WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 151–200 of 476 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export |
≤ 1.49.1 Fixed in 1.49.2 |
CVE-2025-14782 |
Wordfence | |
| 6.8 Medium | Nex-Forms Express WP Form Builder | Cross-Site Scripting Authenticated Stored XSS |
< 9.1.8 Fixed in 9.1.8 |
CVE-2025-14803 |
WPScan | |
| 4.3 Medium | Campaign Monitor | Broken Access Control |
≤ 2.9.1 Fixed in 2.9.2 |
CVE-2026-0674 |
Patchstack | |
| 5.3 Medium | Fluent Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder |
≤ 6.1.7 Fixed in 6.1.8 |
CVE-2025-13722 |
Wordfence | |
| 4.9 Medium | Form Vibes – Database Manager for Forms | SQL Injection Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injection |
≤ 1.4.13 Fixed in 1.5 |
CVE-2025-13409 |
Wordfence | |
| 5.3 Medium | Ninja Forms | Information Disclosure Unauthenticated Token Generation and Submission Disclosure No login needed |
< 3.13.3 Fixed in 3.13.3 |
CVE-2025-14072 |
WPScan | |
| 4.3 Medium | Signature Add-On for Gravity Forms | Broken Access Control |
≤ 1.8.6 Fixed in 1.8.7 |
CVE-2025-62099 |
Patchstack | |
| 6.5 Medium | Funnelforms Free | Cross-Site Scripting |
≤ 3.8 |
CVE-2025-62758 |
Patchstack | |
| 5.3 Medium | weForms | Broken Access Control No login needed |
≤ 1.6.25 Fixed in 1.6.26 |
CVE-2025-69028 |
Patchstack | |
| 5.3 Medium | Funnelforms Free | Broken Access Control No login needed |
≤ 3.8 |
CVE-2025-68582 |
Patchstack | |
| 6.8 Medium | GravityForms | Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed |
< 2.9.23.1 Fixed in 2.9.23.1 |
CVE-2025-13407 |
WPScan | |
| 6.1 Medium | HTML Forms – Simple WordPress Forms | Cross-Site Scripting Simple WordPress Forms Plugin <= 1.6.0 - Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.6.0 Fixed in 1.6.1 |
CVE-2025-13861 |
Wordfence | |
| 6.4 Medium | RegistrationMagic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode |
≤ 6.0.6.7 Fixed in 6.0.6.8 |
CVE-2025-13610 |
Wordfence | |
| 5.5 Medium | MailerLite – Signup forms (official) | Cross-Site Scripting Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting |
≤ 1.7.16 Fixed in 1.7.17 |
CVE-2025-13993 |
Wordfence | |
| 5.3 Medium | Formstack Online Forms | Broken Access Control No login needed |
≤ 2.0.2 |
CVE-2025-62738 |
Patchstack | |
| 4.7 Medium | WP Gravity Forms FreshDesk | Open Redirect No login needed |
≤ 1.3.5 Fixed in 1.3.6 |
CVE-2025-67587 |
Patchstack | |
| 5.3 Medium | WPForms Google Sheet Connector | Broken Access Control No login needed |
≤ 4.0.0 Fixed in 4.0.1 |
CVE-2025-67570 |
Patchstack | |
| 4.3 Medium | Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms | Broken Access Control |
≤ 1.4.6 Fixed in 1.4.7 |
CVE-2025-67468 |
Patchstack | |
| 5.3 Medium | Fluent Forms | Broken Access Control Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id No login needed |
≤ 6.1.7 Fixed in 6.1.8 |
CVE-2025-13748 |
Wordfence | |
| 4.3 Medium | GSheetConnector For Ninja Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) System Information Exposure |
≤ 2.0.1 |
CVE-2025-13136 |
Wordfence | |
| 5.3 Medium | SureForms | Cross-Site Request Forgery Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution No login needed |
≤ 1.13.1 Fixed in 1.13.2 |
CVE-2025-12535 |
Wordfence | |
| 6.4 Medium | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 3.14.8 Fixed in 3.14.9 |
CVE-2025-13054 |
Wordfence | |
| 4.3 Medium | wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce | Broken Access Control Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure |
≤ 1.2.2 Fixed in 1.3 |
CVE-2025-12639 |
Wordfence | |
| 5.9 Medium | Popup addon for Ninja Forms | Cross-Site Scripting |
≤ 3.5.1 Fixed in 3.5.2 |
CVE-2025-64264 |
Patchstack | |
| 5.3 Medium | SureForms | Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed |
≤ 1.13.1 Fixed in 1.13.2 |
CVE-2025-12536 |
Wordfence | |
| 4.4 Medium | HTML Forms | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting |
≤ 1.5.5 |
CVE-2025-12125 |
Wordfence | |
| 5.6 Medium | Everest Forms (Pro) | PHP Object Injection Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature No login needed |
≤ 1.9.7 |
CVE-2025-8871 |
Wordfence | |
| 5.3 Medium | OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) | Other Unauthenticated IP Header Spoofing No login needed |
≤ 1.2.53 Fixed in 1.2.54 |
CVE-2025-12094 |
Wordfence | |
| 6.5 Medium | Doppler Forms | Broken Access Control Subscriber+ Limited Plugin Installation |
≤ 2.5.1 |
CVE-2025-9544 |
WPScan | |
| 4.7 Medium | WP Gravity Forms Zoho CRM and Bigin | Open Redirect No login needed |
≤ 1.2.8 Fixed in 1.2.9 |
CVE-2025-62981 |
Patchstack | |
| 5.3 Medium | BuddyForms | Broken Access Control No login needed |
≤ 2.10.2 Fixed in 2.10.4 |
CVE-2025-62973 |
Patchstack | |
| 4.7 Medium | WP Gravity Forms HubSpot | Open Redirect No login needed |
≤ 1.2.5 Fixed in 1.2.6 |
CVE-2025-60151 |
Patchstack | |
| 4.3 Medium | SureForms – Drag and Drop Form Builder | Broken Access Control Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure |
≤ 1.12.1 Fixed in 1.12.2 |
CVE-2025-10732 |
Wordfence | |
| 4.9 Medium | NEX-Forms – Ultimate Forms | SQL Injection Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection |
≤ 9.1.6 Fixed in 9.1.7 |
CVE-2025-10185 |
Wordfence | |
| 5.3 Medium | GiveWP – Donation Plugin and Fundraising Platform | Broken Access Control Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association No login needed |
≤ 4.10.0 Fixed in 4.10.1 |
CVE-2025-11228 |
Wordfence | |
| 6.5 Medium | GiveWP – Donation Plugin and Fundraising Platform | Broken Access Control Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure No login needed |
≤ 4.10.0 Fixed in 4.10.1 |
CVE-2025-11227 |
Wordfence | |
| 4.3 Medium | PayPal Forms | Cross-Site Request Forgery No login needed |
≤ 1.0.3 |
CVE-2025-10309 |
Wordfence | |
| 4.3 Medium | cForms – Light speed fast Form Builder | Cross-Site Request Forgery Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery No login needed |
≤ 3.0.0 |
CVE-2025-9898 |
Wordfence | |
| 6.1 Medium | Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms | Cross-Site Request Forgery No login needed |
≤ 1.0 |
CVE-2025-9899 |
Wordfence | |
| 4.3 Medium | Ninja Forms – The Contact Form Builder That Grows With You | Cross-Site Request Forgery The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion No login needed |
≤ 3.12.0 Fixed in 3.12.2 |
CVE-2025-10498 |
Wordfence | |
| 4.3 Medium | Ninja Forms – The Contact Form Builder That Grows With You | Cross-Site Request Forgery The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update No login needed |
≤ 3.12.0 Fixed in 3.12.2 |
CVE-2025-10499 |
Wordfence | |
| 4.3 Medium | WP Subscription Forms PRO | Broken Access Control Arbitrary Content Deletion |
≤ 2.0.5 |
CVE-2025-60166 |
Patchstack | |
| 6.5 Medium | GetResponse Forms | Cross-Site Scripting |
≤ 2.6.0 Fixed in 2.6.1 |
CVE-2025-59549 |
Patchstack | |
| 4.3 Medium | Piotnet Forms | Cross-Site Request Forgery No login needed |
≤ 1.0.30 |
CVE-2025-57933 |
Patchstack | |
| 4.7 Medium | WP Gravity Forms Keap/Infusionsoft | Open Redirect No login needed |
≤ 1.2.6 Fixed in 1.2.7 |
CVE-2025-58006 |
Patchstack | |
| 4.3 Medium | SureForms – Drag and Drop Form Builder | Broken Access Control Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation |
≤ 1.12.0 Fixed in 1.12.1 |
CVE-2025-10489 |
Wordfence | |
| 4.3 Medium | Maspik | Cross-Site Request Forgery No login needed |
≤ 2.5.6 Fixed in 2.5.7 |
CVE-2025-9888 |
Wordfence | |
| 4.3 Medium | Maspik | Broken Access Control Authenticated (Subscriber+) Missing Authorization to Spam Log Export |
≤ 2.5.6 Fixed in 2.5.7 |
CVE-2025-9979 |
Wordfence | |
| 6.5 Medium | Donation Forms WP by Givecloud | Cross-Site Scripting |
≤ 1.0.9 Fixed in 1.0.10 |
CVE-2025-58842 |
Patchstack | |
| 5.4 Medium | Contact Form By Mega Forms | Broken Access Control |
≤ 1.6.1 Fixed in 1.6.2 |
CVE-2025-58639 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.