WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 184 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
10.0 Critical BackupSheep Plugin Arbitrary File Deletion Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key No login needed ≤ 1.8 CVE-2026-101148 WPScan
7.5 High BackupEase Plugin backupease Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2.2 Fixed in 2.2.3 CVE-2026-97241 Patchstack
7.5 High StifLi Backup Tools Plugin stifli-backup-tools Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2.7 Fixed in 2.2.8 CVE-2026-97240 Patchstack
7.5 High WordPress Backup & Migration Plugin wp-migration-duplicator Broken Access Control No login needed ≤ 1.6.0 Fixed in 1.6.1 CVE-2026-97197 Patchstack
5.9 Medium File Manager Plugin wp-file-manager Information Disclosure Unauthenticated Database Backup Disclosure No login needed 7.2.2 – < 8.0.5 Fixed in 8.0.5 CVE-2026-19708 WPScan
7.2 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Privilege Escalation Authenticated Privilege Escalation to Admin via Import Secret Key Disclosure < 7.111 Fixed in 7.111 CVE-2026-81810 WPScan
5.3 Medium All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Other Unauthenticated Insufficient Credential Protection via Authorization Basic Header No login needed ≤ 7.110 CVE-2026-89064 Wordfence
9.6 Critical WebTotem Backups Plugin wt-backups Arbitrary File Deletion Subscriber+ Arbitrary File Deletion via Path Traversal < 1.1.0 Fixed in 1.1.0 CVE-2026-77006 WPScan
5.5 Medium BackWPup Plugin backwpup Broken Access Control BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes 5.2.2 – < 5.7.5 Fixed in 5.7.5 CVE-2026-86815 WPScan
7.5 High ZHBackup – Backup, Restore & Migration Plugin zhbackup Information Disclosure Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure No login needed ≤ 2.4.2 Fixed in 2.4.3 CVE-2026-81804 Patchstack
4.9 Medium WP BackItUp Community Edition Plugin wp-backitup Path Traversal Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter ≤ 2.1.0 CVE-2026-18386 Wordfence
5.5 Medium WPvivid Backup & Migration Plugin Arbitrary File Deletion Admin+ Arbitrary File Deletion via Path Traversal < 0.9.134 Fixed in 0.9.134 CVE-2026-82194 WPScan
5.5 Medium WPvivid Backup & Migration Plugin Path Traversal Admin+ File Write Outside the Backup Directory via Path Traversal 0.9.113 – < 0.9.134 Fixed in 0.9.134 CVE-2026-82193 WPScan
4.1 Medium WPvivid Backup & Migration Plugin SQL Injection Admin+ SQLi via Upload Cleaner Isolation < 0.9.133 Fixed in 0.9.133 CVE-2026-82182 WPScan
7.1 High JetBackup Plugin backup Privilege Escalation Subscriber+ Privilege Escalation via Restore Admin User Selection 3.1.7.9 – < 3.1.23.5 Fixed in 3.1.23.5 CVE-2026-19453 WPScan
7.5 High Keep Backup Daily Plugin keep-backup-daily Information Disclosure Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process No login needed < 2.1.4 Fixed in 2.1.4 CVE-2026-75133 VulnCheck
6.6 Medium WPvivid Backup & Migration Plugin Path Traversal Admin+ Arbitrary File Write via Zip Slip in Backup Restore < 0.9.133 Fixed in 0.9.133 CVE-2026-19722 WPScan
6.4 Medium All-in-One WP Migration Unlimited Extension Plugin Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter ≤ 2.84 CVE-2026-6128 Wordfence
5.9 Medium UpdraftPlus Plugin Cross-Site Request Forgery Backup Restoration via CSRF No login needed < 1.26.7 Fixed in 1.26.7 CVE-2026-76549 WPScan
4.4 Medium JetBackup Plugin backup Broken Access Control Admin+ Multisite Network Backup Download 3.1.18.8 – < 3.1.23.5 Fixed in 3.1.23.5 CVE-2026-19454 WPScan
8.8 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration SQL Injection Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution ≤ 7.109 CVE-2026-19949 Wordfence
9.1 Critical WPvivid Backup & Migration Plugin Path Traversal Unauthenticated Path Traversal via send_to_site_connect No login needed < 0.9.131 Fixed in 0.9.131 CVE-2026-19725 WPScan
7.2 High All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Remote Code Execution Multisite Subsite Admin+ Network-Wide PHP Code Execution via REST Import < 7.108 Fixed in 7.108 CVE-2026-17533 WPScan
6.5 Medium Backup Migration Plugin backup-backup Privilege Escalation Admin+ Privilege Escalation via Post-Restore Auto-Login < 2.1.7 Fixed in 2.1.7 CVE-2026-18216 WPScan
9.3 Critical Everest Backup Plugin everest-backup SQL Injection No login needed ≤ 2.3.12 CVE-2026-66472 Patchstack
7.5 High Total Upkeep Plugin boldgrid-backup Information Disclosure Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret No login needed < 1.17.3 Fixed in 1.17.3 CVE-2026-16253 WPScan
8.2 High Total Upkeep Plugin boldgrid-backup Broken Access Control No login needed ≤ 1.17.2 Fixed in 1.17.3 CVE-2026-66708 Patchstack
7.2 High Backup Migration Plugin backup-backup Remote Code Execution Authenticated (Administrator+) OS Command Injection via 'file' Parameter ≤ 2.1.1 CVE-2026-7693 Wordfence
4.9 Medium WPvivid Plugin wpvivid-backuprestore SQL Injection Authenticated (Administrator+) SQL Injection via 'export_data' Parameter ≤ 0.9.131 CVE-2026-17555 Wordfence
7.5 High Demi - One Click Demo Import, Backup & Site Migration Plugin Information Disclosure One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory No login needed < 0.0.7 Fixed in 0.0.7 CVE-2026-14333 WPScan
5.3 Medium Demi Plugin demi-backup-migration Information Disclosure Unauthenticated Information Exposure to Arbitrary Directory Copy No login needed ≤ 0.0.8 CVE-2026-15012 Wordfence
7.5 High Demi Plugin demi-backup-migration Arbitrary File Deletion Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action No login needed ≤ 0.0.7 CVE-2026-14490 Wordfence
8.1 High WP Foodbakery Plugin Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action ≤ 4.9 CVE-2026-15802 Wordfence
6.5 Medium All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Path Traversal Unauthenticated Arbitrary-Location Log File Write via Path Traversal No login needed 7.87 – < 7.106 Fixed in 7.106 CVE-2026-12898 WPScan
6.5 Medium pCloud WP Backup Plugin pcloud-wp-backup Broken Access Control Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read ≤ 2.0.3 CVE-2026-14503 Wordfence
4.4 Medium WPvivid Backup for MainWP Plugin wpvivid-backup-mainwp Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 0.9.33 CVE-2026-15283 Wordfence
6.5 Medium Backup and Staging by WP Time Capsule Plugin wp-time-capsule Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function ≤ 1.22.26 CVE-2026-8996 Wordfence
7.1 High pCloud WP Backup Plugin pcloud-wp-backup Cross-Site Request Forgery No login needed ≤ 2.0.2 CVE-2026-57757 Patchstack
7.2 High WP Database Backup Plugin wp-database-backup Remote Code Execution Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter ≤ 7.11 CVE-2026-9834 Wordfence
7.5 High Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups Plugin trinity-backup Information Disclosure Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure No login needed ≤ 2.0.9 Fixed in 2.0.10 CVE-2026-54839 Patchstack
6.5 Medium XCloner Plugin xcloner-backup-and-restore Information Disclosure Sensitive Data Exposure No login needed ≤ 4.8.6 Fixed in 4.8.7 CVE-2026-48965 Patchstack
7.5 High Backup Migration Plugin backup-backup Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.1 Fixed in 2.1.2 CVE-2026-39480 Patchstack
8.1 High UpdraftPlus: WP Backup & Migration Plugin updraftplus Authentication Bypass Unauthenticated Authentication Bypass via UpdraftCentral udrpc No login needed ≤ 1.26.4 CVE-2026-10795 Wordfence
6.6 Medium LearnPress – Backup & Migration Tool Plugin learnpress-import-export PHP Object Injection Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload ≤ 4.1.4 CVE-2026-7566 Wordfence
3.8 Low Migration, Backup, Staging – WPvivid Backup & Migration Plugin wpvivid-backuprestore Arbitrary File Deletion WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion ≤ 0.9.128 CVE-2025-12656 Wordfence
7.5 High Backup and Staging by WP Time Capsule Plugin wp-time-capsule Authentication Bypass Broken Authentication No login needed ≤ 1.22.25 Fixed in 1.22.26 CVE-2026-42760 Patchstack
8.8 High Backup and Restore Plugin backup-and-restore-for-wp Arbitrary File Deletion WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion 1.0.3 CVE-2021-47979 VulnCheck
6.2 Medium Backup Plugin Local File Inclusion WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion No login needed 2.3.9 CVE-2020-37246 VulnCheck
8.1 High Database Backup Plugin wp-db-backup Broken Access Control Missing Authorization to Unauthenticated Arbitrary File Read and Deletion No login needed ≤ 2.5.2 CVE-2026-4030 Wordfence
7.5 High Database Backup Plugin wp-db-backup Broken Access Control Missing Authorization to Unauthenticated Database Export No login needed ≤ 2.5.2 CVE-2026-4029 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only