WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,601–2,650 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 53 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Welcart e-Commerce Plugin usc-e-shop Broken Access Control ≤ 2.11.24 Fixed in 2.11.25 CVE-2025-62953 Patchstack
4.3 Medium ChatBot Plugin chatbot Broken Access Control ≤ 7.7.3 Fixed in 7.7.4 CVE-2025-62952 Patchstack
6.5 Medium H5P Plugin h5p Cross-Site Scripting ≤ 1.16.0 Fixed in 1.16.1 CVE-2025-62951 Patchstack
6.5 Medium Activity Plus Reloaded for BuddyPress Plugin bp-activity-plus-reloaded Cross-Site Scripting ≤ 1.1.2 CVE-2025-62949 Patchstack
6.5 Medium Date counter Plugin date-counter Cross-Site Scripting ≤ 2.0.3 CVE-2025-62948 Patchstack
5.0 Medium Publitio Plugin publitio Information Disclosure Sensitive Data Exposure ≤ 2.2.5 CVE-2025-62947 Patchstack
5.3 Medium Everest Backup Plugin everest-backup Broken Access Control No login needed ≤ 2.3.8 Fixed in 2.3.9 CVE-2025-62946 Patchstack
5.3 Medium MSTW CSV EXPORTER Plugin mstw-csv-exporter Broken Access Control No login needed ≤ 1.4 CVE-2025-62944 Patchstack
6.5 Medium Next Page, Not Next Post Plugin next-page-not-next-post Cross-Site Scripting ≤ 0.3.0 CVE-2025-62943 Patchstack
6.5 Medium WP Mapbox GL JS Maps Plugin wp-mapbox-gl-js Cross-Site Scripting ≤ 3.0.1 CVE-2025-62942 Patchstack
6.5 Medium Events Maker by dFactory Plugin events-maker Cross-Site Scripting ≤ 1.6.14 CVE-2025-62941 Patchstack
6.5 Medium Blox Lite Plugin blox-lite Cross-Site Scripting ≤ 1.2.8 CVE-2025-62940 Patchstack
6.5 Medium Open Currency Converter Plugin artiss-currency-converter Cross-Site Scripting ≤ 1.5.0 CVE-2025-62939 Patchstack
4.3 Medium Reoon Email Verifier Plugin reoon-email-verifier Broken Access Control ≤ 2.0.1 Fixed in 2.1.1 CVE-2025-62938 Patchstack
6.5 Medium Post List Featured Image Plugin post-list-featured-image Cross-Site Scripting ≤ 0.5.9 CVE-2025-62937 Patchstack
4.3 Medium xSmart Plugin xsmart Content Injection ≤ 1.2.9.4 CVE-2025-62936 Patchstack
4.3 Medium Open Close WooCommerce Store Plugin woc-open-close Broken Access Control ≤ 5.0.0 CVE-2025-62935 Patchstack
4.3 Medium Table Block by RioVizual Plugin riovizual Broken Access Control ≤ 3.0.0 CVE-2025-62932 Patchstack
4.3 Medium MSN Partner Hub Plugin microsoft-start Broken Access Control ≤ 2.9 CVE-2025-62931 Patchstack
6.5 Medium MapSVG Plugin mapsvg-lite-interactive-vector-maps Cross-Site Scripting ≤ 8.7.22 Fixed in 8.7.23 CVE-2025-62930 Patchstack
6.5 Medium Testimonial Slider Plugin testimonial Broken Access Control ≤ 2.0.15 CVE-2025-62929 Patchstack
4.3 Medium SEO Meta Description Updater Plugin seo-meta-description-updater Broken Access Control ≤ 1.2.0 CVE-2025-62928 Patchstack
6.5 Medium Nelio Content Plugin nelio-content Broken Access Control ≤ 4.0.5 Fixed in 4.0.6 CVE-2025-62927 Patchstack
5.4 Medium Conversios.io Plugin enhanced-e-commerce-for-woocommerce-store Broken Access Control ≤ 7.2.13 Fixed in 7.2.14 CVE-2025-62925 Patchstack
6.5 Medium Post Grid and Gutenberg Blocks Plugin post-grid Broken Access Control ≤ 2.3.17 Fixed in 2.3.18 CVE-2025-62924 Patchstack
6.5 Medium Marquee Addons for Elementor Plugin marquee-addons-for-elementor Cross-Site Scripting ≤ 3.8.2 Fixed in 3.8.3 CVE-2025-62923 Patchstack
5.3 Medium Export Categories Plugin export-categories Broken Access Control No login needed ≤ 1.0 CVE-2025-62922 Patchstack
6.5 Medium Bulk Auto Image Title Attribute Plugin bulk-image-title-attribute Cross-Site Scripting ≤ 2.0.1 CVE-2025-62921 Patchstack
5.9 Medium USERCENTRICS CMP Plugin usercentrics-consent-management-platform Cross-Site Scripting ≤ 1.0.9 CVE-2025-62920 Patchstack
5.4 Medium TS Demo Importer Plugin ts-demo-importer Broken Access Control ≤ 0.1.3 CVE-2025-62919 Patchstack
5.4 Medium IgnitionDeck Plugin ignitiondeck Broken Access Control ≤ 2.0.15 CVE-2025-62918 Patchstack
6.5 Medium Tooltipy Plugin bluet-keywords-tooltip-generator Cross-Site Scripting ≤ 5.5.9 CVE-2025-62917 Patchstack
5.4 Medium Flights & Hotels Booking WP Plugin adiaha-hotel Broken Access Control ≤ 3.1 CVE-2025-62916 Patchstack
4.3 Medium SMS Contact Form 7 Notifications by ClickSend Plugin clicksend-contactform7 Broken Access Control ≤ 1.4.0 CVE-2025-62915 Patchstack
6.5 Medium Opal Service Plugin opal-service Cross-Site Scripting ≤ 1.9.1 CVE-2025-62913 Patchstack
6.5 Medium SiteGround Email Marketing Plugin siteground-email-marketing Cross-Site Scripting ≤ 1.7.1 Fixed in 1.7.2 CVE-2025-62912 Patchstack
6.5 Medium Rock Convert Plugin rock-convert Cross-Site Scripting ≤ 3.0.1 CVE-2025-62911 Patchstack
6.5 Medium Video Gallery by Huzzaz Plugin huzzaz-video-gallery Cross-Site Scripting ≤ 10.5 CVE-2025-62910 Patchstack
4.3 Medium Smart WeTransfer Plugin smart-wetransfer Broken Access Control ≤ 1.3 CVE-2025-62909 Patchstack
6.5 Medium Custom Post Type Attachment Plugin custom-post-type-pdf-attachment Cross-Site Scripting ≤ 3.4.6 CVE-2025-62907 Patchstack
4.3 Medium Referral Link Tracker Plugin referral-link-tracker Broken Access Control ≤ 1.1.4 CVE-2025-62906 Patchstack
6.5 Medium Query Posts Plugin query-posts Cross-Site Scripting ≤ 0.3.2 CVE-2025-62905 Patchstack
6.5 Medium WP Geo Plugin wp-geo Cross-Site Scripting ≤ 3.5.1 CVE-2025-62904 Patchstack
6.5 Medium WPC Smart Messages for WooCommerce Plugin wpc-smart-messages Cross-Site Scripting ≤ 4.2.8 Fixed in 4.2.9 CVE-2025-62903 Patchstack
5.3 Medium WP Popup Builder Plugin wp-popup-builder Information Disclosure Sensitive Data Exposure No login needed ≤ 1.3.8 Fixed in 1.3.9 CVE-2025-62902 Patchstack
6.5 Medium Popular Posts by Webline Plugin popular-posts-by-webline Cross-Site Scripting ≤ 1.1.1 CVE-2025-62900 Patchstack
5.9 Medium Photospace Responsive Plugin photospace-responsive Cross-Site Scripting ≤ 2.2.0 CVE-2025-62899 Patchstack
6.5 Medium Links shortcode Plugin links-shortcode Cross-Site Scripting ≤ 1.8.3 CVE-2025-62898 Patchstack
5.3 Medium WP Recipe Maker Plugin wp-recipe-maker Content Injection No login needed ≤ 10.1.0 Fixed in 10.1.0 CVE-2025-62897 Patchstack
5.3 Medium Atarim Plugin atarim-visual-collaboration Information Disclosure Sensitive Data Exposure No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2025-62895 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only