WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 60 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter ≤ 1.6.12.31 CVE-2026-91109 Wordfence
5.3 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.6.12.31 Fixed in 1.6.12.33 CVE-2026-94673 Patchstack
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.12.29 Fixed in 1.6.12.31 CVE-2026-94074 Patchstack
6.5 Medium Easy Appointments Plugin easy-appointments Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action ≤ 3.12.27 CVE-2026-9232 Wordfence
5.3 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR No login needed 4.0 – < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87966 WPScan
4.8 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token No login needed < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87965 WPScan
5.3 Medium Booking for Appointments and Events Calendar - Amelia Plugin Broken Access Control Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass No login needed ≤ 2.4.5 CVE-2026-16582 Wordfence
5.4 Medium Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Broken Access Control Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover ≤ 2.4.4 CVE-2026-14311 Wordfence
6.4 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter ≤ 2.4.9 CVE-2026-10148 Wordfence
5.3 Medium Booktics – Booking Calendar for Appointments and Service Businesses Plugin booktics Broken Access Control Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization No login needed ≤ 1.0.23 CVE-2026-11446 Wordfence
6.5 Medium WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting ≤ 6.3.2 Fixed in 6.4.0 CVE-2026-73402 Patchstack
6.5 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure ≤ 1.6.12.10 CVE-2026-13358 Wordfence
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Team Member+ User Email Disclosure via Users and Customers REST Endpoints < 1.6.12.17 Fixed in 1.6.12.17 CVE-2026-16541 WPScan
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Contributor+ Sensitive Data Disclosure via Admin Shortcode < 1.6.12.11 Fixed in 1.6.12.11 CVE-2026-15254 WPScan
4.3 Medium Easy Appointments Plugin easy-appointments Information Disclosure Subscriber+ Sensitive Information Disclosure via REST Appointments Listing < 3.12.28 Fixed in 3.12.28 CVE-2026-14226 WPScan
4.3 Medium Easy Appointments Plugin easy-appointments Information Disclosure Subscriber+ Customer PII Disclosure via IDOR < 3.12.28 Fixed in 3.12.28 CVE-2026-14223 WPScan
5.4 Medium Easy Appointments Plugin easy-appointments Broken Access Control Subscriber+ Cross-User Appointment Data Modification via IDOR < 3.12.28 Fixed in 3.12.28 CVE-2026-14224 WPScan
6.1 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting Unauthenticated Stored XSS via Booking Customer Information No login needed < 1.6.12.4 Fixed in 1.6.12.4 CVE-2026-13400 WPScan
6.5 Medium Easy Appointments Plugin easy-appointments Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.12.27 Fixed in 3.12.28 CVE-2026-61946 Patchstack
4.9 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking SQL Injection Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import ≤ 2.4.3 CVE-2026-14782 Wordfence
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.11.11 Fixed in 1.6.12.0 CVE-2026-59523 Patchstack
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.12.4 Fixed in 1.6.12.6 CVE-2026-57812 Patchstack
4.3 Medium Easy Appointments Plugin easy-appointments Broken Access Control Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation ≤ 3.12.27 CVE-2026-11992 Wordfence
5.3 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint No login needed ≤ 1.6.11.8 CVE-2026-6937 Wordfence
5.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Denial of Service Unauthenticated Denial of Service No login needed ≤ 1.6.11.5 CVE-2026-7493 Wordfence
6.5 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Unauthenticated Arbitrary Appointment View, Modification and Deletion No login needed ≤ 1.6.10.6 CVE-2026-4807 Wordfence
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Broken Access Control Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint No login needed ≤ 2.1.2 CVE-2026-6449 Wordfence
5.3 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.10.2 CVE-2026-39694 Patchstack
4.3 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure ≤ 1.6.9.29 CVE-2026-1704 Wordfence
6.1 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Request Forgery Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting No login needed ≤ 5.2.7 CVE-2026-2324 Wordfence
4.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Request Forgery Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery No login needed ≤ 5.2.5 CVE-2025-14873 Wordfence
5.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Broken Access Control Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure No login needed ≤ 5.2.6 CVE-2026-1537 Wordfence
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.9.15 Fixed in 1.6.9.17 CVE-2025-69315 Patchstack
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Broken Access Control Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions No login needed ≤ 1.2.38 CVE-2025-14720 Wordfence
6.5 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 1.6.9.5 CVE-2025-11723 Wordfence
5.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed ≤ 1.6.9.16 CVE-2025-13754 Wordfence
4.3 Medium Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution Plugin fluent-booking Broken Access Control The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management ≤ 1.9.11 CVE-2025-13756 Wordfence
5.3 Medium Booking Plugin for WordPress Appointments – Time Slot Plugin timeslot Broken Access Control Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending No login needed ≤ 1.4.7 CVE-2025-12842 Wordfence
6.5 Medium Easy Appointments Plugin easy-appointments Content Injection No login needed ≤ 3.12.14 Fixed in 3.12.14.1 CVE-2025-49398 Patchstack
6.4 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 1.6.8.30 CVE-2025-4667 Wordfence
4.3 Medium Easy!Appointments Plugin easyappointments Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed ≤ 1.4.2 Fixed in 1.4.3 CVE-2025-31828 Patchstack
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Information Disclosure Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure No login needed ≤ 1.2.19 CVE-2025-2578 Wordfence
6.1 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.8.3 CVE-2024-13431 Wordfence
6.1 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting Reflected XSS No login needed < 5.0.0 Fixed in 5.0.0 CVE-2024-12737 WPScan
6.5 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db ≤ 4.9.2 CVE-2024-12558 Wordfence
6.1 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting Reflected Cross-Site Scripting via status Parameter No login needed ≤ 4.9.1 CVE-2024-12469 Wordfence
6.4 Medium Koalendar – Events & Appointments Booking Calendar Plugin koalendar-free-booking-widget Cross-Site Scripting Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter ≤ 1.0.2 CVE-2024-11855 Wordfence
5.4 Medium Booking Ultra Pro Plugin booking-ultra-pro Broken Access Control ≤ 1.1.12 Fixed in 1.1.13 CVE-2023-32601 Patchstack
4.3 Medium Easy Appointments Plugin easy-appointments Cross-Site Scripting Auth. Stored Cross-Site Scripting (XSS) No login needed ≤ 3.10.7 Fixed in 3.11.1 CVE-2023-30748 Patchstack
6.5 Medium Booking for Appointments and Events Calendar – Amelia Premium Plugin ameliabooking Broken Access Control Amelia Premium <= 7.7 and Lite <= 1.2.4 - Missing Authorization to Sensitive Information Exposure No login needed ≤ 1.2.4, ≤ 7.7 CVE-2024-6332 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only