WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 14,751–14,800 of 29,758 vulnerabilities

Known WordPress vulnerabilities, page 296 of 596
Severity Component Vulnerability Affected versions Published CVE Source
9.3 Critical WordPress-WPJobBoard Plugin click-pledge-wpjobboard SQL Injection No login needed ≤ 25.07010000-WP6.8.1-JB5.11.5 Fixed in 25.09000000-WP6.8.2-JB5.12.0 CVE-2025-49455 Patchstack
9.8 Critical CozyStay Theme cozystay PHP Object Injection No login needed ≤ 1.7.1 Fixed in 1.7.1 CVE-2025-49507 Patchstack
5.3 Medium Audio Editor & Recorder Plugin audio-editor-recorder Broken Access Control No login needed ≤ 2.2.1 Fixed in 2.2.2 CVE-2025-49509 Patchstack
4.3 Medium Min Max Step Quantity Limits Manager for WooCommerce Plugin product-quantity-for-woocommerce Cross-Site Request Forgery No login needed ≤ 5.1.0 Fixed in 5.1.1 CVE-2025-49510 Patchstack
7.1 High Civi Framework Plugin civi-framework Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to User Deactivation No login needed ≤ 2.1.6 Fixed in 2.1.6.4 CVE-2025-49511 Patchstack
6.4 Medium Smash Balloon Custom Facebook Feed Plugin custom-facebook-feed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute ≤ 4.3.1 CVE-2025-4577 Wordfence
6.4 Medium Ultimate Blocks – WordPress Blocks Plugin ultimate-blocks Cross-Site Scripting WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 3.3.3 CVE-2025-2918 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 4.11.8 CVE-2025-4774 Wordfence
8.8 High Axle Demo Importer Plugin Arbitrary File Upload Author+ Arbitrary File Upload ≤ 1.0.3 CVE-2025-4954 WPScan
7.5 High Likes and Dislikes Plugin SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.0.0 CVE-2025-4840 WPScan
6.4 Medium Elementor Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.29.0 CVE-2025-3076 Wordfence
8.8 High RH - Real Estate Theme Privilege Escalation Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation ≤ 4.4.0 CVE-2025-4601 Wordfence
4.3 Medium Bunny’s Print CSS Plugin bunnys-print-css Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 0.95 CVE-2025-5925 Wordfence
8.1 High Fitrush Theme bw-fitrush Local File Inclusion No login needed ≤ 1.3.4 CVE-2023-26005 Patchstack
8.1 High BodyCenter - Gym, Fitness WooCommerce Theme bodycenter Local File Inclusion Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Local File Inclusion No login needed ≤ 2.4 CVE-2023-25999 Patchstack
8.1 High One-Login Plugin one-login Privilege Escalation No login needed ≤ 1.4 CVE-2025-23974 Patchstack
9.3 Critical TicketBAI Facturas para WooCommerce Plugin wp-ticketbai SQL Injection No login needed ≤ 3.19 Fixed in 3.21 CVE-2025-24767 Patchstack
8.1 High CraftXtore Plugin bw-craftxtore Local File Inclusion No login needed ≤ 1.7 CVE-2025-24770 Patchstack
8.1 High Nitan Plugin snsnitan Local File Inclusion No login needed ≤ 2.9 CVE-2025-24768 Patchstack
8.1 High Lab Plugin lab Local File Inclusion No login needed ≤ 1.0.0 CVE-2025-26592 Patchstack
8.1 High Petito Plugin bw-petito Local File Inclusion No login needed ≤ 1.6.6 Fixed in 1.6.6 CVE-2025-27362 Patchstack
8.1 High Avaz Plugin snsavaz Local File Inclusion No login needed ≤ 2.8 CVE-2025-28944 Patchstack
8.1 High GiftXtore Plugin bw-giftxtore Local File Inclusion No login needed ≤ 1.7.7 Fixed in 1.7.7 CVE-2025-28888 Patchstack
8.1 High Valen - Sport, Fashion WooCommerce Plugin valen Local File Inclusion Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Local File Inclusion No login needed ≤ 2.4 CVE-2025-28945 Patchstack
8.8 High Password Policy Manager Plugin password-policy-manager Privilege Escalation Account Takeover ≤ 2.0.4 Fixed in 2.0.5 CVE-2025-31019 Patchstack
8.1 High SNS Anton Plugin snsanton Local File Inclusion No login needed ≤ 4.1 CVE-2025-28992 Patchstack
9.8 Critical PayU India Plugin payu-india Privilege Escalation Account Takeover No login needed ≤ 3.8.8 Fixed in 3.8.8 CVE-2025-31022 Patchstack
7.5 High elfsight Contact Form widget Plugin elfsight-contact-form Information Disclosure Sensitive Data Exposure No login needed ≤ 2.3.1 CVE-2025-31045 Patchstack
9.1 Critical Category Icon Plugin category-icon XML External Entity ≤ 1.0.3 CVE-2025-31039 Patchstack
7.5 High Apptha Slider Gallery Plugin apptha-slider-gallery Path Traversal Arbitrary File Read No login needed ≤ 2.5 CVE-2025-31050 Patchstack
9.8 Critical The Fashion - Model Agency One Page Beauty Plugin nrgfashion PHP Object Injection Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data No login needed ≤ 1.4.4 CVE-2025-31052 Patchstack
7.1 High Universal Video Player Plugin elementor_widget_universal_video_player Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.4.0 CVE-2025-31057 Patchstack
7.1 High Revolution Video Player Plugin revolution_video_player Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.9.2 CVE-2025-31058 Patchstack
9.3 Critical WBW Product Table PRO Plugin woo-producttables-pro SQL Injection No login needed ≤ 2.2.6 Fixed in 2.2.7 CVE-2025-31059 Patchstack
7.1 High Wishlist Plugin wishlist Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.1.0 CVE-2025-31061 Patchstack
9.8 Critical PIMP - Creative MultiPurpose Theme pimp PHP Object Injection Creative MultiPurpose <= 1.7 - Deserialization of untrusted data No login needed ≤ 1.7 CVE-2025-31398 Patchstack
9.8 Critical FLAP - Business Theme flap PHP Object Injection Business WordPress Theme <= 1.5 - PHP Object Injection No login needed ≤ 1.5 CVE-2025-31396 Patchstack
9.3 Critical WP Lead Capturing Pages Plugin leadcapture SQL Injection No login needed ≤ 2.6 Fixed in 2.6 CVE-2025-31424 Patchstack
7.1 High Sticky Radio Player Plugin lbg-audio5-html5-shoutcast_sticky Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.4 CVE-2025-31426 Patchstack
7.5 High CLEVER Plugin lbg-audio11-html5-shoutcast_history Path Traversal Arbitrary File Download No login needed ≤ 2.6 CVE-2025-31635 Patchstack
9.8 Critical PressGrid - Frontend Publish Reaction & Multimedia Theme press-grid PHP Object Injection Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Deserialization of untrusted data No login needed ≤ 1.3.1 CVE-2025-31429 Patchstack
7.1 High Spare Theme spare Cross-Site Scripting No login needed ≤ 1.7 CVE-2025-31638 Patchstack
7.1 High Universal Video Player Plugin universal_video_player Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.8.3 CVE-2025-31917 Patchstack
8.5 High WP Guppy Plugin wp-guppy SQL Injection ≤ 4.3.3 CVE-2025-31920 Patchstack
7.1 High SHOUT Plugin lbg-audio8-html5-radio_ads Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.5.3 CVE-2025-31925 Patchstack
7.1 High FlatNews Theme flatnews Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.8 Fixed in 6.2 CVE-2025-32305 Patchstack
10.0 Critical SUMO Affiliates Pro Plugin affs Arbitrary File Upload No login needed ≤ 11.1.0 Fixed in 11.1.0 CVE-2025-32291 Patchstack
7.6 High Team Builder Plugin a-team-showcase Broken Access Control ≤ 1.5.7 CVE-2025-32308 Patchstack
8.1 High Seofy Core Plugin seofy-core Local File Inclusion No login needed ≤ 1.6.8 Fixed in 1.6.11 CVE-2025-39473 Patchstack
8.1 High Krowd Theme krowd Local File Inclusion No login needed ≤ 1.5.0 Fixed in 1.5.0 CVE-2025-32595 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only