WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 17,851–17,900 of 29,694 vulnerabilities

Known WordPress vulnerabilities, page 358 of 594
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium Upload Quota per User Plugin upload-quota-per-user Cross-Site Scripting ≤ 1.3 CVE-2025-30537 Patchstack
5.9 Medium Beautiful Link Preview Plugin beautiful-link-preview Cross-Site Scripting ≤ 1.5.0 CVE-2025-30536 Patchstack
4.3 Medium External image replace Plugin external-image-replace Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed ≤ 1.0.8 CVE-2025-30535 Patchstack
4.3 Medium Image Captcha Plugin image-captcha Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed ≤ 1.2 CVE-2025-30534 Patchstack
5.9 Medium Message ticker Plugin message-ticker Cross-Site Scripting ≤ 9.3 CVE-2025-30533 Patchstack
5.9 Medium Weather Layer Plugin weather-layer Cross-Site Scripting ≤ 4.2.1 CVE-2025-30532 Patchstack
4.3 Medium WP Ride Booking Plugin wp-ride-booking Cross-Site Request Forgery No login needed ≤ 2.4 CVE-2025-30531 Patchstack
5.9 Medium AI Preloader Plugin ai-preloader Cross-Site Scripting ≤ 1.0.2 CVE-2025-30530 Patchstack
4.3 Medium Auto Load Next Post Plugin auto-load-next-post Cross-Site Request Forgery No login needed ≤ 1.5.14 CVE-2025-30529 Patchstack
9.3 Critical Awesome Logos Plugin awesome-logos Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 1.2 CVE-2025-30528 Patchstack
5.9 Medium My Bootstrap Menu Plugin my-bootstrap-menu Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.2.1 CVE-2025-30527 Patchstack
4.3 Medium Typekit Plugin typekit Cross-Site Request Forgery No login needed ≤ 1.2.3 CVE-2025-30526 Patchstack
7.6 High WP Profitshare Plugin wp-profitshare SQL Injection ≤ 1.4.9 CVE-2025-30525 Patchstack
7.6 High Super Simple Subscriptions Plugin super-simple-subscriptions SQL Injection ≤ 1.1.0 CVE-2025-30523 Patchstack
7.1 High Contact Form 7 Material Design Plugin cf7-material-design Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.0.0 CVE-2025-30522 Patchstack
4.3 Medium GP Back To Top Plugin gp-back-to-top Cross-Site Request Forgery No login needed ≤ 3.0 CVE-2025-30521 Patchstack
3.5 Low Slider, Gallery, Carousel by MetaSlider Plugin Cross-Site Scripting Editor+ Stored XSS < 3.95.0 Fixed in 3.95.0 CVE-2025-1203 WPScan
3.5 Low Slider, Gallery, Carousel by MetaSlider Plugin Cross-Site Scripting Editor+ Stored XSS < 3.95.0 Fixed in 3.95.0 CVE-2025-1062 WPScan
3.5 Low Photo Gallery by 10Web Plugin photo-gallery Cross-Site Scripting Admin+ Stored XSS < 1.8.33 Fixed in 1.8.33 CVE-2024-13124 WPScan
3.5 Low Form Maker by 10Web Plugin form-maker Cross-Site Scripting Admin+ Stored XSS < 1.15.30 Fixed in 1.15.30 CVE-2024-10558 WPScan
4.1 Medium Pods Plugin pods SQL Injection Admin+ SQL Injection < 3.2.8.2 Fixed in 3.2.8.2 CVE-2025-1446 WPScan
4.8 Medium Nested Pages Plugin wp-nested-pages Cross-Site Scripting Contributor+ Stored XSS < 3.2.13 Fixed in 3.2.13 CVE-2025-0718 WPScan
7.5 High Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit Plugin wp-marketing-automations SQL Injection Unauthenticated SQL Injection via 'automationId' No login needed ≤ 3.5.1 CVE-2025-2186 Wordfence
4.9 Medium Export and Import Users and Customers Plugin users-customers-import-export-for-wp-woocommerce Path Traversal Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function ≤ 2.6.2 CVE-2025-1973 Wordfence
5.3 Medium GiveWP – Donation Plugin and Fundraising Platform Plugin give Information Disclosure Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure No login needed ≤ 3.22.1 CVE-2025-2331 Wordfence
7.6 High Export and Import Users and Customers Plugin users-customers-import-export-for-wp-woocommerce Server-Side Request Forgery Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function ≤ 2.6.2 CVE-2025-1970 Wordfence
2.7 Low Export and Import Users and Customers Plugin users-customers-import-export-for-wp-woocommerce Path Traversal Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function ≤ 2.6.2 CVE-2025-1972 Wordfence
7.2 High Export and Import Users and Customers Plugin users-customers-import-export-for-wp-woocommerce PHP Object Injection Authenticated (Admin+) PHP Object Injection via form_data Parameter ≤ 2.6.2 CVE-2025-1971 Wordfence
6.4 Medium Bitspecter Suite Plugin bitspecter-suite Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.0 CVE-2025-2577 Wordfence
5.3 Medium Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Plugin fluentform Other Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing No login needed ≤ 5.2.12 CVE-2024-13666 Wordfence
4.9 Medium Code Clone Plugin code-clone SQL Injection Authenticated (Administrator+) SQL Injection via snippetId Parameter ≤ 0.9 CVE-2025-2478 Wordfence
4.3 Medium CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts Plugin cits-support-svg-webp-media-upload Arbitrary File Upload Cross-Site Request Forgery to Font Assignment Deletion No login needed ≤ 4.2 CVE-2024-13768 Wordfence
6.5 Medium WooCommerce Multivendor Marketplace – REST API Plugin wcfm-marketplace-rest-api SQL Injection REST API <= 1.6.2 - Authenticated (Subscriber+) SQL Injection ≤ 1.6.2 CVE-2025-1311 Wordfence
6.4 Medium Make Builder Plugin make-builder Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Function ≤ 1.1.10 CVE-2024-13856 Wordfence
6.1 Medium Gotcha | Gesture-based Captcha Plugin gotcha-gesture-based-captcha Cross-Site Scripting Reflected Cross-Site Scripting via menu Parameter No login needed ≤ 1.0.0 CVE-2025-2482 Wordfence
8.8 High Block Logic Plugin block-logic Remote Code Execution Authenticated (Contributor+) Remote Code Execution ≤ 1.0.8 CVE-2025-2303 Wordfence
6.1 Medium Multi Video Box Plugin multi-video-box Cross-Site Scripting Reflected Cross-Site Scripting via video_id and group_id Parameters No login needed ≤ 1.5.2 CVE-2025-2484 Wordfence
4.3 Medium CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts Plugin cits-support-svg-webp-media-upload Arbitrary File Upload Cross-Site Request Forgery to Settings Update No login needed ≤ 4.2 CVE-2025-0807 Wordfence
6.1 Medium Easy Custom Admin Bar Plugin easy-custom-admin-bar Cross-Site Scripting Reflected Cross-Site Scripting via msg Parameter No login needed ≤ 1.0 CVE-2025-2479 Wordfence
4.7 Medium CryoKey Plugin cryokey Cross-Site Scripting Reflected Cross-Site Scripting via 'ckemail' Parameter No login needed ≤ 2.4 CVE-2025-2477 Wordfence
8.8 High ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities PHP Object Injection User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection ≤ 5.9.4.5 CVE-2025-0724 Wordfence
4.3 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management ≤ 5.9.4.4 CVE-2025-1408 Wordfence
6.1 Medium Newsletters Plugin newsletters-lite Cross-Site Scripting Reflected Cross-Site Scripting via To Parameter No login needed ≤ 4.9.9.7 CVE-2024-13739 Wordfence
6.5 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection ≤ 5.9.4.7 CVE-2025-0723 Wordfence
4.3 Medium Motors – Car Dealer, Classifieds & Listing Plugin motors-car-dealership-classified-listings Broken Access Control Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation ≤ 1.4.57 CVE-2024-13737 Wordfence
4.9 Medium Order Export & Order Import for WooCommerce Plugin order-import-export-for-woocommerce Path Traversal Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function ≤ 2.6.0 CVE-2024-13920 Wordfence
6.4 Medium HT Mega – Absolute Addons For Elementor Plugin ht-mega-for-elementor Cross-Site Scripting Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 2.8.3 CVE-2025-1802 Wordfence
7.2 High Order Export & Order Import for WooCommerce Plugin order-import-export-for-woocommerce PHP Object Injection Authenticated (Admin+) PHP Object Injection via form_data Parameter ≤ 2.6.0 CVE-2024-13921 Wordfence
7.5 High File Away Plugin file-away Broken Access Control Missing Authorization to Unauthenticated Arbitrary File Read No login needed ≤ 3.9.9.0.1 CVE-2025-2539 Wordfence
2.7 Low Order Export & Order Import for WooCommerce Plugin order-import-export-for-woocommerce Path Traversal Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function ≤ 2.6.0 CVE-2024-13922 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only