WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 101–150 of 562 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High UberSlider PerpetuumMobile Plugin uberslider_perpetuummobile Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3 CVE-2026-28100 Patchstack
7.1 High UberSlider Ultra Plugin uberslider_ultra Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3 CVE-2026-28099 Patchstack
8.8 High Slider Responsive Slideshow – Image slider, Gallery slideshow Plugin slider-responsive-slideshow PHP Object Injection Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection ≤ 1.5.4 CVE-2026-22346 Patchstack
6.5 Medium Testimonial Slider Plugin testimonial Broken Access Control ≤ 2.0.15 CVE-2025-68000 Patchstack
4.4 Medium Client Testimonial Slider Plugin wp-client-testimonial Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Testimonial Heading' Setting ≤ 2.0 CVE-2026-2716 Wordfence
4.3 Medium Serious Slider Plugin cryout-serious-slider Broken Access Control ≤ 1.2.7 Fixed in 1.3.0 CVE-2026-25399 Patchstack
9.8 Critical Slider Future Plugin slider-future Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.0.5 CVE-2026-1405 Wordfence
7.5 High Flexi Product Slider and Grid for WooCommerce Plugin flexi-product-slider-grid Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute ≤ 1.0.5 CVE-2026-1988 Wordfence
5.4 Medium Accordion and Accordion Slider Plugin accordion-and-accordion-slider Broken Access Control Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification ≤ 1.4.5 CVE-2026-0727 Wordfence
6.4 Medium Slideshow Wp Plugin slideshow-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute ≤ 1.1 CVE-2026-1885 Wordfence
6.4 Medium Wonka Slide Plugin wonka-slide Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.3 CVE-2026-1613 Wordfence
6.1 Medium Subitem AL Slider Plugin subitem-al-slider Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed ≤ 1.0.0 CVE-2026-1634 Wordfence
5.5 Medium Post Slides Plugin Local File Inclusion Contributor+ Local File Inclusion ≤ 1.0.1 CVE-2025-15491 WPScan
5.9 Medium Logo Slider Plugin logo-slider-wp Cross-Site Scripting ≤ 5.1.1 CVE-2026-24626 Patchstack
6.5 Medium B Slider Plugin b-slider Cross-Site Scripting ≤ 2.0.6 Fixed in 2.0.7 CVE-2026-24383 Patchstack
6.5 Medium Carousel Horizontal Posts Content Slider Plugin carousel-horizontal-posts-content-slider Cross-Site Scripting ≤ 3.3.2 CVE-2026-22347 Patchstack
6.5 Medium Depicter Slider Plugin depicter Broken Access Control No login needed ≤ 4.0.4 Fixed in 4.0.5 CVE-2025-68558 Patchstack
6.5 Medium Slider Templates Plugin slider-templates Broken Access Control No login needed ≤ 1.0.3 CVE-2025-68009 Patchstack
7.1 High Accordion Slider PRO Plugin accordion_slider_pro Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2 CVE-2025-49066 Patchstack
7.1 High Magic Responsive Slider and Carousel Plugin magic_carousel Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6 CVE-2025-49043 Patchstack
7.1 High Magic Slider Plugin magic_slider Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.2 CVE-2025-48094 Patchstack
7.1 High Image&Video FullScreen Background Plugin lbg_fullscreen_fullwidth_slider Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.7 CVE-2025-47666 Patchstack
4.3 Medium Responsive Accordion Slider Plugin responsive-accordion-slider Broken Access Control Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images' ≤ 1.2.2 CVE-2026-0635 Wordfence
4.4 Medium Real Post Slider Lite Plugin real-post-slider-lite Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Settings ≤ 2.4 CVE-2026-0680 Wordfence
4.3 Medium CP Image Store with Slideshow Plugin cp-image-store Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Product Import ≤ 1.1.9 CVE-2026-0684 Wordfence
6.4 Medium Client Testimonial Slider Plugin wp-client-testimonial Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'aft_testimonial_meta_name' Metabox Field ≤ 2.0 CVE-2025-13897 Wordfence
4.3 Medium Image Slider Slideshow Plugin image-slider-slideshow Broken Access Control Insecure Direct Object References (IDOR) ≤ 1.8 CVE-2026-22489 Patchstack
6.5 Medium Block Slider Plugin block-slider Broken Access Control ≤ 2.2.3 CVE-2026-22522 Patchstack
7.1 High Header Image Slider Plugin header-image-slider Cross-Site Scripting No login needed ≤ 0.3 CVE-2024-30547 Patchstack
6.1 Medium Logo Slider Plugin gs-logo-slider Cross-Site Scripting Contributor+ Stored XSS No login needed < 4.9.0 Fixed in 4.9.0 CVE-2025-13153 WPScan
4.3 Medium Accordion Slider Gallery Plugin accordion-slider-gallery Broken Access Control ≤ 2.7 CVE-2025-62130 Patchstack
5.9 Medium Logo Slider , Logo Carousel , Logo showcase , Client Logo Plugin tc-logo-slider Cross-Site Scripting ≤ 1.8.1 CVE-2025-62121 Patchstack
6.5 Medium SEO Slider Plugin seo-slider Cross-Site Scripting ≤ 1.1.1 CVE-2025-62097 Patchstack
6.5 Medium Wp Text Slider Widget Plugin wp-text-slider-widget Cross-Site Scripting ≤ 1.0 CVE-2025-68868 Patchstack
7.1 High Content Grid Slider Plugin content-grid-slider Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.5 CVE-2025-68879 Patchstack
5.4 Medium YITH Slider for page builders Plugin yith-slider-for-page-builders Broken Access Control ≤ 1.0.11 CVE-2025-68581 Patchstack
4.9 Medium Prime Slider – Addons For Elementor Plugin bdthemes-prime-slider-lite Server-Side Request Forgery Addons For Elementor plugin <= 4.0.10 - Server Side Request Forgery (SSRF) ≤ 4.0.10 Fixed in 4.1.0 CVE-2025-68500 Patchstack
5.5 Medium Responsive and Swipe slider Plugin responsive-and-swipe-slider Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.2 CVE-2025-14721 Wordfence
4.3 Medium Prime Slider – Addons for Elementor Plugin bdthemes-prime-slider-lite Server-Side Request Forgery Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery ≤ 4.0.9 CVE-2025-14277 Wordfence
8.8 High Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery Plugin nextgen-gallery Local File Inclusion NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template' ≤ 3.59.12 CVE-2025-13641 Wordfence
8.5 High LBG Zoominoutslider Plugin lbg_zoominoutslider SQL Injection ≤ 5.4.4 Fixed in 5.4.5 CVE-2025-68056 Patchstack
6.5 Medium Stars Testimonials Plugin stars-testimonials-with-slider-and-masonry-grid Cross-Site Scripting ≤ 3.3.4 Fixed in 3.3.5 CVE-2025-67912 Patchstack
4.3 Medium Quick Interest Slider Plugin quick-interest-slider Cross-Site Request Forgery No login needed ≤ 3.1.5 Fixed in 3.1.6 CVE-2025-64237 Patchstack
4.3 Medium Image Slider by Ays- Responsive Slider and Carousel Plugin ays-slider Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Slider Deletion No login needed ≤ 2.7.0 CVE-2025-14454 Wordfence
6.4 Medium HT Slider for Elementor Plugin ht-slider-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.7.4 CVE-2025-14278 Wordfence
6.1 Medium Simple AL Slider Plugin simple-al-slider Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed ≤ 1.2.10 CVE-2025-14137 Wordfence
6.4 Medium Better Elementor Addons Plugin better-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget ≤ 1.5.5 CVE-2025-12830 Wordfence
6.4 Medium Simple Nivo Slider Plugin simple-nivo-slider Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.5.6 CVE-2025-13889 Wordfence
5.3 Medium Slider a SlidersPack Plugin sliderspack-all-in-one-image-sliders Broken Access Control No login needed < 2.3 Fixed in 2.3 CVE-2022-46845 Patchstack
6.5 Medium Master Slider Pro Plugin masterslider Cross-Site Scripting ≤ 3.7.12 CVE-2025-63045 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only