WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 101–150 of 284 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium User Registration & Membership Plugin user-registration Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Deletion No login needed ≤ 4.4.8 CVE-2025-14976 Wordfence
5.3 Medium WP-Members Membership Plugin wp-members Information Disclosure Unauthenticated Information Exposure via Unprotected Files No login needed ≤ 3.5.4.4 CVE-2025-12648 Wordfence
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.0.3 Fixed in 3.0.4 CVE-2025-67909 Patchstack
6.4 Medium Membership Plugin – Restrict Content Plugin restrict-content Cross-Site Scripting Restrict Content <= 3.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes ≤ 3.2.15 CVE-2025-14000 Wordfence
5.3 Medium Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member Information Disclosure User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure No login needed ≤ 2.11.0 CVE-2025-12492 Wordfence
6.4 Medium User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Plugin user-registration Cross-Site Scripting Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.4.6 CVE-2025-13367 Wordfence
9.8 Critical Elated Membership Plugin Authentication Bypass Authentication Bypass via Social Login No login needed ≤ 1.2 CVE-2025-13613 Wordfence
4.3 Medium ARMember Plugin armember-membership Broken Access Control Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control ≤ 3.4.10 Fixed in 3.4.11 CVE-2022-47425 Patchstack
9.8 Critical CRM Memberships Plugin crm-memberships Broken Access Control Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint No login needed ≤ 2.6 CVE-2025-13313 Wordfence
5.3 Medium CRM Memberships Plugin crm-memberships Broken Access Control Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action No login needed ≤ 2.5 CVE-2025-13312 Wordfence
9.8 Critical Tiare Membership Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.2 CVE-2025-13540 Wordfence
9.8 Critical FindAll Membership Plugin Authentication Bypass Authentication Bypass via Social Login No login needed ≤ 1.0.4 CVE-2025-13539 Wordfence
5.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Other Unauthenticated Fake Payment Creation No login needed ≤ 1.1.7 CVE-2025-12752 Wordfence
5.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Broken Access Control No login needed ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-66107 Patchstack
4.4 Medium MembershipWorks Plugin memberfindme Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 6.14 CVE-2025-12018 Wordfence
7.1 High Team Members Showcase Plugin wps-team Cross-Site Scripting Reflected XSS No login needed < 3.5.0 Fixed in 3.5.0 CVE-2025-11560 WPScan
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal No login needed ≤ 2.16.4 CVE-2025-11835 Wordfence
7.5 High wpForo Forum Plugin wpforo SQL Injection Unauthenticated SQL Injection via get_members Function No login needed ≤ 2.4.8 CVE-2025-4203 Wordfence
7.1 High SUMO Memberships for WooCommerce Plugin sumomemberships Cross-Site Request Forgery No login needed ≤ 7.8.0 Fixed in 7.8.0 CVE-2025-62005 Patchstack
8.8 High SUMO Memberships for WooCommerce Plugin sumomemberships Privilege Escalation ≤ 7.8.0 Fixed in 7.9.0 CVE-2025-60222 Patchstack
6.5 Medium SUMO Memberships for WooCommerce Plugin sumomemberships Broken Access Control Arbitrary Content Deletion ≤ 7.8.0 Fixed in 7.8.0 CVE-2025-52757 Patchstack
5.3 Medium Login with YourMembership - YM SSO Login Plugin login-with-yourmembership Broken Access Control YM SSO Login <= 1.1.7 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'moym_display_test_attributes' No login needed ≤ 1.1.7 CVE-2025-10648 Wordfence
6.4 Medium Team Members Plugin team-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.3.5 CVE-2025-8440 Wordfence
5.5 Medium WP-Members Plugin wp-members Cross-Site Scripting ≤ 3.5.4.2 Fixed in 3.5.4.3 CVE-2025-57973 Patchstack
5.3 Medium Memberful - Membership Plugin memberful-wp Broken Access Control No login needed ≤ 1.75.0 Fixed in 1.76.0 CVE-2025-58000 Patchstack
8.8 High StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Plugin storeengine Arbitrary File Upload Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload ≤ 1.5.0 CVE-2025-9216 Wordfence
6.5 Medium StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Plugin storeengine Path Traversal Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download ≤ 1.5.0 CVE-2025-9215 Wordfence
5.0 Medium WP-Members Membership Plugin wp-members Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names ≤ 3.5.4.2 CVE-2025-9489 Wordfence
6.5 Medium UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Plugin userswp SQL Injection Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.44 - Authenticated (Subscriber+) SQL Injection ≤ 1.2.44 CVE-2025-10003 Wordfence
4.9 Medium User Registration & Membership Plugin user-registration SQL Injection Authenticated (Admin+) SQL Injection ≤ 4.3.0 CVE-2025-9085 Wordfence
5.9 Medium GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership Plugin gourl-bitcoin-payment-gateway-paid-downloads-membership Cross-Site Scripting ≤ 1.6.6 CVE-2025-48102 Patchstack
8.1 High Wptobe-memberships Plugin wptobe-memberships Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion ≤ 3.4.2 CVE-2025-9048 Wordfence
6.5 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Arbitrary Shortcode Execution ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 4.16.4 CVE-2025-8878 Wordfence
5.4 Medium WP Membership Plugin wp-membership Broken Access Control Settings Change ≤ 1.6.3 Fixed in 1.6.4 CVE-2025-54717 Patchstack
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control No login needed ≤ 2.9.0 Fixed in 3.0.0 CVE-2025-54692 Patchstack
6.4 Medium WP-Members Plugin wp-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.5.4.1 CVE-2025-7495 Wordfence
4.3 Medium MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin paid-membership Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.2.0 CVE-2025-5937 Wordfence
6.5 Medium WP-Members Plugin wp-members Cross-Site Scripting ≤ 3.5.4 Fixed in 3.5.4.1 CVE-2025-50051 Patchstack
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control No login needed ≤ 2.8.1 Fixed in 2.8.2 CVE-2025-49265 Patchstack
5.9 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.6.3 Fixed in 4.6.4 CVE-2025-49333 Patchstack
6.4 Medium WP-Members Plugin wp-members Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode ≤ 3.5.2 CVE-2025-4610 Wordfence
4.8 Medium Team Members Showcase Plugin wps-team Cross-Site Scripting Editor+ Stored XSS < 4.4.2 Fixed in 4.4.2 CVE-2024-9236 WPScan
6.1 Medium MemberSpace – Membership Plugin and Paid Subscriptions Plugin Cross-Site Scripting Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS No login needed < 2.1.14 Fixed in 2.1.14 CVE-2024-13727 WPScan
5.3 Medium User Registration & Membership – Custom Registration Form, Login Form, and User Profile Plugin user-registration Broken Access Control Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion No login needed ≤ 4.2.1 CVE-2025-3281 Wordfence
6.4 Medium Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder Plugin wps-team Cross-Site Scripting Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.4.1 CVE-2025-3521 Wordfence
8.1 High User Registration & Membership Plugin user-registration Authentication Bypass No login needed < 4.1.3 Fixed in 4.1.3 CVE-2025-2594 WPScan
4.3 Medium User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile Plugin Cross-Site Request Forgery Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion No login needed ≤ 5.1.3 CVE-2025-3284 Wordfence
9.8 Critical UrbanGo Membership Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.0.4 CVE-2025-3278 Wordfence
8.8 High Team Members Plugin wps-team PHP Object Injection ≤ 3.4.4 Fixed in 3.4.5 CVE-2025-32686 Patchstack
6.5 Medium Membership For WooCommerce Plugin membership-for-woocommerce Cross-Site Scripting ≤ 2.8.0 Fixed in 2.8.1 CVE-2025-39579 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only