WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 101–150 of 425 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.2 High	GetContentFromURL Plugin `getcontentfromurl`	Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute No login needed	`≤ 1.0`	Jan 14, 2026	`CVE-2025-14613`	Wordfence
7.1 High	DASHBOARD BUILDER Plugin `dashboard-builder`	Cross-Site Request Forgery Cross-Site Request Forgery to SQL Injection No login needed	`≤ 1.5.7`	Jan 14, 2026	`CVE-2025-14615`	Wordfence
7.1 High	Zoho ZeptoMail Plugin `transmail`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 3.3.1` Fixed in `3.3.2`	Dec 31, 2025	`CVE-2025-49028`	Patchstack
7.1 High	Custom Style Plugin `custom-style`	Cross-Site Request Forgery No login needed	`≤ 1.0`	Dec 31, 2025	`CVE-2025-49342`	Patchstack
7.1 High	Noindex by Path Plugin `noindex-by-path`	Cross-Site Request Forgery No login needed	`≤ 1.0`	Dec 31, 2025	`CVE-2025-49353`	Patchstack
7.1 High	Custom Post Status Plugin `custom-post-status`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.1.0`	Dec 31, 2025	`CVE-2025-68885`	Patchstack
7.1 High	Recent Posts From Each Category Plugin `recent-posts-from-each-category`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Dec 31, 2025	`CVE-2025-49354`	Patchstack
7.1 High	Social Profilr Plugin `social-profilr-display-social-network-profile`	Cross-Site Request Forgery No login needed	`≤ 1.0`	Dec 31, 2025	`CVE-2025-49343`	Patchstack
7.1 High	SensitiveTagCloud Plugin `sensitive-tag-cloud`	Cross-Site Request Forgery No login needed	`≤ 1.4.1`	Dec 31, 2025	`CVE-2025-49344`	Patchstack
7.1 High	WP-EasyArchives Plugin `wp-easyarchives`	Cross-Site Request Forgery No login needed	`≤ 3.1.2`	Dec 31, 2025	`CVE-2025-49345`	Patchstack
7.1 High	Simple Archive Generator Plugin `simple-archive-generator`	Cross-Site Request Forgery No login needed	`≤ 5.2`	Dec 31, 2025	`CVE-2025-49346`	Patchstack
7.1 High	Behance Portfolio Manager Plugin `portfolio-manager-powered-by-behance`	Cross-Site Request Forgery No login needed	`≤ 1.7.5` Fixed in `1.8.0`	Dec 31, 2025	`CVE-2025-59137`	Patchstack
7.1 High	WP-CalDav2ICS Plugin `wp-caldav2ics`	Cross-Site Request Forgery No login needed	`≤ 1.3.4`	Dec 30, 2025	`CVE-2025-59131`	Patchstack
7.1 High	Evergreen Post Tweeter Plugin `evergreen-post-tweeter`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.8.9`	Dec 24, 2025	`CVE-2025-67622`	Patchstack
7.2 High	HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player Plugin `html5-audio-player`	Server-Side Request Forgery The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery No login needed	`2.4.0 – 2.5.1`	Dec 19, 2025	`CVE-2025-13999`	Wordfence
8.8 High	Video Merchant Plugin `video-merchant`	Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary File Upload No login needed	`≤ 5.0.4`	Dec 10, 2025	`CVE-2025-14390`	Wordfence
7.1 High	New User Approve Plugin `new-user-approve`	Cross-Site Request Forgery No login needed	`≤ 3.2.3` Fixed in `3.2.4`	Dec 9, 2025	`CVE-2025-63030`	Patchstack
7.1 High	Create Posts & Terms Plugin `create-posts-terms`	Cross-Site Request Forgery No login needed	`≤ 1.3.1`	Dec 9, 2025	`CVE-2025-49351`	Patchstack
7.1 High	WP sIFR Plugin `wp-sifr`	Cross-Site Request Forgery No login needed	`≤ 0.6.8.1`	Dec 9, 2025	`CVE-2025-49347`	Patchstack
7.1 High	PDF Creator Lite Plugin `pdf-creator-lite`	Cross-Site Request Forgery No login needed	`≤ 1.2`	Dec 9, 2025	`CVE-2025-49341`	Patchstack
7.1 High	Rencontre Plugin `rencontre`	Cross-Site Request Forgery No login needed	`≤ 3.13.7` Fixed in `3.13.8`	Dec 9, 2025	`CVE-2025-67534`	Patchstack
8.8 High	User Generator and Importer Plugin `user-importer-and-generator`	Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation No login needed	`≤ 1.2.2`	Dec 5, 2025	`CVE-2025-12879`	Wordfence
8.8 High	Zegen Core Plugin	Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary File Upload No login needed	`≤ 2.0.1`	Nov 21, 2025	`CVE-2025-11087`	Wordfence
7.1 High	WP GDPR Cookie Consent Plugin `wp-gdpr-cookie-consent`	Cross-Site Request Forgery No login needed	`≤ 1.0.0`	Nov 6, 2025	`CVE-2025-53316`	Patchstack
7.1 High	Simple Stripe Plugin `simple-stripe`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 0.9.17`	Nov 6, 2025	`CVE-2025-48085`	Patchstack
7.1 High	wpNamedUsers Plugin `wpnamedusers`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 0.5`	Nov 6, 2025	`CVE-2025-48083`	Patchstack
7.1 High	Slick Google Map Plugin `slick-google-map`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 0.3`	Nov 6, 2025	`CVE-2025-48078`	Patchstack
7.1 High	Block Country Plugin `block-country`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.0`	Nov 6, 2025	`CVE-2025-48077`	Patchstack
7.1 High	replyMail Plugin `replymail`	Cross-Site Request Forgery No login needed	`≤ 1.2.0`	Nov 6, 2025	`CVE-2025-31029`	Patchstack
7.1 High	hpb seo Plugin `hpbseo`	Cross-Site Request Forgery No login needed	`≤ 3.0.1`	Oct 29, 2025	`CVE-2025-60075`	Patchstack
7.1 High	FanBridge signup Plugin `fanbridge-signup`	Cross-Site Request Forgery No login needed	`≤ 0.6`	Oct 27, 2025	`CVE-2025-62986`	Patchstack
7.1 High	CloudSearch Plugin `cloud-search`	Cross-Site Request Forgery No login needed	`≤ 3.0.0`	Oct 27, 2025	`CVE-2025-62962`	Patchstack
7.1 High	NikanWP WooCommerce Reporting Plugin `wc-reports-lite`	Cross-Site Request Forgery No login needed	`≤ 1.0.0` Fixed in `3.0.0`	Oct 27, 2025	`CVE-2025-62957`	Patchstack
7.1 High	Reloadly Plugin `reloadly-topup-widget`	Cross-Site Request Forgery No login needed	`≤ 2.0.1`	Oct 27, 2025	`CVE-2025-62956`	Patchstack
7.1 High	Did Prestashop Display Plugin `did-prestashop-display`	Cross-Site Request Forgery No login needed	`≤ 1.0.30`	Oct 27, 2025	`CVE-2025-62945`	Patchstack
7.1 High	WP Business Hours Plugin `wp-business-hours`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Oct 27, 2025	`CVE-2025-62934`	Patchstack
7.1 High	Awesome Testimonials Plugin `awesome-testimonials`	Cross-Site Request Forgery No login needed	`≤ 2.2.1`	Oct 27, 2025	`CVE-2025-62933`	Patchstack
7.1 High	Multilang Contact Form Plugin `multilang-contact-form`	Cross-Site Request Forgery No login needed	`≤ 1.5`	Oct 27, 2025	`CVE-2025-62896`	Patchstack
7.1 High	Pricing Table builder Plugin `wpdevart-pricing-table`	Cross-Site Request Forgery No login needed	`≤ 1.5.3`	Oct 27, 2025	`CVE-2025-62886`	Patchstack
8.8 High	Simple Registration for WooCommerce Plugin `woocommerce-simple-registration`	Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via Role Request Approval No login needed	`≤ 1.5.8`	Oct 25, 2025	`CVE-2025-12095`	Wordfence
7.5 High	Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers Plugin `popup-builder-block`	Server-Side Request Forgery Unauthenticated Server-Side Request Forgery No login needed	`≤ 2.1.4`	Oct 24, 2025	`CVE-2025-10861`	Wordfence
8.8 High	IndieAuth Plugin `indieauth`	Cross-Site Request Forgery Cross-Site Request Forgery to Account Takeover via Stolen OAuth Tokens No login needed	`≤ 4.5.4`	Oct 24, 2025	`CVE-2025-12028`	Wordfence
7.1 High	SUMO Memberships for WooCommerce Plugin `sumomemberships`	Cross-Site Request Forgery No login needed	`≤ 7.8.0` Fixed in `7.8.0`	Oct 22, 2025	`CVE-2025-62005`	Patchstack
8.8 High	Advanced Custom Fields : CPT Options Pages Plugin `acf-cpt-options-pages`	Cross-Site Request Forgery No login needed	`≤ 2.0.9`	Oct 22, 2025	`CVE-2025-60208`	Patchstack
7.1 High	HotelRunner Booking Widget Plugin `hotelrunner`	Cross-Site Request Forgery No login needed	`≤ 1.6`	Oct 22, 2025	`CVE-2025-60168`	Patchstack
7.1 High	Video Blogster Lite Plugin `video-blogster-lite`	Cross-Site Request Forgery No login needed	`≤ 1.2`	Oct 22, 2025	`CVE-2025-60132`	Patchstack
8.8 High	Theme Editor Plugin `theme-editor`	Cross-Site Request Forgery Cross-Site Request Forgery to Remote Code Execution No login needed	`≤ 3.0`	Oct 18, 2025	`CVE-2025-9890`	Wordfence
8.8 High	TextBuilder Plugin `textbuilder`	Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via Account Takeover No login needed	`1.0.0 – 1.1.1`	Oct 3, 2025	`CVE-2025-9213`	Wordfence
8.8 High	LatePoint Plugin `latepoint`	Cross-Site Request Forgery Cross-Site Request Forgery to Account Takeover via change_password() Function No login needed	`≤ 5.1.94`	Sep 30, 2025	`CVE-2025-7052`	Wordfence
7.1 High	GST for WooCommerce Plugin `gst-for-woocommerce`	Cross-Site Request Forgery No login needed	`≤ 2.0`	Sep 26, 2025	`CVE-2025-60173`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.