File Manager
KEV
2020-09-09All versions
CVE-2020-25213
WordPress Vulnerability Database
The most comprehensive open vulnerability database for WordPress plugins, themes, and server infrastructure.
16,106
plugins with known vulnerabilities
2,198
themes with known vulnerabilities
13,246
vulnerabilities without a fix
1,948
critical severity (score ≥ 9.0)
Official WordPress Plugin
WPVulnerability
Real-time vulnerability scanner for your WordPress dashboard. Monitors your core, plugins, themes, PHP, Apache, nginx, MariaDB, MySQL, ImageMagick, curl and more — all in one place.
10,000+Active installs
★★★★★20 reviews
4.3.1Latest version
6.9.4Tested with WP
Notable vulnerabilities — last 90 days
2017-05-24All versions
WordPress Huge-IT Video Gallery plugin <=2.0.4 - SQL Injection vulnerability
2017-06-27All versions
CVE-2017-9841
Cloudflare
KEV
2017-06-27All versions
CVE-2017-9841
2020-04-13All versions
CVE-2020-11738
2019-03-24All versions
CVE-2019-9978
2020-07-20All versions
jQuery Manager for WordPress <= 1.10.4 & jQuery Migrate Helper <= 1.4.1- Running Vulnerable Dependency
JS Help Desk – AI-Powered Support & Ticketing System
Critical 10.0
2024-01-05All versions
CVE-2022-46839
2023-12-20All versions
CVE-2023-29384
2024-03-27All versions
CVE-2023-49815
Rencontre – Dating Site
Critical 10.0
2024-12-27All versions
WordPress Rencontre – Dating Site Plugin <= 3.10.1 is vulnerable to Arbitrary File Upload
2024-12-27All versions
WordPress Active Products Tables for WooCommerce Plugin <= 1.0.6 is vulnerable to PHP Object Injection
Latest Plugin Vulnerabilities
View all →2026-05-12< 10.1.3
CVE-2026-5371
2026-05-12< 1.10.12
CVE-2026-1250
Advanced Custom Fields: Extended
Medium 6.5
2026-05-12< 0.9.2.4
CVE-2025-15463
Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend
High 8.5 Unfixed
2026-05-12≤ 3.3.2
CVE-2026-42741
Broadstreet
Medium 5.4
2026-05-12< 1.53.2
CVE-2026-45210
2026-05-12< 4.7.2
CVE-2026-45211
2026-05-12≤ 3.4.6
CVE-2026-42742
2026-05-12< 1.1.8
CVE-2026-45213
Asset CleanUp: Page Speed Booster
Medium 5.3
2026-05-12< 1.4.0.4
CVE-2026-45212
2026-05-12< 1.5.2
CVE-2026-45214
2026-05-12< 11.5.0
CVE-2026-45218
2026-05-12< 4.4.0
CVE-2026-45215
2026-05-12< 7.8.10.2
CVE-2026-25431
Essential Real Estate
Medium 5.3 Unfixed
2025-12-16≤ 5.3.2
WordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability
Translate WordPress with ConveyThis – AI Multilingual Plugin
Medium 6.5 Unfixed
2026-02-20≤ 270.3
WordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerability
Essential Real Estate
Medium 6.5 Unfixed
2025-12-16≤ 5.3.2
WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability
Court Reservation – Manage Your Court Bookings Online
High 7.1 Unfixed
2026-02-20≤ 1.10.13
WordPress Court Reservation plugin <= 1.10.13 - Cross Site Scripting (XSS) vulnerability
Directorist Booking
Critical 9.3
2026-04-27< 3.0.2
WordPress Directorist Booking plugin < 3.0.2 - SQL Injection vulnerability
2026-05-12< 1.4.104
CVE-2026-1934
WP SEO Structured Data Schema
Medium 4.9 Unfixed
2026-05-12≤ 2.8.1
CVE-2026-3604
Latest Theme Vulnerabilities
View all →
Grand Tour
Critical 9.8 Unfixed
2025-05-23≤ 5.6
CVE-2025-39485
Enzio
High 8.1
2025-05-23< 1.2.6
CVE-2025-31912
Kiamo
High 8.1
2025-05-23< 1.3.6
CVE-2025-31633
Avante
N/A
2026-05-08< 3.0.5
WordPress Avante Theme < 3.0.5 is vulnerable to a medium priority Cross Site Scripting (XSS)
Photography
High 7.5 Unfixed
2025-06-06≤ 7.7.2
CVE-2025-47584
Krowd
High 8.1
2025-06-09< 1.5.0
CVE-2025-32595
Petito
High 8.1
2025-06-09< 1.6.6
CVE-2025-27362
GiftXtore
High 8.1
2025-06-09< 1.7.7
CVE-2025-28888
FlatNews
High 7.1
2025-06-09< 6.2
CVE-2025-32305
DSK
High 8.1
2025-06-17< 2.4
CVE-2025-24761
PrintXtore
High 8.1
2025-06-27< 1.7.8
CVE-2025-28946
MagOne
High 7.1
2025-06-27< 8.9
CVE-2025-39488
LMS
High 7.1
2025-06-27< 9.3
CVE-2025-52799
Homey
Critical 9.3 Unfixed
2025-06-27≤ 2.4.7
CVE-2025-52834
Domnoo
High 8.1
2025-06-27< 1.52.1
CVE-2025-52812
LMS
Critical 9.3
2025-07-04< 9.3
CVE-2025-52833
Red Art
High 8.8
2025-07-04< 3.9
CVE-2025-52828
Pressroom
High 7.1
2025-07-04< 7.1
CVE-2025-32311
Halpes
High 7.1
2025-07-07< 1.2.5
CVE-2024-43334
Alone
Critical 9.1
2025-07-15< 7.8.7
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion
Latest WordPress Core Vulnerabilities
View all →
WordPress 3.1-RC4
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.2.1
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3-beta1
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3-beta2
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3-beta3
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3-beta4
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3-RC1
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3-RC2
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.3-RC3
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.2-RC3
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.2-RC2
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.1.1
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.1.1-RC1
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.1.2
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.1.3
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.1.4
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.2
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.2-beta1
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload
WordPress 3.2-beta2
Medium 6.1
2026-03-10All versions
WordPress <= 6.9.1 - Authenticated (Author+) XML External Entity Injection via getID3 Library Media Upload