WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,901–1,950 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 39 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Core Web Vitals & PageSpeed Booster Plugin core-web-vitals-pagespeed-booster Broken Access Control ≤ 1.0.28 CVE-2025-62144 Patchstack
5.8 Medium ColorWay Plugin colorway Information Disclosure Sensitive Data Exposure No login needed ≤ 4.2.3 CVE-2025-59003 Patchstack
5.9 Medium Add Featured Image Custom Link Plugin custom-url-to-featured-image Cross-Site Scripting ≤ 2.0.0 CVE-2025-62119 Patchstack
5.9 Medium Logo Slider , Logo Carousel , Logo showcase , Client Logo Plugin tc-logo-slider Cross-Site Scripting ≤ 1.8.1 CVE-2025-62121 Patchstack
5.9 Medium WP Post Signature Plugin wp-post-signature Cross-Site Scripting ≤ 0.4.1 CVE-2025-62124 Patchstack
5.9 Medium WooCommerce Parcelas Plugin woocommerce-parcelas Cross-Site Scripting ≤ 1.3.5 CVE-2025-62750 Patchstack
5.9 Medium Locatoraid Store Locator Plugin locatoraid Cross-Site Scripting ≤ 3.9.68 CVE-2025-62140 Patchstack
5.9 Medium Post Video Players Plugin video-playlist-and-gallery-plugin Cross-Site Scripting ≤ 1.163 CVE-2025-62142 Patchstack
5.9 Medium Add Custom Codes Plugin add-custom-codes Cross-Site Scripting ≤ 4.80 Fixed in 5.0 CVE-2025-62149 Patchstack
6.5 Medium Bootstrap Modals Plugin bootstrap-modals Cross-Site Scripting ≤ 1.3.2 CVE-2025-62095 Patchstack
6.5 Medium Maximum Products per User for WooCommerce Plugin maximum-products-per-user-for-woocommerce Cross-Site Scripting ≤ 4.4.3 Fixed in 4.4.4 CVE-2025-62096 Patchstack
6.5 Medium SEO Slider Plugin seo-slider Cross-Site Scripting ≤ 1.1.1 CVE-2025-62097 Patchstack
6.5 Medium Postie Plugin postie Cross-Site Scripting ≤ 1.9.73 Fixed in 1.9.74 CVE-2025-63020 Patchstack
6.5 Medium Extra Shortcodes Plugin extra-shortcodes Cross-Site Scripting ≤ 2.2 CVE-2025-62111 Patchstack
6.5 Medium Audiomack Plugin audiomack Cross-Site Scripting ≤ 1.4.8 CVE-2025-49357 Patchstack
6.5 Medium Curator.io Plugin curatorio Cross-Site Scripting ≤ 1.9.5 Fixed in 1.9.6 CVE-2025-62742 Patchstack
6.5 Medium AdWords Conversion Tracking Code Plugin adwords-conversion-tracking-code Cross-Site Scripting ≤ 1.0 CVE-2025-62118 Patchstack
6.5 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting ≤ 3.9.2 CVE-2025-62990 Patchstack
6.5 Medium Custom Background Changer Plugin custom-background-changer Cross-Site Scripting ≤ 3.0 CVE-2025-62125 Patchstack
6.5 Medium MyBookTable Bookstore Plugin mybooktable Cross-Site Scripting ≤ 3.6.0 CVE-2025-62743 Patchstack
6.5 Medium Page Title Splitter Plugin page-title-splitter Cross-Site Scripting ≤ 2.5.9 CVE-2025-62744 Patchstack
6.5 Medium Web and WooCommerce Addons for WPBakery Builder Plugin vc-addons-by-bit14 Cross-Site Scripting ≤ 1.5 CVE-2025-62748 Patchstack
6.5 Medium Content Fetcher Plugin content-fetcher Cross-Site Scripting ≤ 1.1 CVE-2025-49358 Patchstack
6.5 Medium User Specific Content Plugin user-specific-content Cross-Site Scripting ≤ 1.0.6 CVE-2025-62749 Patchstack
6.5 Medium Kalender.digital Plugin kalender-digital Cross-Site Scripting ≤ 1.0.13 Fixed in 1.0.14 CVE-2025-62752 Patchstack
6.5 Medium Responsive Block Control Plugin responsive-block-control Cross-Site Scripting ≤ 1.3.0 Fixed in 1.3.1 CVE-2025-62135 Patchstack
6.5 Medium The Moneytizer Plugin the-moneytizer Cross-Site Scripting ≤ 10.0.9 Fixed in 10.0.10 CVE-2025-62756 Patchstack
6.5 Medium WebMan Amplifier Plugin webman-amplifier Cross-Site Scripting ≤ 1.5.12 Fixed in 1.6.0 CVE-2025-62757 Patchstack
6.5 Medium Minamaze Plugin minamaze Cross-Site Scripting ≤ 1.10.1 CVE-2025-62991 Patchstack
6.5 Medium Consulting Theme consulting Cross-Site Scripting ≤ 1.5.0 CVE-2025-63032 Patchstack
6.5 Medium Melos Plugin melos Cross-Site Scripting ≤ 1.6.0 CVE-2025-62136 Patchstack
6.5 Medium Everest Backup Plugin everest-backup Cross-Site Request Forgery No login needed ≤ 2.3.11 CVE-2025-62992 Patchstack
6.5 Medium Shuttle Plugin shuttle Cross-Site Scripting ≤ 1.5.0 CVE-2025-62137 Patchstack
6.5 Medium Funnelforms Free Plugin funnelforms-free Cross-Site Scripting ≤ 3.8 CVE-2025-62758 Patchstack
6.5 Medium Series Plugin series Cross-Site Scripting ≤ 2.0.1 CVE-2025-62759 Patchstack
6.5 Medium BuddyPress Activity Shortcode Plugin bp-activity-shortcode Cross-Site Scripting ≤ 1.1.8 Fixed in 1.1.9 CVE-2025-62760 Patchstack
6.5 Medium Sermon Manager Plugin sermon-manager-for-wordpress Cross-Site Scripting ≤ 2.30.0 CVE-2025-63000 Patchstack
6.5 Medium MX Time Zone Clocks Plugin mx-time-zone-clocks Cross-Site Scripting ≤ 5.1.1 CVE-2025-62146 Patchstack
6.5 Medium WordPress Tooltips Plugin wordpress-tooltips Cross-Site Scripting ≤ 10.9.3 CVE-2025-63005 Patchstack
6.5 Medium Knowledge Base documentation & wiki plugin – BasePress Plugin basepress Cross-Site Scripting BasePress plugin <= 2.17.0.1 - Cross Site Scripting (XSS) ≤ 2.17.0.1 Fixed in 2.17.0.2 CVE-2025-62761 Patchstack
6.5 Medium WPCal.io Plugin wpcal Cross-Site Scripting ≤ 0.9.5.9 Fixed in 0.9.5.10 CVE-2025-66103 Patchstack
4.3 Medium SiteLock Security – WP Hardening, Login Security & Malware Scans Plugin sitelock Broken Access Control ≤ 5.0.1 Fixed in 5.0.2 CVE-2025-62128 Patchstack
4.3 Medium Import into Easy Property Listings Plugin easy-property-listings-xml-csv-import Cross-Site Request Forgery No login needed ≤ 2.2.1 Fixed in 2.2.2 CVE-2025-62112 Patchstack
6.5 Medium Yada Wiki Plugin yada-wiki Cross-Site Scripting ≤ 3.5 Fixed in 3.6 CVE-2025-66094 Patchstack
6.5 Medium Featured Video for WordPress – VideographyWP Plugin videographywp Cross-Site Scripting VideographyWP plugin <= 1.0.18 - Cross Site Scripting (XSS) ≤ 1.0.18 Fixed in 1.0.20 CVE-2025-62746 Patchstack
5.3 Medium WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin gdpr-cookie-consent Broken Access Control No login needed ≤ 4.0.3 Fixed in 4.0.4 CVE-2025-66080 Patchstack
6.5 Medium WBC907 Core Plugin wbc907-core Cross-Site Scripting ≤ 3.4.1 Fixed in 3.4.2 CVE-2025-63027 Patchstack
6.5 Medium XStore Core Plugin et-core-plugin Cross-Site Scripting ≤ 5.6 Fixed in 5.6 CVE-2025-64190 Patchstack
5.3 Medium ShopMagic Plugin shopmagic-for-woocommerce Broken Access Control No login needed ≤ 4.7.2 Fixed in 4.7.3 CVE-2025-69093 Patchstack
6.5 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting ≤ 6.5.3 Fixed in 6.5.4 CVE-2025-69092 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only