WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,201–2,250 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 45 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Freshchat Plugin freshchat Cross-Site Request Forgery No login needed ≤ 2.3.4 CVE-2025-64240 Patchstack
4.3 Medium RTL Tester Plugin rtl-tester Cross-Site Request Forgery No login needed ≤ 1.2 CVE-2025-64239 Patchstack
4.3 Medium WPS Bidouille Plugin wps-bidouille Broken Access Control ≤ 1.33.1 Fixed in 1.33.2 CVE-2025-64238 Patchstack
4.3 Medium Quick Interest Slider Plugin quick-interest-slider Cross-Site Request Forgery No login needed ≤ 3.1.5 Fixed in 3.1.6 CVE-2025-64237 Patchstack
4.3 Medium Listify Plugin listify Cross-Site Request Forgery No login needed ≤ 3.2.5 CVE-2025-59009 Patchstack
4.3 Medium Salient Core Plugin salient-core Broken Access Control ≤ 3.0.8 Fixed in 3.0.9 CVE-2025-59001 Patchstack
4.3 Medium WP Attractive Donations System - Easy Stripe & Paypal donations Plugin wp_attractivedonationssystem Cross-Site Request Forgery Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.25 CVE-2025-58999 Patchstack
4.3 Medium CM On Demand Search And Replace Plugin cm-on-demand-search-and-replace Broken Access Control ≤ 1.5.5 CVE-2025-54045 Patchstack
4.3 Medium SKT Page Builder Plugin skt-builder Broken Access Control ≤ 4.9 Fixed in 5.0 CVE-2025-54005 Patchstack
5.9 Medium Fancy Product Designer | WooCommerce Plugin Information Disclosure Unauthenticated Information Disclosure and PHAR Deserialization via 'url' Parameter No login needed ≤ 6.4.8 CVE-2025-13439 Wordfence
5.3 Medium LearnPress – WordPress LMS Plugin learnpress Broken Access Control WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure No login needed ≤ 4.3.1 CVE-2025-13956 Wordfence
6.4 Medium LearnPress – WordPress LMS Plugin Cross-Site Scripting WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_social ≤ 4.3.1 CVE-2025-14387 Wordfence
4.3 Medium FileBird – WordPress Media Library Folders & File Manager Plugin filebird Broken Access Control WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering ≤ 6.5.1 CVE-2025-12900 Wordfence
6.4 Medium Wpik WordPress Basic Ajax Form Plugin wpik-wordpress-basic-ajax-form Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0 CVE-2025-14393 Wordfence
4.3 Medium BMLT Plugin bmlt-wordpress-satellite-plugin Cross-Site Request Forgery Cross-Site Request Forgery to Settings Creation and Deletion No login needed ≤ 3.11.4 CVE-2025-14162 Wordfence
5.3 Medium Slider a SlidersPack Plugin sliderspack-all-in-one-image-sliders Broken Access Control No login needed < 2.3 Fixed in 2.3 CVE-2022-46845 Patchstack
4.3 Medium ARMember Plugin armember-membership Broken Access Control Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control ≤ 3.4.10 Fixed in 3.4.11 CVE-2022-47425 Patchstack
4.3 Medium WP Fast Cache Plugin wp-fast-cache Cross-Site Request Forgery No login needed ≤ 1.5 CVE-2023-22675 Patchstack
5.4 Medium Spectra Plugin ultimate-addons-for-gutenberg Broken Access Control WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change ≤ 2.3.0 Fixed in 2.3.1 CVE-2023-23729 Patchstack
5.4 Medium GiveWP Plugin give Cross-Site Request Forgery No login needed ≤ 4.13.1 Fixed in 4.13.2 CVE-2025-67467 Patchstack
6.5 Medium GiveWP Plugin give Remote Code Execution Arbitrary Shortocde Execution No login needed ≤ 4.13.1 Fixed in 4.13.2 CVE-2025-66533 Patchstack
4.3 Medium Happy Addons for Elementor Plugin happy-elementor-addons Broken Access Control ≤ 3.20.3 Fixed in 3.20.4 CVE-2025-63077 Patchstack
6.5 Medium Betheme Plugin betheme Cross-Site Scripting ≤ 28.2 Fixed in 28.2.1 CVE-2025-63075 Patchstack
6.5 Medium The7 Plugin dt-the7 Cross-Site Scripting ≤ 12.9.0 Fixed in 12.9.0 CVE-2025-63073 Patchstack
6.5 Medium Cornerstone Plugin cornerstone Cross-Site Scripting ≤ 7.7.3 CVE-2025-63072 Patchstack
5.3 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Information Disclosure Sensitive Data Exposure No login needed ≤ 2.17.15 CVE-2025-63071 Patchstack
4.3 Medium Download Manager Plugin download-manager Information Disclosure Sensitive Data Exposure ≤ 3.3.32 Fixed in 3.3.33 CVE-2025-63070 Patchstack
5.3 Medium Ivory Search Plugin add-search-to-menu Broken Access Control No login needed ≤ 5.5.12 Fixed in 5.5.13 CVE-2025-63069 Patchstack
5.3 Medium Contact Form 7 – Dynamic Text Extension Plugin contact-form-7-dynamic-text-extension Content Injection No login needed ≤ 5.0.5 CVE-2025-63068 Patchstack
4.3 Medium Porto Theme - Functionality Plugin porto-functionality Broken Access Control Functionality plugin < 3.7.3 - Broken Access Control ≤ 3.7.3 Fixed in 3.7.3 CVE-2025-63067 Patchstack
6.5 Medium Porto Theme - Functionality Plugin porto-functionality Cross-Site Scripting Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) ≤ 3.7.3 Fixed in 3.7.3 CVE-2025-63066 Patchstack
5.3 Medium Media LIbrary Assistant Plugin media-library-assistant Broken Access Control No login needed ≤ 3.29 Fixed in 3.30 CVE-2025-63065 Patchstack
6.5 Medium EventON Plugin eventon Cross-Site Scripting ≤ 4.9.12 CVE-2025-63064 Patchstack
5.3 Medium Yandex.Metrica Plugin wp-yandex-metrika Broken Access Control No login needed ≤ 1.2.2 CVE-2025-63063 Patchstack
6.5 Medium KALLYAS Theme kallyas Cross-Site Scripting ≤ 4.25.0 Fixed in 4.25.0 CVE-2025-63061 Patchstack
4.3 Medium KALLYAS Theme kallyas Cross-Site Request Forgery No login needed ≤ 4.25.0 Fixed in 4.25.0 CVE-2025-63060 Patchstack
6.5 Medium Ninja Popups Plugin arscode-ninja-popups Cross-Site Scripting ≤ 4.7.8 CVE-2025-63059 Patchstack
4.3 Medium Custom Field Template Plugin custom-field-template Information Disclosure Sensitive Data Exposure ≤ 2.7.6 Fixed in 2.7.7 CVE-2025-63058 Patchstack
6.5 Medium Wp Ultimate Review Plugin wp-ultimate-review Cross-Site Scripting ≤ 2.3.7 Fixed in 2.3.8 CVE-2025-63057 Patchstack
4.3 Medium Contact Form by BestWebSoft Plugin contact-form-plugin Broken Access Control ≤ 4.3.6 Fixed in 4.3.7 CVE-2025-63056 Patchstack
6.5 Medium Master Addons for Elementor Plugin master-addons Cross-Site Scripting ≤ 2.0.9.9.4 Fixed in 2.1.0 CVE-2025-63055 Patchstack
5.3 Medium Quiz And Survey Master Plugin quiz-master-next Broken Access Control No login needed ≤ 10.3.2 Fixed in 10.3.3 CVE-2025-63054 Patchstack
6.5 Medium SimpLy Gallery Plugin simply-gallery-block Cross-Site Scripting ≤ 3.3.2.1 Fixed in 3.3.2.2 CVE-2025-63052 Patchstack
6.5 Medium REHub Framework Plugin rehub-framework Cross-Site Scripting ≤ 19.9.9.7 Fixed in 19.9.9.7 CVE-2025-63050 Patchstack
5.3 Medium ListingPro Lead Form Plugin listingpro-lead-form Broken Access Control No login needed ≤ 1.0.7 CVE-2025-63049 Patchstack
6.5 Medium ListingPro Lead Form Plugin listingpro-lead-form Cross-Site Scripting ≤ 1.0.7 CVE-2025-63048 Patchstack
5.3 Medium ListingPro Theme listingpro Broken Access Control No login needed ≤ 2.9.9 CVE-2025-63047 Patchstack
6.5 Medium ListingPro Plugin listingpro-plugin Cross-Site Scripting ≤ 2.9.9 CVE-2025-63046 Patchstack
6.5 Medium Master Slider Pro Plugin masterslider Cross-Site Scripting ≤ 3.7.12 CVE-2025-63045 Patchstack
6.5 Medium Xpro Elementor Addons Plugin xpro-elementor-addons Cross-Site Scripting ≤ 1.4.19.1 Fixed in 1.4.20 CVE-2025-63044 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only