WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,007 vulnerabilities, 1,391 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,148 High 8,901 Medium 17,624 Low 328 Not scored 6

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 5, 2026.

Showing 1–23 of 23 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.2 High JetFormBuilder Plugin jetformbuilder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action No login needed ≤ 3.6.5.4 CVE-2026-97342 Wordfence
7.1 High JetFormBuilder Plugin jetformbuilder Cross-Site Scripting No login needed ≤ 3.6.5.4 Fixed in 3.6.6 CVE-2026-102391 Patchstack
6.1 Medium JetFormBuilder Plugin jetformbuilder Cross-Site Scripting Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field No login needed ≤ 3.6.5.3 CVE-2026-92212 Wordfence
8.6 High JetFormBuilder Stripe Gateway Plugin SQL Injection Unauthenticated Blind SQLi via Payment Token No login needed < 1.1.0 Fixed in 1.1.0 CVE-2022-4997 WPScan
5.5 Medium JetFormBuilder Plugin Arbitrary File Deletion Admin+ Arbitrary File Deletion via Server-Side Validation Callback 3.5.6.2 – < 3.6.5.3 Fixed in 3.6.5.3 CVE-2026-19860 WPScan
9.8 Critical JetFormBuilder Plugin jetformbuilder Privilege Escalation Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter No login needed ≤ 3.6.2 CVE-2026-12793 Wordfence
7.1 High JetFormBuilder Plugin jetformbuilder Cross-Site Scripting No login needed ≤ 3.6.5.1 Fixed in 3.6.5.2 CVE-2026-84817 Patchstack
4.8 Medium JetFormBuilder Plugin Content Injection Unauthenticated Email Header Injection via Send Email Action No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19862 WPScan
6.5 Medium JetFormBuilder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19859 WPScan
4.7 Medium JetFormBuilder Plugin Cross-Site Scripting Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19861 WPScan
7.5 High JetFormBuilder Plugin Information Disclosure Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19858 WPScan
7.5 High JetFormBuilder Plugin jetformbuilder Broken Access Control No login needed ≤ 3.6.4.1 Fixed in 3.6.4.2 CVE-2026-28140 Patchstack
5.3 Medium JetFormBuilder Plugin jetformbuilder Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter No login needed ≤ 3.6.3 CVE-2026-13459 Wordfence
6.8 Medium JetFormBuilder Plugin jetformbuilder Privilege Escalation ≤ 3.6.1 Fixed in 3.6.1.1 CVE-2026-54196 Patchstack
7.1 High JetFormBuilder Plugin jetformbuilder Cross-Site Scripting No login needed ≤ 3.6.0.1 Fixed in 3.6.1 CVE-2026-54195 Patchstack
9.9 Critical JetFormBuilder Plugin jetformbuilder Remote Code Execution ≤ <= 3.5.6.1 Fixed in 3.5.6.2 CVE-2026-32525 Patchstack
7.5 High JetFormBuilder Plugin jetformbuilder Path Traversal Unauthenticated Arbitrary File Read via Media Field No login needed ≤ 3.5.6.2 CVE-2026-4373 Wordfence
5.3 Medium JetFormBuilder Plugin jetformbuilder Broken Access Control Missing Authorization to Unauthenticated Form Generation No login needed ≤ 3.5.3 CVE-2025-11991 Wordfence
5.3 Medium JetFormBuilder Plugin jetformbuilder Broken Access Control No login needed ≤ 3.5.3 Fixed in 3.5.4 CVE-2025-64384 Patchstack
7.2 High JetFormBuilder Plugin jetformbuilder PHP Object Injection ≤ 3.5.1.2 Fixed in 3.5.2 CVE-2025-53990 Patchstack
7.2 High JetFormBuilder Plugin jetformbuilder Privilege Escalation Authenticated (Administrator+) Privilege Escalation ≤ 3.3.4.1 CVE-2024-7291 Wordfence
7.2 High JetFormBuilder Plugin jetformbuilder Privilege Escalation Authenticated Privilege Escalation ≤ 3.0.8 Fixed in 3.0.9 CVE-2023-37866 Patchstack
5.3 Medium JetFormBuilder Plugin jetformbuilder Content Injection No login needed ≤ 3.1.4 Fixed in 3.1.5 CVE-2023-48763 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only