WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–29 of 29 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Invisible Anti-Spam & CAPTCHA Plugin Broken Access Control Subscriber+ Arbitrary Form Submission Deletion 2.0.5 – < 5.1.1 Fixed in 5.1.1 CVE-2026-91010 WPScan
6.5 Medium Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Comment Text No login needed < 6.87 Fixed in 6.87 CVE-2026-19855 WPScan
7.2 High Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin cleantalk-spam-protect Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder No login needed ≤ 6.86 CVE-2026-77830 Wordfence
4.9 Medium Invisible Anti-Spam & CAPTCHA Plugin gdpr-compliant-recaptcha-for-all-forms SQL Injection Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values ≤ 5.1 CVE-2026-16146 Wordfence
7.2 High Invisible Anti-Spam & CAPTCHA Plugin gdpr-compliant-recaptcha-for-all-forms Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'action' Parameter No login needed ≤ 5.1 CVE-2026-16145 Wordfence
4.9 Medium Invisible Anti-Spam & CAPTCHA Plugin gdpr-compliant-recaptcha-for-all-forms SQL Injection Authenticated (Editor+) SQL Injection via 'key' Parameter ≤ 5.1 CVE-2026-16094 Wordfence
7.1 High Maspik – Spam blacklist Plugin contact-forms-anti-spam Cross-Site Scripting Spam blacklist plugin <= 2.9.1 - Cross Site Scripting (XSS) No login needed ≤ 2.9.1 Fixed in 2.9.2 CVE-2026-28003 Patchstack
9.8 Critical WPBruiser {no- Captcha anti-Spam} Plugin goodbye-captcha PHP Object Injection No login needed ≤ 3.1.43 CVE-2026-65556 Patchstack
8.8 High Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin Cross-Site Scripting Unauthenticated Stored XSS via Comment Shortcode Bypass No login needed < 6.79 Fixed in 6.79 CVE-2026-8071 WPScan
7.1 High OOPSpam Anti-Spam Plugin oopspam-anti-spam Cross-Site Scripting No login needed ≤ <= 1.2.62 Fixed in 1.2.63 CVE-2026-32544 Patchstack
9.8 Critical Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin cleantalk-spam-protect Broken Access Control Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation No login needed ≤ 6.71 CVE-2026-1490 Wordfence
5.3 Medium OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) Plugin oopspam-anti-spam Other Unauthenticated IP Header Spoofing No login needed ≤ 1.2.53 CVE-2025-12094 Wordfence
7.1 High NIX Anti-Spam Light Plugin nix-anti-spam-light Cross-Site Request Forgery No login needed ≤ 0.0.4 CVE-2025-58270 Patchstack
4.3 Medium Maspik Plugin contact-forms-anti-spam Cross-Site Request Forgery No login needed ≤ 2.5.6 CVE-2025-9888 Wordfence
4.3 Medium Maspik Plugin contact-forms-anti-spam Broken Access Control Authenticated (Subscriber+) Missing Authorization to Spam Log Export ≤ 2.5.6 CVE-2025-9979 Wordfence
4.3 Medium Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant Plugin gdpr-compliant-recaptcha-for-all-forms Cross-Site Request Forgery No login needed ≤ 4.1.1 Fixed in 4.1.2 CVE-2025-49283 Patchstack
5.4 Medium Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms Plugin stop-spammer-registrations-plugin Cross-Site Request Forgery Cross-Site Request Forgery to Multiple Administrative Actions No login needed ≤ 2024.7 CVE-2025-2935 Wordfence
7.1 High AlphaOmega Captcha & Anti-Spam Filter Plugin alphaomega-captcha-anti-spam Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 3.3 CVE-2025-30584 Patchstack
5.3 Medium Contact Form 7 Anti Spambot Plugin contact-form-7-anti-spambot Broken Access Control No login needed ≤ 1.0.1 CVE-2025-23862 Patchstack
5.4 Medium Peter’s Custom Anti-Spam Plugin peters-custom-anti-spam-image Cross-Site Request Forgery Cross-Site Request Forgery via cas_register_post Function No login needed ≤ 3.2.3 CVE-2024-12554 Wordfence
5.4 Medium Maspik – Spam blacklist Plugin contact-forms-anti-spam Cross-Site Request Forgery CSRF to Settings Change ≤ 2.2.7 Fixed in 2.2.8 CVE-2024-53806 Patchstack
9.8 Critical Spam protection, Anti-Spam, FireWall by CleanTalk Plugin cleantalk-spam-protect Broken Access Control Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation No login needed ≤ 6.43.2 CVE-2024-10542 Wordfence
8.1 High Spam protection, Anti-Spam, FireWall by CleanTalk Plugin cleantalk-spam-protect Broken Access Control Authorization Bypass due to Missing Empty Value Check to Unauthenticated Arbitrary Plugin Installation No login needed ≤ 6.44 CVE-2024-10781 Wordfence
9.8 Critical NIX Anti-Spam Light Plugin nix-anti-spam-light PHP Object Injection No login needed ≤ 0.0.4 CVE-2024-52432 Patchstack
6.5 Medium Titan Anti-spam & Security Plugin anti-spam Broken Access Control ≤ 7.3.6 Fixed in 7.3.8 CVE-2024-38777 Patchstack
5.3 Medium Maspik – Spam blacklist Plugin contact-forms-anti-spam Authentication Bypass Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass No login needed ≤ 0.10.3 Fixed in 0.10.4 CVE-2023-48271 Patchstack
5.9 Medium Maspik – Spam Blacklist Plugin contact-forms-anti-spam Cross-Site Scripting Spam blacklist Plugin <= 0.10.6 is vulnerable to Cross Site Scripting (XSS) ≤ 0.10.6 Fixed in 0.10.7 CVE-2024-25101 Patchstack
4.3 Medium Spam protection, Anti-Spam, FireWall by CleanTalk Plugin cleantalk-spam-protect Cross-Site Request Forgery WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 6.20 Fixed in 6.21 CVE-2023-51696 Patchstack
4.3 Medium Spam protection, Anti-Spam, FireWall by CleanTalk Plugin cleantalk-spam-protect Cross-Site Request Forgery WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 6.20 Fixed in 6.21 CVE-2023-51535 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only