WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 3,101–3,150 of 8,943 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 63 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Advanced Settings Plugin advanced-settings Cross-Site Request Forgery No login needed ≤ 3.1.1 Fixed in 3.2.0 CVE-2025-58975 Patchstack
5.3 Medium PDF Generator Plugin pdf-generator-for-wp Broken Access Control No login needed ≤ 1.5.4 Fixed in 1.5.5 CVE-2025-58978 Patchstack
4.9 Medium WP eBay Product Feeds Plugin ebay-feeds-for-wordpress Server-Side Request Forgery ≤ 3.4.8 Fixed in 3.4.9 CVE-2025-58977 Patchstack
5.3 Medium BerqWP Plugin searchpro Broken Access Control No login needed ≤ 2.2.53 Fixed in 2.2.54 CVE-2025-58979 Patchstack
5.4 Medium Accessibility Checker by Equalize Digital Plugin accessibility-checker Broken Access Control ≤ 1.31.0 Fixed in 1.31.1 CVE-2025-58981 Patchstack
5.3 Medium Export WP Page to Static HTML/CSS Plugin export-wp-page-to-static-html Broken Access Control No login needed ≤ 4.1.0 Fixed in 4.2.0 CVE-2025-58980 Patchstack
5.9 Medium Pixeline's Email Protector Plugin pixelines-email-protector Cross-Site Scripting ≤ 1.3.8 Fixed in 1.4.0 CVE-2025-58982 Patchstack
5.9 Medium Welcart e-Commerce Plugin usc-e-shop Cross-Site Scripting ≤ 2.11.20 Fixed in 2.11.21 CVE-2025-58984 Patchstack
5.9 Medium Include Me Plugin include-me Cross-Site Scripting ≤ 1.3.2 Fixed in 1.3.3 CVE-2025-58983 Patchstack
6.5 Medium Additional Custom Product Tabs for WooCommerce Plugin product-tabs-for-woocommerce Cross-Site Scripting ≤ 1.7.3 Fixed in 1.7.4 CVE-2025-58985 Patchstack
6.5 Medium Football Pool Plugin football-pool Cross-Site Scripting ≤ 2.12.6 Fixed in 2.13.0 CVE-2025-58987 Patchstack
6.5 Medium My Tickets Plugin my-tickets Cross-Site Scripting ≤ 2.0.22 Fixed in 2.0.23 CVE-2025-58988 Patchstack
6.5 Medium Dynamic Text Field For Contact Form 7 Plugin dynamic-text-field-for-contact-form-7 Cross-Site Scripting ≤ 1.0 Fixed in 1.1 CVE-2025-58989 Patchstack
6.5 Medium ShopLentor Plugin woolentor-addons Cross-Site Scripting ≤ 3.2.0 Fixed in 3.2.1 CVE-2025-58990 Patchstack
5.9 Medium WP Weixin Plugin wp-weixin Cross-Site Scripting ≤ 1.3.16 Fixed in 1.3.17 CVE-2025-30875 Patchstack
5.3 Medium Awesome Support Plugin awesome-support Information Disclosure Sensitive Data Exposure No login needed ≤ 6.3.6 Fixed in 6.3.7 CVE-2025-53340 Patchstack
5.4 Medium Spreadconnect Plugin wc-spod Broken Access Control ≤ 2.1.5 CVE-2025-53291 Patchstack
5.3 Medium Kalium Theme kalium Broken Access Control No login needed ≤ 3.18.3 Fixed in 3.19 CVE-2025-53348 Patchstack
5.4 Medium Target Video Easy Publish Plugin brid-video-easy-publish Remote Code Execution Arbitrary Code Execution ≤ 3.8.9 CVE-2025-32688 Patchstack
6.5 Medium WP Simple Booking Calendar Plugin wp-simple-booking-calendar Broken Access Control ≤ 2.0.13 Fixed in 2.0.14 CVE-2025-39541 Patchstack
4.7 Medium GoodBarber Plugin goodbarber Open Redirect No login needed ≤ 1.0.26 Fixed in 1.0.27 CVE-2025-39523 Patchstack
4.3 Medium Church Admin Plugin church-admin Information Disclosure Sensitive Data Exposure ≤ 5.0.9 Fixed in 5.0.10 CVE-2025-39553 Patchstack
6.4 Medium LiteSpeed Cache Plugin litespeed-cache Server-Side Request Forgery ≤ 7.0.1 Fixed in 7.1 CVE-2025-47437 Patchstack
5.3 Medium Majestic Support Plugin majestic-support Broken Access Control No login needed ≤ 1.1.0 Fixed in 1.1.1 CVE-2025-49860 Patchstack
4.3 Medium Categorify Plugin categorify Broken Access Control ≤ 1.0.7.5 CVE-2025-59005 Patchstack
4.3 Medium Quick Paypal Payments Plugin quick-paypal-payments Cross-Site Request Forgery No login needed ≤ 5.7.46 Fixed in 5.7.47 CVE-2025-27003 Patchstack
6.5 Medium HAPPY Plugin happy-helpdesk-support-ticket-system Broken Access Control ≤ 1.0.6 Fixed in 1.0.7 CVE-2025-53571 Patchstack
5.9 Medium GoUrl Bitcoin Payment Gateway & Paid Downloads & Membership Plugin gourl-bitcoin-payment-gateway-paid-downloads-membership Cross-Site Scripting ≤ 1.6.6 CVE-2025-48102 Patchstack
6.5 Medium Today's Date Inserter Plugin todays-date-inserter Cross-Site Scripting ≤ 1.2.1 CVE-2025-48103 Patchstack
6.5 Medium Easy Flash Embed Plugin easy-flash-embed Cross-Site Scripting ≤ 1.0 CVE-2025-48105 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.6.15 Fixed in 3.6.16 CVE-2025-54744 Patchstack
6.5 Medium Course Booking Platform Plugin course-booking-platform Cross-Site Scripting ≤ 1.0.0 CVE-2025-58887 Patchstack
5.9 Medium Instant Locations Plugin instant-locations Cross-Site Scripting ≤ 1.0 CVE-2025-58886 Patchstack
5.9 Medium vipdrv Plugin vipdrv-vip-test-drive Cross-Site Scripting ≤ 1.0.3 CVE-2025-58884 Patchstack
5.9 Medium Search Cloud One Plugin search-cloud-one Cross-Site Scripting ≤ 2.2.5 CVE-2025-58883 Patchstack
6.5 Medium Simple Text Slider Plugin simple-text-slider Cross-Site Scripting ≤ 1.0.5 CVE-2025-58882 Patchstack
6.5 Medium Translate This gTranslate Shortcode Plugin translate-this-google-translate-web-element-shortcode Cross-Site Scripting ≤ 1.0 CVE-2025-58880 Patchstack
6.5 Medium Woocommerce Gifts Product Plugin woo-gift-product Cross-Site Request Forgery No login needed ≤ 1.0.0 CVE-2025-58878 Patchstack
6.5 Medium Aparat Video Shortcode Plugin aparat-shortcode Cross-Site Scripting ≤ 0.2.4 CVE-2025-58876 Patchstack
6.5 Medium WP Github Gist Plugin wp-github-gist Cross-Site Scripting ≤ 0.5 CVE-2025-58875 Patchstack
6.5 Medium StoryMap Plugin wp-storymap Cross-Site Scripting ≤ 2.1 CVE-2025-58874 Patchstack
5.9 Medium Pushe Web Push Notification Plugin pushe-webpush Cross-Site Scripting ≤ 0.5.0 CVE-2025-58873 Patchstack
6.5 Medium Simple Price Calculator Plugin simple-price-calculator-basic Broken Access Control ≤ 1.3 CVE-2025-58872 Patchstack
6.5 Medium Master Paper Collapse Toggle Plugin master-paper-collapse-toggle Cross-Site Scripting ≤ 1.1 CVE-2025-58871 Patchstack
6.5 Medium WP-GraphViz Plugin wp-graphviz Cross-Site Scripting ≤ 1.5.1 CVE-2025-58870 Patchstack
6.5 Medium SimaCookie Plugin simasicher-dsgvo-cookie Cross-Site Request Forgery ≤ 1.3.2 CVE-2025-58869 Patchstack
6.5 Medium SimaCookie Plugin simasicher-dsgvo-cookie Cross-Site Scripting ≤ 1.3.2 CVE-2025-58868 Patchstack
6.5 Medium Easy Download Media Counter Plugin easy-download-media-counter Cross-Site Scripting ≤ 1.2 CVE-2025-58867 Patchstack
4.3 Medium Compact Admin Plugin compact-admin Cross-Site Request Forgery No login needed ≤ 1.3.3 CVE-2025-58865 Patchstack
6.5 Medium 金数据 Plugin jinshuju Cross-Site Scripting ≤ 1.0 CVE-2025-58864 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only