WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–22 of 22 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.3 Critical ARMember Premium Plugin armember SQL Injection No login needed ≤ 7.8 CVE-2026-42417 Patchstack
5.3 Medium ARMember Plugin armember-membership Path Traversal Directory Traversal via X-FILENAME No login needed ≤ 4.0.27 CVE-2026-15302 Wordfence
8.8 High ARMember Premium Plugin armember PHP Object Injection < 7.6 Fixed in 7.6 CVE-2026-27060 Patchstack
7.5 High ARMember Premium Plugin SQL Injection Unauthenticated SQL Injection via 'order' Parameter No login needed ≤ 7.3.1 CVE-2026-5073 Wordfence
9.8 Critical ARMember Premium Plugin Privilege Escalation Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation No login needed ≤ 7.3.1 CVE-2026-5076 Wordfence
6.5 Medium ARMember Premium Plugin SQL Injection Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter ≤ 7.3.1 CVE-2026-5074 Wordfence
7.5 High ARMember Plugin armember-membership SQL Injection Unauthenticated SQL Injection via 'orderby' Parameter No login needed ≤ 4.0.60 CVE-2026-7649 Wordfence
4.3 Medium ARMember Plugin armember-membership Broken Access Control Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control ≤ 3.4.10 Fixed in 3.4.11 CVE-2022-47425 Patchstack
4.3 Medium ARMember Premium Plugin armember Broken Access Control ≤ 5.9.2 Fixed in 5.9.3 CVE-2023-39994 Patchstack
6.3 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Arbitrary Shortcode Execution Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.51 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 4.0.51 CVE-2024-10681 Wordfence
5.4 Medium ARMember Plugin armember-membership Cross-Site Request Forgery No login needed ≤ 4.0.5, < 6.7.1 Fixed in 4.0.6 CVE-2022-47424 Patchstack
6.4 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Scripting Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload ≤ 4.0.37 CVE-2024-7703 Wordfence
6.3 Medium ARMember Premium Plugin Cross-Site Request Forgery Cross-Site Request Forgery via multiple functions No login needed ≤ 6.7 CVE-2024-5596 Wordfence
8.3 High ARMember Plugin armember-membership Privilege Escalation Membership Plan Bypass ≤ 4.0.10 Fixed in 4.0.11 CVE-2023-47837 Patchstack
8.8 High ARMember Plugin armember-membership Privilege Escalation ≤ 4.0.10 Fixed in 4.0.11 CVE-2023-51356 Patchstack
6.1 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin Open Redirect Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect No login needed ≤ 4.0.30 CVE-2024-4133 Wordfence
9.1 Critical ARMember Plugin armember-membership Broken Access Control Membership Plugin plugin <= 4.0.28 - Broken Access Control No login needed ≤ 4.0.28 Fixed in 4.0.29 CVE-2024-32948 Patchstack
8.5 High ARMember Plugin armember-membership PHP Object Injection ≤ 4.0.26 Fixed in 4.0.27 CVE-2024-30222 Patchstack
9.0 Critical ARMember Plugin armember-membership PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 4.0.26 Fixed in 4.0.27 CVE-2024-30223 Patchstack
5.9 Medium ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Scripting ≤ 4.0.23 Fixed in 4.0.24 CVE-2024-27995 Patchstack
5.3 Medium ARMember Plugin armember-membership Broken Access Control Improper Access Control to Sensitive Information Exposure via REST API No login needed ≤ 4.0.24 CVE-2024-0969 Wordfence
9.6 Critical ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Request Forgery WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection No login needed ≤ 4.0.22 Fixed in 4.0.23 CVE-2023-52200 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only