WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 15,201–15,250 of 29,758 vulnerabilities

Known WordPress vulnerabilities, page 305 of 596
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Category Widget Plugin category-widget Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0.2 CVE-2025-46515 Patchstack
6.5 Medium Web3Press Plugin likecoin Path Traversal Decentralize Publishing with Writing NFT plugin <= 3.2.0 - Arbitrary File Read ≤ 3.2.0 Fixed in 3.3.0 CVE-2025-46527 Patchstack
7.1 High My Custom Widgets Plugin mycustomwidget Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0.5 CVE-2025-46526 Patchstack
8.1 High WP Job Portal Plugin wp-job-portal Local File Inclusion No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2025-47438 Patchstack
9.3 Critical Fable Extra Plugin fable-extra SQL Injection No login needed ≤ 1.0.6 Fixed in 1.0.7 CVE-2025-46539 Patchstack
7.1 High Section Widget Plugin section-widget Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.3.1 CVE-2025-46537 Patchstack
7.1 High B2i Investor Tools Plugin b2i-investor-tools Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.7.9 Fixed in 1.0.8 CVE-2025-47458 Patchstack
8.1 High WP Smart Import Plugin wp-smart-import Local File Inclusion No login needed ≤ 1.1.3 Fixed in 1.1.4 CVE-2025-47453 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection ≤ 5.9.5.0 Fixed in 5.9.5.1 CVE-2025-47478 Patchstack
8.8 High Subaccounts for WooCommerce Plugin subaccounts-for-woocommerce Privilege Escalation Account Takeover ≤ 1.6.6 Fixed in 1.6.7 CVE-2025-47461 Patchstack
8.6 High Tainacan Plugin tainacan Arbitrary File Deletion No login needed ≤ 0.21.14 Fixed in 0.21.15 CVE-2025-47512 Patchstack
8.6 High Drag and Drop File Upload for Elementor Forms Plugin drag-and-drop-file-upload-for-elementor-forms Arbitrary File Deletion No login needed ≤ 1.4.3 Fixed in 1.5.0 CVE-2025-47492 Patchstack
6.5 Medium Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin experto-cta-widget Broken Access Control Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change No login needed ≤ 1.1.1 Fixed in 1.2.1 CVE-2025-47529 Patchstack
4.9 Medium Infocob CRM Forms Plugin infocob-crm-forms Path Traversal Arbitrary File Download ≤ 2.4.0 Fixed in 2.4.1 CVE-2025-47513 Patchstack
9.8 Critical CoinPayments.net Payment Gateway for WooCommerce Plugin coinpayments-payment-gateway-for-woocommerce PHP Object Injection No login needed ≤ 1.0.17 Fixed in 1.0.18 CVE-2025-47532 Patchstack
9.8 Critical WPFunnels Plugin wpfunnels PHP Object Injection No login needed ≤ 3.5.18 Fixed in 3.5.19 CVE-2025-47530 Patchstack
9.8 Critical Eventin Plugin wp-event-solution Privilege Escalation No login needed ≤ 4.0.26 Fixed in 4.0.27 CVE-2025-47539 Patchstack
8.6 High Opal Woo Custom Product Variation Plugin opal-woo-custom-product-variation Arbitrary File Deletion No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2025-47535 Patchstack
7.5 High MapSVG Plugin mapsvg Broken Access Control No login needed ≤ 8.6.13 Fixed in 8.6.13 CVE-2025-47558 Patchstack
7.5 High Mail Mint Plugin mail-mint Information Disclosure Sensitive Data Exposure No login needed ≤ 1.17.7 Fixed in 1.17.8 CVE-2025-47541 Patchstack
9.3 Critical Facturante Plugin facturante SQL Injection No login needed ≤ 1.11 Fixed in 1.13 CVE-2025-47599 Patchstack
8.5 High School Management Plugin school-management SQL Injection ≤ 92.0.0 CVE-2025-47575 Patchstack
9.8 Critical ZoomSounds Plugin dzs-zoomsounds PHP Object Injection No login needed ≤ 6.91 CVE-2025-47568 Patchstack
7.1 High User Meta Plugin user-meta Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.1.2 CVE-2025-47611 Patchstack
7.5 High belingoGeo Plugin belingogeo Path Traversal Arbitrary File Download No login needed ≤ 1.12.0 Fixed in 1.12.1 CVE-2025-47603 Patchstack
7.1 High BMI Adult & Kid Calculator Plugin bmi-adultkid-calculator Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.2 CVE-2025-47618 Patchstack
7.1 High School Management Plugin school-management Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 92.0.0 CVE-2025-47613 Patchstack
8.8 High Hospital Management System Plugin hospital-management Privilege Escalation 47.0(20 – 11 CVE-2025-47631 Patchstack
6.5 Medium 6Storage Rentals Plugin 6storage-rentals Broken Access Control ≤ 2.20.2 CVE-2025-47619 Patchstack
10.0 Critical STAGGS Plugin staggs Arbitrary File Upload No login needed ≤ 2.11.0 Fixed in 2.12.0 CVE-2025-47637 Patchstack
10.0 Critical Printcart Web to Print Product Designer for WooCommerce Plugin printcart-integration Arbitrary File Upload No login needed ≤ 2.3.9 Fixed in 2.4.0 CVE-2025-47641 Patchstack
9.3 Critical Printcart Web to Print Product Designer for WooCommerce Plugin printcart-integration SQL Injection No login needed ≤ 2.4.0 Fixed in 2.4.1 CVE-2025-47640 Patchstack
9.9 Critical ELEX WordPress HelpDesk & Customer Ticketing System Plugin elex-helpdesk-customer-support-ticket-system Arbitrary File Upload ≤ 3.2.9 Fixed in 3.3.0 CVE-2025-47658 Patchstack
9.8 Critical PSW Front-end Login & Registration Plugin psw-login-and-registration Authentication Bypass Broken Authentication No login needed ≤ 1.13 CVE-2025-47646 Patchstack
10.0 Critical Ajar in5 Embed Plugin ajar-productions-in5-embed Arbitrary File Upload No login needed ≤ 3.1.5 CVE-2025-47642 Patchstack
9.9 Critical Hospital Management System Plugin hospital-management Arbitrary File Upload 47.0(20 – 11 CVE-2025-47663 Patchstack
8.8 High WC Affiliate Plugin wc-affiliate PHP Object Injection ≤ 2.16 Fixed in 2.17 CVE-2025-47660 Patchstack
7.6 High Binary MLM Plan Plugin binary-mlm-plan SQL Injection ≤ 3.0 Fixed in 5.0 CVE-2025-47671 Patchstack
8.1 High WordPress Social Login and Register Plugin miniorange-login-openid Local File Inclusion No login needed ≤ 7.6.10 Fixed in 7.7.0 CVE-2025-47670 Patchstack
7.1 High Arconix Shortcodes Plugin arconix-shortcodes Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.1.16 Fixed in 2.1.17 CVE-2025-47673 Patchstack
8.1 High miniOrange Discord Integration Plugin miniorange-discord-integration Local File Inclusion No login needed ≤ 2.2.2 CVE-2025-47672 Patchstack
7.1 High xili-tidy-tags Plugin xili-tidy-tags Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.12.06 CVE-2025-47680 Patchstack
7.1 High FunnelCockpit Plugin funnelcockpit Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.4.3 Fixed in 1.4.4 CVE-2025-47678 Patchstack
8.8 High Lead Form Data Collection to CRM Plugin wp-leads-builder-any-crm Privilege Escalation Arbitrary Option Update to Privilege Escalation ≤ 3.1 Fixed in 3.2 CVE-2025-47690 Patchstack
10.0 Critical StoreKeeper for WooCommerce Plugin storekeeper-for-woocommerce Arbitrary File Upload No login needed ≤ 14.4.4 Fixed in 14.4.5 CVE-2025-47687 Patchstack
7.1 High Quick Contact Form Plugin quick-contact-form Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 8.2.1 Fixed in 8.2.2 CVE-2025-48245 Patchstack
7.1 High Verge3D Plugin verge3d Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.9.3 Fixed in 4.9.4 CVE-2025-48241 Patchstack
7.5 High WP Job Portal Plugin wp-job-portal Path Traversal Arbitrary File Download No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2025-48273 Patchstack
6.5 Medium Leadinfo Plugin leadinfo Broken Access Control Settings Change No login needed ≤ 1.1 Fixed in 2.1 CVE-2025-48271 Patchstack
7.1 High ReDi Restaurant Reservation Plugin redi-restaurant-reservation Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 24.1209 Fixed in 25.0513 CVE-2025-48286 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only