WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 84 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.9 Medium File Manager Plugin wp-file-manager Information Disclosure Unauthenticated Database Backup Disclosure No login needed 7.2.2 – < 8.0.5 Fixed in 8.0.5 CVE-2026-19708 WPScan
5.3 Medium All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Other Unauthenticated Insufficient Credential Protection via Authorization Basic Header No login needed ≤ 7.110 CVE-2026-89064 Wordfence
5.5 Medium BackWPup Plugin backwpup Broken Access Control BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes 5.2.2 – < 5.7.5 Fixed in 5.7.5 CVE-2026-86815 WPScan
4.9 Medium WP BackItUp Community Edition Plugin wp-backitup Path Traversal Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter ≤ 2.1.0 CVE-2026-18386 Wordfence
5.5 Medium WPvivid Backup & Migration Plugin Arbitrary File Deletion Admin+ Arbitrary File Deletion via Path Traversal < 0.9.134 Fixed in 0.9.134 CVE-2026-82194 WPScan
5.5 Medium WPvivid Backup & Migration Plugin Path Traversal Admin+ File Write Outside the Backup Directory via Path Traversal 0.9.113 – < 0.9.134 Fixed in 0.9.134 CVE-2026-82193 WPScan
4.1 Medium WPvivid Backup & Migration Plugin SQL Injection Admin+ SQLi via Upload Cleaner Isolation < 0.9.133 Fixed in 0.9.133 CVE-2026-82182 WPScan
6.6 Medium WPvivid Backup & Migration Plugin Path Traversal Admin+ Arbitrary File Write via Zip Slip in Backup Restore < 0.9.133 Fixed in 0.9.133 CVE-2026-19722 WPScan
6.4 Medium All-in-One WP Migration Unlimited Extension Plugin Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter ≤ 2.84 CVE-2026-6128 Wordfence
5.9 Medium UpdraftPlus Plugin Cross-Site Request Forgery Backup Restoration via CSRF No login needed < 1.26.7 Fixed in 1.26.7 CVE-2026-76549 WPScan
4.4 Medium JetBackup Plugin backup Broken Access Control Admin+ Multisite Network Backup Download 3.1.18.8 – < 3.1.23.5 Fixed in 3.1.23.5 CVE-2026-19454 WPScan
6.5 Medium Backup Migration Plugin backup-backup Privilege Escalation Admin+ Privilege Escalation via Post-Restore Auto-Login < 2.1.7 Fixed in 2.1.7 CVE-2026-18216 WPScan
4.9 Medium WPvivid Plugin wpvivid-backuprestore SQL Injection Authenticated (Administrator+) SQL Injection via 'export_data' Parameter ≤ 0.9.131 CVE-2026-17555 Wordfence
5.3 Medium Demi Plugin demi-backup-migration Information Disclosure Unauthenticated Information Exposure to Arbitrary Directory Copy No login needed ≤ 0.0.8 CVE-2026-15012 Wordfence
6.5 Medium All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Path Traversal Unauthenticated Arbitrary-Location Log File Write via Path Traversal No login needed 7.87 – < 7.106 Fixed in 7.106 CVE-2026-12898 WPScan
6.5 Medium pCloud WP Backup Plugin pcloud-wp-backup Broken Access Control Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read ≤ 2.0.3 CVE-2026-14503 Wordfence
4.4 Medium WPvivid Backup for MainWP Plugin wpvivid-backup-mainwp Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 0.9.33 CVE-2026-15283 Wordfence
6.5 Medium Backup and Staging by WP Time Capsule Plugin wp-time-capsule Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function ≤ 1.22.26 CVE-2026-8996 Wordfence
6.5 Medium XCloner Plugin xcloner-backup-and-restore Information Disclosure Sensitive Data Exposure No login needed ≤ 4.8.6 Fixed in 4.8.7 CVE-2026-48965 Patchstack
6.6 Medium LearnPress – Backup & Migration Tool Plugin learnpress-import-export PHP Object Injection Backup & Migration Tool <= 4.1.4 - Authenticated (Administrator+) PHP Object Injection via WXR XML File Upload ≤ 4.1.4 CVE-2026-7566 Wordfence
6.2 Medium Backup Plugin Local File Inclusion WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion No login needed 2.3.9 CVE-2020-37246 VulnCheck
6.5 Medium All-in-One WP Migration Unlimited Extension Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download ≤ 2.83 CVE-2026-5753 Wordfence
5.3 Medium Total Upkeep Plugin boldgrid-backup Broken Access Control Missing Authorization to Unauthenticated Rollback Cancellation No login needed ≤ 1.17.1 CVE-2026-3143 Wordfence
4.9 Medium JetBackup Plugin backup Arbitrary File Deletion Authenticated (Administrator+) Arbitrary Directory Deletion via Path Traversal in 'fileName' Parameter ≤ 3.1.19.8 CVE-2026-4853 Wordfence
6.1 Medium Royal WordPress Backup & Restore Plugin royal-backup-reset Cross-Site Scripting Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter No login needed ≤ 1.0.16 CVE-2026-4305 Wordfence
5.3 Medium Backup Migration Plugin backup-backup Broken Access Control Missing Authorization to Unauthenticated Backup Upload to Offline Storage No login needed ≤ 2.0.0 CVE-2025-14944 Wordfence
4.4 Medium Keep Backup Daily Plugin keep-backup-daily Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title ≤ 2.1.2 CVE-2026-3577 Wordfence
5.3 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Information Disclosure animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup No login needed ≤ 12.8.3 CVE-2026-2589 Wordfence
6.5 Medium Everest Backup Plugin everest-backup Cross-Site Request Forgery No login needed ≤ 2.3.11 CVE-2025-62992 Patchstack
4.3 Medium Backup, Restore and Migrate your sites with XCloner Plugin xcloner-backup-and-restore Cross-Site Request Forgery Cross-Site Request Forgery in Xcloner_Remote_Storage:save() No login needed ≤ 4.8.2 CVE-2025-11759 Wordfence
5.4 Medium Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App Plugin Broken Access Control Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update ≤ 3.6.1 CVE-2025-12887 Wordfence
5.3 Medium Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin Broken Access Control WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure No login needed ≤ 2.3.8 CVE-2025-10304 Wordfence
5.9 Medium Backup Migration Plugin backup-backup Information Disclosure Unauthenticated Backup Download No login needed < 2.0.0 Fixed in 2.0.0 CVE-2025-12394 WPScan
6.5 Medium CYAN Backup Plugin cyan-backup Arbitrary File Deletion Authenticated (Admin+) Arbitrary File Deletion ≤ 2.5.4 CVE-2025-12092 Wordfence
6.5 Medium Backup and Move Plugin backup-and-move Broken Access Control ≤ 0.1 CVE-2025-53246 Patchstack
5.3 Medium Everest Backup Plugin everest-backup Broken Access Control No login needed ≤ 2.3.8 Fixed in 2.3.9 CVE-2025-62946 Patchstack
5.9 Medium Everest Backup Plugin everest-backup Broken Access Control Missing Authorization to Unauthenticated Information Exposure No login needed ≤ 2.3.5 CVE-2025-11380 Wordfence
5.9 Medium File Manager, Code editor, backup by Managefy Plugin softdiscover-db-file-manager Information Disclosure Unauthenticated Information Exposure No login needed ≤ 1.6.1 CVE-2025-10744 Wordfence
6.5 Medium Backuply – Backup, Restore, Migrate and Clone Plugin backuply Arbitrary File Deletion Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion ≤ 1.4.8 CVE-2025-10307 Wordfence
4.9 Medium File Manager, Code Editor, and Backup by Managefy Plugin softdiscover-db-file-manager Path Traversal Authenticated (Admin+) Path Traversal to Arbitrary File Download ≤ 1.4.8 CVE-2025-9345 Wordfence
4.3 Medium Backup Bolt Plugin backup-bolt Cross-Site Request Forgery No login needed ≤ 1.5.0 CVE-2025-49040 Patchstack
4.4 Medium All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Import ≤ 7.97 CVE-2025-8490 Wordfence
6.5 Medium DB Backup Plugin db-backup Broken Access Control ≤ 6.0 CVE-2025-50031 Patchstack
6.4 Medium EZ SQL Reports Shortcode Widget and DB Backup Plugin elisqlreports Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode ≤ 5.25.11 CVE-2025-6462 Wordfence
4.3 Medium Everest Backup Plugin everest-backup Cross-Site Request Forgery No login needed ≤ 2.3.3 Fixed in 2.3.4 CVE-2025-49238 Patchstack
5.4 Medium CYAN Backup Plugin cyan-backup Cross-Site Scripting Admin+ Stored XSS via Remote Storage Settings < 2.5.3 Fixed in 2.5.3 CVE-2024-9663 WPScan
5.4 Medium CYAN Backup Plugin cyan-backup Cross-Site Scripting Admin+ Stored XSS via General Settings < 2.5.3 Fixed in 2.5.3 CVE-2024-9662 WPScan
4.8 Medium Backup Database Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 4.9 CVE-2024-8702 WPScan
5.9 Medium Database Toolset Plugin database-toolset Information Disclosure Unauthenticated Sensitive Information Exposure via Backup Files No login needed ≤ 1.8.4 CVE-2025-4222 Wordfence
5.9 Medium WordPress Backup & Migration Plugin wp-migration-duplicator Information Disclosure Sensitive Data Exposure No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2025-24651 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only