WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 18,751–18,800 of 29,694 vulnerabilities

Known WordPress vulnerabilities, page 376 of 594
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Age Verification Plugin agecheckernet Cross-Site Scripting Reflected cross-site scripting (XSS) No login needed 1.20.0 CVE-2025-22622 Fluid Attacks
6.4 Medium Easypromos Plugin easypromos Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.8 CVE-2024-13443 Wordfence
7.2 High Subscribe2 – Form, Email Subscribers & Newsletters Plugin subscribe2 Cross-Site Scripting Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter No login needed ≤ 10.43 CVE-2024-11582 Wordfence
6.1 Medium Booking Package Plugin booking-package Cross-Site Scripting Reflected Cross-Site Scripting via Locale Parameter No login needed ≤ 1.6.72 CVE-2024-13508 Wordfence
6.4 Medium Wonder Video Embed Plugin wonderplugin-video-embed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.2 CVE-2024-13743 Wordfence
8.6 High Paid Videochat Turnkey Site Plugin ppv-live-webcams Arbitrary File Deletion No login needed ≤ 7.2.12 Fixed in 7.3 CVE-2025-22663 Patchstack
7.5 High Atarim Plugin atarim-visual-collaboration Broken Access Control Arbitrary Content Deletion No login needed ≤ 4.0.9 Fixed in 4.1.0 CVE-2025-22657 Patchstack
8.1 High Cookie Monster Plugin cookie-monster Local File Inclusion No login needed ≤ 1.2.2 CVE-2025-22656 Patchstack
10.0 Critical Simplified Plugin simplified Arbitrary File Upload No login needed ≤ 1.0.6 Fixed in 1.0.7 CVE-2025-22654 Patchstack
6.5 Medium Smartarget Plugin smartarget-contact-us Cross-Site Scripting ≤ 1.5.3 CVE-2025-22650 Patchstack
5.3 Medium Real Estate Manager Plugin real-estate-manager Authentication Bypass Captcha Bypass Vulnerability No login needed ≤ 7.3 CVE-2025-22645 Patchstack
8.5 High Distance Rate Shipping for WooCommerce Plugin distance-rate-shipping-for-woocommerce-pro SQL Injection ≤ 1.3.4 CVE-2025-22639 Patchstack
9.8 Critical K Elements Plugin k-elements Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 5.4.0 Fixed in 5.4.0 CVE-2024-56000 Patchstack
6.5 Medium Drivr Lite – Google Drive Plugin drivr-google-drive-file-picker Cross-Site Scripting Google Drive Plugin plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) ≤ 1.0.1 CVE-2025-27016 Patchstack
5.3 Medium MediCenter - Health Medical Clinic Plugin medicenter Information Disclosure Sensitive Data Exposure No login needed ≤ 14.7 Fixed in 14.7 CVE-2025-27013 Patchstack
6.3 Medium Uncode Core Plugin Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias ≤ 2.9.1.6 CVE-2024-13689 Wordfence
4.3 Medium FormCraft Plugin formcraft-form-builder Broken Access Control Missing Authorization to Plugin Data Export in formcraft-main.php ≤ 3.9.11 CVE-2024-13783 Wordfence
6.5 Medium Uncode Theme Path Traversal Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia ≤ 2.9.1.6 CVE-2024-13691 Wordfence
5.4 Medium Uncode Theme Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via mle-description ≤ 2.9.1.6 CVE-2024-13667 Wordfence
7.2 High FormCraft - Premium WordPress Form Builder Plugin Cross-Site Scripting Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload No login needed ≤ 3.9.11 CVE-2025-0817 Wordfence
7.5 High Uncode Theme Path Traversal Unauthenticated Arbitrary File Read in uncode_admin_get_oembed No login needed ≤ 2.9.1.6 CVE-2024-13681 Wordfence
7.2 High Post SMTP Plugin post-smtp Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 3.0.2 CVE-2025-0521 Wordfence
7.3 High PressMart - Modern Elementor WooCommerce Theme Arbitrary Shortcode Execution Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.2.16 CVE-2024-13797 Wordfence
6.5 Medium Tour Master - Tour Booking, Travel, Hotel Plugin SQL Injection Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter ≤ 5.3.7 CVE-2024-13369 Wordfence
6.4 Medium Threepress Plugin threepress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.7.1 CVE-2024-13395 Wordfence
5.3 Medium Scratch & Win – Giveaways and Contests Plugin scratch-win-giveaways-for-website-facebook Broken Access Control Giveaways and Contests <= 2.8.0 - Missing Authorization to Unauthenticated Coupon Creation No login needed ≤ 2.8.0 CVE-2024-13316 Wordfence
9.8 Critical CarSpot – Dealership Wordpress Classified Theme Privilege Escalation Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover No login needed ≤ 2.4.3 CVE-2024-12860 Wordfence
4.3 Medium Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later Plugin flexible-wishlist Cross-Site Request Forgery Ecommerce Wishlist & Save for later <= 1.2.26 - Cross-Site Request Forgery to Wishlist Creation/Modification No login needed ≤ 1.2.26 CVE-2024-13718 Wordfence
6.4 Medium Web Stories Enhancer – Level Up Your Web Stories Plugin web-stories-enhancer Cross-Site Scripting Level Up Your Web Stories <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3 CVE-2024-13575 Wordfence
6.1 Medium Active Products Tables for WooCommerce. Use constructor to create tables Plugin profit-products-tables-for-woocommerce Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.0.6.6 CVE-2025-0864 Wordfence
4.3 Medium Ecwid by Lightspeed Ecommerce Shopping Cart Plugin ecwid-shopping-cart Cross-Site Request Forgery Cross-Site Request Forgery to Send Deactivation Message No login needed ≤ 6.12.27 CVE-2024-13795 Wordfence
6.4 Medium aBlocks – WordPress Gutenberg Blocks Plugin Cross-Site Scripting WordPress Gutenberg Blocks <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.1 CVE-2024-13465 Wordfence
6.4 Medium Online Payments – Get Paid with PayPal, Square & Stripe Plugin paypal-payment-button-by-vcita Cross-Site Scripting Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.20.0 CVE-2024-11895 Wordfence
7.2 High Super Testimonials Plugin sola-testimonials Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.0.1 CVE-2024-13704 Wordfence
6.1 Medium s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin s2member Cross-Site Scripting Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site Scripting No login needed ≤ 241216 CVE-2024-11376 Wordfence
6.1 Medium MemorialDay Plugin memorialday Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 1.0.4 CVE-2024-13523 Wordfence
8.1 High Affiliate Links: WordPress Plugin for Link Cloaking and Link Management Plugin Broken Access Control Missing Authorization to Unauthenticated Import/Export and PHP Object Injection No login needed ≤ 3.0.1 CVE-2024-13556 Wordfence
8.8 High Shopwarden – Automated WooCommerce monitoring & testing Plugin shopwarden Cross-Site Request Forgery Automated WooCommerce monitoring & testing <= 1.0.11 - Cross-Site Request Forgery to Arbitrary Options Update No login needed ≤ 1.0.11 CVE-2024-13315 Wordfence
4.3 Medium SpeedSize Image & Video AI-Optimizer Plugin speedsize-ai-image-optimizer Cross-Site Request Forgery Cross-Site Request Forgery to Clear Cache No login needed ≤ 1.5.1 CVE-2024-13438 Wordfence
6.4 Medium Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) Plugin simple-pricing-tables-vc-extension Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0 CVE-2024-13582 Wordfence
5.9 Medium 1 Click WordPress Migration Plugin – 100% FREE for a limited time Plugin 1-click-migration Information Disclosure Unauthenticated Sensitive Information Exposure via Database Backup in class-ocm-backup.php No login needed ≤ 2.2 CVE-2024-13609 Wordfence
6.4 Medium Simple Map No Api Plugin simple-map-no-api Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter ≤ 1.9 CVE-2024-13565 Wordfence
6.4 Medium Library Bookshelves Plugin library-bookshelves Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.10 CVE-2024-13464 Wordfence
8.8 High GetBookingsWp - Appointments & Bookings Plugin Basic Version Plugin get-bookings-wp Privilege Escalation Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover ≤ 1.1.27 CVE-2024-13677 Wordfence
7.5 High File Uploads Addon for WooCommerce Plugin woo-addon-uploads Arbitrary File Upload Unauthenticated Sensitive Information Exposure Through Unprotected Directory No login needed ≤ 1.7.1 CVE-2024-13622 Wordfence
5.3 Medium 1 Click WordPress Migration Plugin – 100% FREE for a limited time Plugin 1-click-migration Cross-Site Request Forgery Cross-Site Request Forgery to Backup Process Cancellation No login needed ≤ 2.2 CVE-2024-13555 Wordfence
5.5 Medium Reaction Buttons Plugin reaction-buttons Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 2.1.6 CVE-2024-13848 Wordfence
4.3 Medium Team Builder – Meet the Team Plugin team-display Broken Access Control Meet the Team <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 1.3 CVE-2024-13687 Wordfence
6.4 Medium Zigaform – Form Builder Lite Plugin zigaform-form-builder-lite Cross-Site Scripting Form Builder Lite <= 7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 7.4.7 CVE-2024-13573 Wordfence
5.3 Medium Actionwear products sync Plugin actionwear-products-sync Information Disclosure Unauthenticated Full Patch Disclosure No login needed ≤ 2.3.2 CVE-2024-13535 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only