WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–37 of 37 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.6 Medium Ninja Forms Plugin ninja-forms PHP Object Injection Authenticated (Administrator+) PHP Object Injection via Form Import ≤ 3.14.6 CVE-2026-11363 Wordfence
4.8 Medium Ninja Forms Plugin ninja-forms Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags No login needed 3.14.10 – < 3.15.2 Fixed in 3.15.2 CVE-2026-80437 WPScan
5.9 Medium Ninja Forms Plugin ninja-forms Information Disclosure Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API 3.14.0 – < 3.15.2 Fixed in 3.15.2 CVE-2026-80438 WPScan
4.8 Medium Ninja Forms Plugin ninja-forms Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field Default No login needed < 3.14.10 Fixed in 3.14.10 CVE-2026-15256 WPScan
4.9 Medium Ninja Forms Plugin ninja-forms SQL Injection Authenticated (Administrator+) SQL Injection via Import File 'settings' Key ≤ 3.14.9 CVE-2026-15663 Wordfence
6.5 Medium Ninja Forms Plugin ninja-forms Other Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler No login needed < 3.14.9 Fixed in 3.14.9 CVE-2026-65051 VulnCheck
6.5 Medium Ninja Forms Plugin ninja-forms Broken Access Control Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors < 3.14.9 Fixed in 3.14.9 CVE-2026-65050 VulnCheck
6.4 Medium Ninja Forms - Excel Export Plugin ninja-forms-excel-export Cross-Site Scripting Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter ≤ 3.3.6 CVE-2026-15161 Wordfence
4.3 Medium Ninja Forms - Excel Export Plugin ninja-forms-excel-export Broken Access Control Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal ≤ 3.3.6 CVE-2026-15160 Wordfence
4.3 Medium Ninja Forms - Excel Export Plugin ninja-forms-excel-export Broken Access Control Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter ≤ 3.3.6 CVE-2026-15159 Wordfence
5.3 Medium Ninja Forms - File Uploads Plugin ninja-forms-uploads Arbitrary File Upload File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints No login needed ≤ 3.3.29 CVE-2026-12557 Wordfence
6.5 Medium Ninja Forms Plugin ninja-forms Information Disclosure Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token ≤ 3.14.1 CVE-2026-1307 Wordfence
5.3 Medium Ninja Forms Plugin ninja-forms Information Disclosure Unauthenticated Token Generation and Submission Disclosure No login needed < 3.13.3 Fixed in 3.13.3 CVE-2025-14072 WPScan
5.9 Medium Popup addon for Ninja Forms Plugin popup-addon-for-ninja-forms Cross-Site Scripting ≤ 3.5.1 Fixed in 3.5.2 CVE-2025-64264 Patchstack
4.3 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Cross-Site Request Forgery The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion No login needed ≤ 3.12.0 CVE-2025-10498 Wordfence
4.3 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Cross-Site Request Forgery The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 3.12.0 CVE-2025-10499 Wordfence
6.5 Medium Popup addon for Ninja Forms Plugin popup-addon-for-ninja-forms Cross-Site Scripting ≤ 3.4 Fixed in 3.5 CVE-2025-53279 Patchstack
6.4 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI ≤ 3.10.2.1 CVE-2025-5398 Wordfence
4.8 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Admin+ Stored XSS < 3.10.1 Fixed in 3.10.1 CVE-2025-2561 WPScan
4.8 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Admin+ Stored XSS < 3.10.1 Fixed in 3.10.1 CVE-2025-2560 WPScan
4.8 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Admin+ Stored XSS < 3.10.1 Fixed in 3.10.1 CVE-2025-2524 WPScan
6.4 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Cross-Site Scripting The Contact Form Builder That Grows With You <= 3.8.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.8.24 CVE-2024-13470 Wordfence
6.3 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Arbitrary Shortcode Execution The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 3.8.22 CVE-2024-12238 Wordfence
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) ≤ 3.8.16 Fixed in 3.8.18 CVE-2024-50514 Patchstack
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting The Contact Form Builder That Grows With You plugin <= 3.8.16 - Cross Site Scripting (XSS) ≤ 3.8.16 Fixed in 3.8.18 CVE-2024-50515 Patchstack
6.5 Medium Styler for Ninja Forms Plugin styler-for-ninja-forms-lite Broken Access Control Authenticated (Subscriber+) Arbitrary Option Deletion via deactivate_license ≤ 3.3.4 CVE-2024-10717 Wordfence
4.7 Medium Ninja Forms Contact Form Plugin ninja-forms Cross-Site Scripting Reflected Self-Based Cross-Site Scripting via Referer No login needed ≤ 3.8.15 CVE-2024-3866 Wordfence
5.9 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting ≤ 3.8.11 Fixed in 3.8.12 CVE-2024-43999 Patchstack
6.1 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Reflected XSS No login needed 3.8.6 – < 3.8.11 Fixed in 3.8.11 CVE-2024-7354 WPScan
5.4 Medium Ninja Forms Plugin ninja-forms Cross-Site Request Forgery No login needed ≤ 3.8.6 Fixed in 3.8.7 CVE-2024-39628 Patchstack
5.4 Medium Ninja Forms Plugin ninja-forms Arbitrary Shortcode Execution Subscriber+ Arbitrary Shortcode Execution ≤ 3.8.4 Fixed in 3.8.5 CVE-2024-37934 Patchstack
6.8 Medium Ninja Forms Contact Form Plugin ninja-forms Arbitrary File Deletion WordPress Ninja Forms Plugin <= 3.6.24 is vulnerable to Arbitrary File Deletion ≤ 3.6.24 Fixed in 3.6.25 CVE-2023-36505 Patchstack
5.4 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web b… prior to 3.8.1 CVE-2024-26019 jpcert
6.1 Medium Ninja Forms Plugin ninja-forms Cross-Site Scripting Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on th… No login needed prior to 3.8.1 CVE-2024-29220 jpcert
4.6 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Scripting The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 3.8.0 CVE-2024-2108 Wordfence
4.3 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Request Forgery The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export No login needed ≤ 3.8.0 CVE-2024-2113 Wordfence
5.9 Medium Ninja Forms Contact Form Plugin ninja-forms SQL Injection Unauthenticated Second Order SQL Injection No login needed ≤ 3.7.1 CVE-2024-0685 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only