WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 301–350 of 1,491 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 7 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Off-Canvas Sidebars & Menus (Slidebars) Plugin `off-canvas-sidebars`	Cross-Site Request Forgery No login needed	`≤ 0.5.8.5` Fixed in `0.5.9`	Oct 27, 2025	`CVE-2025-62891`	Patchstack
4.3 Medium	Premmerce Brands for WooCommerce Plugin `premmerce-woocommerce-brands`	Cross-Site Request Forgery No login needed	`≤ 1.2.13` Fixed in `1.2.14`	Oct 27, 2025	`CVE-2025-62890`	Patchstack
5.3 Medium	User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds Plugin `userfeedback-lite`	Broken Access Control Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure No login needed	`≤ 1.8.0`	Oct 25, 2025	`CVE-2025-10694`	Wordfence
4.3 Medium	Product Catalog Simple Plugin `post-type-x`	Cross-Site Request Forgery No login needed	`≤ 1.8.4` Fixed in `1.8.5`	Oct 22, 2025	`CVE-2025-62061`	Patchstack
4.3 Medium	UPC/EAN/GTIN Code Generator Plugin `upc-ean-barcode-generator`	Cross-Site Request Forgery No login needed	`≤ 2.0.2` Fixed in `2.0.3`	Oct 22, 2025	`CVE-2025-62009`	Patchstack
4.3 Medium	WP Media Categories Plugin `wp-media-categories`	Cross-Site Request Forgery No login needed	`≤ 2.1.0`	Oct 22, 2025	`CVE-2025-60134`	Patchstack
4.4 Medium	Icegram Express Pro Plugin `email-subscribers-premium`	Server-Side Request Forgery	`≤ 5.9.5` Fixed in `5.9.6`	Oct 22, 2025	`CVE-2025-49917`	Patchstack
5.4 Medium	Captcha.eu Plugin `captcha-eu`	Server-Side Request Forgery No login needed	`≤ 1.0.61` Fixed in `1.0.62`	Oct 22, 2025	`CVE-2025-49374`	Patchstack
4.3 Medium	Evergreen Content Poster Plugin `evergreen-content-poster`	Cross-Site Request Forgery No login needed	`≤ 1.4.5` Fixed in `1.4.6`	Oct 22, 2025	`CVE-2025-49373`	Patchstack
4.7 Medium	Search & Filter Plugin `search-filter`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Open Redirect No login needed	`≤ 1.2.17` Fixed in `1.2.18`	Oct 22, 2025	`CVE-2025-48099`	Patchstack
5.4 Medium	Silencesoft RSS Reader Plugin `external-rss-reader`	Server-Side Request Forgery No login needed	`≤ 0.6`	Sep 26, 2025	`CVE-2025-60181`	Patchstack
5.4 Medium	ZoloBlocks Plugin `zoloblocks`	Server-Side Request Forgery No login needed	`≤ 2.3.11` Fixed in `2.3.12`	Sep 26, 2025	`CVE-2025-60161`	Patchstack
4.3 Medium	Lenix scss compiler Plugin `lenix-scss-compiler`	Cross-Site Request Forgery No login needed	`≤ 1.2`	Sep 26, 2025	`CVE-2025-60145`	Patchstack
4.3 Medium	Sendle Shipping Plugin `official-sendle-shipping-method`	Cross-Site Request Forgery No login needed	`≤ 6.02` Fixed in `6.03`	Sep 26, 2025	`CVE-2025-60139`	Patchstack
4.3 Medium	Post Featured Video Plugin `post-featured-video`	Cross-Site Request Forgery No login needed	`≤ 1.7`	Sep 26, 2025	`CVE-2025-60137`	Patchstack
4.3 Medium	Vehica Core Plugin `vehica-core`	Cross-Site Request Forgery No login needed	`≤ 1.0.100` Fixed in `1.0.101`	Sep 26, 2025	`CVE-2025-60117`	Patchstack
4.3 Medium	Instapage Plugin `instapage`	Cross-Site Request Forgery No login needed	`≤ 3.7.0` Fixed in `3.7.1`	Sep 26, 2025	`CVE-2025-60115`	Patchstack
4.3 Medium	Groovy Menu Plugin `groovy-menu-free`	Cross-Site Request Forgery No login needed	`≤ 1.4.3`	Sep 26, 2025	`CVE-2025-60113`	Patchstack
4.3 Medium	Download Manager Plugin `download-manager`	Cross-Site Request Forgery No login needed	`≤ 3.3.24` Fixed in `3.3.25`	Sep 26, 2025	`CVE-2025-60093`	Patchstack
4.3 Medium	Di Themes Demo Site Importer Plugin `di-themes-demo-site-importer`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Plugin Activation No login needed	`≤ 1.2`	Sep 26, 2025	`CVE-2025-58914`	Patchstack
6.4 Medium	Publitio Plugin `publitio`	Server-Side Request Forgery	`≤ 2.2.1` Fixed in `2.2.2`	Sep 22, 2025	`CVE-2025-58962`	Patchstack
4.3 Medium	Zoho Flow Plugin `zoho-flow`	Cross-Site Request Forgery No login needed	`≤ 2.14.1` Fixed in `2.14.2`	Sep 22, 2025	`CVE-2025-59568`	Patchstack
6.5 Medium	Penci Shortcodes & Performance Plugin `penci-shortcodes`	Cross-Site Scripting	`≤ 6.1` Fixed in `6.1`	Sep 22, 2025	`CVE-2025-59587`	Patchstack
5.4 Medium	Mihdan: No External Links Plugin `mihdan-no-external-links`	Cross-Site Request Forgery No login needed	`≤ 5.1.6.2` Fixed in `5.1.7`	Sep 22, 2025	`CVE-2025-53451`	Patchstack
4.3 Medium	SEO Backlink Monitor Plugin `seo-backlink-monitor`	Cross-Site Request Forgery No login needed	`≤ 1.8.0`	Sep 22, 2025	`CVE-2025-53456`	Patchstack
4.4 Medium	SEO Backlink Monitor Plugin `seo-backlink-monitor`	Server-Side Request Forgery	`≤ 1.8.0`	Sep 22, 2025	`CVE-2025-53457`	Patchstack
4.4 Medium	Beaf Plugin `image-compare-block`	Server-Side Request Forgery	`≤ 1.6.2`	Sep 22, 2025	`CVE-2025-53461`	Patchstack
6.5 Medium	RIS Version Switcher – Downgrade or Upgrade WP Versions Easily Plugin `ris-version-switcher`	Cross-Site Request Forgery Downgrade or Upgrade WP Versions Easily Plugin <= 1.0 - Cross Site Request Forgery (CSRF) No login needed	`≤ 1.0`	Sep 22, 2025	`CVE-2025-57902`	Patchstack
4.3 Medium	AgreeMe Checkboxes For WooCommerce Plugin `agreeme-checkboxes-for-woocommerce`	Cross-Site Request Forgery No login needed	`≤ 1.1.3`	Sep 22, 2025	`CVE-2025-57905`	Patchstack
4.3 Medium	TOCHAT.BE Plugin `tochat-be`	Cross-Site Request Forgery No login needed	`≤ 1.3.4`	Sep 22, 2025	`CVE-2025-57915`	Patchstack
4.3 Medium	Deliver via Shipos for WooCommerce Plugin `wc-shipos-delivery`	Cross-Site Request Forgery No login needed	`≤ 3.0.2` Fixed in `3.1.0`	Sep 22, 2025	`CVE-2025-57914`	Patchstack
4.3 Medium	Developer Plugin `developer`	Cross-Site Request Forgery No login needed	`≤ 1.2.6`	Sep 22, 2025	`CVE-2025-57924`	Patchstack
4.3 Medium	Dashboard Notepad Plugin `dashboard-notepad`	Cross-Site Request Forgery No login needed	`≤ 1.42`	Sep 22, 2025	`CVE-2025-57927`	Patchstack
4.3 Medium	Double the Donation Plugin `double-the-donation`	Cross-Site Request Forgery No login needed	`≤ 2.0.0` Fixed in `3.0.0`	Sep 22, 2025	`CVE-2025-57930`	Patchstack
4.3 Medium	Piotnet Forms Plugin `piotnetforms`	Cross-Site Request Forgery No login needed	`≤ 1.0.30`	Sep 22, 2025	`CVE-2025-57933`	Patchstack
6.5 Medium	PowerFolio Plugin `portfolio-elementor`	Cross-Site Scripting	`≤ 3.2.1` Fixed in `3.2.2`	Sep 22, 2025	`CVE-2025-57932`	Patchstack
4.3 Medium	LWS Affiliation Plugin `lws-affiliation`	Cross-Site Request Forgery No login needed	`≤ 2.3.6`	Sep 22, 2025	`CVE-2025-57934`	Patchstack
4.3 Medium	Emergency Password Reset Plugin `emergency-password-reset`	Cross-Site Request Forgery No login needed	`≤ 9.3` Fixed in `9.4`	Sep 22, 2025	`CVE-2025-57942`	Patchstack
4.4 Medium	Skimlinks Affiliate Marketing Tool Plugin `skimlinks`	Server-Side Request Forgery	`≤ 1.3.1`	Sep 22, 2025	`CVE-2025-57943`	Patchstack
5.4 Medium	payOS Plugin `payos`	Cross-Site Request Forgery No login needed	`≤ 1.0.73`	Sep 22, 2025	`CVE-2025-57946`	Patchstack
4.3 Medium	Travel Map Plugin `travelmap-blog`	Cross-Site Request Forgery No login needed	`≤ 1.0.3` Fixed in `1.0.4`	Sep 22, 2025	`CVE-2025-57960`	Patchstack
4.3 Medium	SALESmanago & Leadoo Plugin `salesmanago`	Cross-Site Request Forgery No login needed	`≤ 3.8.1` Fixed in `3.8.2`	Sep 22, 2025	`CVE-2025-57970`	Patchstack
4.3 Medium	Advanced Appointment Booking & Scheduling Plugin `advanced-appointment-booking-scheduling`	Cross-Site Request Forgery No login needed	`≤ 2.1`	Sep 22, 2025	`CVE-2025-57978`	Patchstack
6.5 Medium	BP Disable Activation Reloaded Plugin `bp-disable-activation-reloaded`	Cross-Site Request Forgery No login needed	`≤ 1.2.1`	Sep 22, 2025	`CVE-2025-57983`	Patchstack
4.4 Medium	MakeStories (for Google Web Stories) Plugin `makestories-helper`	Server-Side Request Forgery	`≤ 3.0.4`	Sep 22, 2025	`CVE-2025-57984`	Patchstack
4.3 Medium	Mail Baby SMTP Plugin `mail-baby-smtp`	Cross-Site Request Forgery No login needed	`≤ 2.8` Fixed in `3.2.12`	Sep 22, 2025	`CVE-2025-57992`	Patchstack
5.3 Medium	Memberful - Membership Plugin `memberful-wp`	Broken Access Control No login needed	`≤ 1.75.0` Fixed in `1.76.0`	Sep 22, 2025	`CVE-2025-58000`	Patchstack
5.4 Medium	DriCub Plugin `dricub-driving-school`	Server-Side Request Forgery No login needed	`≤ 2.9`	Sep 22, 2025	`CVE-2025-58005`	Patchstack
6.4 Medium	Content Mask Plugin `content-mask`	Server-Side Request Forgery	`≤ 1.8.5.2` Fixed in `1.8.5.3`	Sep 22, 2025	`CVE-2025-58011`	Patchstack
4.3 Medium	SV Proven Expert Plugin `sv-provenexpert`	Cross-Site Request Forgery No login needed	`≤ 2.0.06`	Sep 22, 2025	`CVE-2025-58010`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.