WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,101–2,150 of 6,499 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 43 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
8.1 High	The Aisle Theme `theaisle`	Local File Inclusion No login needed	`≤ 2.9.1` Fixed in `2.9.1`	Jan 22, 2026	`CVE-2025-67941`	Patchstack
8.1 High	Powerlift Theme `powerlift`	Local File Inclusion No login needed	`≤ 3.2.1` Fixed in `3.2.1`	Jan 22, 2026	`CVE-2025-67940`	Patchstack
8.1 High	Biagiotti Theme `biagiotti`	Local File Inclusion No login needed	`≤ 3.5.2` Fixed in `3.5.2`	Jan 22, 2026	`CVE-2025-67938`	Patchstack
7.1 High	JetEngine Plugin `jet-engine`	Cross-Site Scripting No login needed	`≤ 3.7.7` Fixed in `3.7.8`	Jan 22, 2026	`CVE-2025-67923`	Patchstack
7.1 High	Anon Plugin `anon2x`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.2.10`	Jan 22, 2026	`CVE-2025-67620`	Patchstack
8.8 High	Kids Heaven Plugin `kids-world`	PHP Object Injection	`≤ 3.2`	Jan 22, 2026	`CVE-2025-67619`	Patchstack
8.1 High	Mella Plugin `mella`	Local File Inclusion No login needed	`≤ 1.2.29`	Jan 22, 2026	`CVE-2025-67616`	Patchstack
8.1 High	Myour Plugin `myour`	Local File Inclusion No login needed	`≤ 1.5.1`	Jan 22, 2026	`CVE-2025-67615`	Patchstack
7.1 High	TheNa Plugin `thena`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5.5`	Jan 22, 2026	`CVE-2025-67614`	Patchstack
7.5 High	WerkStatt Plugin `werkstatt-plugin`	Local File Inclusion	`≤ 1.6.6` Fixed in `1.6.7`	Jan 22, 2026	`CVE-2025-63017`	Patchstack
8.1 High	Depot Plugin `depot`	Local File Inclusion No login needed	`≤ 1.16`	Jan 22, 2026	`CVE-2025-54003`	Patchstack
7.1 High	WordPress Photo Gallery Plugin `photo-gallery-portfolio`	Cross-Site Scripting No login needed	`≤ 1.1.0`	Jan 22, 2026	`CVE-2025-53240`	Patchstack
7.1 High	flexo-posts-manager Plugin `flexo-posts-manager`	Cross-Site Scripting No login needed	`≤ 1.0001`	Jan 22, 2026	`CVE-2025-52762`	Patchstack
7.1 High	Restaurante Plugin `restaurante`	Cross-Site Scripting No login needed	`≤ 3.0.7` Fixed in `3.1.1`	Jan 22, 2026	`CVE-2025-52746`	Patchstack
8.8 High	xSmart Plugin `xsmart`	Privilege Escalation	`≤ 1.2.9.4`	Jan 22, 2026	`CVE-2025-50007`	Patchstack
7.1 High	xSmart Plugin `xsmart`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2.9.4`	Jan 22, 2026	`CVE-2025-50006`	Patchstack
8.8 High	JupiterX Core Plugin `jupiterx-core`	PHP Object Injection	`≤ 4.10.1` Fixed in `4.11.0`	Jan 22, 2026	`CVE-2025-50004`	Patchstack
8.1 High	Amuli Plugin `amuli`	Local File Inclusion No login needed	`≤ 2.3.0`	Jan 22, 2026	`CVE-2025-50003`	Patchstack
8.1 High	Athens Plugin `athens`	Local File Inclusion No login needed	`≤ 1.1.6`	Jan 22, 2026	`CVE-2025-49994`	Patchstack
7.1 High	Drone Plugin `drone`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.40`	Jan 22, 2026	`CVE-2025-49249`	Patchstack
7.1 High	Accordion Slider PRO Plugin `accordion_slider_pro`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2`	Jan 22, 2026	`CVE-2025-49066`	Patchstack
8.5 High	WP Lead Capturing Pages Plugin `wp-lead-capture`	SQL Injection	`≤ 2.5`	Jan 22, 2026	`CVE-2025-49050`	Patchstack
8.5 High	DZS Video Gallery Plugin `dzs-videogallery`	SQL Injection	`≤ 12.39` Fixed in `12.40`	Jan 22, 2026	`CVE-2025-49049`	Patchstack
7.1 High	xPromoter Plugin `top_bar_promoter`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.3.4`	Jan 22, 2026	`CVE-2025-49046`	Patchstack
7.1 High	Super Interactive Maps Plugin `super-interactive-maps`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.3`	Jan 22, 2026	`CVE-2025-49045`	Patchstack
7.1 High	Magic Responsive Slider and Carousel Plugin `magic_carousel`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.6`	Jan 22, 2026	`CVE-2025-49043`	Patchstack
7.1 High	Magic Slider Plugin `magic_slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.2`	Jan 22, 2026	`CVE-2025-48094`	Patchstack
7.1 High	Image&Video FullScreen Background Plugin `lbg_fullscreen_fullwidth_slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.6.7`	Jan 22, 2026	`CVE-2025-47666`	Patchstack
8.1 High	Anarkali Plugin `anarkali`	Local File Inclusion No login needed	`≤ 1.0.9`	Jan 22, 2026	`CVE-2025-47474`	Patchstack
7.1 High	HTML5 Video Player with Playlist & Multiple Skins Plugin `lbg-vp2-html5-rightside`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.3.5`	Jan 22, 2026	`CVE-2025-32123`	Patchstack
7.1 High	HTML5 Video Player Plugin `lbg-vp2-html5-bottom`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.3.5`	Jan 22, 2026	`CVE-2025-27005`	Patchstack
7.5 High	Handmade Framework Plugin `handmade-framework`	Local File Inclusion	`≤ 3.9`	Jan 8, 2026	`CVE-2026-22521`	Patchstack
7.1 High	Scroll rss excerpt Plugin `scroll-rss-excerpt`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.0`	Jan 8, 2026	`CVE-2025-68892`	Patchstack
7.1 High	WP App Bar Plugin `wp-app-bar`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5`	Jan 8, 2026	`CVE-2025-68891`	Patchstack
7.1 High	e-shops Plugin `e-shops-cart2`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.4`	Jan 8, 2026	`CVE-2025-68890`	Patchstack
7.1 High	Pinpoll Plugin `pinpoll`	Cross-Site Scripting No login needed	`≤ 4.0.0`	Jan 8, 2026	`CVE-2025-68889`	Patchstack
7.1 High	WP-BusinessDirectory Plugin `wp-businessdirectory`	Cross-Site Scripting No login needed	`≤ 4.0.1`	Jan 8, 2026	`CVE-2025-68887`	Patchstack
7.1 High	Visitor Stats Widget Plugin `visitor-stats-widget`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5.0`	Jan 8, 2026	`CVE-2025-68874`	Patchstack
7.1 High	PRIMER by chloédigital Plugin `primer-by-chloedigital`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.25`	Jan 8, 2026	`CVE-2025-68873`	Patchstack
8.1 High	Hendon Theme `hendon`	Local File Inclusion No login needed	`≤ 1.7` Fixed in `1.7`	Jan 8, 2026	`CVE-2025-67937`	Patchstack
8.1 High	Curly Theme `curly`	Local File Inclusion No login needed	`≤ 3.3` Fixed in `3.3`	Jan 8, 2026	`CVE-2025-67936`	Patchstack
8.1 High	Optimize Theme `optimizewp`	Local File Inclusion No login needed	`≤ 2.4` Fixed in `2.4`	Jan 8, 2026	`CVE-2025-67935`	Patchstack
8.1 High	Wellspring Theme `wellspring`	Local File Inclusion No login needed	`≤ 2.8` Fixed in `2.8`	Jan 8, 2026	`CVE-2025-67934`	Patchstack
7.1 High	Taskbuilder Plugin `taskbuilder`	Cross-Site Scripting No login needed	`≤ 4.0.9` Fixed in `5.0.0`	Jan 8, 2026	`CVE-2025-67933`	Patchstack
7.1 High	Listeo Core Plugin `listeo-core`	Cross-Site Scripting No login needed	`≤ 2.0.19` Fixed in `2.0.19`	Jan 8, 2026	`CVE-2025-67932`	Patchstack
7.5 High	BulletProof Security Plugin `bulletproof-security`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 6.9` Fixed in `7.0`	Jan 8, 2026	`CVE-2025-67931`	Patchstack
7.1 High	eHive Search Plugin `ehive-search`	Cross-Site Scripting No login needed	`≤ 2.5.0` Fixed in `2.5.1`	Jan 8, 2026	`CVE-2025-67930`	Patchstack
7.1 High	Link Whisper Free Plugin `link-whisper`	Cross-Site Scripting No login needed	`≤ 0.8.8` Fixed in `0.8.9`	Jan 8, 2026	`CVE-2025-67927`	Patchstack
7.5 High	Corpkit Theme `corpkit`	Local File Inclusion	`≤ 2.0` Fixed in `2.0.1`	Jan 8, 2026	`CVE-2025-67925`	Patchstack
7.1 High	Grand Restaurant Plugin `grandrestaurant`	Cross-Site Scripting No login needed	`≤ 7.0.9` Fixed in `7.0.9`	Jan 8, 2026	`CVE-2025-67922`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.