WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 1–50 of 30,513 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| – Not scored | Duplicator | Privilege Escalation Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade |
1.5.17 – < 5.0.0 Fixed in 5.0.0 |
CVE-2026-115251 |
WPScan | |
| – Not scored | Datawiza Proxy Auth | Privilege Escalation Unauthenticated Privilege Escalation via X-User and Role Headers No login needed |
1.1.0 – < 1.1.1 Fixed in 1.1.1 |
CVE-2026-115214 |
WPScan | |
| – Not scored | Qi Addons For Elementor | Content Injection Contributor+ Content Injection via Animated Text Widget |
< 1.11.2 Fixed in 1.11.2 |
CVE-2026-115183 |
WPScan | |
| – Not scored | InstaWP Connect | Broken Access Control Authenticated Plugin Settings Update via instawp_update_settings |
< 0.1.4.2 Fixed in 0.1.4.2 |
CVE-2026-114743 |
WPScan | |
| – Not scored | WP VR | Broken Access Control Contributor+ Arbitrary Tour Update via IDOR |
8.3.0 – < 9.0.3 Fixed in 9.0.3 |
CVE-2026-114742 |
WPScan | |
| – Not scored | WP VR | Information Disclosure Contributor+ Arbitrary Tour Update and Disclosure via IDOR |
9.0.0 – < 9.0.3 Fixed in 9.0.3 |
CVE-2026-114741 |
WPScan | |
| – Not scored | WP VR | Broken Access Control Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard |
8.5.55 – < 9.1.3 Fixed in 9.1.3 |
CVE-2026-114740 |
WPScan | |
| – Not scored | GiveWP | Broken Access Control Authenticated Arbitrary Donor Address Modification via donor_manage_addresses |
< 4.19.0.1 Fixed in 4.19.0.1 |
CVE-2026-111981 |
WPScan | |
| – Not scored | GiveWP | Broken Access Control Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant |
< 4.19.0.1 Fixed in 4.19.0.1 |
CVE-2026-111980 |
WPScan | |
| – Not scored | GiveWP | Cross-Site Scripting Give Worker+ Stored XSS via Form Template Primary Color |
< 4.19.0.1 Fixed in 4.19.0.1 |
CVE-2026-111979 |
WPScan | |
| – Not scored | GiveWP | Path Traversal Give Manager+ Path Traversal via Core Settings Import |
< 4.19.0.1 Fixed in 4.19.0.1 |
CVE-2026-111978 |
WPScan | |
| – Not scored | GiveWP | Information Disclosure Unauthenticated Unpublished Donation Form Disclosure via Form View Route No login needed |
< 4.19.0.1 Fixed in 4.19.0.1 |
CVE-2026-111976 |
WPScan | |
| – Not scored | WP Stripe Checkout | Authentication Bypass Unauthenticated Forged Payment Completion via an Unset Webhook Signing Secret No login needed |
< 1.2.2.62 Fixed in 1.2.2.62 |
CVE-2026-110285 |
WPScan | |
| – Not scored | Chikkili Google Pay for WooCommerce | Broken Access Control Unauthenticated Payment Confirmation Forgery via Unverified Signature No login needed |
≤ 1.0.6 |
CVE-2026-94295 |
WPScan | |
| – Not scored | Contact Form by Supsystic | Cross-Site Scripting Admin+ Stored XSS |
< 1.8.0 Fixed in 1.8.0 |
CVE-2025-15705 |
WPScan | |
| 7.2 High | Relevanssi | PHP Object Injection |
≤ 4.28.4 Fixed in 4.28.5 |
CVE-2026-114704 |
Patchstack | |
| 6.5 Medium | WpEvently | Broken Access Control No login needed |
≤ 5.7.8 Fixed in 5.7.9 |
CVE-2026-114192 |
Patchstack | |
| 7.5 High | UPI QR Code Payment Gateway for WooCommerce | Broken Access Control No login needed |
≤ 1.6.3 Fixed in 1.7.0 |
CVE-2026-114191 |
Patchstack | |
| 8.8 High | aBlocks | Privilege Escalation Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute |
≤ 2.17.0 Fixed in 2.18.0 |
CVE-2026-110018 |
Wordfence | |
| 6.5 Medium | WP Social Feed Gallery | Broken Access Control No login needed |
≤ 5.0.13 |
CVE-2026-114705 |
Patchstack | |
| 6.5 Medium | Ad Inserter | Cross-Site Scripting |
≤ 2.8.18 Fixed in 2.8.19 |
CVE-2026-114194 |
Patchstack | |
| 7.1 High | VOD Infomaniak | Cross-Site Scripting No login needed |
≤ 1.5.14 Fixed in 1.5.15 |
CVE-2026-114695 |
Patchstack | |
| 7.1 High | Events Manager | Cross-Site Scripting No login needed |
≤ 7.4.8 Fixed in 7.4.9 |
CVE-2026-114694 |
Patchstack | |
| 9.8 Critical | Paytium | PHP Object Injection No login needed |
≤ 5.0.5 Fixed in 5.0.6 |
CVE-2026-114196 |
Patchstack | |
| 7.1 High | QA Analytics | Cross-Site Scripting No login needed |
≤ 5.3.0.1 Fixed in 5.3.0.2 |
CVE-2026-114697 |
Patchstack | |
| 6.5 Medium | All-in-One Video Gallery | Cross-Site Scripting |
≤ 4.9.7 Fixed in 5.0.0 |
CVE-2026-114693 |
Patchstack | |
| 6.5 Medium | SureDash | Broken Access Control |
≤ 1.12.2 Fixed in 1.12.3 |
CVE-2026-110892 |
Patchstack | |
| 5.9 Medium | LiteSpeed Cache | Information Disclosure Sensitive Data Exposure No login needed |
≤ 7.9 Fixed in 7.9.1 |
CVE-2026-114190 |
Patchstack | |
| 7.1 High | W3 Total Cache | Cross-Site Scripting No login needed |
≤ 2.10.7 Fixed in 2.11.0 |
CVE-2026-114178 |
Patchstack | |
| 9.3 Critical | Product Filter by WBW | SQL Injection No login needed |
≤ 3.4.6 Fixed in 3.4.7 |
CVE-2026-112866 |
Patchstack | |
| 9.8 Critical | Newsletters | PHP Object Injection No login needed |
≤ 4.18.1 Fixed in 4.18.2 |
CVE-2026-94075 |
Patchstack | |
| 7.1 High | BP Better Messages | Cross-Site Scripting No login needed |
≤ 3.1.3 Fixed in 3.1.4 |
CVE-2026-114179 |
Patchstack | |
| 7.1 High | We’re Open! | Cross-Site Scripting No login needed |
≤ 2.6 Fixed in 2.7 |
CVE-2026-112869 |
Patchstack | |
| 7.1 High | WP Event Solution | Cross-Site Scripting No login needed |
≤ 4.1.26 Fixed in 4.1.27 |
CVE-2026-112844 |
Patchstack | |
| 9.3 Critical | Newsletters | SQL Injection No login needed |
≤ 4.18.1 Fixed in 4.18.2 |
CVE-2026-111402 |
Patchstack | |
| 6.8 Medium | WP VR | Cross-Site Scripting Contributor+ Stored XSS via Hotspot Content |
8.5.49 – < 9.0.3 Fixed in 9.0.3 |
CVE-2026-114429 |
WPScan | |
| 3.7 Low | GeoDirectory | Broken Access Control Unauthenticated Guest-Submitted Listing Modification No login needed |
< 2.8.194 Fixed in 2.8.194 |
CVE-2026-113674 |
WPScan | |
| 7.2 High | GeoDirectory | Remote Code Execution Admin+ RCE via DB Text Export |
< 2.8.194 Fixed in 2.8.194 |
CVE-2026-113673 |
WPScan | |
| 6.8 Medium | GeoDirectory | Cross-Site Scripting Contributor+ Stored XSS via gd_map Shortcode width Attribute |
< 2.8.194 Fixed in 2.8.194 |
CVE-2026-113493 |
WPScan | |
| 5.3 Medium | GeoDirectory | Information Disclosure Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action No login needed |
< 2.8.194 Fixed in 2.8.194 |
CVE-2026-113492 |
WPScan | |
| 6.4 Medium | GeoDirectory | Information Disclosure Subscriber+ Media File Disclosure and Deletion via Path Traversal |
< 2.8.194 Fixed in 2.8.194 |
CVE-2026-113491 |
WPScan | |
| 5.3 Medium | GeoDirectory | Information Disclosure Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint No login needed |
< 2.8.194 Fixed in 2.8.194 |
CVE-2026-113490 |
WPScan | |
| 4.3 Medium | GeoDirectory | Broken Access Control Subscriber+ Arbitrary Listing Image Modification via IDOR |
< 2.8.194 Fixed in 2.8.194 |
CVE-2026-113489 |
WPScan | |
| 7.1 High | Download Monitor | Cross-Site Scripting Reflected XSS via Cross-Origin Download Link No login needed |
< 5.3.4 Fixed in 5.3.4 |
CVE-2026-112207 |
WPScan | |
| 9.8 Critical | asVereinbase | Authentication Bypass Unauthenticated Authentication Bypass via 2FA Validation No login needed |
< 1.1.8 Fixed in 1.1.8 |
CVE-2026-110956 |
WPScan | |
| 6.8 Medium | Pixel Tag Manager for WooCommerce | Cross-Site Scripting Contributor+ Stored XSS via Google Tag Manager Container ID |
< 2.2.3 Fixed in 2.2.3 |
CVE-2026-105199 |
WPScan | |
| 5.4 Medium | News Kit Addons For Elementor | Broken Access Control Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form |
≤ 1.4.7 |
CVE-2026-97353 |
WPScan | |
| 4.3 Medium | News Kit Addons For Elementor | Broken Access Control Subscriber+ Plugin Installation and Activation via nekit_install_importer |
< 1.4.9 Fixed in 1.4.9 |
CVE-2026-97352 |
WPScan | |
| 6.5 Medium | MAS Videos | Broken Access Control Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist |
≤ 1.3.4 |
CVE-2026-107907 |
WPScan | |
| 5.4 Medium | Advanced Twenty Seventeen | Cross-Site Request Forgery Subscriber+ Site Theme Switch via ats_create_child_theme |
≤ 1.3.1 |
CVE-2026-107887 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.