WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,323 High 9,483 Medium 18,323 Low 369 Not scored 15

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.

Showing 1–50 of 82 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 2
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
9.8 Critical	Conversational Forms for ChatBot Plugin `conversational-forms`	PHP Object Injection No login needed	`≤ 1.5.1` Fixed in `1.5.2`	Oct 18, 2026	`CVE-2026-110886`	Patchstack
9.8 Critical	click5 CRM add-on to Gravity Forms Plugin	Cross-Site Request Forgery Unauthenticated Arbitrary Options Update No login needed	`≤ 1.0.3`	Oct 11, 2026	`CVE-2026-84253`	WPScan
9.8 Critical	click5 CRM add-on to WPForms Plugin	Cross-Site Request Forgery Unauthenticated Arbitrary Options Update No login needed	`≤ 1.0.3`	Oct 11, 2026	`CVE-2026-84252`	WPScan
9.8 Critical	click5 CRM add-on to Ninja Forms Plugin	Cross-Site Request Forgery Unauthenticated Arbitrary Options Update No login needed	`≤ 1.0.1`	Oct 11, 2026	`CVE-2026-84251`	WPScan
9.1 Critical	Super Forms Plugin	Arbitrary File Deletion Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter No login needed	`≤ 6.3.316`	Oct 8, 2026	`CVE-2026-17609`	Wordfence
9.1 Critical	Super Forms Plugin	Path Traversal Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter No login needed	`≤ 6.3.316`	Oct 2, 2026	`CVE-2026-15896`	Wordfence
9.8 Critical	Super Forms Plugin	Privilege Escalation Unauthenticated Privilege Escalation via 'role' Parameter No login needed	`≤ 6.3.316`	Oct 1, 2026	`CVE-2026-15989`	Wordfence
9.8 Critical	Paytium: Mollie payment forms & donations Plugin `paytium`	Privilege Escalation Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter No login needed	`≤ 5.0.3` Fixed in `5.0.4`	Sep 24, 2026	`CVE-2026-18467`	Wordfence
9.1 Critical	Forminator Forms Plugin `forminator`	Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter No login needed	`≤ 1.57.2` Fixed in `1.57.2.1`	Sep 19, 2026	`CVE-2026-92229`	Wordfence
9.8 Critical	Gravity Forms Plugin	Arbitrary File Upload Unauthenticated Arbitrary File Upload via Hidden File Upload Field No login needed	`≤ 3.1.0.4`	Sep 19, 2026	`CVE-2026-84434`	Wordfence
9.8 Critical	Multi Uploader for Gravity Forms Plugin `gf-multi-uploader`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via Chunked File Upload No login needed	`≤ 1.1.9`	Sep 17, 2026	`CVE-2026-87796`	Wordfence
9.8 Critical	Everest Forms Plugin `everest-forms`	PHP Object Injection No login needed	`≤ 3.6.0` Fixed in `3.6.1`	Sep 11, 2026	`CVE-2026-62103`	Patchstack
9.8 Critical	Drag and Drop File Upload for Elementor Forms Plugin `drag-and-drop-file-upload-for-elementor-forms`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'type' Parameter No login needed	`≤ 1.6.0` Fixed in `1.6.1`	Sep 10, 2026	`CVE-2026-18351`	Wordfence
9.8 Critical	SigmaForms Pro Plugin	Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field No login needed	`≤ 1.4.11`	Sep 2, 2026	`CVE-2026-78657`	Wordfence
9.3 Critical	Smart Marketing SMS and Newsletters Forms Plugin `smart-marketing-for-wp`	SQL Injection No login needed	`≤ 5.1.24` Fixed in `5.1.25`	Aug 31, 2026	`CVE-2026-81756`	Patchstack
9.8 Critical	Sigma Forms Pro Plugin	Arbitrary File Upload Unauthenticated Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via Pre-built Template File Upload Field No login needed	`≤ 1.4.5`	Aug 29, 2026	`CVE-2026-14494`	Wordfence
9.8 Critical	Forminator Forms Plugin `forminator`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration No login needed	`≤ 1.56.1`	Aug 18, 2026	`CVE-2026-15748`	Wordfence
9.8 Critical	Contact Form, Survey, Quiz & Popup Form Builder – ARForms Plugin `arforms-form-builder`	PHP Object Injection ARForms <= 1.8.5 - Unauthenticated PHP Object Injection No login needed	`≤ 1.8.5`	Aug 16, 2026	`CVE-2024-13784`	Wordfence
9.8 Critical	Fluent Forms Pro Plugin `fluentformpro`	Other Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build No login needed	`6.2.7`	Aug 13, 2026	`CVE-2026-73532`	VulnCheck
9.1 Critical	Multi Uploader for Gravity Forms Plugin `gf-multi-uploader`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Media Deletion No login needed	`≤ 1.1.8` Fixed in `1.1.9`	Aug 5, 2026	`CVE-2026-5581`	Wordfence
9.6 Critical	Ninja Forms File Uploads Extension Plugin `ninja-forms-uploads`	Cross-Site Request Forgery No login needed	`≤ 3.3.26`	Jul 23, 2026	`CVE-2026-57784`	Patchstack
9.8 Critical	GoDAM Plugin `godam`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via WPForms File Upload Field No login needed	`≤ 1.12.2` Fixed in `2.0.0`	Jul 23, 2026	`CVE-2026-14282`	Wordfence
9.3 Critical	Ninja Forms Plugin `ninja-forms`	Broken Access Control Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action No login needed	`< 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65049`	VulnCheck
9.3 Critical	Ninja Forms Plugin `ninja-forms`	Cross-Site Scripting Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index No login needed	`3.10.4 – < 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65048`	VulnCheck
9.8 Critical	Bricksforge Plugin	Privilege Escalation Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter No login needed	`≤ 3.1.8.6`	Jul 17, 2026	`CVE-2026-14956`	Wordfence
9.8 Critical	Super Forms Plugin	Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) No login needed	`≤ 6.3.313`	Jul 10, 2026	`CVE-2026-14894`	Wordfence
9.0 Critical	SigmaForms Pro – AI Generated Forms Plugin `sigmaforms-pro`	Arbitrary File Upload AI Generated Forms plugin <= 1.4.5 - Arbitrary File Upload No login needed	`≤ 1.4.5` Fixed in `1.4.6`	Jun 17, 2026	`CVE-2026-52705`	Patchstack
9.8 Critical	Happyforms Plugin `happyforms`	PHP Object Injection No login needed	`≤ 1.26.13` Fixed in `1.26.14`	Jun 15, 2026	`CVE-2026-49768`	Patchstack
9.8 Critical	Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin `cf7-mailchimp`	PHP Object Injection No login needed	`≤ 1.1.8` Fixed in `1.1.9`	Jun 15, 2026	`CVE-2026-49765`	Patchstack
9.8 Critical	Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms Plugin `cf7-salesforce`	PHP Object Injection No login needed	`≤ 1.4.3` Fixed in `1.4.4`	Jun 15, 2026	`CVE-2026-49109`	Patchstack
9.8 Critical	WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin `cf7-zendesk`	PHP Object Injection No login needed	`≤ 1.1.4` Fixed in `1.1.5`	Jun 15, 2026	`CVE-2026-49105`	Patchstack
9.8 Critical	Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms Plugin `cf7-infusionsoft`	PHP Object Injection No login needed	`≤ 1.2.1` Fixed in `1.2.2`	Jun 15, 2026	`CVE-2026-49104`	Patchstack
9.8 Critical	WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin `cf7-insightly`	PHP Object Injection No login needed	`≤ 1.1.4` Fixed in `1.1.5`	Jun 15, 2026	`CVE-2026-49085`	Patchstack
9.8 Critical	Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin `cf7-active-campaign`	PHP Object Injection No login needed	`≤ 1.1.1` Fixed in `1.1.2`	Jun 15, 2026	`CVE-2026-9691`	Patchstack
9.6 Critical	Gravity Forms Plugin `gravityforms`	Arbitrary File Deletion No login needed	`≤ 2.10.0.1` Fixed in `2.10.1`	Jun 1, 2026	`CVE-2026-48866`	Patchstack
9.8 Critical	Piotnet Forms Plugin `piotnetforms`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via Form File Upload No login needed	`≤ 2.1.40`	May 19, 2026	`CVE-2026-4883`	Wordfence
9.8 Critical	Receive Notifications After Form Submitting – Form Notify for Any Forms Plugin `form-notify`	Authentication Bypass Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback No login needed	`≤ 1.1.10` Fixed in `1.1.11`	May 15, 2026	`CVE-2026-5229`	Wordfence
9.9 Critical	FunnelFormsPro Plugin `funnelforms-pro`	Remote Code Execution	`≤ 3.8.1`	Apr 23, 2026	`CVE-2026-39440`	Patchstack
9.8 Critical	Everest Forms Plugin `everest-forms`	PHP Object Injection Unauthenticated PHP Object Injection via Form Entry Metadata No login needed	`≤ 3.4.3` Fixed in `3.4.4`	Apr 8, 2026	`CVE-2026-3296`	Wordfence
9.8 Critical	Ninja Forms - File Upload Plugin	Arbitrary File Upload File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload No login needed	`≤ 3.3.26`	Apr 7, 2026	`CVE-2026-0740`	Wordfence
9.8 Critical	Everest Forms Pro Plugin `everest-forms`	Remote Code Execution Unauthenticated Remote Code Execution via Calculation Field No login needed	`≤ 1.9.12` Fixed in `2.0.0`	Mar 31, 2026	`CVE-2026-3300`	Wordfence
9.8 Critical	Kali Forms Plugin `kali-forms`	Remote Code Execution Unauthenticated Remote Code Execution via form_process No login needed	`≤ 2.4.9` Fixed in `2.4.10`	Mar 20, 2026	`CVE-2026-3584`	Wordfence
9.8 Critical	Database for Contact Form 7, WPforms, Elementor forms Plugin `contact-form-entries`	PHP Object Injection Unauthenticated PHP Object Injection via 'download_csv' No login needed	`≤ 1.4.7`	Mar 5, 2026	`CVE-2026-2599`	Wordfence
9.9 Critical	WPForms Google Sheet Connector Plugin `gsheetconnector-wpforms`	Remote Code Execution	`≤ 4.0.1` Fixed in `4.0.2`	Feb 20, 2026	`CVE-2025-67979`	Patchstack
9.8 Critical	Snow Monkey Forms Plugin `snow-monkey-forms`	Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal No login needed	`≤ 12.0.3`	Jan 28, 2026	`CVE-2026-1056`	Wordfence
9.8 Critical	WP Gravity Forms Salesforce Plugin `gf-salesforce-crmperks`	PHP Object Injection No login needed	`≤ 1.5.1` Fixed in `1.5.2`	Dec 18, 2025	`CVE-2025-60180`	Patchstack
9.8 Critical	WP Gravity Forms HubSpot Plugin `gf-hubspot`	PHP Object Injection Deserialization of untrusted data No login needed	`≤ 1.2.6` Fixed in `1.2.7`	Dec 18, 2025	`CVE-2025-60178`	Patchstack
9.8 Critical	WP Gravity Forms Constant Contact Plugin `gf-constant-contact`	PHP Object Injection Deserialization of untrusted data No login needed	`≤ 1.1.2` Fixed in `1.1.3`	Dec 18, 2025	`CVE-2025-60174`	Patchstack
9.8 Critical	WP Gravity Forms Zoho CRM and Bigin Plugin `gf-zoho`	PHP Object Injection Deserialization of untrusted data No login needed	`≤ 1.2.9` Fixed in `1.3.0`	Dec 18, 2025	`CVE-2025-60091`	Patchstack
9.8 Critical	WP Gravity Forms Insightly Plugin `gf-insightly`	PHP Object Injection Deserialization of untrusted data No login needed	`≤ 1.1.6` Fixed in `1.1.7`	Dec 18, 2025	`CVE-2025-60090`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.