WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 4,351–4,400 of 9,038 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 88 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-48170 Patchstack
7.1 High UpStore Plugin upstore Cross-Site Scripting No login needed ≤ 1.7.0 Fixed in 1.7.1 CVE-2025-48296 Patchstack
8.1 High Cena Store Plugin cena Local File Inclusion No login needed ≤ 2.11.26 Fixed in 2.11.27 CVE-2025-48171 Patchstack
7.1 High Simple Link Directory Plugin qc-simple-link-directory Cross-Site Scripting No login needed ≤ 14.8.1 Fixed in 14.8.1 CVE-2025-48297 Patchstack
7.5 High FundEngine Plugin wp-fundraising-donation Local File Inclusion ≤ 1.7.4 Fixed in 1.7.5 CVE-2025-48302 Patchstack
7.5 High SEOPress for MainWP Plugin seopress-for-mainwp Local File Inclusion No login needed ≤ 1.4 Fixed in 1.5 CVE-2025-48298 Patchstack
8.5 High JetEngine Plugin jet-engine Remote Code Execution ≤ 3.7.0 Fixed in 3.7.1.1 CVE-2025-53194 Patchstack
8.1 High Houzez Plugin houzez Local File Inclusion No login needed ≤ 4.0.4 Fixed in 4.0.8 CVE-2025-53198 Patchstack
8.1 High eventlist Plugin eventlist Local File Inclusion No login needed ≤ 1.9.2 Fixed in 2.0.2 CVE-2025-53204 Patchstack
7.1 High Jobmonster Theme noo-jobmonster Cross-Site Scripting No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2025-53201 Patchstack
8.1 High WP Travel Gutenberg Blocks Plugin wp-travel-blocks Local File Inclusion No login needed ≤ 3.9.0 Fixed in 3.9.1 CVE-2025-53207 Patchstack
7.1 High Radio Player Shoutcast & Icecast Plugin lbg-audio4-html5-shoutcast Cross-Site Scripting No login needed ≤ 4.4.7 Fixed in 4.4.8 CVE-2025-53205 Patchstack
7.5 High ZoloBlocks Plugin zoloblocks Local File Inclusion ≤ 2.3.2 Fixed in 2.3.3 CVE-2025-53210 Patchstack
7.5 High Maya Business Plugin paymaya-checkout-for-woocommerce Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.2.0 Fixed in 1.3.0 CVE-2025-53208 Patchstack
7.1 High Revolution Video Player With Bottom Playlist Plugin revolution-video-player Cross-Site Scripting No login needed ≤ 2.9.2 Fixed in 2.9.3 CVE-2025-53212 Patchstack
7.1 High Comments Capcha Box Plugin comments-capcha-box Cross-Site Scripting No login needed ≤ 1.1 CVE-2025-53226 Patchstack
7.1 High Raptive Ads Plugin adthrive-ads Cross-Site Scripting No login needed ≤ 3.8.0 Fixed in 3.9.0 CVE-2025-53319 Patchstack
8.8 High Noisa Plugin noisa PHP Object Injection ≤ 2.6.0 Fixed in 2.6.2 CVE-2025-53560 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53559 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg_universal_video_player_addon_visual_composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53562 Patchstack
7.1 High HTML5 Radio Player - WPBakery Page Builder Addon Plugin lbg_radio_player_addon_visual_composer Cross-Site Scripting WPBakery Page Builder Addon <= 2.5 - Cross Site Scripting (XSS) No login needed ≤ 2.5 Fixed in 2.5.2 CVE-2025-53564 Patchstack
7.1 High Youtube Vimeo Video Player and Slider Plugin video_player_youtube_vimeo Cross-Site Scripting No login needed ≤ 3.8 Fixed in 3.9 CVE-2025-53563 Patchstack
8.1 High Ghost Kit Plugin ghostkit Local File Inclusion No login needed ≤ 3.4.1 Fixed in 3.4.2 CVE-2025-53567 Patchstack
8.1 High Widget for Google Reviews Plugin business-reviews-wp Local File Inclusion No login needed ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-53565 Patchstack
8.8 High Post Grid and Gutenberg Blocks Plugin post-grid PHP Object Injection ≤ 2.3.11 Fixed in 2.3.12 CVE-2025-54007 Patchstack
7.2 High Welcart e-Commerce Plugin usc-e-shop PHP Object Injection ≤ 2.11.16 Fixed in 2.11.17 CVE-2025-54012 Patchstack
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions Local File Inclusion No login needed ≤ 2.15.4 Fixed in 2.15.5 CVE-2025-54017 Patchstack
7.5 High Simple File List Plugin simple-file-list Path Traversal Arbitrary File Download No login needed ≤ 6.1.14 Fixed in 6.1.15 CVE-2025-54021 Patchstack
7.1 High Support Board Plugin supportboard Cross-Site Scripting No login needed ≤ 3.8.0 Fixed in 3.8.1 CVE-2025-54027 Patchstack
7.5 High CF7 WOW Styler Plugin cf7-styler Local File Inclusion No login needed ≤ 1.7.2 Fixed in 1.7.3 CVE-2025-54028 Patchstack
7.1 High Real Estate Manager Pro Plugin real-estate-manager-pro Cross-Site Scripting No login needed ≤ 12.7.3 Fixed in 12.7.4 CVE-2025-54032 Patchstack
8.1 High Support Board Plugin supportboard Local File Inclusion No login needed ≤ 3.8.0 Fixed in 3.8.1 CVE-2025-54031 Patchstack
7.5 High Newsletters Plugin newsletters-lite Local File Inclusion No login needed ≤ 4.10 Fixed in 4.11 CVE-2025-54034 Patchstack
7.1 High Elite Video Player Plugin elite-video-player Cross-Site Scripting No login needed ≤ 10.0.5 Fixed in 10.0.7 CVE-2025-54044 Patchstack
7.5 High Realtyna Organic IDX Plugin real-estate-listing-realtyna-wpl Local File Inclusion No login needed ≤ 5.0.0 Fixed in 5.0.1 CVE-2025-54052 Patchstack
7.1 High Druco Plugin druco Cross-Site Scripting No login needed ≤ 1.5.2 Fixed in 1.5.3 CVE-2025-54055 Patchstack
7.1 High oik Plugin oik Cross-Site Scripting No login needed ≤ 4.15.2 Fixed in 4.15.3 CVE-2025-54670 Patchstack
7.1 High Responsive HTML5 Audio Player PRO With Playlist Plugin lbg-audio2-html5 Cross-Site Scripting No login needed ≤ 3.5.8 Fixed in 3.5.9 CVE-2025-54056 Patchstack
7.5 High Funnel Builder by FunnelKit Plugin funnel-builder Local File Inclusion No login needed ≤ 3.11.1 Fixed in 3.12.0 CVE-2025-54750 Patchstack
8.8 High CubeWP Plugin cubewp-framework Privilege Escalation ≤ 1.1.24 Fixed in 1.1.25 CVE-2025-54735 Patchstack
7.5 High Otter - Gutenberg Block Plugin otter-blocks Information Disclosure Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure No login needed ≤ 3.1.0 Fixed in 3.1.1 CVE-2025-55715 Patchstack
7.5 High Redirection for Contact Form 7 Plugin wpcf7-redirect PHP Object Injection Unauthenticated PHP Object Injection via PHAR Deserialization No login needed ≤ 3.2.4 CVE-2025-8289 Wordfence
8.8 High Redirection for Contact Form 7 Plugin wpcf7-redirect Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 3.2.4 CVE-2025-8141 Wordfence
8.8 High Redirection for Contact Form 7 Plugin wpcf7-redirect PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 3.2.4 CVE-2025-8145 Wordfence
7.5 High JS Archive List Plugin jquery-archive-list-widget SQL Injection Unauthenticated SQL Injection via build_sql_where Function No login needed ≤ 6.1.5 CVE-2025-7670 Wordfence
8.8 High Multiple Plugins By FunnelKit <= (Various Versions) Plugin wp-marketing-automations Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure to Privilege Escalation via Woofunnel Library ≤ 3.6.3, ≤ 3.11.0.2 CVE-2025-7654 Wordfence
8.8 High Real Spaces - WordPress Properties Directory Theme Privilege Escalation WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member' ≤ 3.5 CVE-2025-8218 Wordfence
7.3 High Soledad Theme Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 8.6.7 CVE-2025-8105 Wordfence
8.8 High Soledad Theme Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'header_layout' ≤ 8.6.7 CVE-2025-8142 Wordfence
8.8 High School Management System Plugin wpschoolpress Arbitrary File Upload Authenticated (Student+) Arbitrary File Upload ≤ 93.2.0 CVE-2025-6079 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only