WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 4,101–4,150 of 9,038 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 83 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.2 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager SQL Injection Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection ≤ 6.0.6.2 CVE-2025-11204 Wordfence
8.1 High Motors – Car Dealership & Classified Listings Plugin Arbitrary File Deletion Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion ≤ 1.4.89 CVE-2025-10494 Wordfence
7.5 High OrderConvo Plugin admin-and-client-message-after-order-for-woocommerce Path Traversal Unauthenticated Arbitrary File Read No login needed < 14 Fixed in 14 CVE-2025-10162 WPScan
8.1 High Cost Calculator Builder Plugin cost-calculator-builder Broken Access Control Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions ≤ 3.5.32 CVE-2025-9243 Wordfence
8.8 High AP Background Plugin ap-background Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function 3.8.1 – 3.8.2 CVE-2025-9561 Wordfence
7.5 High WP Dispatcher Plugin wp-dispatcher Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload ≤ 1.2.0 CVE-2025-9212 Wordfence
8.8 High WP Dispatcher Plugin wp-dispatcher SQL Injection Authenticated (Contributor+) SQL Injection ≤ 1.2.0 CVE-2025-10582 Wordfence
7.5 High Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin yournewsapp SQL Injection Your native, mobile iPhone App and Android App <= 0.8.8.8 - Unauthenticated SQL Injection No login needed ≤ 0.8.8.8 CVE-2025-9200 Wordfence
8.8 High TextBuilder Plugin textbuilder Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via Account Takeover No login needed 1.0.0 – 1.1.1 CVE-2025-9213 Wordfence
8.6 High CTL Behance Importer Lite Plugin SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.0 CVE-2025-9587 WPScan
7.5 High AffiliateWP Plugin affiliatewp-affiliate-area-tabs SQL Injection Unauthenticated SQL Injection No login needed ≤ 2.28.2 CVE-2025-8877 Wordfence
8.8 High LatePoint Plugin latepoint Cross-Site Request Forgery Cross-Site Request Forgery to Account Takeover via change_password() Function No login needed ≤ 5.1.94 CVE-2025-7052 Wordfence
8.2 High LatePoint Plugin latepoint Authentication Bypass Unauthenticated Authentication Bypass via load_step Function No login needed ≤ 5.1.94 CVE-2025-7038 Wordfence
8.1 High Tiny Bootstrap Elements Light Plugin tiny-bootstrap-elements-light Local File Inclusion Unauthenticated Local File Inclusion No login needed ≤ 4.3.34 CVE-2025-9991 Wordfence
8.1 High Bei Fen – WordPress Backup Plugin bei-fen Local File Inclusion WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion No login needed ≤ 1.4.2 CVE-2025-9993 Wordfence
7.2 High WP Statistics Plugin wp-statistics Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via User-Agent Header No login needed ≤ 14.15.4 CVE-2025-9816 Wordfence
7.1 High GST for WooCommerce Plugin gst-for-woocommerce Cross-Site Request Forgery No login needed ≤ 2.0 CVE-2025-60173 Patchstack
7.1 High Flytedesk Digital Plugin flytedesk-digital Cross-Site Request Forgery No login needed ≤ 20181101 CVE-2025-60172 Patchstack
7.1 High Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin yourplugins-wc-conditional-cart-notices Cross-Site Request Forgery YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.2.10 CVE-2025-60171 Patchstack
7.1 High HTACCESS IP Blocker Plugin htaccess-ip-blocker Cross-Site Request Forgery No login needed ≤ 1.0 CVE-2025-60170 Patchstack
7.1 High W3SCloud Contact Form 7 to Zoho CRM Plugin w3s-cf7-zoho Cross-Site Request Forgery No login needed ≤ 3.2 CVE-2025-60169 Patchstack
7.1 High NewsmanApp Plugin newsmanapp Cross-Site Request Forgery No login needed ≤ 2.7.7 Fixed in 3.0.0 CVE-2025-60164 Patchstack
7.5 High Subscribe To Unlock Plugin subscribe-to-unlock Local File Inclusion ≤ 1.1.5 CVE-2025-60153 Patchstack
7.5 High Subscribe to Download Plugin subscribe-to-download Local File Inclusion ≤ 2.0.9 Fixed in 2.1.0 CVE-2025-60150 Patchstack
8.8 High Testimonial Slider Plugin testimonial-add Local File Inclusion ≤ 3.5.8.6 CVE-2025-60126 Patchstack
8.5 High PGS Core Plugin pgs-core SQL Injection ≤ 5.9.0 CVE-2025-60118 Patchstack
8.8 High Javo Core Plugin javo-core Cross-Site Request Forgery No login needed ≤ 3.0.0.266 CVE-2025-60111 Patchstack
8.5 High AllInOne - Banner Rotator Plugin all-in-one-bannerrotator SQL Injection Banner Rotator Plugin <= 3.8 - SQL Injection ≤ 3.8 CVE-2025-60110 Patchstack
8.5 High LambertGroup - AllInOne - Content Slider Plugin all-in-one-contentslider SQL Injection AllInOne - Content Slider Plugin <= 3.8 - SQL Injection ≤ 3.8 CVE-2025-60109 Patchstack
8.5 High LambertGroup - AllInOne - Banner with Thumbnails Plugin all-in-one-thumbnailsbanner SQL Injection AllInOne - Banner with Thumbnails Plugin <= 3.8 - SQL Injection ≤ 3.8 CVE-2025-60108 Patchstack
8.5 High LambertGroup - AllInOne - Banner with Playlist Plugin all-in-one-bannerwithplaylist SQL Injection AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection ≤ 3.8 CVE-2025-60107 Patchstack
7.1 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.9.5.7 Fixed in 5.9.5.8 CVE-2025-4957 Patchstack
7.1 High Uncode Plugin uncode Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.9.4.4 Fixed in 2.9.4.4 CVE-2025-48107 Patchstack
7.1 High Traveler Plugin traveler Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.2.3 Fixed in 3.2.3 CVE-2025-59012 Patchstack
7.7 High BM Content Builder Plugin bm-builder Arbitrary File Deletion ≤ 3.16.3.3 Fixed in 3.16.3.3 CVE-2025-59002 Patchstack
7.5 High Permalink Manager Lite Plugin permalink-manager Information Disclosure Sensitive Data Exposure No login needed ≤ 2.5.1.3 Fixed in 2.5.1.4 CVE-2025-59010 Patchstack
7.5 High Traveler Plugin traveler Broken Access Control Arbitrary Content Deletion No login needed ≤ 3.2.3 Fixed in 3.2.3 CVE-2025-59011 Patchstack
7.2 High WP-DownloadManager Plugin wp-downloadmanager Arbitrary File Upload Authenticated (Admin+) Arbitrary File Upload ≤ 1.68.11 CVE-2025-10747 Wordfence
8.8 High Advanced Views – Display Posts, Custom Fields, and More Plugin acf-views Remote Code Execution Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI ≤ 3.7.19 CVE-2025-10380 Wordfence
7.1 High WP Attractive Donations System Plugin wp-attractive-donations-system-easy-stripe-paypal-donations Cross-Site Request Forgery No login needed ≤ 1.29 Fixed in 1.29 CVE-2025-58956 Patchstack
7.5 High Easy Elementor Addons Plugin easy-elementor-addons Local File Inclusion ≤ 2.2.8 Fixed in 2.2.9 CVE-2025-58973 Patchstack
8.8 High WorkScout-Core Plugin workscout-core Cross-Site Request Forgery No login needed ≤ 1.7.06 Fixed in 1.7.06 CVE-2025-59572 Patchstack
7.6 High Mail Mint Plugin mail-mint SQL Injection ≤ 1.18.6 Fixed in 1.18.7 CVE-2025-59570 Patchstack
7.5 High Soledad Theme soledad Local File Inclusion ≤ 8.6.8 Fixed in 8.6.9 CVE-2025-59588 Patchstack
7.5 High Easy Pricing Table WP Plugin easy-pricing-table-wp Local File Inclusion ≤ 1.1.3 CVE-2025-53450 Patchstack
7.2 High GSheets Connector Plugin sheetlink PHP Object Injection ≤ 1.1.1 CVE-2025-53465 Patchstack
8.5 High Wp tabber widget Plugin wp-tabber-widget SQL Injection ≤ 4.0 CVE-2025-53468 Patchstack
7.2 High ConveyThis Plugin conveythis-translate PHP Object Injection ≤ 269.1 Fixed in 269.2 CVE-2025-57919 Patchstack
7.1 High LinkedInclude Plugin linkedinclude Cross-Site Request Forgery No login needed ≤ 3.0.4 CVE-2025-57918 Patchstack
7.5 High immonex Kickstart Team Plugin immonex-kickstart-team Local File Inclusion ≤ 1.6.9 Fixed in 1.7.0 CVE-2025-57925 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only