WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 97 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.2 High Appointment Hour Booking Plugin appointment-hour-booking Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer No login needed ≤ 1.5.97 CVE-2026-96573 Wordfence
7.5 High Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Broken Access Control No login needed ≤ 4.6.0 Fixed in 4.6.3 CVE-2026-95513 Patchstack
7.2 High Booking Calendar Plugin booking Privilege Escalation Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter ≤ 11.8.2 CVE-2026-92619 Wordfence
7.5 High Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Plugin wp-event-solution Privilege Escalation Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter ≤ 4.1.23 CVE-2026-75983 Wordfence
7.2 High Booking for Appointments and Events Calendar Plugin ameliabooking Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission No login needed ≤ 2.2 CVE-2026-6286 Wordfence
8.8 High Booking calendar, Appointment Booking System Plugin Cross-Site Scripting Unauthenticated Stored XSS via SVG File Upload No login needed 3.2.18 – 3.2.36 CVE-2026-14334 WPScan
7.2 High Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter No login needed ≤ 4.6.0 CVE-2026-14433 Wordfence
7.5 High VikAppointments – Services Booking Calendar Plugin vikappointments SQL Injection Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection No login needed ≤ 1.2.19 CVE-2026-15918 Wordfence
7.1 High Booking Calendar Plugin booking Cross-Site Scripting No login needed ≤ 11.4.2 Fixed in 11.4.3 CVE-2026-59558 Patchstack
8.6 High Modern Events Calendar (Lite & Pro) Plugin SQL Injection Unauthenticated SQL Injection via mec_list_load_more No login needed < 7.34.0 Fixed in 7.34.0 CVE-2026-11349 WPScan
7.1 High ICS Calendar Plugin ics-calendar Cross-Site Scripting No login needed ≤ 12.1.1 Fixed in 12.1.1.1 CVE-2026-59516 Patchstack
7.2 High EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter No login needed ≤ 4.3.4.2 CVE-2026-13441 Wordfence
7.5 High LatePoint - Calendar Booking Plugin for Appointments and Events Plugin latepoint Broken Access Control Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass No login needed ≤ 5.4.0 CVE-2026-5356 Wordfence
7.5 High My Calendar Plugin my-calendar SQL Injection Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters No login needed ≤ 3.7.8 CVE-2026-6854 Wordfence
8.8 High EventPrime Plugin eventprime-event-calendar-management PHP Object Injection ≤ 4.3.4.1 Fixed in 4.3.4.2 CVE-2026-56053 Patchstack
8.5 High Events Schedule - WordPress Events Calendar Plugin weekly-class SQL Injection WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection ≤ 2.7.2 CVE-2025-69135 Patchstack
8.1 High EventPrime Plugin eventprime-event-calendar-management PHP Object Injection No login needed ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42687 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42686 Patchstack
8.8 High Events Calendar for GeoDirectory Plugin events-for-geodirectory PHP Object Injection ≤ 2.3.25 Fixed in 2.3.26 CVE-2026-39532 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.3.0.0 Fixed in 4.3.0.1 CVE-2026-39518 Patchstack
8.8 High Events Calendar for GeoDirectory Plugin events-for-geodirectory Privilege Escalation Authenticated (Subscriber+) Privilege Escalation ≤ 2.3.28 CVE-2026-11616 Wordfence
7.5 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control No login needed ≤ 4.3.2.0 Fixed in 4.3.2.1 CVE-2026-42669 Patchstack
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'append_where_sql' Parameter No login needed ≤ 1.6.11.8 CVE-2026-7797 Wordfence
7.2 High Booking Calendar – Event Calendar Plugin Cross-Site Scripting Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters No login needed ≤ 2.1.6 CVE-2026-8143 Wordfence
8.8 High my-calendar Plugin Information Disclosure My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog No login needed < 3.7.7 CVE-2026-40308 GitHub_M
7.1 High Booking calendar, Appointment Booking System Plugin booking-calendar Cross-Site Scripting No login needed ≤ 3.2.36 CVE-2026-25435 Patchstack
7.5 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control No login needed ≤ 4.2.6.0 Fixed in 4.2.7.0 CVE-2025-69358 Patchstack
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'fields' Parameter No login needed ≤ 1.6.10.0 CVE-2026-3658 Wordfence
7.5 High EventPrime Plugin eventprime-event-calendar-management Price Manipulation Payment Bypass No login needed ≤ 4.2.8.3 Fixed in 4.2.8.4 CVE-2026-25312 Patchstack
7.6 High Booking Calendar Plugin booking SQL Injection ≤ 10.14.15 Fixed in 10.14.16 CVE-2026-32358 Patchstack
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint No login needed ≤ 1.6.9.29 CVE-2026-3045 Wordfence
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'append_where_sql' Parameter No login needed ≤ 1.6.9.27 CVE-2026-1708 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar Path Traversal Authenticated (Author+) Arbitrary File Read via ajax_create_import No login needed ≤ 6.15.17 CVE-2026-3585 Wordfence
7.5 High WP FullCalendar Plugin wp-fullcalendar Broken Access Control No login needed ≤ 1.6 CVE-2026-22351 Patchstack
7.2 High LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Scripting Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 5.2.5 CVE-2026-0617 Wordfence
7.2 High Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) Plugin wp-event-solution Broken Access Control Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' No login needed ≤ 4.0.51 CVE-2025-14657 Wordfence
7.5 High Booking Calendar Plugin booking SQL Injection Unauthenticated SQL Injection via dates_to_check No login needed ≤ 10.14.8 CVE-2025-14383 Wordfence
7.5 High Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking SQL Injection Amelia <= 1.2.35 - Unauthenticated SQL Injection via search No login needed ≤ 1.2.35 CVE-2025-12482 Wordfence
7.5 High Booking Calendar | Appointment Booking | Bookit Plugin bookit Broken Access Control Missing Authorization to Unauthenticated Stripe Connection No login needed ≤ 2.5.0 CVE-2025-12633 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection via s No login needed 6.15.1.1 – 6.15.9 CVE-2025-12197 Wordfence
7.1 High Calendar Plus Plugin calendar-plus Cross-Site Scripting No login needed ≤ 1.2.4 CVE-2025-53350 Patchstack
7.5 High The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.15.1 CVE-2025-9807 Wordfence
7.1 High Quick Event Calendar Plugin quick-event-calendar Cross-Site Request Forgery No login needed ≤ 1.4.9 CVE-2025-58861 Patchstack
7.2 High Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin Plugin wp-event-solution Server-Side Request Forgery Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery No login needed ≤ 4.0.37 CVE-2025-7813 Wordfence
7.5 High BizCalendar Web Plugin bizcalendar-web Local File Inclusion Authenticated (Contributor+) Local File Inclusion ≤ 1.1.0.53 CVE-2025-7650 Wordfence
7.5 High Event Manager, Event Calendar and Booking Plugin eventin-pro Broken Access Control Arbitrary Content Deletion No login needed ≤ 4.0.24 Fixed in 4.0.25 CVE-2025-52731 Patchstack
7.1 High Bg Orthodox Calendar Plugin bg-orthodox-calendar Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 0.13.10 CVE-2025-28958 Patchstack
7.1 High WordPress Events Calendar Registration & Tickets Plugin wpeventplus Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.6.0 CVE-2025-39372 Patchstack
8.8 High QuickCal - Appointment Booking Calendar Plugin quickcal Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-32310 Patchstack
7.5 High Event Calendar Plugin Broken Access Control Unauthenticated Arbitrary Calendar Deletion No login needed ≤ 1.0.4 CVE-2024-8700 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only