WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 4,851–4,900 of 9,029 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 98 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
8.8 High	Ultimate WP Mail Plugin `ultimate-wp-mail`	Privilege Escalation Account Takeover via Email Log Leak	`≤ 1.3.5` Fixed in `1.3.6`	Jun 6, 2025	`CVE-2025-49288`	Patchstack
7.6 High	WC Vendors Marketplace Plugin `wc-vendors`	SQL Injection	`≤ 2.5.6` Fixed in `2.5.7`	Jun 6, 2025	`CVE-2025-49263`	Patchstack
7.6 High	Sina Extension for Elementor Plugin `sina-extension-for-elementor`	Cross-Site Scripting	`≤ 3.6.1` Fixed in `3.7.0`	Jun 6, 2025	`CVE-2025-49262`	Patchstack
7.4 High	POEditor Plugin `poeditor`	Cross-Site Request Forgery CSRF to Arbitrary File Deletion No login needed	`≤ 0.9.10` Fixed in `0.9.11`	Jun 6, 2025	`CVE-2025-49237`	Patchstack
7.1 High	Real Time Validation for Gravity Forms Plugin `real-time-validation-for-gravity-forms`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.7.0`	Jun 6, 2025	`CVE-2025-48329`	Patchstack
8.8 High	WP Posts Carousel Plugin `wp-posts-carousel`	PHP Object Injection	`≤ 1.3.12` Fixed in `1.3.13`	Jun 6, 2025	`CVE-2025-39358`	Patchstack
8.5 High	Photography Theme `photography`	PHP Object Injection	`≤ 7.5.2`	Jun 6, 2025	`CVE-2025-47584`	Patchstack
7.1 High	Hive Support Plugin `hive-support`	Broken Access Control Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox	`≤ 1.2.5`	Jun 6, 2025	`CVE-2025-5018`	Wordfence
8.8 High	Short URL Plugin	SQL Injection Subscriber+ SQLi	`≤ 1.6.8`	Jun 6, 2025	`CVE-2023-2921`	WPScan
8.8 High	HyperComments Plugin `hypercomments`	Broken Access Control Unauthenticated (Subscriber+) Arbitrary Options Update	`≤ 1.2.2`	Jun 5, 2025	`CVE-2025-5701`	Wordfence
8.1 High	WP User Frontend Pro Plugin	Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion	`≤ 4.1.3`	Jun 5, 2025	`CVE-2025-3055`	Wordfence
8.8 High	WP User Frontend Pro Plugin	Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload	`≤ 4.1.3`	Jun 5, 2025	`CVE-2025-3054`	Wordfence
8.8 High	Sunshine Photo Cart Plugin `sunshine-photo-cart`	Privilege Escalation Authenticated (Subscriber+) Privilege Escalation	`≤ 3.4.11`	Jun 4, 2025	`CVE-2025-5482`	Wordfence
7.2 High	Shared Files Plugin `shared-files`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via sanitize_file Function No login needed	`≤ 1.7.48`	Jun 3, 2025	`CVE-2025-4392`	Wordfence
7.2 High	wpForo + wpForo Advanced Attachments Plugin	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed	`≤ 3.1.3`	Jun 3, 2025	`CVE-2025-4224`	Wordfence
7.2 High	Newsletters Plugin `newsletters-lite`	Local File Inclusion Authenticated (Administrator+) Local File Inclusion	`≤ 4.9.9.9`	May 31, 2025	`CVE-2025-4857`	Wordfence
8.8 High	Offsprout Page Builder Plugin `offsprout-page-builder`	Privilege Escalation Authenticated (Contributor+) Privilege Escalation via permission_callback Function	`2.2.1 – 2.15.2`	May 31, 2025	`CVE-2025-4672`	Wordfence
8.8 High	WP-GeoMeta Plugin `wp-geometa`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function	`0.3.4 – 0.3.5`	May 31, 2025	`CVE-2025-4103`	Wordfence
7.5 High	WooCommerce Orders & Customers Exporter Plugin `woocommerce-orders-customers-exporter`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 5.0`	May 30, 2025	`CVE-2025-48331`	Patchstack
8.8 High	Browse As Plugin `browse-as`	Authentication Bypass Authenticated (Subscriber+) Authentication Bypass via Cookie	`≤ 0.2`	May 30, 2025	`CVE-2025-5190`	Wordfence
7.5 High	Likes and Dislikes Plugin `inprosysmedia-likes-dislikes-post`	SQL Injection Unauthenticated SQL Injection No login needed	`≤ 1.0.0`	May 28, 2025	`CVE-2025-5287`	Wordfence
8.8 High	MasterStudy LMS Pro Plugin	Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload	`≤ 4.7.0`	May 28, 2025	`CVE-2025-4800`	Wordfence
8.8 High	Property Plugin `property`	Broken Access Control Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in PayPal Registration	`1.0.5 – 1.0.6`	May 27, 2025	`CVE-2025-5117`	Wordfence
8.1 High	eMagicOne Store Manager for WooCommerce Plugin `store-manager-connector`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via set_file() No login needed	`≤ 1.2.5`	May 24, 2025	`CVE-2025-4336`	Wordfence
7.7 High	KBx Pro Ultimate Plugin `knowledgebase-helpdesk-pro`	Arbitrary File Deletion	`≤ 8.0.5` Fixed in `8.0.5`	May 23, 2025	`CVE-2025-31053`	Patchstack
8.1 High	Vizeon - Business Consulting Plugin `vizeon`	Local File Inclusion No login needed	`≤ 1.2.1` Fixed in `1.2.1`	May 23, 2025	`CVE-2025-31064`	Patchstack
8.1 High	Capie Theme `capie`	Local File Inclusion No login needed	`≤ 1.0.40` Fixed in `1.0.53.1`	May 23, 2025	`CVE-2025-31060`	Patchstack
8.1 High	La Boom Theme `laboom`	Local File Inclusion No login needed	`≤ 2.7`	May 23, 2025	`CVE-2025-31632`	Patchstack
8.1 High	Enzio - Responsive Business Plugin `enzio`	Local File Inclusion Responsive Business WordPress Theme theme < 1.2.6 - Local File Inclusion No login needed	`≤ 1.2.6` Fixed in `1.2.6`	May 23, 2025	`CVE-2025-31912`	Patchstack
7.1 High	WP Post Modules for Elementor Plugin `wp-post-modules-el`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.5.0`	May 23, 2025	`CVE-2025-31636`	Patchstack
8.1 High	Kiamo - Responsive Business Service Theme `kiamo`	Local File Inclusion Responsive Business Service WordPress Theme <= 1.3.3 - Local File Inclusion No login needed	`≤ 1.3.3`	May 23, 2025	`CVE-2025-31633`	Patchstack
8.1 High	Ogami Theme `ogami`	Local File Inclusion No login needed	`≤ 1.53` Fixed in `1.61.1`	May 23, 2025	`CVE-2025-31913`	Patchstack
8.8 High	Crafts & Arts Plugin `crafts-and-arts`	PHP Object Injection	`≤ 2.5`	May 23, 2025	`CVE-2025-31924`	Patchstack
8.8 High	Pet World Theme `petsworld`	PHP Object Injection	`≤ 2.8`	May 23, 2025	`CVE-2025-32284`	Patchstack
8.1 High	Butcher Theme `butcher`	Local File Inclusion No login needed	`≤ 2.40`	May 23, 2025	`CVE-2025-32286`	Patchstack
7.1 High	Butcher Theme `butcher`	Cross-Site Scripting No login needed	`≤ 2.54` Fixed in `2.54`	May 23, 2025	`CVE-2025-32285`	Patchstack
8.1 High	Yozi Theme `yozi`	Local File Inclusion No login needed	`≤ 2.0.63` Fixed in `2.0.66.1`	May 23, 2025	`CVE-2025-32289`	Patchstack
8.1 High	Oxpitan Theme `oxpitan`	Local File Inclusion No login needed	`≤ 1.3.5` Fixed in `1.3.6`	May 23, 2025	`CVE-2025-32294`	Patchstack
8.8 High	Finance Consultant Plugin `finance`	PHP Object Injection	`≤ 2.8`	May 23, 2025	`CVE-2025-32293`	Patchstack
8.1 High	Healsoul Theme `healsoul`	Local File Inclusion No login needed	`≤ 2.2.3` Fixed in `2.2.4`	May 23, 2025	`CVE-2025-32309`	Patchstack
8.1 High	Winnex Plugin `winnex`	Local File Inclusion No login needed	`≤ 1.3.2`	May 23, 2025	`CVE-2025-32302`	Patchstack
8.1 High	Wilmër Plugin `wilmer`	Local File Inclusion No login needed	`≤ 3.4.2` Fixed in `3.4.2`	May 23, 2025	`CVE-2025-39494`	Patchstack
8.1 High	Backpack Traveler Theme `backpacktraveler`	Local File Inclusion No login needed	`≤ 2.10.2` Fixed in `2.10.3`	May 23, 2025	`CVE-2025-39490`	Patchstack
7.1 High	Goodlayers Hostel Plugin `gdlr-hostel`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.2`	May 23, 2025	`CVE-2025-39502`	Patchstack
7.1 High	Goodlayers Hotel Plugin `gdlr-hotel`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.4`	May 23, 2025	`CVE-2025-39505`	Patchstack
8.2 High	JobHunt Job Alerts Plugin `jobhunt-notifications`	Broken Access Control Arbitrary Content Deletion No login needed	`≤ 3.6`	May 23, 2025	`CVE-2025-39536`	Patchstack
8.1 High	Nasa Core Plugin `nasa-core`	Local File Inclusion No login needed	`≤ 6.3.2`	May 23, 2025	`CVE-2025-39506`	Patchstack
7.1 High	kStats Reloaded Plugin `kstats-reloaded`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.7.4`	May 23, 2025	`CVE-2025-46440`	Patchstack
7.1 High	Tayori Form Plugin `tayori`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.2.9`	May 23, 2025	`CVE-2025-46437`	Patchstack
7.1 High	Libro de Reclamaciones Plugin `libro-de-reclamaciones`	Cross-Site Scripting No login needed	`≤ 1.0.1`	May 23, 2025	`CVE-2025-46446`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.