WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–38 of 38 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.0 High Bulk Password Reset Plugin bulk-password-reset Privilege Escalation Authenticated (Subscriber+) Arbitrary Password Reset ≤ 1.3.3 CVE-2026-14873 Wordfence
7.5 High JetFormBuilder Plugin Information Disclosure Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19858 WPScan
8.8 High InfusedWoo Pro Plugin Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure ≤ 5.1.17 CVE-2026-19892 Wordfence
8.8 High Frontend Admin by DynamiApps Plugin acf-frontend-form-element Broken Access Control Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token ≤ 3.29.9 CVE-2026-15606 Wordfence
8.1 High Login & Register Forms Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset Code Brute Force No login needed 3.2.5 – < 4.0.2 Fixed in 4.0.2 CVE-2026-18469 WPScan
8.1 High Login & Register Forms Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header No login needed 3.2.5 – < 4.0.2 Fixed in 4.0.2 CVE-2026-18468 WPScan
8.1 High Bricksforge Plugin Broken Access Control Unauthenticated Arbitrary Password Reset via Pro Forms No login needed < 3.1.8.8 Fixed in 3.1.8.8 CVE-2026-18030 WPScan
8.1 High Lenxel WP Theme Privilege Escalation Unauthenticated Account Takeover via Arbitrary Password Reset No login needed ≤ 1.0.31 CVE-2026-12586 WPScan
7.5 High Five Star Restaurant Reservations Plugin restaurant-reservations Broken Access Control Booking Manager+ Missing Authorization via rtb_reset_notifications No login needed < 2.7.23 Fixed in 2.7.23 CVE-2026-15151 WPScan
8.1 High Login/Signup Popup Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset Rate Limit Bypass No login needed < 3.2.5 Fixed in 3.2.5 CVE-2026-14836 WPScan
8.8 High DynamicKit for Elementor Plugin dynamickit-elementor Privilege Escalation Unauthenticated Account Takeover via Password Reset Link Host Injection No login needed < 1.0.3 Fixed in 1.0.3 CVE-2026-14596 WPScan
8.1 High Chat On Desk Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset OTP Bypass No login needed < 1.0.9 Fixed in 1.0.9 CVE-2026-14309 WPScan
7.5 High CAFEHAUS API Plugin Privilege Escalation Unauthenticated Arbitrary User Password Reset No login needed ≤ 1.0.0 CVE-2026-12981 WPScan
8.1 High Admin and Site Enhancements Plugin Privilege Escalation Unauthenticated Administrator-Role Restoration via reset-for Parameter No login needed 7.6.3 – < 8.8.4 Fixed in 8.8.4 CVE-2026-12083 WPScan
8.8 High Ultimate Member Plugin ultimate-member Privilege Escalation Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure ≤ 2.11.4 CVE-2026-7761 Wordfence
7.5 High LatePoint Plugin latepoint Privilege Escalation Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset ≤ 5.5.1 CVE-2026-8176 Wordfence
7.1 High MonsterInsights Plugin google-analytics-for-wordpress Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset ≤ 10.1.2 CVE-2026-5371 Wordfence
8.1 High Custom Login Page Customizer Plugin login-customizer Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed 2.1.1 – < 2.5.4 Fixed in 2.5.4 CVE-2025-14975 WPScan
7.5 High PowerPack Pro for Elementor Plugin powerpack-elements Broken Access Control Unauthenticated Plugin Settings Reset No login needed ≤ 2.10.6 Fixed in 2.10.8 CVE-2024-24844 Patchstack
8.8 High Demo Importer Plus Plugin demo-importer-plus Broken Access Control Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation ≤ 2.0.8 CVE-2025-14364 Wordfence
8.1 High Blaze Demo Importer Plugin blaze-demo-importer Broken Access Control Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion 1.0.0 – 1.0.13 CVE-2025-13334 Wordfence
8.8 High Hydra Booking Plugin hydra-booking Broken Access Control Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via tfhb_reset_password_callback Function 1.1.0 – 1.1.18 CVE-2025-7689 Wordfence
8.8 High Dataverse Integration Plugin integration-cds Broken Access Control Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route 2.77 – 2.81 CVE-2025-7695 Wordfence
8.8 High Frontend Login and Registration Blocks Plugin frontend-login-and-registration-blocks Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Password Reset ≤ 1.0.8 CVE-2025-3607 Wordfence
8.8 High BoomBox Theme Extensions Plugin Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password ≤ 1.8.0 CVE-2024-12295 Wordfence
8.1 High Reset Plugin Cross-Site Request Forgery Cross-Site Request Forgery to Database Reset No login needed ≤ 1.6 CVE-2024-13684 Wordfence
8.8 High eCommerce Product Catalog Plugin ecommerce-product-catalog Cross-Site Request Forgery Cross-Site Request Forgery to Password Reset No login needed ≤ 3.3.43 CVE-2024-12771 Wordfence
7.5 High Easing Slider Plugin easing-slider Broken Access Control Plugin Settings Reset No login needed ≤ 3.0.8 CVE-2023-30490 Patchstack
7.1 High User Password Reset Plugin user-password-reset Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0 CVE-2024-51714 Patchstack
8.8 High SULly Plugin sully Cross-Site Request Forgery Plugin Reset via CSRF No login needed < 4.3.1 Fixed in 4.3.1 CVE-2024-5034 WPScan
7.6 High Muslim Prayer Time BD Plugin muslim-prayer-time-bd Cross-Site Request Forgery Settings Reset via CSRF No login needed ≤ 2.4 CVE-2024-4758 WPScan
7.2 High UberMenu Plugin Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.8.3 CVE-2024-3593 Wordfence
8.1 High Login with phone number Plugin login-with-phone-number Broken Access Control Insecure Password Reset Mechanism No login needed ≤ 1.7.34 CVE-2024-6125 Wordfence
8.1 High Build App Online Plugin build-app-online Privilege Escalation Account Takeover via Weak Password Reset Mechanism No login needed ≤ 1.0.22 CVE-2023-7264 Wordfence
8.8 High Essential Addons for Elementor Plugin essential-addons-for-elementor-lite PHP Object Injection Authenticated (Author+) PHP Object Injection via error_resetpassword ≤ 5.9.13 CVE-2024-3018 Wordfence
8.8 High Enjoy Social Feed Plugin Broken Access Control Subscriber+ Plugin Database Reset ≤ 6.2.2 CVE-2024-0780 WPScan
7.1 High Index Now Plugin mihdan-index-now Cross-Site Request Forgery Cross-Site Request Forgery via reset_form No login needed ≤ 2.6.3 CVE-2024-0428 Wordfence
8.8 High WP Register Profile With Shortcode Plugin wp-register-profile-with-shortcode Cross-Site Request Forgery Cross-Site Request Forgery to User Password Reset No login needed ≤ 3.5.9 CVE-2023-5448 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only