WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 4,401–4,450 of 8,961 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 89 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	WP w3all phpBB Plugin `wp-w3all-phpbb-integration`	Cross-Site Request Forgery No login needed	`≤ 2.9.8` Fixed in `2.9.9`	Apr 4, 2025	`CVE-2025-32274`	Patchstack
4.3 Medium	Freetobook Responsive Widget Plugin `freetobook-responsive-widget`	Cross-Site Request Forgery No login needed	`≤ 1.1` Fixed in `1.1.1`	Apr 4, 2025	`CVE-2025-32273`	Patchstack
4.3 Medium	Wishlist Plugin `wishlist`	Cross-Site Request Forgery No login needed	`≤ 1.0.46`	Apr 4, 2025	`CVE-2025-32272`	Patchstack
4.3 Medium	Woocommerce Role Pricing Plugin `woocommerce-role-pricing`	Cross-Site Request Forgery No login needed	`≤ 3.5.6`	Apr 4, 2025	`CVE-2025-32271`	Patchstack
4.3 Medium	Broadstreet Ads Plugin `broadstreet`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed	`≤ 1.52.1` Fixed in `1.52.2`	Apr 4, 2025	`CVE-2025-32270`	Patchstack
4.3 Medium	WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin `cf7-zendesk`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed	`≤ 1.1.3` Fixed in `1.1.4`	Apr 4, 2025	`CVE-2025-32269`	Patchstack
4.3 Medium	QR Code Tag for WC Plugin `qr-code-tag-for-wc-from-goaskle-com`	Cross-Site Request Forgery No login needed	`≤ 1.9.42`	Apr 4, 2025	`CVE-2025-32268`	Patchstack
4.3 Medium	Post to Social Media – WordPress to Hootsuite Plugin `wp-to-hootsuite`	Cross-Site Request Forgery No login needed	`≤ 1.5.8` Fixed in `1.6.0`	Apr 4, 2025	`CVE-2025-32267`	Patchstack
4.3 Medium	404 Image Redirection (Replace Broken Images) Plugin `broken-images-redirection`	Cross-Site Request Forgery No login needed	`≤ 1.4`	Apr 4, 2025	`CVE-2025-32266`	Patchstack
4.3 Medium	JobWP Plugin `jobwp`	Cross-Site Request Forgery No login needed	`≤ 2.3.9` Fixed in `2.4.0`	Apr 4, 2025	`CVE-2025-32265`	Patchstack
4.3 Medium	UltraAddons Elementor Lite Plugin `ultraaddons-elementor-lite`	Cross-Site Request Forgery Elementor Addons plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) No login needed	`≤ 2.0.2`	Apr 4, 2025	`CVE-2025-32264`	Patchstack
4.3 Medium	Sequential Order Numbers for WooCommerce Plugin `sequential-order-numbers-for-woocommerce`	Cross-Site Request Forgery No login needed	`≤ 3.6.2` Fixed in `3.6.3`	Apr 4, 2025	`CVE-2025-32263`	Patchstack
4.3 Medium	RDP Wiki Embed Plugin `rdp-wiki-embed`	Cross-Site Request Forgery No login needed	`≤ 1.2.20`	Apr 4, 2025	`CVE-2025-32262`	Patchstack
4.3 Medium	Advanced All in One Admin Search by WP Spotlight Plugin `wp-spotlight-search`	Cross-Site Request Forgery No login needed	`≤ 1.1.1` Fixed in `1.1.2`	Apr 4, 2025	`CVE-2025-32261`	Patchstack
5.3 Medium	Simple Website Logo Plugin `simple-website-logo`	Broken Access Control No login needed	`≤ 1.1`	Apr 4, 2025	`CVE-2025-32258`	Patchstack
5.3 Medium	1 Click WordPress Migration Plugin `1-click-migration`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.5.7`	Apr 4, 2025	`CVE-2025-32257`	Patchstack
5.3 Medium	SurveyJS Plugin `surveyjs`	Broken Access Control No login needed	`≤ 1.12.20` Fixed in `1.12.57`	Apr 4, 2025	`CVE-2025-32256`	Patchstack
5.3 Medium	StaffList Plugin `stafflist`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 3.2.7`	Apr 4, 2025	`CVE-2025-32255`	Patchstack
5.3 Medium	WPBookit Plugin `wpbookit`	Broken Access Control No login needed	`≤ 1.0.7` Fixed in `1.0.8`	Apr 4, 2025	`CVE-2025-32254`	Patchstack
5.3 Medium	Course Booking System Plugin `course-booking-system`	Broken Access Control No login needed	`≤ 6.1` Fixed in `6.1.1`	Apr 4, 2025	`CVE-2025-32253`	Patchstack
5.3 Medium	WP Genealogy – Your Family History Website Plugin `wpgenealogy`	Broken Access Control No login needed	`≤ 0.1.9`	Apr 4, 2025	`CVE-2025-32252`	Patchstack
5.3 Medium	Jetpack Feedback Exporter Plugin `jetpack-feedback-exporter`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.23`	Apr 4, 2025	`CVE-2025-32251`	Patchstack
5.4 Medium	DirectoryPress Plugin `directorypress`	Cross-Site Request Forgery No login needed	`≤ 3.6.22` Fixed in `3.6.23`	Apr 4, 2025	`CVE-2025-32249`	Patchstack
5.4 Medium	SwiftXR (3D/AR/VR) Viewer Plugin `swiftxr-3darvr-viewer`	Cross-Site Request Forgery No login needed	`≤ 1.0.7`	Apr 4, 2025	`CVE-2025-32248`	Patchstack
5.4 Medium	AI Content Creator Plugin `ai-content-creator`	Cross-Site Request Forgery No login needed	`≤ 1.2.6`	Apr 4, 2025	`CVE-2025-32247`	Patchstack
5.4 Medium	1-Click Backup & Restore Database Plugin `1-click-backup-restore-database-by-sunbytes`	Broken Access Control	`≤ 1.0.3`	Apr 4, 2025	`CVE-2025-32246`	Patchstack
6.5 Medium	Official CleverReach Plugin for WooCommerce Plugin `cleverreach-wc`	Cross-Site Request Forgery CSRF to Settings Change No login needed	`≤ 3.4.6` Fixed in `3.4.7`	Apr 4, 2025	`CVE-2025-32241`	Patchstack
4.3 Medium	Online Booking & Scheduling Calendar for WordPress by vcita Plugin `meeting-scheduler-by-vcita`	Information Disclosure Sensitive Data Exposure	`≤ 4.5.5` Fixed in `4.6.0`	Apr 4, 2025	`CVE-2025-32238`	Patchstack
4.3 Medium	MasterStudy LMS Plugin `masterstudy-lms-learning-management-system`	Broken Access Control	`≤ 3.5.28` Fixed in `3.5.29`	Apr 4, 2025	`CVE-2025-32237`	Patchstack
4.3 Medium	MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin `mp3-music-player-by-sonaar`	Broken Access Control Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control	`≤ 5.9.4` Fixed in `5.9.5`	Apr 4, 2025	`CVE-2025-32235`	Patchstack
4.3 Medium	AdMail – Multilingual Back in-Stock Notifier for WooCommerce Plugin `admail`	Broken Access Control	`≤ 1.7.0`	Apr 4, 2025	`CVE-2025-32234`	Patchstack
4.3 Medium	Revive.so Plugin `revive-so`	Broken Access Control	`≤ 2.0.3` Fixed in `2.0.4`	Apr 4, 2025	`CVE-2025-32233`	Patchstack
4.3 Medium	StaffList Plugin `stafflist`	Broken Access Control	`≤ 3.2.7`	Apr 4, 2025	`CVE-2025-32232`	Patchstack
4.3 Medium	Bookingor Plugin `bookingor`	Broken Access Control	`≤ 2.0.1` Fixed in `2.0.2`	Apr 4, 2025	`CVE-2025-32231`	Patchstack
4.3 Medium	Variable Inspector Plugin `variable-inspector`	Broken Access Control	`≤ 2.6.3`	Apr 4, 2025	`CVE-2025-32229`	Patchstack
4.3 Medium	Display product variations dropdown on shop page Plugin `display-product-variations-dropdown-on-shop-page`	Broken Access Control	`≤ 1.1.3`	Apr 4, 2025	`CVE-2025-32226`	Patchstack
5.3 Medium	WP Event Manager Plugin `wp-event-manager`	Broken Access Control No login needed	`≤ 3.2.0` Fixed in `3.2.1`	Apr 4, 2025	`CVE-2025-32225`	Patchstack
5.4 Medium	Salon booking system Plugin `salon-booking-system`	Broken Access Control	`≤ 10.31.9`	Apr 4, 2025	`CVE-2025-32220`	Patchstack
5.4 Medium	eaSYNC Plugin `easync-booking`	Broken Access Control	`≤ 1.3.19` Fixed in `1.3.21`	Apr 4, 2025	`CVE-2025-32219`	Patchstack
5.4 Medium	TableOn Plugin `posts-table-filterable`	Broken Access Control	`≤ 1.0.5.1`	Apr 4, 2025	`CVE-2025-32218`	Patchstack
5.4 Medium	Ai Image Alt Text Generator for WP Plugin `ai-image-alt-text-generator-for-wp`	Broken Access Control	`≤ 1.1.1` Fixed in `1.1.2`	Apr 4, 2025	`CVE-2025-32217`	Patchstack
6.5 Medium	Ni WooCommerce Cost Of Goods Plugin `ni-woocommerce-cost-of-goods`	Cross-Site Scripting	`≤ 3.2.8` Fixed in `3.2.9`	Apr 4, 2025	`CVE-2025-32207`	Patchstack
4.3 Medium	Xpro Theme Builder Plugin `xpro-theme-builder`	Broken Access Control	`≤ 1.2.8.4` Fixed in `1.2.8.5`	Apr 4, 2025	`CVE-2025-32201`	Patchstack
6.5 Medium	Piotnet Addons For Elementor Plugin `piotnet-addons-for-elementor`	Cross-Site Scripting	`≤ 2.4.36`	Apr 4, 2025	`CVE-2025-32197`	Patchstack
6.5 Medium	News Kit Elementor Addons Plugin `news-kit-elementor-addons`	Cross-Site Scripting	`≤ 1.4.2`	Apr 4, 2025	`CVE-2025-32196`	Patchstack
6.5 Medium	Ecwid Shopping Cart Plugin `ecwid-shopping-cart`	Cross-Site Scripting	`≤ 7.0` Fixed in `7.0.1`	Apr 4, 2025	`CVE-2025-32195`	Patchstack
6.5 Medium	LA-Studio Element Kit for Elementor Plugin `lastudio-element-kit`	Cross-Site Scripting	`≤ 1.5.1` Fixed in `1.5.2`	Apr 4, 2025	`CVE-2025-32194`	Patchstack
6.5 Medium	Simple WP Events Plugin `simple-wp-events`	Cross-Site Scripting	`≤ 1.8.17` Fixed in `1.9.0`	Apr 4, 2025	`CVE-2025-32193`	Patchstack
6.5 Medium	Ultra Addons Lite for Elementor Plugin `ut-elementor-addons-lite`	Cross-Site Scripting	`≤ 1.1.8` Fixed in `1.1.9`	Apr 4, 2025	`CVE-2025-32192`	Patchstack
6.5 Medium	News Element Elementor Blog Magazine Plugin `news-element`	Cross-Site Scripting	`≤ 1.0.9`	Apr 4, 2025	`CVE-2025-32191`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.