WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,251–2,300 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 46 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.5 Medium	Tutor LMS Elementor Addons Plugin `tutor-lms-elementor-addons`	Cross-Site Scripting	`≤ 3.0.1` Fixed in `3.0.2`	Dec 9, 2025	`CVE-2025-63042`	Patchstack
6.5 Medium	Ronneby Theme Core Plugin `ronneby-core`	Cross-Site Scripting	`≤ 1.5.68`	Dec 9, 2025	`CVE-2025-63037`	Patchstack
6.5 Medium	WPLMS Plugin `wplms_plugin`	Cross-Site Scripting	`≤ 1.9.9.5.4`	Dec 9, 2025	`CVE-2025-63035`	Patchstack
5.4 Medium	Page View Count Plugin `page-views-count`	Broken Access Control Settings Change	`≤ 2.9.0`	Dec 9, 2025	`CVE-2025-63034`	Patchstack
5.9 Medium	Make Section & Column Clickable For Elementor Plugin `make-section-column-clickable-elementor`	Cross-Site Scripting	`≤ 2.4` Fixed in `2.4.1`	Dec 9, 2025	`CVE-2025-63033`	Patchstack
5.3 Medium	Traveler Plugin `traveler`	Broken Access Control No login needed	`≤ 3.2.6`	Dec 9, 2025	`CVE-2025-63028`	Patchstack
4.3 Medium	Xagio SEO Plugin `xagio-seo`	Broken Access Control	`≤ 7.1.0.37`	Dec 9, 2025	`CVE-2025-63025`	Patchstack
5.4 Medium	Order Delivery Date for WooCommerce Plugin `order-delivery-date-for-woocommerce`	Broken Access Control No login needed	`≤ 4.3.1` Fixed in `4.3.2`	Dec 9, 2025	`CVE-2025-63024`	Patchstack
5.3 Medium	Payment Gateway for PayPal on WooCommerce Plugin `woo-paypal-gateway`	Broken Access Control No login needed	`≤ 9.0.53` Fixed in `9.0.54`	Dec 9, 2025	`CVE-2025-63023`	Patchstack
4.3 Medium	WooCommerce Payment Gateway - Paysera Plugin `woo-payment-gateway-paysera`	Broken Access Control Paysera plugin <= 3.10.0 - Broken Access Control	`≤ 3.10.0` Fixed in `3.11.0`	Dec 9, 2025	`CVE-2025-63015`	Patchstack
4.3 Medium	WP Hotel Booking Plugin `wp-hotel-booking`	Information Disclosure Sensitive Data Exposure	`≤ 2.2.7` Fixed in `2.2.8`	Dec 9, 2025	`CVE-2025-63013`	Patchstack
4.3 Medium	WP Hotel Booking Plugin `wp-hotel-booking`	Cross-Site Request Forgery No login needed	`≤ 2.2.8` Fixed in `2.2.9`	Dec 9, 2025	`CVE-2025-63012`	Patchstack
5.9 Medium	WP Hotel Booking Plugin `wp-hotel-booking`	Cross-Site Scripting	`≤ 2.2.8` Fixed in `2.2.9`	Dec 9, 2025	`CVE-2025-63011`	Patchstack
4.9 Medium	Hercules Core Plugin `hercules-core`	Server-Side Request Forgery	`≤ 7.4`	Dec 9, 2025	`CVE-2025-63010`	Patchstack
5.3 Medium	WP Google Analytics Events Plugin `wp-google-analytics-events`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.8.2`	Dec 9, 2025	`CVE-2025-63009`	Patchstack
5.3 Medium	WP ERP Plugin `erp`	Broken Access Control No login needed	`≤ 1.16.7` Fixed in `1.16.8`	Dec 9, 2025	`CVE-2025-63008`	Patchstack
4.3 Medium	EventPrime Plugin `eventprime-event-calendar-management`	Information Disclosure Sensitive Data Exposure	`≤ 4.2.4.1` Fixed in `4.2.5.0`	Dec 9, 2025	`CVE-2025-63007`	Patchstack
4.3 Medium	EventPrime Plugin `eventprime-event-calendar-management`	Broken Access Control	`≤ 4.2.4.1` Fixed in `4.2.5.0`	Dec 9, 2025	`CVE-2025-63006`	Patchstack
5.4 Medium	Litho Addons Plugin `litho-addons`	Broken Access Control	`≤ 3.5`	Dec 9, 2025	`CVE-2025-62999`	Patchstack
5.3 Medium	WP EasyCart Plugin `wp-easycart`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 5.8.11` Fixed in `5.8.12`	Dec 9, 2025	`CVE-2025-62997`	Patchstack
4.3 Medium	Custom Layouts – Post + Product grids made easy Plugin `custom-layouts`	Broken Access Control Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control	`≤ 1.4.12` Fixed in `1.5.0`	Dec 9, 2025	`CVE-2025-62996`	Patchstack
4.3 Medium	MultiParcels Shipping For WooCommerce Plugin `multiparcels-shipping-for-woocommerce`	Broken Access Control	`≤ 1.30.12` Fixed in `1.30.13`	Dec 9, 2025	`CVE-2025-62995`	Patchstack
4.3 Medium	WP AI CoPilot Plugin `ai-co-pilot-for-wp`	Information Disclosure Sensitive Data Exposure	`≤ 1.2.7` Fixed in `1.2.8`	Dec 9, 2025	`CVE-2025-62994`	Patchstack
4.3 Medium	Notification for Telegram Plugin `notification-for-telegram`	Broken Access Control	`≤ 3.5.1`	Dec 9, 2025	`CVE-2025-62993`	Patchstack
4.3 Medium	WP Flashy Marketing Automation Plugin `wp-flashy-marketing-automation`	Cross-Site Request Forgery No login needed	`≤ 2.0.8` Fixed in `2.0.9`	Dec 9, 2025	`CVE-2025-62873`	Patchstack
4.3 Medium	Social Photo Fetcher Plugin `facebook-photo-fetcher`	Cross-Site Request Forgery No login needed	`≤ 3.0.4`	Dec 9, 2025	`CVE-2025-62872`	Patchstack
4.3 Medium	Just TinyMCE Custom Styles Plugin `just-tinymce-styles`	Cross-Site Request Forgery No login needed	`≤ 1.2.1`	Dec 9, 2025	`CVE-2025-62871`	Patchstack
5.3 Medium	Eupago Gateway For Woocommerce Plugin `eupago-gateway-for-woocommerce`	Broken Access Control No login needed	`≤ 4.7.1`	Dec 9, 2025	`CVE-2025-62870`	Patchstack
4.3 Medium	Gravitec.net – Web Push Notifications Plugin `gravitec-net-web-push-notifications`	Broken Access Control Web Push Notifications plugin <= 2.9.17 - Broken Access Control	`≤ 2.9.17` Fixed in `2.9.18`	Dec 9, 2025	`CVE-2025-62869`	Patchstack
4.3 Medium	Ergonet Cache Plugin `ergonet-varnish-cache`	Broken Access Control	`≤ 1.0.13` Fixed in `1.0.14`	Dec 9, 2025	`CVE-2025-62867`	Patchstack
4.3 Medium	Auto Alt Text Plugin `auto-alt-text`	Cross-Site Request Forgery No login needed	`≤ 2.5.2` Fixed in `2.5.3`	Dec 9, 2025	`CVE-2025-62866`	Patchstack
5.3 Medium	Post Cloner Plugin `post-cloner`	Broken Access Control No login needed	`≤ 1.0.0`	Dec 9, 2025	`CVE-2025-62865`	Patchstack
4.3 Medium	SMTP Mail Plugin `smtp-mail`	Cross-Site Request Forgery No login needed	`≤ 1.3.51`	Dec 9, 2025	`CVE-2025-62762`	Patchstack
5.3 Medium	WP-CRM System Plugin `wp-crm-system`	Broken Access Control No login needed	`≤ 3.4.6`	Dec 9, 2025	`CVE-2025-62740`	Patchstack
6.5 Medium	Add Custom Codes Plugin `add-custom-codes`	Cross-Site Request Forgery No login needed	`≤ 4.80` Fixed in `5.0`	Dec 9, 2025	`CVE-2025-62739`	Patchstack
5.3 Medium	Formstack Online Forms Plugin `formstack`	Broken Access Control No login needed	`≤ 2.0.2`	Dec 9, 2025	`CVE-2025-62738`	Patchstack
5.3 Medium	Image Cleanup Plugin `image-cleanup`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.9.2`	Dec 9, 2025	`CVE-2025-62737`	Patchstack
4.3 Medium	Image Cleanup Plugin `image-cleanup`	Broken Access Control	`≤ 1.9.2`	Dec 9, 2025	`CVE-2025-62736`	Patchstack
5.3 Medium	User Spam Remover Plugin `user-spam-remover`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.1`	Dec 9, 2025	`CVE-2025-62735`	Patchstack
4.3 Medium	Media Library Downloader Plugin `media-library-downloader`	Cross-Site Request Forgery No login needed	`≤ 1.4.0`	Dec 9, 2025	`CVE-2025-62734`	Patchstack
4.3 Medium	Custom Sidebars by ProteusThemes Plugin `custom-sidebars-by-proteusthemes`	Cross-Site Request Forgery No login needed	`≤ 1.0.3`	Dec 9, 2025	`CVE-2025-62733`	Patchstack
5.3 Medium	Quick Interest Slider Plugin `quick-interest-slider`	Broken Access Control No login needed	`≤ 3.1.7`	Dec 9, 2025	`CVE-2025-62153`	Patchstack
5.3 Medium	ConveyThis Plugin `conveythis-translate`	Broken Access Control No login needed	`≤ 269.2` Fixed in `269.3`	Dec 9, 2025	`CVE-2025-62152`	Patchstack
5.3 Medium	Virtuaria PagBank / PagSeguro para Woocommerce Plugin `virtuaria-pagseguro`	Broken Access Control No login needed	`≤ 3.6.3` Fixed in `3.6.4`	Dec 9, 2025	`CVE-2025-62151`	Patchstack
5.3 Medium	Geo Controller Plugin `cf-geoplugin`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 8.9.4`	Dec 9, 2025	`CVE-2025-62109`	Patchstack
4.3 Medium	Media Library File Download Plugin `media-download`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Dec 9, 2025	`CVE-2025-62103`	Patchstack
4.3 Medium	DoFollow Case by Case Plugin `dofollow-case-by-case`	Cross-Site Request Forgery No login needed	`≤ 3.5.1` Fixed in `3.6.0`	Dec 9, 2025	`CVE-2025-62102`	Patchstack
5.3 Medium	ThemeRain Core Plugin `themerain-core`	Broken Access Control No login needed	`≤ 1.1.9`	Dec 9, 2025	`CVE-2025-62100`	Patchstack
6.5 Medium	Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons Plugin `gutenverse-news`	Broken Access Control Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control	`≤ 3.0.2` Fixed in `3.1.0`	Dec 9, 2025	`CVE-2025-62090`	Patchstack
5.4 Medium	Яндекс Доставка (Boxberry) Plugin `boxberry`	Broken Access Control	`≤ 2.34`	Dec 9, 2025	`CVE-2025-62086`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.