WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 4,151–4,200 of 9,038 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 84 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High VikRestaurants Plugin vikrestaurants Cross-Site Scripting No login needed ≤ 1.5 Fixed in 1.5.1 CVE-2025-57968 Patchstack
7.1 High Flexible PDF Invoices for WooCommerce & Plugin flexible-invoices Cross-Site Request Forgery No login needed ≤ 6.0.13 Fixed in 6.0.14 CVE-2025-57977 Patchstack
8.8 High CouponXxL Plugin couponxxl Cross-Site Request Forgery No login needed ≤ 4.5.0 CVE-2025-58013 Patchstack
8.8 High Constructo Plugin constructo Cross-Site Request Forgery No login needed ≤ 4.3.9 CVE-2025-58244 Patchstack
8.8 High Findgo Plugin fingo Cross-Site Request Forgery No login needed ≤ 1.3.55 Fixed in 1.3.60.1 CVE-2025-58250 Patchstack
7.1 High Nokri Theme nokri Cross-Site Request Forgery No login needed ≤ 1.6.4 CVE-2025-58259 Patchstack
7.1 High Mavis HTTPS to HTTP Redirection Plugin mavis-https-to-http-redirect Cross-Site Request Forgery No login needed ≤ 1.4.3 CVE-2025-58261 Patchstack
7.1 High Sweet Energy Efficiency Plugin sweet-energy-efficiency Cross-Site Request Forgery No login needed ≤ 1.0.8 Fixed in 1.0.9 CVE-2025-58262 Patchstack
7.1 High WPMK PDF Generator Plugin wpmk-pdf-generator Cross-Site Request Forgery No login needed ≤ 1.0.1 CVE-2025-58268 Patchstack
7.1 High Stock Message Plugin stock-message Cross-Site Request Forgery No login needed ≤ 1.1.0 CVE-2025-58267 Patchstack
7.1 High NIX Anti-Spam Light Plugin nix-anti-spam-light Cross-Site Request Forgery No login needed ≤ 0.0.4 CVE-2025-58270 Patchstack
7.1 High Grid Plugin grid Cross-Site Request Forgery No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2025-58657 Patchstack
7.2 High Awesome Support Plugin awesome-support PHP Object Injection Deserialization of untrusted data ≤ 6.3.5 Fixed in 6.3.6 CVE-2025-58662 Patchstack
7.1 High Auction Feed Plugin auction-feed Cross-Site Request Forgery No login needed ≤ 1.1.4 CVE-2025-58671 Patchstack
7.1 High WP Content Protection Plugin wp-content-protection Cross-Site Request Forgery No login needed ≤ 1.3 CVE-2025-58670 Patchstack
7.1 High HORIZONTAL SLIDER Plugin horizontal-slider Cross-Site Request Forgery No login needed ≤ 2.4 CVE-2025-58676 Patchstack
7.1 High ShrinkTheWeb (STW) Website Previews Plugin shrinktheweb-website-preview-plugin Cross-Site Request Forgery No login needed ≤ 2.8.5 CVE-2025-58677 Patchstack
8.5 High Perfect Brands for WooCommerce Plugin perfect-woocommerce-brands SQL Injection ≤ 3.6.2 Fixed in 3.6.3 CVE-2025-58686 Patchstack
7.1 High Current Age Plugin current-age Cross-Site Request Forgery No login needed ≤ 1.6 Fixed in 1.7 CVE-2025-58687 Patchstack
7.1 High Casengo Live Chat Support Plugin the-casengo-chat-widget Cross-Site Request Forgery No login needed ≤ 2.1.4 CVE-2025-58688 Patchstack
7.1 High Doliconnect Plugin doliconnect Cross-Site Request Forgery No login needed ≤ 9.5.7 Fixed in 9.6.2 CVE-2025-58690 Patchstack
8.1 High Miniorange OTP Verification with Firebase Plugin miniorange-firebase-sms-otp-verification Privilege Escalation Unauthenticated Privilege Escalation No login needed 3.1.0 – 3.6.2 CVE-2025-7665 Wordfence
8.8 High Embed PDF for WPForms Plugin embed-pdf-wpforms Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload ≤ 1.1.5 CVE-2025-10647 Wordfence
8.1 High Service Finder SMS System Plugin Authentication Bypass No login needed ≤ 2.0.0 CVE-2025-5955 Wordfence
8.1 High Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages Plugin Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation ≤ 3.4.3 CVE-2025-8565 Wordfence
8.8 High StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Plugin storeengine Arbitrary File Upload Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload ≤ 1.5.0 CVE-2025-9216 Wordfence
8.8 High WP Import – Ultimate CSV XML Importer Plugin wp-ultimate-csv-importer Remote Code Execution Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection 7.20 – 7.28 CVE-2025-10057 Wordfence
8.1 High WP Import – Ultimate CSV XML Importer Plugin wp-ultimate-csv-importer Arbitrary File Deletion Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion ≤ 7.27 CVE-2025-10058 Wordfence
7.5 High Catch Dark Mode Plugin catch-dark-mode Local File Inclusion Authenticated (Contributor+) Local File Inclusion ≤ 2.0 CVE-2025-10143 Wordfence
7.2 High The Hack Repair Guy's Plugin Archiver Plugin hackrepair-plugin-archiver Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion ≤ 2.0.4 CVE-2025-10176 Wordfence
7.2 High LWS Cleaner Plugin lws-cleaner Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file' ≤ 2.4.1.3 CVE-2025-8575 Wordfence
7.5 High Spirit Framework Plugin spirit-framework Local File Inclusion Authenticated (Subscriber+) Local File Inclusion ≤ 1.2.13 CVE-2025-10269 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.15.1 CVE-2025-9807 Wordfence
8.8 High Time Tracker Plugin time-tracker Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion ≤ 3.1.0 CVE-2025-9018 Wordfence
8.8 High My WP Translate Plugin my-wp-translate Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update ≤ 1.1 CVE-2025-8425 Wordfence
8.0 High User Meta – User Profile Builder and User management Plugin user-meta Arbitrary File Deletion User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion ≤ 3.1.2 CVE-2025-9693 Wordfence
7.5 High Ultimate Classified Listings Plugin ultimate-classified-listings Local File Inclusion Authenticated (Contributor+) Local File Inclusion ≤ 1.6 CVE-2025-9874 Wordfence
7.5 High All in one Minifier Plugin all-in-one-minifier SQL Injection Unauthenticated SQL Injection No login needed ≤ 3.2 CVE-2025-9073 Wordfence
7.5 High Propovoice Plugin propovoice Path Traversal Unauthenticated Arbitrary File Read No login needed ≤ 1.7.6.7 CVE-2025-8422 Wordfence
8.1 High Catalog Importer, Scraper & Crawler Plugin intelligent-importer Remote Code Execution Unauthenticated PHP Code Injection No login needed ≤ 5.1.4 CVE-2025-8417 Wordfence
8.8 High Resideo Plugin for Resideo - Real Estate Theme Broken Access Control Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover ≤ 2.5.4 CVE-2025-7718 Wordfence
7.2 High Import any XML, CSV or Excel File to Plugin wp-all-import Arbitrary File Upload Authenticated (Admin+) Limited Unsafe File Upload ≤ 3.9.3 CVE-2025-10001 Wordfence
7.7 High WP Import – Ultimate CSV XML Importer Plugin wp-ultimate-csv-importer Broken Access Control Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure ≤ 7.27 CVE-2025-10040 Wordfence
8.8 High WPGYM - Wordpress Gym Management System Plugin Privilege Escalation Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover ≤ 67.7.0 CVE-2025-7049 Wordfence
7.2 High Responsive Filterable Portfolio Plugin Arbitrary File Upload Authenticated (Admin+) Arbitrary File Upload ≤ 1.0.24 CVE-2025-10049 Wordfence
7.1 High WooCommerce Booking Bundle Hours Plugin woo-booking-bundle-hours Cross-Site Request Forgery No login needed ≤ 0.7.4 Fixed in 0.7.5 CVE-2025-58991 Patchstack
7.6 High Tutor LMS Plugin tutor SQL Injection ≤ 3.7.4 Fixed in 3.8.0 CVE-2025-58993 Patchstack
8.8 High ThemeMove Core Plugin thememove-core PHP Object Injection ≤ 1.4.2 CVE-2025-53303 Patchstack
8.1 High Ziston Plugin ziston Local File Inclusion No login needed ≤ 1.4.5 CVE-2025-58215 Patchstack
8.8 High Constant Contact Plugin constant-contact-api PHP Object Injection No login needed ≤ 4.1.1 CVE-2025-48101 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only