Wordpress CVEs and Security Vulnerabilities

Export limit exceeded: 425897 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16307 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

CVE-2026-10835

SALESmanago & Leadoo < 3.11.3 - Subscriber+ SQL Injection

The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Salesmanago Wordpress

Products

Salesmanago Wordpress

CVE-2025-63041

WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability

Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Codeamp Wordpress

Products

Forget About Shortcode Buttons Wordpress

CVE-2025-63078

WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability

Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jetmonsters Wordpress

Products

Restaurant Menu By Motopress Wordpress

CVE-2025-63079

WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability

Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress

Products

Live Copy Paste For Elementor Wordpress

CVE-2025-64636

WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rhewlif Wordpress

Products

Donation Thermometer Wordpress

CVE-2025-64637

WordPress Auros Core plugin <= 5.3.1 - Content Injection vulnerability

Unauthenticated Content Injection in Auros Core <= 5.3.1 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opal Wp Wordpress

Products

Auros Core Wordpress

CVE-2025-66123

WordPress BookPro plugin <= 1.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

About Envato Wordpress

Products

Bookpro Wordpress

CVE-2025-68063

WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Stylemixthemes Wordpress

Products

Splash - Sport Club Wordpress Theme For Basketball, Football, Hockey Wordpress

CVE-2025-68064

WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability

Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Everthemess Wordpress

Products

Goya Core Wordpress

CVE-2025-68074

WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ghozylab Wordpress

Products

Image Carousel Wordpress

CVE-2025-68075

WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Kerry Wordpress

Products

Bne Testimonials Wordpress

CVE-2026-54833

WordPress Enable CORS plugin <= 2.0.3 - Backdoor vulnerability

Unauthenticated Backdoor in Enable CORS <= 2.0.3 versions.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Dev Kabir Wordpress

Products

Enable Cors Wordpress

CVE-2026-54834

WordPress Object Cache 4 everyone plugin <= 2.3.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Fpuenteonline Wordpress

Products

Object Cache 4 Everyone Wordpress

CVE-2026-54835

WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Rustaurius Wordpress

Products

Five Star Restaurant Menu Wordpress

CVE-2026-54837

WordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Syed Balkhi Wordpress

Products

Intranet & Private Site – All-in-one Intranet Wordpress

CVE-2026-54839

WordPress Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Kingaddons Wordpress

Products

Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups Wordpress

CVE-2026-54846

WordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Akosglys Wordpress

Products

Syncee Premium Dropshipping & Wholesale Wordpress

CVE-2026-56025

WordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Paymob Wordpress

Products

Paymob For Woocommerce Wordpress

CVE-2026-56026

WordPress utm.codes plugin <= 1.9.0 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Chris Carlevato Wordpress

Products

Utm.codes Wordpress

CVE-2026-56029

WordPress CorvusPay WooCommerce Payment Gateway plugin <= 2.7.4 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Corvuspay Wordpress

Products

Woocommerce Payment Gateway Wordpress

« first previous Page 145 of 816. next last »