WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 20,151–20,200 of 29,413 vulnerabilities

Known WordPress vulnerabilities, page 404 of 589
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.5 High	WPMozo Addons Lite for Elementor Plugin `wpmozo-addons-lite-for-elementor`	Local File Inclusion	`≤ 1.1.0` Fixed in `1.1.1`	Jan 7, 2025	`CVE-2024-56282`	Patchstack
9.3 Critical	SSL Wireless SMS Notification Plugin `ssl-wireless-sms-notification`	SQL Injection No login needed	`≤ 3.5.0` Fixed in `3.6.0`	Jan 7, 2025	`CVE-2024-56284`	Patchstack
6.5 Medium	WPBITS Addons For Elementor Page Builder Plugin `wpbits-addons-for-elementor`	Cross-Site Scripting	`≤ 1.5.1` Fixed in `1.6`	Jan 7, 2025	`CVE-2024-56285`	Patchstack
7.5 High	Classic Addons – WPBakery Page Builder Plugin `classic-addons-wpbakery-page-builder-addons`	Local File Inclusion WPBakery Page Builder plugin <= 3.0 - Local File Inclusion	`≤ 3.0` Fixed in `3.1`	Jan 7, 2025	`CVE-2024-56286`	Patchstack
5.9 Medium	WP Docs Plugin `wp-docs`	Cross-Site Scripting	`≤ 2.2.1` Fixed in `2.2.2`	Jan 7, 2025	`CVE-2024-56288`	Patchstack
6.5 Medium	WP jQuery DataTable Plugin `wp-jquery-datatable`	Cross-Site Scripting	`≤ 4.0.1` Fixed in `4.1.0`	Jan 7, 2025	`CVE-2024-56287`	Patchstack
7.1 High	Groundhogg Plugin `groundhogg`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.7.3.3` Fixed in `3.7.3.4`	Jan 7, 2025	`CVE-2024-56289`	Patchstack
9.3 Critical	Multiple Shipping And Billing Address For Woocommerce Plugin `different-shipping-and-billing-address-for-woocommerce`	SQL Injection Unauthenticated SQL Injection No login needed	`≤ 1.2` Fixed in `1.3`	Jan 7, 2025	`CVE-2024-56290`	Patchstack
8.1 High	PlainInventory Plugin `z-inventory-manager`	PHP Object Injection Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection No login needed	`≤ 3.1.6` Fixed in `3.1.7`	Jan 7, 2025	`CVE-2024-56291`	Patchstack
5.9 Medium	Advanced Form Integration Plugin `advanced-form-integration`	Cross-Site Scripting The Easiest Integration Plugin <= 1.95.0 - Cross Site Scripting (XSS)	`≤ 1.95.0` Fixed in `1.97.0`	Jan 7, 2025	`CVE-2024-56293`	Patchstack
5.9 Medium	Email Reminders Plugin `email-reminders`	Cross-Site Scripting	`≤ 2.0.5` Fixed in `2.0.6`	Jan 7, 2025	`CVE-2024-56292`	Patchstack
6.4 Medium	Nexter Blocks Plugin `the-plus-addons-for-block-editor`	Broken Access Control	`≤ 4.0.7` Fixed in `4.0.8`	Jan 7, 2025	`CVE-2024-56294`	Patchstack
7.1 High	Mang Board WP Plugin `mangboard`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.8.4` Fixed in `1.8.5`	Jan 7, 2025	`CVE-2024-56296`	Patchstack
5.9 Medium	Highlight Plugin `highlight`	Cross-Site Scripting	`≤ 2.0.2` Fixed in `2.0.6`	Jan 7, 2025	`CVE-2024-56297`	Patchstack
7.1 High	Notify Odoo Plugin `notify-odoo`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.0.0` Fixed in `1.0.1`	Jan 7, 2025	`CVE-2024-56299`	Patchstack
5.9 Medium	Pretty Simple Popup Builder Plugin `pretty-simple-popup-builder`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 1.0.9` Fixed in `1.0.10`	Jan 7, 2025	`CVE-2024-56298`	Patchstack
7.5 High	Post/Page Copying Tool Plugin `postpage-import-export-with-custom-fields-taxonomies`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.0.0` Fixed in `2.0.1`	Jan 7, 2025	`CVE-2024-56300`	Patchstack
6.5 Medium	WP FullCalendar Plugin `wp-fullcalendar`	Cross-Site Scripting	`≤ 1.5` Fixed in `1.6`	Jan 7, 2025	`CVE-2025-22261`	Patchstack
6.5 Medium	Gutentor Plugin `gutentor`	Cross-Site Scripting	`≤ 3.4.3` Fixed in `3.4.4`	Jan 7, 2025	`CVE-2025-22293`	Patchstack
4.3 Medium	Hive Support Plugin `hive-support`	Broken Access Control	`≤ 1.1.6` Fixed in `1.1.7`	Jan 7, 2025	`CVE-2025-22298`	Patchstack
4.3 Medium	AI WP Writer Plugin `ai-wp-writer`	Cross-Site Request Forgery No login needed	`≤ 3.8.4.4` Fixed in `3.8.4.5`	Jan 7, 2025	`CVE-2025-22297`	Patchstack
4.3 Medium	AI for SEO Plugin `ai-for-seo`	Broken Access Control	`≤ 1.2.9` Fixed in `1.2.10`	Jan 7, 2025	`CVE-2025-22299`	Patchstack
5.4 Medium	PixelYourSite – Your smart PIXEL (TAG) Manager Plugin `pixelyoursite`	Cross-Site Request Forgery No login needed	`≤ 10.0.1.2` Fixed in `10.0.2`	Jan 7, 2025	`CVE-2025-22300`	Patchstack
5.4 Medium	MyBookTable Bookstore Plugin `mybooktable`	Cross-Site Request Forgery No login needed	`≤ 3.5.3` Fixed in `3.5.4`	Jan 7, 2025	`CVE-2025-22301`	Patchstack
5.3 Medium	WP Wand Plugin `ai-content-generation`	Broken Access Control No login needed	`≤ 1.2.5` Fixed in `1.2.6`	Jan 7, 2025	`CVE-2025-22302`	Patchstack
5.3 Medium	WP Mailster Plugin `wp-mailster`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.8.17.0` Fixed in `1.8.18.0`	Jan 7, 2025	`CVE-2025-22303`	Patchstack
6.5 Medium	Hero Banner Ultimate Plugin `hero-banner-ultimate`	Local File Inclusion	`≤ 1.4.4` Fixed in `1.4.5`	Jan 7, 2025	`CVE-2025-22305`	Patchstack
4.3 Medium	WP Visitor Statistics (Real Time Traffic) Plugin `wp-stats-manager`	Broken Access Control	`≤ 7.5` Fixed in `7.6`	Jan 7, 2025	`CVE-2025-22304`	Patchstack
6.5 Medium	Smart Custom Fields Plugin `smart-custom-fields`	Cross-Site Scripting	`≤ 5.0.0` Fixed in `5.0.1`	Jan 7, 2025	`CVE-2025-22308`	Patchstack
6.5 Medium	SpeakOut! Email Petitions Plugin `speakout`	Cross-Site Scripting	`≤ 4.4.2` Fixed in `4.5.0`	Jan 7, 2025	`CVE-2025-22309`	Patchstack
6.5 Medium	TemplatesNext ToolKit Plugin `templatesnext-toolkit`	Cross-Site Scripting	`≤ 3.2.9`	Jan 7, 2025	`CVE-2025-22310`	Patchstack
6.5 Medium	Typing Text Plugin `typing-text`	Cross-Site Scripting	`≤ 1.2.7`	Jan 7, 2025	`CVE-2025-22315`	Patchstack
6.5 Medium	Thim Elementor Kit Plugin `thim-elementor-kit`	Cross-Site Scripting	`≤ 1.2.9` Fixed in `1.2.9.1`	Jan 7, 2025	`CVE-2025-22312`	Patchstack
5.9 Medium	WPBITS Addons For Elementor Page Builder Plugin `wpbits-addons-for-elementor`	Cross-Site Scripting	`≤ 1.5.1` Fixed in `1.6`	Jan 7, 2025	`CVE-2025-22316`	Patchstack
7.1 High	ProductDyno Plugin `productdyno`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.24` Fixed in `1.0.25`	Jan 7, 2025	`CVE-2025-22320`	Patchstack
6.5 Medium	Image Hover Effects for Elementor Plugin `image-hover-effects-elementor-addon`	Cross-Site Scripting	`≤ 1.0.2.4`	Jan 7, 2025	`CVE-2025-22323`	Patchstack
6.5 Medium	ElementsCSS Addons for Elementor Plugin `css-for-elementor`	Cross-Site Scripting	`≤ 1.0.8.9`	Jan 7, 2025	`CVE-2025-22321`	Patchstack
7.1 High	OZ Canonical Plugin `oz-canonical`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.5`	Jan 7, 2025	`CVE-2025-22324`	Patchstack
7.1 High	Autocompleter Plugin `autocompleter`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.3.5.2`	Jan 7, 2025	`CVE-2025-22325`	Patchstack
7.1 High	5centsCDN Plugin `5centscdn`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 25.4.15`	Jan 7, 2025	`CVE-2025-22326`	Patchstack
7.1 High	Elevio Plugin `elevio`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 4.4.1`	Jan 7, 2025	`CVE-2025-22328`	Patchstack
6.5 Medium	EO4WP Plugin `fw-integration-for-emailoctopus`	Cross-Site Scripting	`≤ 1.0.8.1` Fixed in `1.0.8.2`	Jan 7, 2025	`CVE-2025-22327`	Patchstack
6.5 Medium	Piotnet Addons For Elementor Plugin `piotnet-addons-for-elementor`	Cross-Site Scripting	`≤ 2.4.31` Fixed in `2.4.32`	Jan 7, 2025	`CVE-2025-22333`	Patchstack
7.1 High	Wizhi Multi Filters by Wenprise Plugin `wizhi-multi-filters`	Cross-Site Request Forgery CSRF to Stored Cross Site Scripting (XSS) No login needed	`≤ 1.8.6`	Jan 7, 2025	`CVE-2025-22336`	Patchstack
6.5 Medium	Store Commerce Plugin `store-commerce`	Cross-Site Scripting	`≤ 1.2.3`	Jan 7, 2025	`CVE-2025-22339`	Patchstack
7.1 High	wpSOL Plugin `wpsol`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.2.0`	Jan 7, 2025	`CVE-2025-22343`	Patchstack
7.1 High	WP Simple Sitemap Plugin `wp-simple-sitemap`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 0.2`	Jan 7, 2025	`CVE-2025-22342`	Patchstack
8.2 High	BSK Forms Blacklist Plugin `bsk-gravityforms-blacklist`	Cross-Site Request Forgery CSRF to SQL Injection No login needed	`≤ 3.9` Fixed in `4.0`	Jan 7, 2025	`CVE-2025-22347`	Patchstack
8.5 High	DynamicTags Plugin `dynamictags`	SQL Injection	`≤ 1.4.0` Fixed in `1.4.1`	Jan 7, 2025	`CVE-2025-22348`	Patchstack
7.6 High	Auction Plugin `wp-auctions`	SQL Injection	`≤ 3.7`	Jan 7, 2025	`CVE-2025-22349`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.