WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–30 of 30 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical TranslatePress – Multilingual Plugin translatepress-multilingual Privilege Escalation Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure No login needed ≤ 3.3.1 CVE-2026-19632 Wordfence
9.8 Critical Single Sign On For TNG Plugin single-sign-on-for-tng Authentication Bypass Unauthenticated Arbitrary Password Reset No login needed < 2.2.0 Fixed in 2.2.0 CVE-2026-16299 WPScan
9.8 Critical FoodBoxBooker Plugin foodboxbooker Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed < 1.0.7 Fixed in 1.0.7 CVE-2026-16298 WPScan
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' No login needed ≤ 1.2.3 CVE-2026-14364 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' No login needed ≤ 1.2.3 CVE-2026-14365 Wordfence
9.3 Critical Membership Plugin – Kadence Memberships Plugin restrict-content Privilege Escalation Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover No login needed ≤ 4.0.0 CVE-2026-9273 Wordfence
9.8 Critical Chama Plugin Broken Access Control Unauthenticated Arbitrary User Password Reset No login needed < 1.0.13 Fixed in 1.0.13 CVE-2026-16300 WPScan
9.8 Critical ShopMonitor.io Plugin shopmonitorio Privilege Escalation Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute No login needed < 1.2.0 Fixed in 1.2.0 CVE-2026-14919 WPScan
9.8 Critical TrueBooker Appointment Booking Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset No login needed < 1.2.4 Fixed in 1.2.4 CVE-2026-14545 WPScan
9.8 Critical Eventer Plugin Privilege Escalation Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation No login needed ≤ 4.4.2 CVE-2026-9701 Wordfence
9.8 Critical SMS Alert Plugin sms-alert Privilege Escalation Unauthenticated Privilege Escalation via Arbitrary Password Reset No login needed ≤ 3.9.5 CVE-2026-11387 Wordfence
9.8 Critical Invoice Generator Plugin invoice-creator Privilege Escalation Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter No login needed ≤ 1.0.0 CVE-2026-12416 Wordfence
9.8 Critical SignUp & SignIn Plugin signup-signin Privilege Escalation Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover No login needed ≤ 1.0.0 CVE-2026-12417 Wordfence
9.8 Critical ARMember Premium Plugin Privilege Escalation Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation No login needed ≤ 7.3.1 CVE-2026-5076 Wordfence
9.8 Critical User Profile Builder Plugin profile-builder Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed 1.1.27 – < 3.15.2 Fixed in 3.15.2 CVE-2025-15030 WPScan
9.8 Critical CRM Memberships Plugin crm-memberships Broken Access Control Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint No login needed ≤ 2.6 CVE-2025-13313 Wordfence
9.8 Critical Appy Pie Connect for WooCommerce Plugin appy-pie-connect-for-woocommerce Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password No login needed ≤ 1.1.2 CVE-2025-9286 Wordfence
9.8 Critical Password Reset with Code Plugin bdvs-password-reset Privilege Escalation Insecure Password Reset Code Creation No login needed < 0.0.17 Fixed in 0.0.17 CVE-2025-5305 WPScan
9.8 Critical Sala - Startup & SaaS Theme Privilege Escalation Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover No login needed ≤ 1.1.4 CVE-2025-4606 Wordfence
9.8 Critical DWT - Directory & Listing Theme Privilege Escalation Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset No login needed ≤ 3.3.6 CVE-2024-12827 Wordfence
9.8 Critical WP Email Debug Plugin wp-email-debug Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via Password Reset No login needed 1.0 – 1.1.0 CVE-2025-5486 Wordfence
9.8 Critical WP JobHunt Plugin Privilege Escalation Unauthenticated Privilege Escalation via Password Reset/Account Takeover No login needed ≤ 7.1 CVE-2024-11284 Wordfence
9.8 Critical InWave Jobs Plugin Privilege Escalation Unauthenticated Privilege Escalation via Password Reset No login needed ≤ 3.5.1 CVE-2025-1315 Wordfence
9.8 Critical CarSpot – Dealership Wordpress Classified Theme Privilege Escalation Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover No login needed ≤ 2.4.3 CVE-2024-12860 Wordfence
9.8 Critical Adifier System Plugin Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed ≤ 3.1.7 CVE-2024-13375 Wordfence
9.8 Critical AdForest Theme Privilege Escalation Privilege Escalation via Password Reset/Account Takeover No login needed ≤ 5.1.6 CVE-2024-11350 Wordfence
9.8 Critical Contest Gallery Plugin contest-gallery Privilege Escalation Unauthenticated Arbitrary Password Reset to Privilege Escalation/Account Takeover No login needed ≤ 24.0.7 CVE-2024-11103 Wordfence
9.8 Critical AppPresser – Mobile App Framework Plugin apppresser Privilege Escalation Mobile App Framework <= 4.4.6 - Unauthenticated Privilege Escalation via Password Reset No login needed ≤ 4.4.6 CVE-2024-11024 Wordfence
9.8 Critical WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin timetics Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover No login needed ≤ 1.0.25 CVE-2024-9263 Wordfence
9.9 Critical ThemeGrill Demo Importer Plugin Broken Access Control Authorization Bypass to Site Reset 1.3.4 – 1.6.1 CVE-2020-36837 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only