WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 201–250 of 985 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
8.2 High	StoryMap Plugin `wp-storymap`	Cross-Site Request Forgery No login needed	`≤ 2.1`	Aug 14, 2025	`CVE-2025-52797`	Patchstack
7.1 High	Primer MyData for Woocommerce Plugin `primer-mydata`	Cross-Site Request Forgery No login needed	`≤ 4.2.5` Fixed in `4.2.6`	Aug 14, 2025	`CVE-2025-53575`	Patchstack
8.8 High	Findgo Plugin `findgo`	Cross-Site Request Forgery No login needed	`≤ 1.3.57` Fixed in `1.3.58`	Aug 14, 2025	`CVE-2025-53587`	Patchstack
7.1 High	Simple Poll Plugin `simple-poll`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.1.1`	Aug 14, 2025	`CVE-2025-49044`	Patchstack
7.1 High	Import CDN-Remote Images Plugin `import-cdn-remote-images`	Cross-Site Request Forgery No login needed	`≤ 2.1.2` Fixed in `2.1.3`	Jul 16, 2025	`CVE-2025-48153`	Patchstack
7.2 High	Allmart Plugin `allmart-core`	Server-Side Request Forgery No login needed	`≤ 1.0.0`	Jul 4, 2025	`CVE-2025-49418`	Patchstack
7.1 High	re.place Plugin `replace`	Cross-Site Request Forgery No login needed	`≤ 0.2.1`	Jun 27, 2025	`CVE-2025-53338`	Patchstack
7.1 High	Track Everything Plugin `track-everything`	Cross-Site Request Forgery No login needed	`≤ 2.0.1`	Jun 27, 2025	`CVE-2025-53332`	Patchstack
7.1 High	RSS Digest Plugin `rss-digest`	Cross-Site Request Forgery No login needed	`≤ 1.5`	Jun 27, 2025	`CVE-2025-53331`	Patchstack
7.1 High	Społecznościowa 6 PL 2013 Plugin `spolecznosciowa-6-pl-2013`	Cross-Site Request Forgery No login needed	`≤ 2.0.6`	Jun 27, 2025	`CVE-2025-53329`	Patchstack
7.1 High	WPShapere - WordPress admin Plugin `wpshapere-lite`	Cross-Site Request Forgery No login needed	`≤ 1.4.1`	Jun 27, 2025	`CVE-2025-53317`	Patchstack
7.1 High	Relocate Upload Plugin `relocate-upload`	Cross-Site Request Forgery No login needed	`≤ 0.24.1`	Jun 27, 2025	`CVE-2025-53315`	Patchstack
7.1 High	Twitch TV Embed Suite Plugin `twitch-tv-embed-suite`	Cross-Site Request Forgery No login needed	`≤ 2.1.0`	Jun 27, 2025	`CVE-2025-53313`	Patchstack
7.1 High	OnionBuzz Plugin `onionbuzz-viral-quiz`	Cross-Site Request Forgery No login needed	`≤ 1.0.7`	Jun 27, 2025	`CVE-2025-53312`	Patchstack
7.1 High	Navayan Subscribe Plugin `navayan-subscribe`	Cross-Site Request Forgery No login needed	`≤ 1.13`	Jun 27, 2025	`CVE-2025-53311`	Patchstack
7.1 High	HidePost Plugin `hidepost`	Cross-Site Request Forgery No login needed	`≤ 2.3.8`	Jun 27, 2025	`CVE-2025-53310`	Patchstack
7.1 High	Image Slider With Description Plugin `image-slider-with-description`	Cross-Site Request Forgery No login needed	`≤ 9.2`	Jun 27, 2025	`CVE-2025-53308`	Patchstack
7.1 High	WP Forum Server Plugin `forum-server`	Cross-Site Request Forgery No login needed	`≤ 1.8.2`	Jun 27, 2025	`CVE-2025-53305`	Patchstack
8.8 High	IS-theme-companion Plugin `weblizar-companion`	Cross-Site Request Forgery No login needed	`≤ 1.59`	Jun 27, 2025	`CVE-2025-53277`	Patchstack
7.1 High	WP Permalink Translator Plugin `wp-permalink-translator`	Cross-Site Request Forgery No login needed	`≤ 1.7.6`	Jun 27, 2025	`CVE-2025-53274`	Patchstack
7.1 High	Additional Order Filters for WooCommerce Plugin `additional-order-filters-for-woocommerce`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.22` Fixed in `1.23`	Jun 27, 2025	`CVE-2025-53271`	Patchstack
7.1 High	Virtual Moderator Plugin `virtual-moderator`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Jun 20, 2025	`CVE-2025-52772`	Patchstack
7.1 High	TinyNav Plugin `tinynav`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Jun 20, 2025	`CVE-2025-52781`	Patchstack
7.1 High	Logo Manager For Samandehi Plugin `samandehi-logo-manager`	Cross-Site Request Forgery No login needed	`≤ 0.5`	Jun 20, 2025	`CVE-2025-52780`	Patchstack
7.1 High	Change Cart button Colors WooCommerce Plugin `wc-style`	Cross-Site Request Forgery No login needed	`≤ 1.0`	Jun 20, 2025	`CVE-2025-52783`	Patchstack
7.1 High	Lewe ChordPress Plugin `chordpress`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 4.0.1`	Jun 20, 2025	`CVE-2025-52789`	Patchstack
7.1 High	Bluff Post Plugin `bluff-post`	Cross-Site Request Forgery No login needed	`≤ 1.1.1`	Jun 20, 2025	`CVE-2025-52784`	Patchstack
7.1 High	Knowledge Base – Knowledge Base Maker Plugin `knowledge-base-maker`	Cross-Site Request Forgery Knowledge Base Maker plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) No login needed	`≤ 1.1.8`	Jun 20, 2025	`CVE-2025-52791`	Patchstack
7.1 High	WP-DownloadCounter Plugin `wp-downloadcounter`	Cross-Site Request Forgery No login needed	`≤ 1.01`	Jun 20, 2025	`CVE-2025-52790`	Patchstack
7.1 High	Esselink.nu Settings Plugin `esselinknu-settings`	Cross-Site Request Forgery No login needed	`≤ 4.5`	Jun 20, 2025	`CVE-2025-52793`	Patchstack
7.1 High	WP User Stylesheet Switcher Plugin `wp-user-stylesheet-switcher`	Cross-Site Request Forgery No login needed	`≤ v2.2.0`	Jun 20, 2025	`CVE-2025-52792`	Patchstack
7.1 High	WP Front User Submit / Front Editor Plugin `front-editor`	Cross-Site Request Forgery No login needed	`≤ 5.0.6`	Jun 20, 2025	`CVE-2025-52795`	Patchstack
7.1 High	Creative Contact Form Plugin `sexy-contact-form`	Cross-Site Request Forgery No login needed	`≤ 1.0.0`	Jun 20, 2025	`CVE-2025-52794`	Patchstack
8.8 High	Real Estate Manager Plugin `real-estate-manager`	Cross-Site Request Forgery No login needed	`≤ 7.3`	Jun 20, 2025	`CVE-2025-52825`	Patchstack
7.1 High	Civi Framework Plugin `civi-framework`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to User Deactivation No login needed	`≤ 2.1.6` Fixed in `2.1.6.4`	Jun 10, 2025	`CVE-2025-49511`	Patchstack
7.1 High	Konami Easter Egg Plugin `konami-easter-egg`	Cross-Site Request Forgery No login needed	`≤ v0.4`	Jun 6, 2025	`CVE-2025-49425`	Patchstack
7.1 High	BP Profile as Homepage Plugin `bp-profile-as-homepage`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.1`	Jun 6, 2025	`CVE-2025-49453`	Patchstack
7.1 High	Post Author Plugin `post-author`	Cross-Site Request Forgery No login needed	`≤ 1.1.1`	Jun 6, 2025	`CVE-2025-28950`	Patchstack
7.1 High	Mediabay - WordPress Media Library Folders Plugin `mediabay`	Cross-Site Request Forgery WordPress Media Library Folders plugin <= 1.4 - CSRF to Reflected XSS No login needed	`≤ 1.4`	Jun 6, 2025	`CVE-2025-28948`	Patchstack
7.4 High	Backwp Plugin `backwp`	Cross-Site Request Forgery CSRF to Arbitrary File Deletion No login needed	`≤ 2.0.2`	Jun 6, 2025	`CVE-2025-28954`	Patchstack
7.1 High	Personal Favicon Plugin `personal-favicon`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 2.0`	Jun 6, 2025	`CVE-2025-28964`	Patchstack
7.1 High	Bg Orthodox Calendar Plugin `bg-orthodox-calendar`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 0.13.10`	Jun 6, 2025	`CVE-2025-28958`	Patchstack
7.1 High	Free WP Mail SMTP Plugin `free-wp-mail-smtp`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 1.0`	Jun 6, 2025	`CVE-2025-28974`	Patchstack
7.1 High	Recent Posts Slider Responsive Plugin `recent-posts-slider-responsive`	Cross-Site Request Forgery No login needed	`≤ 1.0.1`	Jun 6, 2025	`CVE-2025-28966`	Patchstack
7.1 High	WP Mail Options Plugin `wp-mail-options`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 0.2.3`	Jun 6, 2025	`CVE-2025-28981`	Patchstack
8.2 High	Epicwin Plugin `epicwin-subscribers`	Cross-Site Request Forgery CSRF to SQL Injection No login needed	`≤ 1.5`	Jun 6, 2025	`CVE-2025-28986`	Patchstack
7.1 High	Widgetize Pages Light Plugin `widgetize-pages-light`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed	`≤ 3.0`	Jun 6, 2025	`CVE-2025-30995`	Patchstack
7.4 High	POEditor Plugin `poeditor`	Cross-Site Request Forgery CSRF to Arbitrary File Deletion No login needed	`≤ 0.9.10` Fixed in `0.9.11`	Jun 6, 2025	`CVE-2025-49237`	Patchstack
8.2 High	occupancyplan Plugin `occupancyplan`	Cross-Site Request Forgery CSRF to SQL Injection No login needed	`≤ 1.0.3.0`	May 23, 2025	`CVE-2025-46458`	Patchstack
7.1 High	CheckBot Plugin `checkbot`	Cross-Site Request Forgery CSRF to Stored XSS No login needed	`≤ 1.05`	May 19, 2025	`CVE-2025-43840`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.