WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.
Showing 151–200 of 220 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.3 High | Create custom forms for WordPress with a smart form plugin for smart businesses | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.2.4 |
CVE-2025-2801 |
Wordfence | |
| 7.5 High | WordPress Simple PayPal Shopping Cart | Price Manipulation Unauthenticated Product Price Manipulation No login needed |
≤ 5.1.2 |
CVE-2025-3530 |
Wordfence | |
| 8.2 High | WordPress Simple PayPal Shopping Cart | Information Disclosure Unauthenticated Information Exposure via file_url Parameter No login needed |
≤ 5.1.2 |
CVE-2025-3529 |
Wordfence | |
| 7.1 High | AT Internet SmartTag | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.2 |
CVE-2025-32506 |
Patchstack | |
| 7.1 High | Cart66 Cloud | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.3.7 |
CVE-2025-32653 |
Patchstack | |
| 7.5 High | Smart Agreements | Local File Inclusion No login needed |
≤ 1.0.3 Fixed in 1.0.4 |
CVE-2025-39462 |
Patchstack | |
| 7.1 High | Mobile Smart | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ v1.3.16 |
CVE-2025-31021 |
Patchstack | |
| 7.1 High | Smart Product Gallery Slider | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.0.4 |
CVE-2025-31392 |
Patchstack | |
| 8.8 High | WPC Smart Linked Products - Upsells & Cross-sells for WooCommerce | Privilege Escalation |
≤ 1.3.5 Fixed in 1.3.6 |
CVE-2025-30825 |
Patchstack | |
| 8.5 High | RJ Quickcharts | SQL Injection |
≤ 0.6.1 |
CVE-2025-31024 |
Patchstack | |
| 7.6 High | MC Woocommerce Wishlist | SQL Injection |
≤ 1.8.9 Fixed in 1.9.0 |
CVE-2025-30879 |
Patchstack | |
| 7.6 High | Cart tracking for WooCommerce | SQL Injection |
≤ 1.0.16 Fixed in 1.0.17 |
CVE-2025-30791 |
Patchstack | |
| 8.8 High | WPC Smart Upsell Funnel for WooCommerce | Privilege Escalation Arbitrary Option Update to Privilege Escalation |
≤ 3.0.4 Fixed in 3.0.5 |
CVE-2025-30772 |
Patchstack | |
| 7.1 High | Pixobe Cartography | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0.1 |
CVE-2025-23612 |
Patchstack | |
| 7.5 High | Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit | SQL Injection Unauthenticated SQL Injection via 'automationId' No login needed |
≤ 3.5.1 |
CVE-2025-2186 |
Wordfence | |
| 8.1 High | WooCommerce Recover Abandoned Cart | PHP Object Injection Unauthenticated PHP Object Injection No login needed |
≤ 24.4.0 |
CVE-2025-0956 |
Wordfence | |
| 7.1 High | sidebarTabs | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 3.1 |
CVE-2025-26587 |
Patchstack | |
| 7.1 High | Heartland Management Terminal | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.3.0 Fixed in 1.4.0 |
CVE-2025-23520 |
Patchstack | |
| 7.1 High | Smart Maintenance & Countdown | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.2 |
CVE-2025-27332 |
Patchstack | |
| 7.3 High | PressMart - Modern Elementor WooCommerce | Arbitrary Shortcode Execution Modern Elementor WooCommerce WordPress Theme <= 1.2.16 - Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 1.2.16 |
CVE-2024-13797 |
Wordfence | |
| 7.2 High | Welcart e-Commerce | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via name Parameter No login needed |
≤ 2.11.9 |
CVE-2025-0511 |
Wordfence | |
| 7.1 High | Smart DoFollow | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.0.2 |
CVE-2025-25152 |
Patchstack | |
| 7.1 High | RomanCart | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.0.2 |
CVE-2025-23685 |
Patchstack | |
| 8.8 High | MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics | Broken Access Control CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update |
≤ 1.5.9 |
CVE-2024-10591 |
Wordfence | |
| 7.5 High | WooCommerce Wishlist | Information Disclosure Unauthenticated Wishlist Disclosure via download_pdf_file Function No login needed |
≤ 1.8.7 |
CVE-2024-13694 |
Wordfence | |
| 7.6 High | Smart Manager | SQL Injection |
≤ 8.52.0 Fixed in 8.53.0 |
CVE-2025-22710 |
Patchstack | |
| 7.1 High | SEOReseller Partner | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.3.15 |
CVE-2025-23805 |
Patchstack | |
| 7.1 High | Theme My Ontraport Smartform | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.2.11 |
CVE-2025-23717 |
Patchstack | |
| 7.1 High | ECT Add to Cart Button | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.4 |
CVE-2025-23471 |
Patchstack | |
| 7.1 High | Partners | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.2.0 |
CVE-2025-22751 |
Patchstack | |
| 7.1 High | Smart Agenda | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 4.7 Fixed in 4.8 |
CVE-2025-22506 |
Patchstack | |
| 7.1 High | Opencart Product in WP | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0.1 |
CVE-2025-22335 |
Patchstack | |
| 7.5 High | WP Data Access – App, Table, Form and Chart Builder | SQL Injection App, Table, Form and Chart Builder plugin <= 5.5.22 - Unauthenticated SQL Injection No login needed |
≤ 5.5.22 Fixed in 5.5.23 |
CVE-2024-12428 |
Wordfence | |
| 7.1 High | Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 3.9 |
CVE-2024-54386 |
Patchstack | |
| 7.1 High | WP Flipkart Importer | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.4 |
CVE-2024-54432 |
Patchstack | |
| 8.1 High | Smart Forms | Broken Access Control Authenticated Arbitrary Options Change |
≤ 2.6.84 Fixed in 2.6.85 |
CVE-2023-49856 |
Patchstack | |
| 7.1 High | Continue Shopping From Cart | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.3 |
CVE-2024-53714 |
Patchstack | |
| 7.1 High | Third Party Cookie Eraser | Cross-Site Request Forgery CSRF to Cross Site Scripting (XSS) No login needed |
≤ 1.0.2 |
CVE-2024-53755 |
Patchstack | |
| 8.1 High | Sky Addons – Elementor Addons with Widgets & Templates | Cross-Site Request Forgery Cross-Site Request Forgery to Limited Arbitrary Options Update No login needed |
≤ 2.6.1 Fixed in 2.6.2 |
CVE-2024-11601 |
Wordfence | |
| 8.1 High | Sky Addons – Elementor Addons with Widgets & Templates | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update |
≤ 2.6.2 Fixed in 2.6.4 |
CVE-2024-11104 |
Wordfence | |
| 7.1 High | e-shops | Cross-Site Request Forgery CSRF to Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0.3 Fixed in 1.0.4 |
CVE-2024-51648 |
Patchstack | |
| 7.1 High | SmartLink Dynamic URLs | Cross-Site Request Forgery CSRF to Stored XSS No login needed |
≤ 1.1.0 Fixed in 1.1.1 |
CVE-2024-51657 |
Patchstack | |
| 8.1 High | ZIJ KART | Local File Inclusion No login needed |
≤ 1.1 |
CVE-2024-52381 |
Patchstack | |
| 7.3 High | WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts | Broken Access Control Task, team, and project management plugin featuring kanban board and gantt charts <= 2.6.13 - Insecure Direct Object Reference to Unauthenticated Authorization Bypass No login needed |
≤ 2.6.13 Fixed in 2.6.14 |
CVE-2024-10174 |
Wordfence | |
| 7.1 High | Forms: 3rd-Party Post Again | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.3 |
CVE-2024-51783 |
Patchstack | |
| 7.1 High | Sunshine Photo Cart | Broken Access Control |
≤ 3.2.8 Fixed in 3.2.9 |
CVE-2024-47314 |
Patchstack | |
| 7.3 High | Filter & Grids | Authentication Bypass Broken Authentication No login needed |
≤ 2.8.33 Fixed in 2.8.34 |
CVE-2024-39664 |
Patchstack | |
| 7.1 High | ACL Floating Cart for WooCommerce | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 0.9 |
CVE-2024-49640 |
Patchstack | |
| 8.8 High | WPC Smart Messages for WooCommerce | Local File Inclusion Authenticated (Subscriber+) Local File Inclusion |
≤ 4.2.1 Fixed in 4.2.2 |
CVE-2024-10436 |
Wordfence | |
| 8.3 High | ScottCart | Remote Code Execution No login needed |
≤ 1.1 |
CVE-2024-50492 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.