WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 14,301–14,350 of 29,758 vulnerabilities

Known WordPress vulnerabilities, page 287 of 596
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Drag and Drop Multiple File Upload (Pro) - WooCommerce Plugin Arbitrary File Upload WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload No login needed ≤ 1.7.1, 5.0 – 5.0.5 CVE-2025-5746 Wordfence
8.1 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin Local File Inclusion Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion No login needed ≤ 4.89 CVE-2025-4380 Wordfence
6.4 Medium Magic Buttons for Elementor Plugin magic-buttons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode ≤ 1.0 CVE-2025-6687 Wordfence
8.8 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin Cross-Site Request Forgery Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate No login needed ≤ 4.89 CVE-2025-6459 Wordfence
9.8 Critical Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin Local File Inclusion Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution No login needed ≤ 4.89 CVE-2025-4689 Wordfence
7.5 High Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager Plugin SQL Injection Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection No login needed ≤ 4.89 CVE-2025-4381 Wordfence
6.3 Medium Lead Form Data Collection to CRM Plugin wp-leads-builder-any-crm Broken Access Control Missing Authorization to Authenticated (Subscriber+) Many Actions ≤ 3.1 Fixed in 3.2 CVE-2025-5692 Wordfence
5.4 Medium The Plus Addons for Elementor Pro Plugin theplus_elementor_addon Broken Access Control Pro Plugin < 6.3.7 - Broken Access Control < 6.3.7 Fixed in 6.3.7 CVE-2025-46259 Patchstack
9.1 Critical Custom Login And Signup Widget Plugin custom-login-and-signup-widget Remote Code Execution Arbitrary Code Execution ≤ 1.0 CVE-2025-49029 Patchstack
6.1 Medium Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer Plugin 3d-flipbook-dflip-lite Cross-Site Scripting PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source' No login needed ≤ 2.3.65 CVE-2025-5314 Wordfence
6.4 Medium Ultra Addons for Contact Form 7 Plugin ultimate-addons-for-contact-form-7 Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode ≤ 3.5.21 CVE-2025-6756 Wordfence
9.8 Critical Opal Estate Pro Plugin opal-estate-pro Privilege Escalation Unauthenticated Privilege Escalation via 'on_regiser_user' No login needed ≤ 1.7.5 CVE-2025-6934 Wordfence
4.3 Medium Easy Contact Form Lite Plugin Cross-Site Scripting Contributor+ Stored XSS < 1.1.29 Fixed in 1.1.29 CVE-2025-5730 WPScan
6.3 Medium WP Lightbox 2 Plugin wp-lightbox-2 Cross-Site Scripting Unauthenticated Stored XSS No login needed < 3.0.6.8 Fixed in 3.0.6.8 CVE-2025-3745 WPScan
6.4 Medium EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode ≤ 5.25.11 CVE-2025-6462 Wordfence
4.3 Medium MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin paid-membership Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.2.0 CVE-2025-5937 Wordfence
8.8 High Game Users Share Buttons Plugin game-users-share-buttons Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter ≤ 1.3.0 CVE-2025-6755 Wordfence
9.8 Critical PT Project Notebooks Plugin project-notebooks Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function No login needed 1.0.0 – 1.1.3 CVE-2025-5304 Wordfence
6.4 Medium Qi Addons For Elementor Plugin qi-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.9.1 Fixed in 1.9.2 CVE-2025-6252 Wordfence
8.8 High BeeTeam368 Extensions Plugin Path Traversal Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion ≤ 2.3.4 CVE-2025-6381 Wordfence
6.4 Medium WP VR – 360 Panorama and Free Virtual Tour Builder Plugin wpvr Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.5.32 Fixed in 8.5.33 CVE-2025-6350 Wordfence
8.8 High BeeTeam368 Extensions Pro Plugin Path Traversal Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion ≤ 2.3.4 CVE-2025-6379 Wordfence
7.5 High Devnex Addons For Elementor Plugin devnex-addons-for-elementor Local File Inclusion ≤ 1.0.9 CVE-2025-53339 Patchstack
7.1 High re.place Plugin replace Cross-Site Request Forgery No login needed ≤ 0.2.1 CVE-2025-53338 Patchstack
6.5 Medium My Resume Builder Plugin my-resume-builder Cross-Site Scripting ≤ 1.0.3 CVE-2025-53336 Patchstack
7.1 High Track Everything Plugin track-everything Cross-Site Request Forgery No login needed ≤ 2.0.1 CVE-2025-53332 Patchstack
7.1 High RSS Digest Plugin rss-digest Cross-Site Request Forgery No login needed ≤ 1.5 CVE-2025-53331 Patchstack
7.1 High Społecznościowa 6 PL 2013 Plugin spolecznosciowa-6-pl-2013 Cross-Site Request Forgery No login needed ≤ 2.0.6 CVE-2025-53329 Patchstack
4.3 Medium Aioseo Multibyte Descriptions Plugin aioseo-multibyte-descriptions Cross-Site Request Forgery No login needed ≤ 0.0.6 CVE-2025-53327 Patchstack
5.9 Medium Beauty Contact Popup Form Plugin beauty-contact-popup-form Cross-Site Scripting ≤ 6.0 CVE-2025-53325 Patchstack
4.3 Medium Pre-Publish Post Checklist Plugin pre-publish-post-checklist Broken Access Control ≤ 3.1 CVE-2025-53323 Patchstack
5.3 Medium Accept Authorize.NET Payments Using Contact Form 7 Plugin accept-authorize-net-payments-using-contact-form-7 Information Disclosure Sensitive Data Exposure No login needed ≤ 2.5 Fixed in 2.6 CVE-2025-53322 Patchstack
6.5 Medium Raise The Money Plugin raise-the-money Cross-Site Scripting ≤ 5.2 CVE-2025-53321 Patchstack
6.5 Medium Free Downloads EDD Plugin free-downloads-edd Cross-Site Scripting ≤ 1.0.4 CVE-2025-53320 Patchstack
5.4 Medium WP DB Booster Plugin wp-db-booster Broken Access Control ≤ 1.0.1 CVE-2025-53318 Patchstack
7.1 High WPShapere - WordPress admin Plugin wpshapere-lite Cross-Site Request Forgery No login needed ≤ 1.4.1 CVE-2025-53317 Patchstack
7.1 High Relocate Upload Plugin relocate-upload Cross-Site Request Forgery No login needed ≤ 0.24.1 CVE-2025-53315 Patchstack
9.6 Critical WP Optimizer Plugin wp-optimizer Cross-Site Request Forgery No login needed ≤ 2.5.0 CVE-2025-53314 Patchstack
7.1 High Twitch TV Embed Suite Plugin twitch-tv-embed-suite Cross-Site Request Forgery No login needed ≤ 2.1.0 CVE-2025-53313 Patchstack
7.1 High OnionBuzz Plugin onionbuzz-viral-quiz Cross-Site Request Forgery No login needed ≤ 1.0.7 CVE-2025-53312 Patchstack
7.1 High Navayan Subscribe Plugin navayan-subscribe Cross-Site Request Forgery No login needed ≤ 1.13 CVE-2025-53311 Patchstack
7.1 High HidePost Plugin hidepost Cross-Site Request Forgery No login needed ≤ 2.3.8 CVE-2025-53310 Patchstack
5.3 Medium Accept Stripe Payments Using Contact Form 7 Plugin accept-stripe-payments-using-contact-form-7 Information Disclosure Sensitive Data Exposure No login needed ≤ 3.0 Fixed in 3.1 CVE-2025-53309 Patchstack
7.1 High Image Slider With Description Plugin image-slider-with-description Cross-Site Request Forgery No login needed ≤ 9.2 CVE-2025-53308 Patchstack
7.6 High WP Forum Server Plugin forum-server SQL Injection ≤ 1.8.2 CVE-2025-53306 Patchstack
7.1 High WP Forum Server Plugin forum-server Cross-Site Request Forgery No login needed ≤ 1.8.2 CVE-2025-53305 Patchstack
5.3 Medium Contact Form – 7 : Hide Success Message Plugin contact-form-7-hide-success-message Broken Access Control No login needed ≤ 1.1.4 CVE-2025-53304 Patchstack
6.5 Medium Theme Junkie Team Content Plugin theme-junkie-team-content Cross-Site Scripting ≤ 0.1.1 CVE-2025-53301 Patchstack
6.5 Medium Podcast Feed Player Widget and Shortcode Plugin podcast-feed-player-widget Cross-Site Scripting ≤ 2.2.0 CVE-2025-53300 Patchstack
4.9 Medium Plugin Inspector Plugin plugin-inspector Path Traversal Arbitrary File Download ≤ 1.5 CVE-2025-53298 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only