WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 79 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin	Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF No login needed	`< 1.2.2` Fixed in `1.2.2`	Sep 12, 2026	`CVE-2026-84024`	WPScan
6.5 Medium	BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin	Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF No login needed	`< 1.2.2` Fixed in `1.2.2`	Sep 12, 2026	`CVE-2026-84023`	WPScan
6.4 Medium	Media Library Assistant Plugin `media-library-assistant`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import	`≤ 3.35`	Sep 11, 2026	`CVE-2026-6642`	Wordfence
4.3 Medium	Dokan Plugin	Broken Access Control Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint	`< 5.0.9` Fixed in `5.0.9`	Aug 3, 2026	`CVE-2026-16564`	WPScan
5.3 Medium	Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder Plugin `gutena-forms`	Broken Access Control Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action() No login needed	`≤ 1.9.0`	Aug 1, 2026	`CVE-2026-11995`	Wordfence
4.3 Medium	Cookie Banner for GDPR / CCPA – WPLP Cookie Consent Plugin `gdpr-cookie-consent`	Cross-Site Request Forgery WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries No login needed	`≤ 4.3.7`	Jul 28, 2026	`CVE-2026-15136`	Wordfence
6.4 Medium	Bulk Page Generator Plugin `lpagery`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title	`≤ 2.5.7`	Jul 23, 2026	`CVE-2026-15404`	Wordfence
4.9 Medium	WP Bulk Delete Plugin `wp-bulk-delete`	SQL Injection Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter	`≤ 1.4.2`	Jul 16, 2026	`CVE-2026-15727`	Wordfence
4.9 Medium	WooCommerce Bulk Edit Products – WP Sheet Editor Plugin `woo-bulk-edit-products`	Broken Access Control WP Sheet Editor plugin <= 1.8.21 - Broken Access Control	`≤ 1.8.21` Fixed in `1.8.22`	Jul 13, 2026	`CVE-2026-61952`	Patchstack
4.3 Medium	Easy Appointments Plugin `easy-appointments`	Broken Access Control Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation	`≤ 3.12.27`	Jul 10, 2026	`CVE-2026-11992`	Wordfence
5.3 Medium	Bulk Order Update for WooCommerce Plugin `bulk-order-update-for-woocommerce`	Path Traversal Unauthenticated Arbitrary File Read via 'csv_url' Parameter No login needed	`≤ 1.6`	Jul 8, 2026	`CVE-2026-14500`	Wordfence
4.3 Medium	Bulk SEO Image Plugin `bulk-seo-image`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed	`≤ 1.1`	Jun 24, 2026	`CVE-2026-11997`	Wordfence
6.4 Medium	Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) Plugin `auto-image-attributes-from-filename-with-bulk-updater`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute	`≤ 4.9`	Jun 2, 2026	`CVE-2026-3722`	Wordfence
5.3 Medium	Appointment Booking Calendar Plugin `simply-schedule-appointments`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint No login needed	`≤ 1.6.11.8`	May 28, 2026	`CVE-2026-6937`	Wordfence
4.3 Medium	BEAR Plugin `woo-bulk-editor`	Cross-Site Request Forgery No login needed	`≤ 1.1.5` Fixed in `1.1.6`	May 7, 2026	`CVE-2026-27415`	Patchstack
6.5 Medium	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Plugin `woo-bulk-editor`	Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification No login needed	`≤ 1.1.5`	Apr 8, 2026	`CVE-2026-1672`	Wordfence
4.3 Medium	BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Plugin `woo-bulk-editor`	Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion No login needed	`≤ 1.1.5`	Apr 8, 2026	`CVE-2026-1673`	Wordfence
6.5 Medium	Astra Bulk Edit Plugin `astra-bulk-edit`	Cross-Site Scripting	`≤ 1.2.10` Fixed in `1.2.11`	Mar 13, 2026	`CVE-2026-32431`	Patchstack
4.3 Medium	Set Bulk Post Categories Plugin `set-bulk-post-categories`	Cross-Site Request Forgery Cross-Site Request Forgery to Bulk Post Category Update No login needed	`≤ 1.1`	Jan 24, 2026	`CVE-2026-1081`	Wordfence
4.3 Medium	Wordpress Movies Bulk Importer Plugin `movies`	Cross-Site Request Forgery No login needed	`≤ <= 1.0`	Jan 22, 2026	`CVE-2026-22359`	Patchstack
6.4 Medium	BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce Plugin `bulk-image-alt-text-with-yoast`	Cross-Site Scripting Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 2.2.1`	Jan 9, 2026	`CVE-2025-15019`	Wordfence
5.4 Medium	Bulk Landing Page Creator for WordPress LPagery Plugin `lpagery`	Broken Access Control	`≤ 2.4.9` Fixed in `2.4.10`	Jan 8, 2026	`CVE-2026-22490`	Patchstack
4.3 Medium	My Sticky Elements Plugin `mystickyelements`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Bulk Lead Deletion	`≤ 2.3.3`	Jan 1, 2026	`CVE-2025-14428`	Wordfence
6.5 Medium	Pro Bulk Watermark Plugin `pro-watermark`	Path Traversal	`≤ 2.0`	Dec 31, 2025	`CVE-2025-28973`	Patchstack
4.3 Medium	Download Plugins and Themes from Dashboard Plugin `download-plugins-dashboard`	Cross-Site Request Forgery Cross-Site Request Forgery to Bulk Plugin/Theme Archival No login needed	`≤ 1.9.6`	Dec 17, 2025	`CVE-2025-14399`	Wordfence
4.3 Medium	Image Optimizer by wps.sk Plugin `image-optimizer-wpssk`	Cross-Site Request Forgery Cross-Site Request Forgery to Bulk Image Optimization No login needed	`≤ 1.2.0`	Dec 5, 2025	`CVE-2025-12190`	Wordfence
4.3 Medium	Photo Gallery by Ays Plugin `gallery-photo-gallery`	Cross-Site Request Forgery Cross-Site Request Forgery to Bulk Actions No login needed	`≤ 6.4.8`	Dec 2, 2025	`CVE-2025-13685`	Wordfence
4.3 Medium	Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images Plugin	Broken Access Control Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion	`≤ 1.8.3`	Nov 12, 2025	`CVE-2025-12113`	Wordfence
6.5 Medium	Bulk Auto Image Title Attribute Plugin `bulk-image-title-attribute`	Cross-Site Scripting	`≤ 2.0.1`	Oct 27, 2025	`CVE-2025-62921`	Patchstack
4.3 Medium	Pro Bulk Watermark Plugin `pro-watermark`	Path Traversal	`≤ 2.0`	Aug 30, 2025	`CVE-2025-4956`	Patchstack
4.3 Medium	WP Bulk Delete Plugin `wp-bulk-delete`	Broken Access Control	`≤ 1.3.6` Fixed in `1.3.7`	Aug 27, 2025	`CVE-2025-58192`	Patchstack
5.5 Medium	Featured Image Plus – Quick & Bulk Edit with Unsplash Plugin `featured-image-plus`	Server-Side Request Forgery Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery	`≤ 1.6.6`	Jul 23, 2025	`CVE-2025-5818`	Wordfence
4.3 Medium	Custom Bulk/Quick Edit Plugin `custom-bulkquick-edit`	Cross-Site Request Forgery No login needed	`≤ 1.6.10`	Jun 6, 2025	`CVE-2025-30946`	Patchstack
5.3 Medium	Bulk Theme `bulk`	Broken Access Control No login needed	`≤ 1.0.11`	May 19, 2025	`CVE-2025-26867`	Patchstack
6.5 Medium	GDPR Cookie Consent Plugin	Cross-Site Request Forgery Bulk Delete via CSRF No login needed	`< 2.6.1` Fixed in `2.6.1`	May 15, 2025	`CVE-2024-8286`	WPScan
4.3 Medium	Bulk Featured Image Plugin `bulk-featured-image`	Broken Access Control	`≤ 1.2.4`	May 7, 2025	`CVE-2025-47591`	Patchstack
5.4 Medium	PW WooCommerce Bulk Edit Plugin `pw-bulk-edit`	Cross-Site Request Forgery No login needed	`≤ 2.134` Fixed in `2.135`	May 7, 2025	`CVE-2025-47473`	Patchstack
5.3 Medium	Bulk Assign Linked Products For WooCommerce Plugin `wc-bulk-assign-linked-products`	Broken Access Control No login needed	`≤ 2.1`	Apr 24, 2025	`CVE-2025-46489`	Patchstack
6.5 Medium	ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes Plugin `elex-bulk-edit-products-prices-attributes-for-woocommerce-basic`	SQL Injection Authenticated (Subscriber+) SQL Injection	`≤ 1.4.9`	Apr 24, 2025	`CVE-2025-3280`	Wordfence
4.3 Medium	Bulk Term Editor Plugin `bulk-term-editor`	Cross-Site Request Forgery No login needed	`≤ 1.1.4`	Apr 16, 2025	`CVE-2025-39512`	Patchstack
4.3 Medium	Bulk Product Sync Plugin `sync-wc-google`	Cross-Site Request Forgery No login needed	`≤ 8.6` Fixed in `9.0`	Apr 1, 2025	`CVE-2025-31852`	Patchstack
4.3 Medium	Bulk Fields Editor Plugin `bulk-user-editor`	Broken Access Control	`≤ 1.8.0`	Apr 1, 2025	`CVE-2025-31752`	Patchstack
6.5 Medium	Quantity Dynamic Pricing & Bulk Discounts for WooCommerce Plugin `wholesale-pricing-woocommerce`	Cross-Site Scripting Stored Cross Site Scripting (XSS)	`≤ 4.0.3` Fixed in `4.0.4`	Mar 31, 2025	`CVE-2025-31598`	Patchstack
4.3 Medium	WP Bulk Post Duplicator Plugin `wp-bulk-post-duplicator`	Cross-Site Request Forgery No login needed	`≤ 1.2`	Mar 11, 2025	`CVE-2025-28884`	Patchstack
4.3 Medium	easy-broken-link-checker Plugin	Cross-Site Request Forgery Bulk Actions via CSRF	`≤ 9.0.2`	Mar 9, 2025	`CVE-2025-1362`	WPScan
4.3 Medium	Bulk Content Creator Plugin `bulk-content-creator`	Cross-Site Request Forgery No login needed	`≤ 1.2.1`	Feb 24, 2025	`CVE-2025-27311`	Patchstack
5.9 Medium	BEAR Plugin `woo-bulk-editor`	Cross-Site Scripting	`≤ 1.1.4.4` Fixed in `1.1.4.5`	Feb 17, 2025	`CVE-2025-26775`	Patchstack
4.3 Medium	Bulk Me Now Plugin	Cross-Site Request Forgery Message Deletion via CSRF No login needed	`≤ 2.0`	Jan 30, 2025	`CVE-2024-12709`	WPScan
4.3 Medium	WP Customer Area Plugin `customer-area`	Cross-Site Request Forgery Bulk Delete via CSRF No login needed	`≤ 8.2.4`	Jan 27, 2025	`CVE-2024-12436`	WPScan
6.5 Medium	SEO Bulk Editor Plugin `seo-bulk-editor`	Cross-Site Scripting	`≤ 1.1.0`	Jan 15, 2025	`CVE-2025-22587`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.