WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.
Showing 3,301–3,350 of 9,038 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.1 High | Magic Slider | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.2 |
CVE-2025-48094 |
Patchstack | |
| 7.1 High | Image&Video FullScreen Background | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.6.7 |
CVE-2025-47666 |
Patchstack | |
| 8.1 High | Anarkali | Local File Inclusion No login needed |
≤ 1.0.9 |
CVE-2025-47474 |
Patchstack | |
| 7.1 High | HTML5 Video Player with Playlist & Multiple Skins | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 5.3.5 |
CVE-2025-32123 |
Patchstack | |
| 7.1 High | HTML5 Video Player | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 5.3.5 |
CVE-2025-27005 |
Patchstack | |
| 7.2 High | NotificationX | Cross-Site Scripting Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview' No login needed |
≤ 3.2.0 |
CVE-2025-15380 |
Wordfence | |
| 8.8 High | Creator LMS – The LMS for Creators, Coaches, and Trainers | Broken Access Control The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update |
≤ 1.1.12 |
CVE-2025-15347 |
Wordfence | |
| 8.1 High | Nexter Extension – Site Enhancements Toolkit | PHP Object Injection Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace' No login needed |
≤ 4.4.6 |
CVE-2026-0726 |
Wordfence | |
| 8.1 High | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy | Broken Access Control Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure |
≤ 4.2.4 |
CVE-2025-14977 |
Wordfence | |
| 8.4 High | koko-analytics | SQL Injection Koko Analytics vulnerable to arbitrary SQL execution through unescaped analytics export/import and permissive admin SQL import No login needed |
< 2.1.3 |
CVE-2026-22850 |
GitHub_M | |
| 7.5 High | Demo Importer Plus | XML External Entity Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload No login needed |
≤ 2.0.9 |
CVE-2025-14478 |
Wordfence | |
| 8.2 High | Membership Plugin – Restrict Content | Broken Access Control Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure No login needed |
≤ 3.2.16 |
CVE-2025-14844 |
Wordfence | |
| 8.8 High | All-in-One Video Gallery | Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass |
≤ 4.5.7 |
CVE-2025-12957 |
Wordfence | |
| 8.8 High | Supreme Modules Lite | Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass |
≤ 2.5.62 |
CVE-2025-13062 |
Wordfence | |
| 7.5 High | Simply Schedule Appointments | SQL Injection Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters No login needed |
≤ 1.6.9.9 |
CVE-2025-12166 |
Wordfence | |
| 7.5 High | Shipping Rate By Cities | SQL Injection Unauthenticated SQL Injection via 'city' Parameter No login needed |
≤ 2.0.0 |
CVE-2025-14770 |
Wordfence | |
| 7.2 High | GetContentFromURL | Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute No login needed |
≤ 1.0 |
CVE-2025-14613 |
Wordfence | |
| 7.2 High | GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.1.8 |
CVE-2025-15266 |
Wordfence | |
| 7.2 High | AJS Footnotes | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.0 |
CVE-2025-15378 |
Wordfence | |
| 7.2 High | Name Directory | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Multiple Parameters No login needed |
≤ 1.30.3 |
CVE-2025-15283 |
Wordfence | |
| 7.1 High | DASHBOARD BUILDER | Cross-Site Request Forgery Cross-Site Request Forgery to SQL Injection No login needed |
≤ 1.5.7 |
CVE-2025-14615 |
Wordfence | |
| 7.5 High | WooCommerce Square | Broken Access Control Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure in get_token_by_id No login needed |
4.2.0 – < 4.2.3, 4.3.0 – < 4.3.2, 4.4.0 – < 4.4.2, … Fixed in 4.2.3 |
CVE-2025-13457 |
Wordfence | |
| 7.2 High | Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) | Broken Access Control Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' No login needed |
≤ 4.0.51 |
CVE-2025-14657 |
Wordfence | |
| 7.2 High | Frontend Admin by DynamiApps | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'update_field' No login needed |
≤ 3.28.23 |
CVE-2025-14937 |
Wordfence | |
| 7.2 High | SlimStat Analytics | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter No login needed |
≤ 5.3.3 |
CVE-2025-15057 |
Wordfence | |
| 7.2 High | SlimStat Analytics | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters No login needed |
≤ 5.3.4 |
CVE-2025-15055 |
Wordfence | |
| 7.2 High | Brevo for WooCommerce | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 4.0.49 |
CVE-2025-14436 |
Wordfence | |
| 7.5 High | Handmade Framework | Local File Inclusion |
≤ 3.9 |
CVE-2026-22521 |
Patchstack | |
| 7.1 High | Scroll rss excerpt | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 5.0 |
CVE-2025-68892 |
Patchstack | |
| 7.1 High | WP App Bar | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.5 |
CVE-2025-68891 |
Patchstack | |
| 7.1 High | e-shops | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0.4 |
CVE-2025-68890 |
Patchstack | |
| 7.1 High | Pinpoll | Cross-Site Scripting No login needed |
≤ 4.0.0 |
CVE-2025-68889 |
Patchstack | |
| 7.1 High | WP-BusinessDirectory | Cross-Site Scripting No login needed |
≤ 4.0.1 |
CVE-2025-68887 |
Patchstack | |
| 7.1 High | Visitor Stats Widget | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.5.0 |
CVE-2025-68874 |
Patchstack | |
| 7.1 High | PRIMER by chloédigital | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.0.25 |
CVE-2025-68873 |
Patchstack | |
| 8.1 High | Hendon | Local File Inclusion No login needed |
≤ 1.7 Fixed in 1.7 |
CVE-2025-67937 |
Patchstack | |
| 8.1 High | Curly | Local File Inclusion No login needed |
≤ 3.3 Fixed in 3.3 |
CVE-2025-67936 |
Patchstack | |
| 8.1 High | Optimize | Local File Inclusion No login needed |
≤ 2.4 Fixed in 2.4 |
CVE-2025-67935 |
Patchstack | |
| 8.1 High | Wellspring | Local File Inclusion No login needed |
≤ 2.8 Fixed in 2.8 |
CVE-2025-67934 |
Patchstack | |
| 7.1 High | Taskbuilder | Cross-Site Scripting No login needed |
≤ 4.0.9 Fixed in 5.0.0 |
CVE-2025-67933 |
Patchstack | |
| 7.1 High | Listeo Core | Cross-Site Scripting No login needed |
≤ 2.0.19 Fixed in 2.0.19 |
CVE-2025-67932 |
Patchstack | |
| 7.5 High | BulletProof Security | Information Disclosure Sensitive Data Exposure No login needed |
≤ 6.9 Fixed in 7.0 |
CVE-2025-67931 |
Patchstack | |
| 7.1 High | eHive Search | Cross-Site Scripting No login needed |
≤ 2.5.0 Fixed in 2.5.1 |
CVE-2025-67930 |
Patchstack | |
| 7.1 High | Link Whisper Free | Cross-Site Scripting No login needed |
≤ 0.8.8 Fixed in 0.8.9 |
CVE-2025-67927 |
Patchstack | |
| 7.5 High | Corpkit | Local File Inclusion |
≤ 2.0 Fixed in 2.0.1 |
CVE-2025-67925 |
Patchstack | |
| 7.1 High | Grand Restaurant | Cross-Site Scripting No login needed |
≤ 7.0.9 Fixed in 7.0.9 |
CVE-2025-67922 |
Patchstack | |
| 8.5 High | Lobo | SQL Injection |
≤ 2.8.6 Fixed in 2.8.6 |
CVE-2025-67921 |
Patchstack | |
| 8.1 High | Neo Ocular | Local File Inclusion No login needed |
≤ 1.2 Fixed in 1.2 |
CVE-2025-67920 |
Patchstack | |
| 7.1 High | Woffice | Cross-Site Scripting No login needed |
≤ 5.4.30 Fixed in 5.4.31 |
CVE-2025-67918 |
Patchstack | |
| 7.1 High | Jobify | Cross-Site Scripting No login needed |
≤ 4.3.0 Fixed in 4.3.1 |
CVE-2025-67916 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.