ≤ 2.4.0 Fixed in 2.4.1 CVE-2025-24780 Patchstack
7.1 High SB Breadcrumbs Plugin sb-breadcrumbs Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0 CVE-2025-28978 Patchstack
6.5 Medium Email Address Security by WebEmailProtector Plugin webemailprotector Cross-Site Scripting ≤ 3.3.6 CVE-2025-28976 Patchstack
9.8 Critical Click & Pledge Connect Plugin click-pledge-connect Privilege Escalation Privilege Escalation via SQL Injection No login needed 25.04010101 – WP6.8 CVE-2025-28983 Patchstack
7.7 High Aviation Weather from NOAA Plugin aviation-weather-from-noaa Arbitrary File Deletion ≤ 0.7.2 CVE-2025-28980 Patchstack
7.1 High Homey Plugin homey Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.4.5 CVE-2025-31037 Patchstack
10.0 Critical LogisticsHub Plugin logistics-hub Arbitrary File Upload No login needed ≤ 1.1.6 CVE-2025-30933 Patchstack
7.1 High Pressroom Theme pressroom Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 7.0 Fixed in 7.1 CVE-2025-32311 Patchstack
8.5 High Simple Link Directory Plugin qc-simple-link-directory SQL Injection ≤ 14.8.1 Fixed in 14.8.1 CVE-2025-32297 Patchstack
5.3 Medium WP Compress Plugin wp-compress-image-optimizer Authentication Bypass Broken Authentication No login needed ≤ 6.30.30 Fixed in 6.30.31 CVE-2025-47479 Patchstack
7.1 High Rankie Plugin valvepress-rankie Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.8.2 Fixed in 1.8.3 CVE-2025-39487 Patchstack
6.3 Medium EventON Plugin eventon Broken Access Control ≤ 4.9.9 CVE-2025-47565 Patchstack
6.5 Medium WC Pickup Store Plugin wc-pickup-store Broken Access Control Settings Change No login needed ≤ 1.8.9 Fixed in 1.8.10 CVE-2025-47634 Patchstack
7.5 High PrivateContent - Mail Actions Plugin private-content-mail-actions Local File Inclusion Mail Actions plugin <= 2.3.2 - Local File Inclusion No login needed ≤ 2.3.2 CVE-2025-47627 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only