WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 251–300 of 569 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure ≤ 6.15.9 CVE-2025-12175 Wordfence
6.5 Medium Events Maker by dFactory Plugin events-maker Cross-Site Scripting ≤ 1.6.14 CVE-2025-62941 Patchstack
6.5 Medium Event post Plugin event-post Cross-Site Scripting ≤ 5.10.3 Fixed in 5.10.4 CVE-2025-62042 Patchstack
5.4 Medium Event Tickets Plugin event-tickets Broken Access Control ≤ 5.26.3 Fixed in 5.26.4 CVE-2025-62027 Patchstack
7.5 High Event Tickets and Registration Plugin event-tickets Price Manipulation Unauthenticated Ticket Payment Bypass No login needed ≤ 5.26.5 CVE-2025-11517 Wordfence
9.8 Critical Ovatheme Events Manager Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.8.5 CVE-2025-6553 Wordfence
9.8 Critical Community Events Plugin community-events SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.5.1 CVE-2025-10586 Wordfence
9.8 Critical Community Events Plugin community-events SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.5.1 CVE-2025-10587 Wordfence
6.4 Medium Event Tickets, RSVPs, Calendar Plugin ticket-spot Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.2 CVE-2025-9875 Wordfence
5.3 Medium WooEvents Plugin woo-events Broken Access Control No login needed ≤ 4.1.7 Fixed in 4.1.8 CVE-2025-60121 Patchstack
4.3 Medium Event Rocket Plugin event-rocket Broken Access Control ≤ 3.3 CVE-2025-53452 Patchstack
5.3 Medium WP Events Manager Plugin wp-events-manager Broken Access Control No login needed ≤ 2.2.1 Fixed in 2.2.2 CVE-2025-57987 Patchstack
5.4 Medium Upcoming Events Lists Plugin upcoming-events-lists Broken Access Control Insecure Direct Object References (IDOR) ≤ 1.4.0 CVE-2025-57994 Patchstack
3.8 Low CP Multi View Event Calendar Plugin cp-multi-view-calendar Broken Access Control ≤ 1.4.35 CVE-2025-58009 Patchstack
6.5 Medium Events Manager – OpenStreetMaps Plugin stonehenge-em-osm Cross-Site Scripting OpenStreetMaps Plugin <= 4.2.1 - Cross Site Scripting (XSS) ≤ 4.2.1 CVE-2025-58265 Patchstack
5.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Unauthenticated Password-Protected Information Disclosure No login needed ≤ 6.15.2 CVE-2025-9808 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.15.1 CVE-2025-9807 Wordfence
6.4 Medium Digital Events Calendar Plugin digital-events-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter ≤ 1.0.8 CVE-2025-5801 Wordfence
6.4 Medium Certifica WP Plugin certifica-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter ≤ 3.1 CVE-2025-8316 Wordfence
6.5 Medium WordPress Events Calendar Plugin – connectDaily Plugin connect-daily-web-calendar Cross-Site Scripting connectDaily Plugin <= 1.5.5 - Cross Site Scripting (XSS) ≤ 1.5.5 CVE-2025-58862 Patchstack
7.1 High Quick Event Calendar Plugin quick-event-calendar Cross-Site Request Forgery No login needed ≤ 1.4.9 CVE-2025-58861 Patchstack
6.5 Medium Event Feed for Eventbrite Plugin event-feed-for-eventbrite Cross-Site Scripting ≤ 1.3.2 Fixed in 1.4.0 CVE-2025-58623 Patchstack
4.3 Medium Tickera Plugin tickera-event-ticketing-system Cross-Site Request Forgery No login needed ≤ 3.5.5.6 Fixed in 3.5.5.8 CVE-2025-58611 Patchstack
6.4 Medium Events Addon for Elementor Plugin events-addon-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets ≤ 2.2.9 CVE-2025-8150 Wordfence
8.8 High WpEvently Plugin mage-eventpress PHP Object Injection ≤ 4.4.8 Fixed in 4.4.9 CVE-2025-54742 Patchstack
8.1 High Ovatheme Events Plugin ova-events Local File Inclusion No login needed ≤ 1.2.8 Fixed in 1.2.7 CVE-2025-53576 Patchstack
8.8 High Event List Plugin Privilege Escalation Authenticated (Subscriber+) Privilege Escalation ≤ 2.0.4 CVE-2025-6366 Wordfence
7.2 High Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin Plugin wp-event-solution Server-Side Request Forgery Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery No login needed ≤ 4.0.37 CVE-2025-7813 Wordfence
8.1 High eventlist Plugin eventlist Local File Inclusion No login needed ≤ 1.9.2 Fixed in 2.0.2 CVE-2025-53204 Patchstack
6.5 Medium Prevent files / folders access Plugin prevent-file-access Path Traversal ≤ 2.6.0 Fixed in 2.6.1 CVE-2025-53561 Patchstack
4.3 Medium EventON Lite Plugin eventon-lite Information Disclosure Authenticated (Contributor+) Information Disclosure ≤ 2.4.7 CVE-2025-8091 Wordfence
4.3 Medium WpEvently Plugin mage-eventpress Broken Access Control ≤ 4.4.6 Fixed in 4.4.7 CVE-2025-54705 Patchstack
6.5 Medium Eventer Plugin eventer Content Injection No login needed ≤ 3.9.9.1 Fixed in 3.9.9.1 CVE-2025-39483 Patchstack
8.8 High Eventin Plugin wp-event-solution PHP Object Injection ≤ 4.0.31 Fixed in 4.0.32 CVE-2025-49869 Patchstack
7.5 High Event Manager, Event Calendar and Booking Plugin eventin-pro Broken Access Control Arbitrary Content Deletion No login needed ≤ 4.0.24 Fixed in 4.0.25 CVE-2025-52731 Patchstack
6.5 Medium Event Manager, Event Calendar and Booking Plugin eventin-pro Cross-Site Scripting ≤ 4.0.24 Fixed in 4.0.25 CVE-2025-52730 Patchstack
8.8 High Eventin Plugin wp-event-solution Privilege Escalation Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover ≤ 4.0.34 CVE-2025-4796 Wordfence
4.4 Medium WP Event Manager Plugin wp-event-manager Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 3.1.49 CVE-2025-2799 Wordfence
7.2 High WP Event Manager Plugin wp-event-manager Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'organizer_name' No login needed ≤ 3.1.50 CVE-2025-2800 Wordfence
5.9 Medium Modern Events Calendar Lite Plugin modern-events-calendar-lite SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.3.0 CVE-2021-4458 Wordfence
6.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes ≤ 6.6.4.4, 7.0.1 – 7.0.3 CVE-2025-6976 Wordfence
6.1 Medium Event Manager Plugin events-manager Cross-Site Scripting Reflected Cross-Site Scripting via `calendar_header` Parameter No login needed ≤ 6.6.4.4, 7.0.1 – 7.0.3 CVE-2025-6975 Wordfence
7.5 High Events Manager Plugin events-manager SQL Injection Unauthenticated SQL Injection via `orderby` Parameter No login needed ≤ 6.6.4.4, 7.0.1 – 7.0.3 CVE-2025-6970 Wordfence
6.3 Medium EventON Plugin eventon Broken Access Control ≤ 4.9.9 CVE-2025-47565 Patchstack
7.1 High Eventin Plugin wp-event-solution Cross-Site Scripting No login needed ≤ 4.0.28 Fixed in 4.0.29 CVE-2025-49321 Patchstack
6.4 Medium Event RSVP and Simple Event Management Plugin wp-easy-events Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.1.0 CVE-2025-5540 Wordfence
10.0 Critical Ovatheme Events Manager Plugin ova-events-manager Arbitrary File Upload No login needed ≤ 1.8.4 Fixed in 1.8.5 CVE-2025-32510 Patchstack
6.4 Medium IRM Newsroom Plugin irm-newsroom Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode ≤ 1.2.19 CVE-2025-4584 Wordfence
6.4 Medium The Events Calendar Plugin the-events-calendar Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 6.13.2 CVE-2025-5144 Wordfence
8.1 High WP Event Manager Plugin wp-event-manager Local File Inclusion No login needed ≤ 3.1.51 Fixed in 3.2.0 CVE-2025-48125 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only