WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 3,001–3,050 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 61 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.5 Medium	ProfileGrid Plugin `profilegrid-user-profiles-groups-and-communities`	Cross-Site Scripting	`≤ 5.9.8.1` Fixed in `5.9.8.2`	Mar 25, 2026	`CVE-2026-25417`	Patchstack
8.8 High	WPBookit Pro Plugin `wpbookit-pro`	Privilege Escalation	`≤ 1.6.18`	Mar 25, 2026	`CVE-2026-25414`	Patchstack
9.9 Critical	WPBookit Pro Plugin `wpbookit-pro`	Arbitrary File Upload	`≤ 1.6.18`	Mar 25, 2026	`CVE-2026-25413`	Patchstack
8.1 High	Tutor LMS Pro Plugin `tutor-pro`	Authentication Bypass Broken Authentication No login needed	`≤ 3.9.4`	Mar 25, 2026	`CVE-2026-25406`	Patchstack
7.5 High	WPCargo Track & Trace Plugin `wpcargo`	Broken Access Control No login needed	`≤ 8.0.2`	Mar 25, 2026	`CVE-2026-25401`	Patchstack
8.8 High	Apicona Theme `apicona`	PHP Object Injection	`≤ 24.1.0`	Mar 25, 2026	`CVE-2026-25400`	Patchstack
6.5 Medium	Vertex Addons for Elementor Plugin `addons-for-elementor-builder`	Broken Access Control	`≤ 1.6.4` Fixed in `1.7.0`	Mar 25, 2026	`CVE-2026-25398`	Patchstack
7.5 High	File Uploader for WooCommerce Plugin `file-uploader-for-woocommerce`	Arbitrary File Upload Path Traversal No login needed	`≤ 1.0.4`	Mar 25, 2026	`CVE-2026-25397`	Patchstack
7.5 High	Commerce Coinbase For WooCommerce Plugin `commerce-coinbase-for-woocommerce`	Broken Access Control No login needed	`≤ 1.6.6`	Mar 25, 2026	`CVE-2026-25396`	Patchstack
6.5 Medium	New User Approve Plugin `new-user-approve`	Broken Access Control	`≤ 3.2.3` Fixed in `3.2.4`	Mar 25, 2026	`CVE-2026-25390`	Patchstack
7.1 High	KiviCare Plugin `kivicare-clinic-management-system`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.6.16` Fixed in `4.0.0`	Mar 25, 2026	`CVE-2026-25383`	Patchstack
8.1 High	IdealAuto Theme `idealauto`	Local File Inclusion No login needed	`≤ 3.8.6` Fixed in `3.8.6`	Mar 25, 2026	`CVE-2026-25382`	Patchstack
8.1 High	LoveDate Theme `lovedate`	Local File Inclusion No login needed	`≤ 3.8.6` Fixed in `3.8.6`	Mar 25, 2026	`CVE-2026-25381`	Patchstack
8.1 High	Feedy Theme `feedy`	Local File Inclusion No login needed	`≤ 2.1.5` Fixed in `2.1.5`	Mar 25, 2026	`CVE-2026-25380`	Patchstack
8.1 High	StreamVid Theme `streamvid`	Local File Inclusion No login needed	`≤ 6.8.6` Fixed in `6.8.6`	Mar 25, 2026	`CVE-2026-25379`	Patchstack
9.3 Critical	Addon Jobsearch Chat Plugin `addon-jobsearch-chat`	SQL Injection No login needed	`≤ 3.0` Fixed in `3.1`	Mar 25, 2026	`CVE-2026-25377`	Patchstack
7.1 High	Addon Jobsearch Chat Plugin `addon-jobsearch-chat`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.0` Fixed in `3.1`	Mar 25, 2026	`CVE-2026-25376`	Patchstack
7.1 High	Vayvo Theme `vayvo-progression`	Cross-Site Scripting Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) No login needed	`≤ 6.8` Fixed in `6.8`	Mar 25, 2026	`CVE-2026-25373`	Patchstack
9.3 Critical	Lumise Product Designer Plugin `lumise`	SQL Injection No login needed	`≤ 2.0.9` Fixed in `2.0.9`	Mar 25, 2026	`CVE-2026-25371`	Patchstack
9.9 Critical	Woody ad snippets Plugin `insert-php`	Remote Code Execution	`≤ 2.7.1` Fixed in `2.7.2`	Mar 25, 2026	`CVE-2026-25366`	Patchstack
6.5 Medium	Kargo Takip Plugin `kargo-takip-turkiye`	Broken Access Control	`≤ 0.2.4` Fixed in `0.2.4`	Mar 25, 2026	`CVE-2026-25365`	Patchstack
7.1 High	WpEvently Plugin `mage-eventpress`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.1.4` Fixed in `5.1.5`	Mar 25, 2026	`CVE-2026-25361`	Patchstack
8.8 High	Vex Theme `vex`	PHP Object Injection	`≤ 1.2.9` Fixed in `1.2.9`	Mar 25, 2026	`CVE-2026-25360`	Patchstack
8.8 High	Pendulum Theme `pendulum`	PHP Object Injection	`≤ 3.1.5` Fixed in `3.1.5`	Mar 25, 2026	`CVE-2026-25359`	Patchstack
8.8 High	Meloo Theme `meloo`	PHP Object Injection	`≤ 2.8.2` Fixed in `2.8.2`	Mar 25, 2026	`CVE-2026-25358`	Patchstack
8.1 High	Ultimate Membership Pro Plugin `indeed-membership-pro`	Privilege Escalation Account Takeover No login needed	`≤ 13.7` Fixed in `13.7.1`	Mar 25, 2026	`CVE-2026-25357`	Patchstack
7.1 High	Yobazar Theme `yobazar`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.6.7` Fixed in `1.6.7`	Mar 25, 2026	`CVE-2026-25356`	Patchstack
6.5 Medium	Sanzo Theme `sanzo`	Cross-Site Scripting	`≤ 2.4.3` Fixed in `2.4.3`	Mar 25, 2026	`CVE-2026-25355`	Patchstack
7.1 High	Reebox Theme `reebox`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.4.8` Fixed in `1.4.8`	Mar 25, 2026	`CVE-2026-25354`	Patchstack
7.1 High	Nooni Theme `nooni`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5.1` Fixed in `1.5.1`	Mar 25, 2026	`CVE-2026-25353`	Patchstack
7.1 High	MyDecor Theme `mydecor`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5.9` Fixed in `1.5.9`	Mar 25, 2026	`CVE-2026-25352`	Patchstack
7.1 High	MyMedi Theme `mymedi`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.7.7` Fixed in `1.7.7`	Mar 25, 2026	`CVE-2026-25351`	Patchstack
7.1 High	Miti Theme `miti`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5.3` Fixed in `1.5.3`	Mar 25, 2026	`CVE-2026-25350`	Patchstack
7.1 High	Loobek Theme `loobek`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.5.2` Fixed in `1.5.2`	Mar 25, 2026	`CVE-2026-25349`	Patchstack
7.1 High	WP REST Cache Plugin `wp-rest-cache`	Cross-Site Scripting No login needed	`≤ 2026.1.0` Fixed in `2026.1.1`	Mar 25, 2026	`CVE-2026-25347`	Patchstack
7.1 High	FAQ Builder AYS Plugin `faq-builder-ays`	Cross-Site Scripting No login needed	`≤ 1.8.2` Fixed in `1.8.3`	Mar 25, 2026	`CVE-2026-25346`	Patchstack
9.9 Critical	SimpLy Gallery Plugin `simply-gallery-block`	Remote Code Execution Arbitrary Code Execution	`≤ 3.3.2` Fixed in `3.3.2.1`	Mar 25, 2026	`CVE-2026-25345`	Patchstack
6.5 Medium	Review Schema Plugin `review-schema`	Information Disclosure Sensitive Data Exposure	`≤ 2.2.6` Fixed in `2.2.7`	Mar 25, 2026	`CVE-2026-25344`	Patchstack
7.1 High	Boutique Theme `kute-boutique`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.4.6` Fixed in `2.4.6`	Mar 25, 2026	`CVE-2026-25342`	Patchstack
7.1 High	RSFirewall! Plugin `rsfirewall`	Cross-Site Scripting No login needed	`≤ 1.1.45` Fixed in `1.1.46`	Mar 25, 2026	`CVE-2026-25341`	Patchstack
9.3 Critical	Jobmonster Theme `noo-jobmonster`	SQL Injection No login needed	`≤ 4.8.4` Fixed in `4.8.4`	Mar 25, 2026	`CVE-2026-25340`	Patchstack
6.5 Medium	Contact Form by WPForms Plugin `wpforms-lite`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.9.8.7` Fixed in `1.9.9.2`	Mar 25, 2026	`CVE-2026-25339`	Patchstack
8.1 High	Salon Booking System Pro Plugin `salon-booking-plugin-pro`	Privilege Escalation Account Takeover No login needed	`≤ 10.30.12` Fixed in `10.30.12`	Mar 25, 2026	`CVE-2026-25334`	Patchstack
6.8 Medium	Product File Upload for WooCommerce Plugin `products-file-upload-for-woocommerce`	Arbitrary File Upload Arbitrary File Deletion No login needed	`≤ 2.2.4` Fixed in `2.2.5`	Mar 25, 2026	`CVE-2026-25328`	Patchstack
6.5 Medium	Five Star Restaurant Reservations Plugin `restaurant-reservations`	Broken Access Control No login needed	`≤ 2.7.9` Fixed in `2.7.10`	Mar 25, 2026	`CVE-2026-25327`	Patchstack
7.5 High	Print Invoice & Delivery Notes for WooCommerce Plugin `woocommerce-delivery-notes`	Broken Access Control No login needed	`≤ 5.9.0` Fixed in `6.0.0`	Mar 25, 2026	`CVE-2026-25317`	Patchstack
7.5 High	PublishPress Authors Plugin `publishpress-authors`	Broken Access Control No login needed	`≤ 4.10.1` Fixed in `4.11.0`	Mar 25, 2026	`CVE-2026-25309`	Patchstack
7.1 High	XStore Core Plugin `et-core-plugin`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 5.6.4` Fixed in `5.6.5`	Mar 25, 2026	`CVE-2026-25306`	Patchstack
7.1 High	Jaroti Theme `jaroti`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.4.8` Fixed in `1.4.8`	Mar 25, 2026	`CVE-2026-25304`	Patchstack
9.8 Critical	Contest Gallery Plugin `contest-gallery`	Privilege Escalation Account Takeover No login needed	`≤ 28.1.2.2` Fixed in `28.1.3`	Mar 25, 2026	`CVE-2026-25035`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.