WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 90 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.5 Medium	Custom Thank You Page for WooCommerce Plugin `wc-custom-thank-you`	Broken Access Control Missing Authorization to Unauthenticated Settings Export and Settings Reset No login needed	`≤ 1.1.2`	Sep 24, 2026	`CVE-2026-4806`	Wordfence
4.3 Medium	VW Writer Blog Theme `vw-writer-blog`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset	`≤ 1.3.8`	Sep 19, 2026	`CVE-2026-2278`	Wordfence
6.4 Medium	Media Library Assistant Plugin `media-library-assistant`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import	`≤ 3.35`	Sep 11, 2026	`CVE-2026-6642`	Wordfence
4.3 Medium	WPLP Cookie Consent Plugin `gdpr-cookie-consent`	Broken Access Control Subscriber+ Banner Settings Overwrite and A/B Test Data Reset	`3.6.5 – < 4.4.2` Fixed in `4.4.2`	Sep 9, 2026	`CVE-2026-82185`	WPScan
4.3 Medium	ECS Plugin	Broken Access Control Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers	`< 4.3.8` Fixed in `4.3.8`	Aug 15, 2026	`CVE-2026-18807`	WPScan
4.3 Medium	Astro Booking Engine Plugin `astro-booking-engine`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset No login needed	`≤ 1.4.0`	Aug 14, 2026	`CVE-2025-10308`	Wordfence
6.5 Medium	Udimi Tools Plugin `udimi-optin`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action	`≤ 3.2`	Aug 5, 2026	`CVE-2026-7456`	Wordfence
4.3 Medium	Kirki Plugin `kirki`	Content Injection Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password No login needed	`< 6.0.12` Fixed in `6.0.12`	Jul 20, 2026	`CVE-2026-12724`	WPScan
4.3 Medium	GoodMeet Plugin `goodmeet`	Cross-Site Request Forgery Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential' No login needed	`≤ 1.1.8`	Jul 10, 2026	`CVE-2026-6440`	Wordfence
4.3 Medium	DSGVO All in one for WP Plugin `dsgvo-all-in-one-for-wp`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Reset	`≤ 4.9`	Jul 9, 2026	`CVE-2026-4298`	Wordfence
5.3 Medium	SearchPlus Plugin `searchplus`	Broken Access Control Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions No login needed	`≤ 1.7.1`	Jun 24, 2026	`CVE-2026-8617`	Wordfence
4.3 Medium	Emergency Password Reset Plugin `emergency-password-reset`	Cross-Site Request Forgery No login needed	`≤ 8.0` Fixed in `9.0`	Jun 17, 2026	`CVE-2024-35648`	Patchstack
6.4 Medium	WP-Paginate Plugin `wp-paginate`	Cross-Site Scripting WordPress Plugin WP-Paginate 2.1.3 Stored XSS via preset	`2.1.3`	Jun 8, 2026	`CVE-2021-47982`	VulnCheck
5.3 Medium	WP Promoter Plugin `wp-promoter`	Broken Access Control Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action No login needed	`≤ 1.3`	May 27, 2026	`CVE-2026-9014`	Wordfence
4.3 Medium	GSheet For Woo Importer Plugin `import-products-from-gsheet-for-woo-importer`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset	`≤ 2.3.1`	May 21, 2026	`CVE-2026-4843`	Wordfence
4.3 Medium	Bigfishgames Syndicate Plugin `bigfishgames-syndicate`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset and Update No login needed	`≤ 1.2`	May 20, 2026	`CVE-2026-6452`	Wordfence
5.3 Medium	Essential Chat Support Plugin `essential-chat-support`	Broken Access Control Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter No login needed	`≤ 1.0.1`	May 16, 2026	`CVE-2026-8681`	Wordfence
6.1 Medium	Royal WordPress Backup & Restore Plugin `royal-backup-reset`	Cross-Site Scripting Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter No login needed	`≤ 1.0.16`	Apr 10, 2026	`CVE-2026-4305`	Wordfence
4.3 Medium	Aruba HiSpeed Cache Plugin `aruba-hispeed-cache`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Reset No login needed	`≤ 3.0.4`	Apr 10, 2026	`CVE-2026-1924`	Wordfence
4.3 Medium	Blog2Social: Social Media Auto Post & Scheduler Plugin `blog2social`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action	`≤ 8.8.2`	Mar 26, 2026	`CVE-2026-4331`	Wordfence
5.3 Medium	Smarter Analytics Plugin `smarter-analytics`	Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter No login needed	`≤ 2.0`	Mar 21, 2026	`CVE-2026-3570`	Wordfence
4.3 Medium	Membership Plugin – Restrict Content Plugin `restrict-content`	Authentication Bypass Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect No login needed	`≤ 3.2.24`	Mar 20, 2026	`CVE-2026-4136`	Wordfence
4.3 Medium	Dealia – Request a quote Plugin `dealia-request-a-quote`	Broken Access Control Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset	`≤ 1.0.7`	Feb 19, 2026	`CVE-2026-2504`	Wordfence
6.5 Medium	OpenPix Plugin `openpix-for-woocommerce`	Broken Access Control Subscriber+ Payment Gateway Settings Reset	`≤ 2.13.3`	Feb 11, 2026	`CVE-2025-15400`	WPScan
4.3 Medium	NotificationX Plugin `notificationx`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Analytics Reset	`≤ 3.1.11`	Jan 20, 2026	`CVE-2026-0554`	Wordfence
6.5 Medium	Flaming Password Reset Plugin `flaming-password-reset`	Cross-Site Scripting	`≤ 1.0.3`	Jan 8, 2026	`CVE-2025-68875`	Patchstack
4.3 Medium	xShare Plugin `xshare`	Cross-Site Request Forgery Cross-Site Request Forgery to 'rs_plugin_reset' Parameter No login needed	`≤ 1.0.1`	Jan 7, 2026	`CVE-2025-13527`	Wordfence
4.3 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Authentication Bypass Unvalidated Redirect in Password Reset Flow via edd_redirect No login needed	`≤ 3.6.2`	Dec 31, 2025	`CVE-2025-14783`	Wordfence
6.4 Medium	FluentAuth - Auth Security Plugin `fluent-security`	Cross-Site Scripting Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode	`≤ 2.0.3`	Dec 15, 2025	`CVE-2025-13728`	Wordfence
5.3 Medium	HelloLeads CRM Form Shortcode Plugin	Cross-Site Request Forgery Unauthenticated Settings Reset No login needed	`≤ 1.0`	Dec 14, 2025	`CVE-2025-12696`	WPScan
5.4 Medium	Popup Builder Plugin `easy-notify-lite`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset	`≤ 1.1.37`	Dec 13, 2025	`CVE-2025-14446`	Wordfence
4.3 Medium	Rabbit Hole Plugin `rabbit-hole`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset No login needed	`≤ 1.1`	Dec 12, 2025	`CVE-2025-13366`	Wordfence
4.3 Medium	Beaver Builder – WordPress Page Builder Plugin `beaver-builder-lite-version`	Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification	`≤ 2.9.4`	Dec 2, 2025	`CVE-2025-11726`	Wordfence
5.3 Medium	Reuters Direct Plugin `reuters-direct`	Broken Access Control Missing Authorization to Unauthenticated Settings Reset No login needed	`≤ 3.0.0`	Nov 27, 2025	`CVE-2025-12579`	Wordfence
4.3 Medium	Reuters Direct Plugin `reuters-direct`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset No login needed	`≤ 3.0.0`	Nov 27, 2025	`CVE-2025-12578`	Wordfence
5.3 Medium	SiteSEO – SEO Simplified Plugin `siteseo`	Broken Access Control SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset No login needed	`≤ 1.3.2`	Nov 19, 2025	`CVE-2025-12814`	Wordfence
4.3 Medium	WSChat – WordPress Live Chat Plugin `wschat-live-chat`	Broken Access Control WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset	`≤ 3.1.6`	Nov 19, 2025	`CVE-2025-12751`	Wordfence
4.3 Medium	Private Google Calendars Plugin `private-google-calendars`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Reset	`≤ 20250811`	Nov 11, 2025	`CVE-2025-12526`	Wordfence
4.3 Medium	Contact Form 7 AWeber Extension Plugin	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Log Reset	`≤ 0.1.42`	Nov 8, 2025	`CVE-2025-12167`	Wordfence
4.3 Medium	Features Plugin `features`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Option Reset	`≤ 0.0.2`	Nov 5, 2025	`CVE-2025-12582`	Wordfence
5.3 Medium	Simple User Capabilities Plugin `simple-user-capabilities`	Broken Access Control Missing Authorization to Unauthenticated Capability Reset No login needed	`≤ 1.0`	Nov 4, 2025	`CVE-2025-12157`	Wordfence
4.3 Medium	FileBird Plugin `filebird`	Broken Access Control Improper Authorization to Authenticated (Author+) Settings Reset	`≤ 6.4.9`	Oct 18, 2025	`CVE-2025-11510`	Wordfence
5.3 Medium	WP Reset Plugin `wp-reset`	Information Disclosure Unauthenticated Sensitive Information Exposure via wf-licensing.log No login needed	`≤ 2.05`	Oct 7, 2025	`CVE-2025-10645`	Wordfence
4.3 Medium	Optimize More! – CSS Plugin `optimize-more-css`	Cross-Site Request Forgery CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset No login needed	`≤ 1.0.3`	Oct 3, 2025	`CVE-2025-9945`	Wordfence
4.3 Medium	Emergency Password Reset Plugin `emergency-password-reset`	Cross-Site Request Forgery No login needed	`≤ 9.3` Fixed in `9.4`	Sep 22, 2025	`CVE-2025-57942`	Patchstack
4.3 Medium	CBX Restaurant Booking Plugin	Cross-Site Request Forgery Plugin Reset via CSRF No login needed	`≤ 1.2.1`	Aug 11, 2025	`CVE-2025-7965`	WPScan
4.3 Medium	MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin `paid-membership`	Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed	`≤ 3.2.0`	Jun 28, 2025	`CVE-2025-5937`	Wordfence
4.3 Medium	GamiPress - Reset User Plugin	Cross-Site Request Forgery Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF No login needed	`< 1.0.1` Fixed in `1.0.1`	May 15, 2025	`CVE-2024-8245`	WPScan
4.3 Medium	Widgets Reset Plugin	Cross-Site Request Forgery Settings Update via CSRF No login needed	`≤ 0.1`	May 15, 2025	`CVE-2024-8082`	WPScan
4.3 Medium	Nokaut Offers Box Plugin	Cross-Site Request Forgery Plugin Reset via CSRF No login needed	`≤ 1.4.0`	May 15, 2025	`CVE-2024-10634`	WPScan

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.