Wordpress - vulnerabilities (CVEs)
487 CVEs in 122 products, 0 in the last 30 days, newest from 2026-09-22.
Products
- Wordpress - 357 CVEs
- Wordpress-develop - 17 CVEs
- Wordpress Mu - 10 CVEs
- Adserve - 3 CVEs
- Sniplets Plugin - 3 CVEs
- Blix - 2 CVEs
- Geo Controller - 2 CVEs
- Math Comment Spam Protection Plugin - 2 CVEs
- Max Addons Pro For Bricks - 2 CVEs
- Pay-with-tweet - 2 CVEs
- Royal-elementor-addons - 2 CVEs
- Wassup Plugin - 2 CVEs
- WP Google Review Slider - 1 CVEs
- Absolutely Glamorous Custom Admin - 1 CVEs
- Acf-on-the-go - 1 CVEs
- Alert Before You Post - 1 CVEs
- Blixed - 1 CVEs
- Blixkrieg - 1 CVEs
- Blogger Importer - 1 CVEs
- Buddypress Cover - 1 CVEs
- Captcha - 1 CVEs
- Checkout Mestres - 1 CVEs
- Contact Form Drag And Drop Form Builder - 1 CVEs
- Counter Box - 1 CVEs
- Cryptographp - 1 CVEs
- Cssigniter Elements Team - 1 CVEs
- Customer Reviews For Woocommerce - 1 CVEs
- Dean Logan Wp-people Plugin - 1 CVEs
- Debug Bar - 1 CVEs
- Directorist - 1 CVEs
- Download Monitor Plugin - 1 CVEs
- Easy Social Feed - 1 CVEs
- Elementsready Addons For Elementor - 1 CVEs
- Elespare - 1 CVEs
- Email Customizer For Woocommerce - 1 CVEs
- Enl Newsletter - 1 CVEs
- External Database Based Actions - 1 CVEs
- Fcchat Widget - 1 CVEs
- Filemanager - 1 CVEs
- Form Maker By 10web - 1 CVEs
- Free Widgets For Elementor Plugin - 1 CVEs
- Frontend Admin By Dynamiapps - 1 CVEs
- Gdpr Compliance - 1 CVEs
- Grid Shortcodes - 1 CVEs
- Gutenberg - 1 CVEs
- Health Check & Troubleshooting - 1 CVEs
- Import Export Wordpress Users - 1 CVEs
- Import Xml And Rss Feeds Plugin - 1 CVEs
- Interactive World Maps - 1 CVEs
- Jeg Elementor Kit - 1 CVEs
- Language Switcher For Transposh - 1 CVEs
- Lanoba Social Plugin - 1 CVEs
- Leadconnector - 1 CVEs
- Leaflet Maps Marker - 1 CVEs
- Login With Otp Plugin - 1 CVEs
- Media Cleaner - 1 CVEs
- Mini Loops - 1 CVEs
- Nate Reist Protected Posts Logout Button - 1 CVEs
- Orderconvo - 1 CVEs
- Page Flip Image Gallery Plugin - 1 CVEs
- Paid Memberships Pro - 1 CVEs
- Payment Gateway Based Fees And Discounts For Woocommerce - 1 CVEs
- Paypal Buy Now Button - 1 CVEs
- Paypal Cart Buttons Shortcode - 1 CVEs
- Paypal Donation Button - 1 CVEs
- Paypal Pay Now Button - 1 CVEs
- Performance Lab - 1 CVEs
- Permalinks Migration Plugin - 1 CVEs
- Peter's Math Anti-spam For Wordpress - 1 CVEs
- Photo Album Plugin - 1 CVEs
- Pictpress - 1 CVEs
- Plugin Newsletter Plugin - 1 CVEs
- Plus Addon For Elementor Page Builder - 1 CVEs
- Pool - 1 CVEs
- Popup Anything - 1 CVEs
- Popup Box - 1 CVEs
- Post Grid Shortcode Gutenberg Blocks Elementor - 1 CVEs
- Premium Addons For Elementor - 1 CVEs
- Profile Grid - 1 CVEs
- Rank Math Seo - 1 CVEs
- Real Media Library - 1 CVEs
- Recipe Maker - 1 CVEs
- Requests - 1 CVEs
- Responsive Contact Form Builder Lead Generation - 1 CVEs
- Reviews Plus - 1 CVEs
- Search Unleashed Plugin - 1 CVEs
- Seers Plugin - 1 CVEs
- Shoplentor - 1 CVEs
- Simple Membership - 1 CVEs
- Sina Extension For Elementor - 1 CVEs
- Sirius - 1 CVEs
- Slideshow Gallery2 - 1 CVEs
- Spambam Plugin - 1 CVEs
- St Newsletter Plugin - 1 CVEs
- Svs Pricing Tables - 1 CVEs
- Teluro Theme - 1 CVEs
- Thanh Toan Quet Ma Qr Code Tu Dong - 1 CVEs
- Thimo Grauerholz Wp-spreadplugin - 1 CVEs
- Tutor Lms Elearning And Online Course Solution - 1 CVEs
- Unamed Theme - 1 CVEs
- Unamed Theme Se - 1 CVEs
- Unique Theme - 1 CVEs
- Upload File Plugin - 1 CVEs
- Video Lightbox - 1 CVEs
- Widget Post Slider - 1 CVEs
- Woocommerce Order Proposal - 1 CVEs
- Wordpress-coding-standards - 1 CVEs
- Wordpress-users - 1 CVEs
- Wordpressclassic - 1 CVEs
- Wordspew - 1 CVEs
- Wp-contactform - 1 CVEs
- Wp-footnotes - 1 CVEs
- Wp Cal Plugin - 1 CVEs
- Wp Download - 1 CVEs
- Wp Downloads Manager - 1 CVEs
- Wp Forum - 1 CVEs
- Wp Maintenance Mode Plugin - 1 CVEs
- Wp Private Content Plus Plugin - 1 CVEs
- Wppizza - 1 CVEs
- Wpss - 1 CVEs
- Xstore Core - 1 CVEs
- Yith Woocommerce Compare - 1 CVEs
Newest CVEs of Wordpress
- CVE-2026-87902 - CVSS 8.1 (high), 2026-09-22: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme…
- CVE-2026-65640 - CVSS 8.8 (high), 2026-08-17: WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: *…
- CVE-2026-64638 - CVSS 8.9 (high), 2026-08-07: WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an…
- CVE-2026-45293 - CVSS 8.6 (high), 2026-07-28: WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the…
- CVE-2026-63030 - CVSS 9.8 (critical), 2026-07-17: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in…
- CVE-2026-60137 - CVSS 5.9 (medium), 2026-07-17: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could…
- CVE-2025-58674 - CVSS 5.9 (medium), 2025-09-23: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordPress allows Stored XSS. WordPress core security…
- CVE-2025-58246 - CVSS 4.3 (medium), 2025-09-23: Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. The WordPress Core security team is…
- CVE-2025-54352 - CVSS 3.7 (low), 2025-07-21: WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts via pingback.ping XML-RPC requests. NOTE: the Supplier is not…
- CVE-2023-25454 - CVSS 6.5 (medium), 2024-12-09: Missing Authorization vulnerability in Nate Reist Protected Posts Logout Button allows Exploiting Incorrectly Configured Access Control Security Levels.This…
- CVE-2024-11292 - CVSS 5.3 (medium), 2024-12-06: The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.1 via the WordPress…
- CVE-2024-11178 - CVSS 8.1 (high), 2024-12-06: The Login With OTP plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.4.2. This is due to the plugin generating…
- CVE-2024-10311 - CVSS 8.8 (high), 2024-11-15: The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a…
- CVE-2024-9927 - CVSS 7.2 (high), 2024-10-23: The WooCommerce Order Proposal plugin for WordPress is vulnerable to privilege escalation via order proposal in all versions up to and including 2.0.5. This…
- CVE-2022-4973 - CVSS 5.4 (medium), 2024-10-16: WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the…
- CVE-2024-8914 - CVSS 7.2 (high), 2024-09-25: The Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam plugin for WordPress is vulnerable to Stored Cross-Site Scripting in…
- CVE-2024-7381 - CVSS 5.3 (medium), 2024-09-05: The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the…
- CVE-2024-5448 - CVSS 6.1 (medium), 2024-06-21: The PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode WordPress plugin through 1.7 does not validate and escape some of its shortcode attributes…
- CVE-2024-5455 - CVSS 8.8 (high), 2024-06-21: The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.5.4 via the…
- CVE-2024-35746 - CVSS 10 (critical), 2024-06-10: Unrestricted Upload of File with Dangerous Type vulnerability in Asghar Hatampoor BuddyPress Cover allows Code Injection.This issue affects BuddyPress Cover:…
- CVE-2024-5382 - CVSS 6.5 (medium), 2024-06-07: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to unauthorized modification…
- CVE-2024-33952 - CVSS 6.5 (medium), 2024-05-14: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Unique allows Stored XSS.This issue…
- CVE-2024-33576 - CVSS 6.5 (medium), 2024-05-06: Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.
- CVE-2024-34374 - CVSS 6.5 (medium), 2024-05-06: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows…
- CVE-2024-34367 - CVSS 7.1 (high), 2024-05-06: Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through…
- CVE-2024-33929 - CVSS 5.3 (medium), 2024-05-03: Missing Authorization vulnerability in wpWax Directorist.This issue affects Directorist: from n/a through 7.8.6.
- CVE-2024-33934 - CVSS 6.5 (medium), 2024-05-03: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Mini Loops allows Stored XSS.This issue…
- CVE-2024-4439 - CVSS 7.2 (high), 2024-05-03: WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient…
- CVE-2024-4324 - CVSS 6.4 (medium), 2024-05-02: The WP Video Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.9.10…
- CVE-2024-3991 - CVSS 6.4 (medium), 2024-05-02: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to…
