WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 2,651–2,700 of 6,509 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 54 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Doctreat Plugin doctreat Cross-Site Scripting No login needed ≤ 1.6.7 Fixed in 1.6.8 CVE-2025-58971 Patchstack
8.1 High Businext Plugin businext Local File Inclusion No login needed ≤ 2.4.4 Fixed in 2.4.4 CVE-2025-58967 Patchstack
7.1 High NEX-Forms LITE Plugin nex-forms-lite Cross-Site Scripting No login needed ≤ 8.2 Fixed in 8.2 CVE-2025-58966 Patchstack
7.1 High CF7 Auto Responder Addon Plugin cf7-autoresponder-addon Cross-Site Scripting No login needed ≤ 2.4 Fixed in 2.5 CVE-2025-58961 Patchstack
7.7 High Taskbot Plugin taskbot Arbitrary File Deletion ≤ 6.4 Fixed in 6.5 CVE-2025-58959 Patchstack
8.1 High SmilePure Plugin smilepure Local File Inclusion No login needed ≤ 1.8.5 Fixed in 1.8.5 CVE-2025-58958 Patchstack
8.1 High Karzo Theme karzo Local File Inclusion No login needed ≤ 2.6 Fixed in 2.6 CVE-2025-58955 Patchstack
7.1 High WP Tactical Popup Plugin wp-tactical-popup Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.1 CVE-2025-58921 Patchstack
7.1 High Author: Munzir Plugin myshouts-shoutbox Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.9 CVE-2025-58916 Patchstack
8.8 High Simple User Registration Plugin wp-registration Privilege Escalation ≤ 6.8 CVE-2025-53428 Patchstack
7.1 High SEO Pyramid Plugin seo-pyramid Cross-Site Scripting No login needed ≤ 1.9.8 CVE-2025-53427 Patchstack
7.1 High Likert Survey Master Plugin likert-survey-master Cross-Site Scripting No login needed ≤ 0.8.0.1 CVE-2025-53426 Patchstack
7.2 High Dokan Plugin dokan-lite Privilege Escalation ≤ 4.1.3 Fixed in 4.1.4 CVE-2025-53425 Patchstack
7.1 High Triss Plugin triss Cross-Site Scripting No login needed ≤ 2.6 CVE-2025-53423 Patchstack
7.1 High WhatsApp Chat for WordPress and WooCommerce Plugin tw-whatsapp-chat-rotator Cross-Site Scripting No login needed ≤ 1.2.1 CVE-2025-53422 Patchstack
7.1 High WPLMS Plugin wplms_plugin Cross-Site Scripting No login needed ≤ 1.9.9.8 CVE-2025-53420 Patchstack
7.1 High Grid Plus Plugin grid-plus Cross-Site Scripting No login needed ≤ 3.3 CVE-2025-53352 Patchstack
7.1 High Fidelo Snippet Plugin thebing-snippet Cross-Site Scripting No login needed ≤ 1.12 CVE-2025-53351 Patchstack
7.1 High Calendar Plus Plugin calendar-plus Cross-Site Scripting No login needed ≤ 1.2.4 CVE-2025-53350 Patchstack
7.1 High Woocommerce Envato Affiliates Plugin wooenvato Cross-Site Scripting No login needed ≤ 1.2.1 CVE-2025-53297 Patchstack
7.1 High Toast Mobile Menu Plugin toast-responsive-menu Cross-Site Scripting No login needed ≤ 1.0.8 Fixed in 1.0.9 CVE-2025-53238 Patchstack
7.1 High UDesign Core Plugin u-design-core Cross-Site Scripting No login needed ≤ 4.14.0 CVE-2025-53234 Patchstack
7.1 High RockON DJ Plugin rockon Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.3 Fixed in 3.4 CVE-2025-53229 Patchstack
7.1 High Hello Followers Plugin hellofollowers Cross-Site Scripting No login needed ≤ 2.5 CVE-2025-52770 Patchstack
7.1 High Nifty Backups Plugin nifty-backups Cross-Site Scripting No login needed ≤ 1.08 CVE-2025-52763 Patchstack
7.1 High MultiSite Clone Duplicator Plugin multisite-clone-duplicator Cross-Site Scripting No login needed ≤ 1.5.3 CVE-2025-52760 Patchstack
7.4 High WP Last Modified Info Plugin wp-last-modified-info Remote Code Execution ≤ 1.9.4 Fixed in 1.9.5 CVE-2025-52756 Patchstack
7.1 High Child Themes Plugin child-themes Cross-Site Scripting No login needed ≤ 1.0.1 CVE-2025-52755 Patchstack
7.1 High Sello ChannelConnector Plugin sello-channelconnector Cross-Site Scripting No login needed ≤ 1.6.3 CVE-2025-52754 Patchstack
7.1 High Contact Form by Supsystic Plugin contact-form-by-supsystic Cross-Site Scripting No login needed ≤ 1.7.36 Fixed in 1.8.0 CVE-2025-52753 Patchstack
7.1 High Slide Puzzle Plugin slide-puzzle Cross-Site Scripting No login needed ≤ 1.0.0 CVE-2025-52751 Patchstack
7.1 High Emu2 Plugin emu2-email-users-2 Cross-Site Scripting No login needed ≤ 0.83b CVE-2025-52750 Patchstack
7.1 High Uji Countdown Plugin uji-countdown Cross-Site Scripting No login needed ≤ 2.3.3 CVE-2025-52749 Patchstack
7.1 High Directory Pro Plugin directory-pro Cross-Site Scripting No login needed ≤ 2.5.5 CVE-2025-52748 Patchstack
7.1 High oik-privacy-policy Plugin oik-privacy-policy Cross-Site Scripting No login needed ≤ 1.4.10 Fixed in 1.4.11 CVE-2025-52743 Patchstack
7.1 High Pets Plugin pets Cross-Site Scripting No login needed ≤ 1.4.1 CVE-2025-52742 Patchstack
7.1 High Post Connector Plugin post-connector Cross-Site Scripting No login needed ≤ 1.0.11 CVE-2025-52741 Patchstack
8.8 High Boldermail Plugin boldermail PHP Object Injection ≤ 2.4.0 CVE-2025-52740 Patchstack
8.8 High WP Store Locator Plugin wp-store-locator PHP Object Injection ≤ 2.2.260 Fixed in 2.2.261 CVE-2025-52737 Patchstack
7.1 High Finale Lite Plugin finale-woocommerce-sales-countdown-timer-discount Cross-Site Scripting No login needed ≤ 2.20.0 CVE-2025-52736 Patchstack
7.1 High NextMove Lite Plugin woo-thank-you-page-nextmove-lite Cross-Site Scripting No login needed ≤ 2.24.0 CVE-2025-52735 Patchstack
7.1 High CropRefine Plugin croprefine Cross-Site Scripting No login needed ≤ 1.2.1 CVE-2025-52734 Patchstack
7.1 High LearnPress Export Import Plugin learnpress-import-export Cross-Site Scripting No login needed ≤ 4.0.9 Fixed in 4.1.0 CVE-2025-49992 Patchstack
7.1 High Simple Stripe Checkout Plugin simple-stripe-checkout Cross-Site Scripting No login needed ≤ 1.1.28 CVE-2025-49963 Patchstack
7.1 High bbPress Notify Plugin bbpress-notify-nospam Cross-Site Scripting No login needed ≤ 2.19.5 Fixed in 2.20 CVE-2025-49962 Patchstack
7.1 High bbPress Move Topics Plugin bbp-move-topics Cross-Site Scripting No login needed ≤ 1.1.6 CVE-2025-49959 Patchstack
7.1 High Robokassa payment gateway for Woocommerce Plugin robokassa Cross-Site Scripting No login needed ≤ 1.8.6 CVE-2025-49958 Patchstack
7.1 High Email Attachment by Order Status & Products Plugin email-attachment-by-order-status-products Cross-Site Scripting No login needed ≤ 1.0.1 CVE-2025-49957 Patchstack
7.1 High Fade Slider Plugin fade-slider Cross-Site Scripting No login needed ≤ 2.5 Fixed in 2.6 CVE-2025-49956 Patchstack
7.1 High WP Smart Flexslider Plugin wp-smart-flexslider Cross-Site Scripting No login needed ≤ 2.5 CVE-2025-49955 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only