WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 162 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Custom Thank You Page for WooCommerce Plugin wc-custom-thank-you Broken Access Control Missing Authorization to Unauthenticated Settings Export and Settings Reset No login needed ≤ 1.1.2 CVE-2026-4806 Wordfence
4.3 Medium VW Writer Blog Theme vw-writer-blog Broken Access Control Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset ≤ 1.3.8 CVE-2026-2278 Wordfence
3.7 Low Eventin Plugin wp-event-solution Broken Access Control Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint No login needed 4.1.5 – < 4.1.24 Fixed in 4.1.24 CVE-2026-84907 WPScan
6.4 Medium Media Library Assistant Plugin media-library-assistant Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import ≤ 3.35 CVE-2026-6642 Wordfence
8.0 High Bulk Password Reset Plugin bulk-password-reset Privilege Escalation Authenticated (Subscriber+) Arbitrary Password Reset ≤ 1.3.3 CVE-2026-14873 Wordfence
4.3 Medium WPLP Cookie Consent Plugin gdpr-cookie-consent Broken Access Control Subscriber+ Banner Settings Overwrite and A/B Test Data Reset 3.6.5 – < 4.4.2 Fixed in 4.4.2 CVE-2026-82185 WPScan
3.7 Low WP Travel Plugin wp-travel Broken Access Control Unauthenticated Arbitrary Booking Payment Reset No login needed < 12.0.2 Fixed in 12.0.2 CVE-2026-13144 WPScan
7.5 High JetFormBuilder Plugin Information Disclosure Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19858 WPScan
9.8 Critical TranslatePress – Multilingual Plugin translatepress-multilingual Privilege Escalation Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure No login needed ≤ 3.3.1 CVE-2026-19632 Wordfence
8.8 High InfusedWoo Pro Plugin Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure ≤ 5.1.17 CVE-2026-19892 Wordfence
4.3 Medium ECS Plugin Broken Access Control Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers < 4.3.8 Fixed in 4.3.8 CVE-2026-18807 WPScan
4.3 Medium Astro Booking Engine Plugin astro-booking-engine Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset No login needed ≤ 1.4.0 CVE-2025-10308 Wordfence
8.8 High Frontend Admin by DynamiApps Plugin acf-frontend-form-element Broken Access Control Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token ≤ 3.29.9 CVE-2026-15606 Wordfence
8.1 High Login & Register Forms Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset Code Brute Force No login needed 3.2.5 – < 4.0.2 Fixed in 4.0.2 CVE-2026-18469 WPScan
8.1 High Login & Register Forms Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header No login needed 3.2.5 – < 4.0.2 Fixed in 4.0.2 CVE-2026-18468 WPScan
8.1 High Bricksforge Plugin Broken Access Control Unauthenticated Arbitrary Password Reset via Pro Forms No login needed < 3.1.8.8 Fixed in 3.1.8.8 CVE-2026-18030 WPScan
9.8 Critical Single Sign On For TNG Plugin single-sign-on-for-tng Authentication Bypass Unauthenticated Arbitrary Password Reset No login needed < 2.2.0 Fixed in 2.2.0 CVE-2026-16299 WPScan
9.8 Critical FoodBoxBooker Plugin foodboxbooker Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed < 1.0.7 Fixed in 1.0.7 CVE-2026-16298 WPScan
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' No login needed ≤ 1.2.3 CVE-2026-14364 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' No login needed ≤ 1.2.3 CVE-2026-14365 Wordfence
6.5 Medium Udimi Tools Plugin udimi-optin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action ≤ 3.2 CVE-2026-7456 Wordfence
9.3 Critical Membership Plugin – Kadence Memberships Plugin restrict-content Privilege Escalation Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover No login needed ≤ 4.0.0 CVE-2026-9273 Wordfence
9.8 Critical Chama Plugin Broken Access Control Unauthenticated Arbitrary User Password Reset No login needed < 1.0.13 Fixed in 1.0.13 CVE-2026-16300 WPScan
8.1 High Lenxel WP Theme Privilege Escalation Unauthenticated Account Takeover via Arbitrary Password Reset No login needed ≤ 1.0.31 CVE-2026-12586 WPScan
7.5 High Five Star Restaurant Reservations Plugin restaurant-reservations Broken Access Control Booking Manager+ Missing Authorization via rtb_reset_notifications No login needed < 2.7.23 Fixed in 2.7.23 CVE-2026-15151 WPScan
8.1 High Login/Signup Popup Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset Rate Limit Bypass No login needed < 3.2.5 Fixed in 3.2.5 CVE-2026-14836 WPScan
8.8 High DynamicKit for Elementor Plugin dynamickit-elementor Privilege Escalation Unauthenticated Account Takeover via Password Reset Link Host Injection No login needed < 1.0.3 Fixed in 1.0.3 CVE-2026-14596 WPScan
8.1 High Chat On Desk Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset OTP Bypass No login needed < 1.0.9 Fixed in 1.0.9 CVE-2026-14309 WPScan
9.8 Critical ShopMonitor.io Plugin shopmonitorio Privilege Escalation Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute No login needed < 1.2.0 Fixed in 1.2.0 CVE-2026-14919 WPScan
9.8 Critical TrueBooker Appointment Booking Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset No login needed < 1.2.4 Fixed in 1.2.4 CVE-2026-14545 WPScan
7.5 High CAFEHAUS API Plugin Privilege Escalation Unauthenticated Arbitrary User Password Reset No login needed ≤ 1.0.0 CVE-2026-12981 WPScan
4.3 Medium Kirki Plugin kirki Content Injection Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password No login needed < 6.0.12 Fixed in 6.0.12 CVE-2026-12724 WPScan
4.3 Medium GoodMeet Plugin goodmeet Cross-Site Request Forgery Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential' No login needed ≤ 1.1.8 CVE-2026-6440 Wordfence
4.3 Medium DSGVO All in one for WP Plugin dsgvo-all-in-one-for-wp Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Reset ≤ 4.9 CVE-2026-4298 Wordfence
9.8 Critical Eventer Plugin Privilege Escalation Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation No login needed ≤ 4.4.2 CVE-2026-9701 Wordfence
8.1 High Admin and Site Enhancements Plugin Privilege Escalation Unauthenticated Administrator-Role Restoration via reset-for Parameter No login needed 7.6.3 – < 8.8.4 Fixed in 8.8.4 CVE-2026-12083 WPScan
9.8 Critical SMS Alert Plugin sms-alert Privilege Escalation Unauthenticated Privilege Escalation via Arbitrary Password Reset No login needed ≤ 3.9.5 CVE-2026-11387 Wordfence
8.8 High Ultimate Member Plugin ultimate-member Privilege Escalation Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure ≤ 2.11.4 CVE-2026-7761 Wordfence
9.8 Critical Invoice Generator Plugin invoice-creator Privilege Escalation Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter No login needed ≤ 1.0.0 CVE-2026-12416 Wordfence
9.8 Critical SignUp & SignIn Plugin signup-signin Privilege Escalation Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover No login needed ≤ 1.0.0 CVE-2026-12417 Wordfence
5.3 Medium SearchPlus Plugin searchplus Broken Access Control Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions No login needed ≤ 1.7.1 CVE-2026-8617 Wordfence
2.7 Low UsersWP Plugin userswp Broken Access Control Insecure Direct Object Reference to Authenticated (Editor+) Arbitrary User Avatar/Banner Reset via 'user_id' Parameter ≤ 1.2.63 CVE-2026-12102 Wordfence
4.3 Medium Emergency Password Reset Plugin emergency-password-reset Cross-Site Request Forgery No login needed ≤ 8.0 Fixed in 9.0 CVE-2024-35648 Patchstack
7.5 High LatePoint Plugin latepoint Privilege Escalation Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset ≤ 5.5.1 CVE-2026-8176 Wordfence
6.4 Medium WP-Paginate Plugin wp-paginate Cross-Site Scripting WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset 2.1.3 CVE-2021-47982 VulnCheck
9.8 Critical ARMember Premium Plugin Privilege Escalation Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation No login needed ≤ 7.3.1 CVE-2026-5076 Wordfence
5.3 Medium WP Promoter Plugin wp-promoter Broken Access Control Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action No login needed ≤ 1.3 CVE-2026-9014 Wordfence
4.3 Medium GSheet For Woo Importer Plugin import-products-from-gsheet-for-woo-importer Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset ≤ 2.3.1 CVE-2026-4843 Wordfence
4.3 Medium Bigfishgames Syndicate Plugin bigfishgames-syndicate Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset and Update No login needed ≤ 1.2 CVE-2026-6452 Wordfence
5.3 Medium Essential Chat Support Plugin essential-chat-support Broken Access Control Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter No login needed ≤ 1.0.1 CVE-2026-8681 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only