WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 1–45 of 45 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | WP Accessibility Helper (WAH) | Cross-Site Request Forgery No login needed |
≤ 0.6.6 |
CVE-2026-24537 |
Patchstack | |
| 6.4 Medium | Equalize Digital Accessibility Checker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter |
≤ 1.46.0 |
CVE-2026-14481 |
Wordfence | |
| 4.3 Medium | Equalize Digital Accessibility Checker | Broken Access Control Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter |
≤ 1.42.1 |
CVE-2026-9199 |
Wordfence | |
| 4.3 Medium | Equalize Digital Accessibility Checker | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action |
≤ 1.42.0 |
CVE-2026-9015 |
Wordfence | |
| 6.5 Medium | Accessibility Suite by Ability, Inc | SQL Injection Authenticated (Subscriber+) SQL Injection via 'scan_id' Parameter |
≤ 4.20 |
CVE-2026-3773 |
Wordfence | |
| 7.5 High | Ally – Web Accessibility & Usability | SQL Injection Web Accessibility & Usability <= 4.0.3 - Unauthenticated SQL Injection via URL Path No login needed |
≤ 4.0.3 |
CVE-2026-2413 |
Wordfence | |
| 6.4 Medium | WP Accessibility | Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute |
≤ 2.3.1 |
CVE-2026-2362 |
Wordfence | |
| 5.3 Medium | Ally | Broken Access Control No login needed |
≤ 4.0.2 Fixed in 4.0.3 |
CVE-2026-25386 |
Patchstack | |
| 5.3 Medium | Web Accessibility by accessiBe | Information Disclosure Unauthenticated Sensitive Information Exposure No login needed |
≤ 2.11 |
CVE-2025-13113 |
Wordfence | |
| 6.4 Medium | Orange Confort+ accessibility toolbar | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.7 |
CVE-2026-1808 |
Wordfence | |
| 5.9 Medium | Web Accessibility with Max Access | Cross-Site Scripting |
≤ 2.1.0 |
CVE-2026-24629 |
Patchstack | |
| 5.9 Medium | Accessibility Press | Cross-Site Scripting |
≤ 1.0.2 |
CVE-2025-49355 |
Patchstack | |
| 4.3 Medium | All in One Accessibility | Broken Access Control |
≤ 1.15 Fixed in 1.16 |
CVE-2025-63004 |
Patchstack | |
| 4.3 Medium | Accessibility by AudioEye | Broken Access Control |
≤ 1.0.49 Fixed in 1.1.0 |
CVE-2025-64246 |
Patchstack | |
| 5.3 Medium | Accessiy By CodeConfig Accessibility | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation No login needed |
≤ 1.0.0 |
CVE-2025-13358 |
Wordfence | |
| 4.3 Medium | Accessiy By CodeConfig Accessibility – Easy One-Click Accessibility Toolbar That Truly Matters | Broken Access Control Easy One-Click Accessibility Toolbar That Truly Matters <= 1.0.2 - Authenticated (Subscriber+) Missing Authorization to Modify Accessibility Settings |
≤ 1.0.2 |
CVE-2025-13309 |
Wordfence | |
| 4.3 Medium | Accessibility Toolkit by WebYes | Broken Access Control |
≤ 2.0.4 Fixed in 2.0.5 |
CVE-2025-66112 |
Patchstack | |
| 5.4 Medium | Web Accessibility By accessiBe | Broken Access Control |
≤ 2.10 Fixed in 2.11 |
CVE-2025-49920 |
Patchstack | |
| 4.3 Medium | Ally - Web Accessibility & Usability | Cross-Site Request Forgery Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update No login needed |
≤ 3.8.0 |
CVE-2025-10700 |
Wordfence | |
| 4.3 Medium | Web Accessibility By accessiBe | Cross-Site Request Forgery No login needed |
≤ 2.10 |
CVE-2025-10375 |
Wordfence | |
| 4.3 Medium | Text To Speech TTS Accessibility | Broken Access Control |
≤ 1.9.30 Fixed in 1.9.31 |
CVE-2025-58664 |
Patchstack | |
| 4.3 Medium | Accessibility Checker by Equalize Digital | Broken Access Control |
≤ 1.31.0 Fixed in 1.31.1 |
CVE-2025-58976 |
Patchstack | |
| 5.4 Medium | Accessibility Checker by Equalize Digital | Broken Access Control |
≤ 1.31.0 Fixed in 1.31.1 |
CVE-2025-58981 |
Patchstack | |
| 5.4 Medium | Accessibility Checker by Equalize Digital | Broken Access Control Insecure Direct Object References (IDOR) |
≤ 1.30.0 Fixed in 1.30.1 |
CVE-2025-57886 |
Patchstack | |
| 6.4 Medium | FL3R Accessibility Suite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode |
≤ 1.4 |
CVE-2025-6689 |
Wordfence | |
| 5.4 Medium | Accessibility Suite | Broken Access Control |
≤ 4.19 Fixed in 4.20 |
CVE-2025-30636 |
Patchstack | |
| 4.3 Medium | Web Accessibility with Max Access | Cross-Site Request Forgery No login needed |
≤ 2.0.9 Fixed in 2.1.0 |
CVE-2025-47681 |
Patchstack | |
| 8.5 High | Accessibility Suite | SQL Injection |
≤ 4.18 Fixed in 4.19 |
CVE-2025-32650 |
Patchstack | |
| 6.5 Medium | Accessibility Suite | Arbitrary File Upload |
≤ 4.18 Fixed in 4.19 |
CVE-2025-32215 |
Patchstack | |
| 5.9 Medium | Ally | Cross-Site Scripting |
≤ 3.1.0 Fixed in 3.2.0 |
CVE-2025-32640 |
Patchstack | |
| 5.9 Medium | wA11y – The Web Accessibility Toolbox | Cross-Site Scripting The Web Accessibility Toolbox plugin <= 1.0.3 - Cross Site Scripting (XSS) |
≤ 1.0.3 |
CVE-2025-30623 |
Patchstack | |
| 7.1 High | Web Accessibility By accessiBe | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 2.5 Fixed in 2.6 |
CVE-2025-26981 |
Patchstack | |
| 6.3 Medium | Accessibility Suite | Broken Access Control Multiple Broken Access Control |
≤ 4.18 Fixed in 4.19 |
CVE-2025-22698 |
Patchstack | |
| 7.1 High | Accessibility Task Manager | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.2.1 |
CVE-2025-23725 |
Patchstack | |
| 8.8 High | Accessibility by AllAccessible | Privilege Escalation |
≤ 1.3.4 Fixed in 1.3.5 |
CVE-2024-49644 |
Patchstack | |
| 6.1 Medium | Enable Accessibility | Cross-Site Scripting Reflected Cross-Site Scripting No login needed |
≤ 1.4.1 |
CVE-2024-9208 |
Wordfence | |
| 4.3 Medium | WP Accessibility Helper (WAH) | Broken Access Control |
≤ 0.6.2.4 Fixed in 0.6.2.5 |
CVE-2023-41869 |
Patchstack | |
| 8.8 High | Accessibility by AllAccessible | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update |
≤ 1.3.4 |
CVE-2024-11643 |
Wordfence | |
| 5.3 Medium | WP Accessibility Helper (WAH) | Broken Access Control No login needed |
≤ 0.6.2.9 Fixed in 0.6.3 |
CVE-2024-37926 |
Patchstack | |
| 5.4 Medium | WP Accessibility Helper | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Settings Update |
≤ 0.6.2.8 |
CVE-2024-5987 |
Wordfence | |
| 4.3 Medium | WP Accessibility Helper (WAH) | Broken Access Control |
≤ 0.6.2.5 Fixed in 0.6.2.6 |
CVE-2024-31423 |
Patchstack | |
| 4.3 Medium | WP Dark Mode – WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing | Broken Access Control WordPress Dark Mode Plugin for Improved Accessibility, Dark Theme, Night Mode, and Social Sharing <= 5.0.4 - Missing Authorization |
≤ 5.0.4 |
CVE-2024-5449 |
Wordfence | |
| 8.8 High | Alt Text AI – Automatically generate image alt text for SEO and accessibility | SQL Injection Automatically generate image alt text for SEO and accessibility <= 1.4.9 - Authenticated (Subscriber+) SQL Injection |
≤ 1.4.9 |
CVE-2024-4847 |
Wordfence | |
| 6.5 Medium | Accessibility Widget | Cross-Site Scripting |
≤ 2.2 Fixed in 2.2.1 |
CVE-2024-32831 |
Patchstack | |
| 5.4 Medium | Accessibility | Cross-Site Request Forgery WordPress Accessibility Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF) No login needed |
≤ 1.0.6 |
CVE-2024-24705 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.