WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–26 of 26 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Bit Form Plugin bit-form SQL Injection Authenticated (Administrator+) SQL Injection via 'filterText' Parameter ≤ 3.2.0 CVE-2026-16810 Wordfence
7.5 High Bit Form Plugin bit-form Cross-Site Scripting Unauthenticated Stored XSS via SVG Signature Upload No login needed < 3.2.0 Fixed in 3.2.0 CVE-2026-16573 WPScan
4.8 Medium Bit Form Plugin bit-form Cross-Site Scripting Admin+ Stored XSS via Conversational Form Progress Label < 3.1.4 Fixed in 3.1.4 CVE-2025-15669 WPScan
3.7 Low Bit Form Plugin bit-form Broken Access Control Unauthenticated Inactive Form Submission No login needed < 3.1.2 Fixed in 3.1.2 CVE-2026-15054 WPScan
6.5 Medium Bit Form Plugin bit-form Authentication Bypass Unauthenticated Workflow Trigger via Authentication Bypass No login needed < 3.1.0 Fixed in 3.1.0 CVE-2026-13694 WPScan
5.9 Medium Bit Form Plugin bit-form Path Traversal Unauthenticated Arbitrary File Read via Path Traversal No login needed < 3.1.0 Fixed in 3.1.0 CVE-2026-13693 WPScan
7.1 High Bit Form Plugin bit-form Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter ≤ 3.1.1 CVE-2026-14372 Wordfence
7.6 High Bit Form Plugin bit-form SQL Injection ≤ 2.21.10 Fixed in 2.21.11 CVE-2026-25418 Patchstack
6.5 Medium Bit Form – Contact Form Plugin bit-form Broken Access Control Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay No login needed ≤ 2.21.6 CVE-2025-14901 Wordfence
9.8 Critical Contact Form by Bit Form - Bit Form Plugin bit-form Arbitrary File Upload Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload No login needed ≤ 2.20.3 CVE-2025-6679 Wordfence
5.3 Medium Contact Form by Bit Form Plugin bit-form Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 2.17.5 CVE-2024-13451 Wordfence
4.9 Medium Contact Form by Bit Form Plugin bit-form Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.18.3 CVE-2025-2580 Wordfence
4.7 Medium Bit Form Plugin bit-form Open Redirect No login needed ≤ 2.18.0 Fixed in 2.18.1 CVE-2025-30885 Patchstack
3.8 Low Contact Form by Bit Form Plugin bit-form Server-Side Request Forgery Authenticated (Administrator+) Server-Side Request Forgery ≤ 2.17.4 CVE-2024-13450 Wordfence
4.3 Medium Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Broken Access Control Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure ≤ 2.17.3 CVE-2024-12190 Wordfence
4.9 Medium Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Path Traversal Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read ≤ 2.15.2 CVE-2024-9507 Wordfence
7.6 High Bit Form Plugin bit-form SQL Injection ≤ 2.13.11 Fixed in 2.13.12 CVE-2024-47335 Patchstack
7.1 High Bit Form Plugin bit-form Cross-Site Scripting No login needed ≤ 2.13.10 Fixed in 2.13.11 CVE-2024-47301 Patchstack
8.0 High Bit Form Plugin bit-form Arbitrary File Upload ≤ 2.13.10 Fixed in 2.13.11 CVE-2024-47319 Patchstack
8.7 High Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Arbitrary File Deletion Authenticater (Administrator+) Arbitrary File Deletion 2.0 – 2.13.4 CVE-2024-7782 Wordfence
7.2 High Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form SQL Injection Authenticated (Administrator+) SQL Injection 2.0 – 2.13.9 CVE-2024-7780 Wordfence
9.0 Critical Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Path Traversal Authenticated (Administrator+) Arbitrary File Read And Deletion 2.0 – 2.13.9 CVE-2024-7777 Wordfence
5.5 Medium Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Arbitrary File Upload Authenticated (Administrator+) Arbitrary JavaScript File Uploads 2.0 – 2.13.9 CVE-2024-7775 Wordfence
7.2 High Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form SQL Injection Authenticated (Administrator+) SQL Injection via getLogHistory Function 2.0 – 2.13.9 CVE-2024-7702 Wordfence
7.2 High Bit Form Plugin bit-form Arbitrary File Upload Authenticated (Administrator+) Arbitrary File Upload ≤ 2.13.3 CVE-2024-6123 Wordfence
5.3 Medium Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form Plugin bit-form Broken Access Control Unauthenticated Insecure Direct Object Reference to Form Submission Alteration No login needed ≤ 2.10.1 CVE-2024-1640 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only