WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 217 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons Plugin `social-icons-widget-by-wpzoom`	Information Disclosure Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`… No login needed	`≤ 4.7.3`	Oct 3, 2026	`CVE-2026-100149`	Wordfence
5.3 Medium	Easy PayPal & Stripe Buy Now Button Plugin `wp-ecommerce-paypal`	Price Manipulation Unauthenticated Payment Amount Manipulation via Client-Supplied Price No login needed	`1.8 – < 2.0.6` Fixed in `2.0.6`	Oct 2, 2026	`CVE-2026-90987`	WPScan
5.3 Medium	Request a Quote Plugin `get-a-quote-button-for-woocommerce`	Information Disclosure Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum No login needed	`≤ 2.5.6`	Oct 2, 2026	`CVE-2026-90988`	WPScan
6.1 Medium	Social Media Share Buttons & Social Sharing Icons Plugin `ultimate-social-media-icons`	Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via URL No login needed	`≤ 3.0.1`	Oct 1, 2026	`CVE-2026-89047`	Wordfence
6.8 Medium	Happy Addons for Elementor Plugin	Cross-Site Scripting Contributor+ Stored XSS via Creative Button Widget	`< 3.50.0` Fixed in `3.50.0`	Sep 23, 2026	`CVE-2026-85006`	WPScan
6.4 Medium	Custom Twitter Feeds Plugin `custom-twitter-feeds`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute	`≤ 2.8.0`	Sep 18, 2026	`CVE-2026-84909`	Wordfence
4.3 Medium	Foxtool All-in-One: Contact chat button, Custom login, Media optimize images Plugin `foxtool`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action	`≤ 2.5.3`	Sep 18, 2026	`CVE-2026-18317`	Wordfence
6.8 Medium	All Bootstrap Blocks Plugin	Cross-Site Scripting Contributor+ Stored XSS via areoi/button type Attribute	`≤ 1.3.31`	Sep 18, 2026	`CVE-2026-88993`	WPScan
6.4 Medium	Advanced Popups Plugin `advanced-popups`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field	`≤ 1.2.3`	Sep 16, 2026	`CVE-2026-11996`	Wordfence
6.4 Medium	Job Postings Plugin `job-postings`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter	`≤ 2.8.1`	Sep 15, 2026	`CVE-2026-18063`	Wordfence
6.1 Medium	Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button Plugin `chaty`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 3.5.9`	Sep 11, 2026	`CVE-2026-18964`	Wordfence
6.8 Medium	Bold Page Builder Plugin `bold-page-builder`	Cross-Site Scripting Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL	`< 5.9.8` Fixed in `5.9.8`	Sep 5, 2026	`CVE-2026-84021`	WPScan
6.8 Medium	Social Media Share Buttons & Social Sharing Icons Plugin `ultimate-social-media-icons`	Cross-Site Scripting Contributor+ Stored XSS via Post Title	`< 3.0.1` Fixed in `3.0.1`	Sep 2, 2026	`CVE-2026-19719`	WPScan
6.4 Medium	Beaver Builder Page Builder Plugin `beaver-builder-lite-version`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter	`≤ 2.10.2.2`	Aug 15, 2026	`CVE-2026-17090`	Wordfence
5.3 Medium	Payment Button for PayPal Plugin `wp-paypal`	Price Manipulation Unauthenticated Payment Price Manipulation No login needed	`≤ 1.2.3.44`	Aug 12, 2026	`CVE-2026-16990`	WPScan
6.1 Medium	Blog Floating Button Plugin `blog-floating-button`	Cross-Site Scripting Unauthenticated Stored XSS via User-Agent Header No login needed	`≤ 1.4.20`	Aug 3, 2026	`CVE-2026-15383`	WPScan
6.6 Medium	Payment forms, Buy now buttons, and Invoicing System \| GetPaid Plugin `invoicing`	Local File Inclusion Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field	`≤ 2.8.56`	Aug 1, 2026	`CVE-2026-17605`	Wordfence
6.1 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Cross-Site Scripting Contributor+ Stored XSS via ult_buttons Shortcode No login needed	`< 3.21.5` Fixed in `3.21.5`	Jul 31, 2026	`CVE-2026-14921`	WPScan
6.5 Medium	Improved Save Button Plugin `improved-save-button`	SQL Injection Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter	`≤ 1.2.1`	Jul 30, 2026	`CVE-2026-16092`	Wordfence
6.4 Medium	The Plus Addons for Elementor Plugin `the-plus-addons-for-elementor-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	`≤ 6.4.11`	Jul 10, 2026	`CVE-2026-15285`	Wordfence
6.1 Medium	MaxButtons Plugin `maxbuttons`	Cross-Site Scripting Reflected Cross-Site Scripting via 'view' Parameter No login needed	`≤ 9.8.5`	Jun 27, 2026	`CVE-2026-13245`	Wordfence
5.4 Medium	Forget About Shortcode Buttons Plugin `forget-about-shortcode-buttons`	Broken Access Control	`≤ 2.1.3`	Jun 26, 2026	`CVE-2025-63041`	Patchstack
4.3 Medium	Social Media & Share Icons Plugin `ultimate-social-media-icons`	Broken Access Control No login needed	`≤ 2.8.6` Fixed in `2.8.7`	Jun 17, 2026	`CVE-2024-31435`	Patchstack
6.4 Medium	Bold Page Builder Plugin `bold-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode	`≤ 5.6.8`	May 14, 2026	`CVE-2026-3694`	Wordfence
6.4 Medium	Royal Addons for Elementor Plugin `royal-elementor-addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter	`≤ 1.7.1056`	May 5, 2026	`CVE-2026-5159`	Wordfence
6.4 Medium	ShopLentor Plugin `woolentor-addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute	`≤ 3.3.5`	Apr 14, 2026	`CVE-2026-4059`	Wordfence
6.4 Medium	Page Builder: Pagelayer Plugin `pagelayer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes	`≤ 2.0.8`	Apr 8, 2026	`CVE-2026-2509`	Wordfence
6.4 Medium	WP Random Button Plugin `wp-random-button`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute	`≤ 1.0`	Mar 21, 2026	`CVE-2026-4086`	Wordfence
4.3 Medium	Purchase Button For Affiliate Link Plugin `purchase-button`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed	`≤ 1.0.2`	Mar 7, 2026	`CVE-2026-1073`	Wordfence
6.4 Medium	Electric Enquiries Plugin `electric-enquiries`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute	`≤ 1.1`	Feb 27, 2026	`CVE-2025-14142`	Wordfence
4.3 Medium	Bitcoin Donate Button Plugin `bitcoin-donate-button`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed	`≤ 1.0`	Jan 28, 2026	`CVE-2026-1380`	Wordfence
5.3 Medium	Payment Button for PayPal Plugin `wp-paypal`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Order Creation No login needed	`≤ 1.2.3.41`	Jan 17, 2026	`CVE-2025-14463`	Wordfence
4.3 Medium	Sosh Share Buttons Plugin `sosh-share-buttons`	Cross-Site Request Forgery No login needed	`≤ 1.1.0`	Jan 14, 2026	`CVE-2025-15377`	Wordfence
4.3 Medium	Sticky Action Buttons Plugin `sticky-action-buttons`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed	`≤ 1.1`	Jan 7, 2026	`CVE-2025-14465`	Wordfence
6.4 Medium	Viitor Button Shortcodes Plugin `viitor-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute	`≤ 3.0.0`	Jan 7, 2026	`CVE-2025-14113`	Wordfence
6.4 Medium	WishSuite Plugin `wishsuite`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute	`≤ 1.5.1`	Dec 21, 2025	`CVE-2025-13838`	Wordfence
5.4 Medium	Buttoner for Elementor Plugin `buttoner-elementor`	Broken Access Control Settings Change	`≤ 1.0.6`	Dec 16, 2025	`CVE-2025-68085`	Patchstack
4.3 Medium	Foxtool All-in-One: Contact chat button, Custom login, Media optimize images Plugin `foxtool`	Cross-Site Request Forgery Cross-Site Request Forgery to Google OAuth Connection No login needed	`≤ 2.5.2`	Dec 12, 2025	`CVE-2025-13408`	Wordfence
6.4 Medium	CSS3 Buttons Plugin `css3-buttons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.1`	Dec 6, 2025	`CVE-2025-13907`	Wordfence
6.4 Medium	Ultra Skype Button Plugin `ultra-skype-button`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute	`≤ 1.0`	Dec 6, 2025	`CVE-2025-13898`	Wordfence
6.4 Medium	Save as PDF Button Plugin `save-as-pdf`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode	`≤ 1.9.2`	Nov 13, 2025	`CVE-2025-8397`	Wordfence
5.3 Medium	Download Counter Button Plugin	Path Traversal Unauthenticated Arbitrary File Download No login needed	`≤ 1.8.6.7`	Nov 5, 2025	`CVE-2025-11072`	WPScan
4.3 Medium	Call Now Button Plugin `call-now-button`	Broken Access Control Authenticated (Subscriber+) Missing Authorization to Multiple Functions	`≤ 1.5.4`	Oct 29, 2025	`CVE-2025-11632`	Wordfence
4.3 Medium	Call Now Button Plugin `call-now-button`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Settings Update	`≤ 1.5.3`	Oct 29, 2025	`CVE-2025-11587`	Wordfence
5.9 Medium	WeShare Buttons Plugin `e-mailit`	Cross-Site Scripting	`≤ 13.0.0`	Oct 22, 2025	`CVE-2025-60135`	Patchstack
6.4 Medium	Print Button Shortcode Plugin `print-button-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 1.0.1`	Oct 22, 2025	`CVE-2025-11810`	Wordfence
6.4 Medium	Shortcode Button Plugin `shortcode-button`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 1.1.9`	Oct 15, 2025	`CVE-2025-10194`	Wordfence
5.3 Medium	WhyDonate – FREE Donate button – Crowdfunding – Fundraising Plugin `wp-whydonate`	Broken Access Control FREE Donate button – Crowdfunding – Fundraising <= 4.0.15 - Missing Authorization to Unauthenticated wp_wdplugin_style Rww Deletion No login needed	`≤ 4.0.15`	Oct 15, 2025	`CVE-2025-10186`	Wordfence
6.4 Medium	Epic Bootstrap Buttons Plugin `epic-bootstrap-buttons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter	`≤ 1.0`	Oct 3, 2025	`CVE-2025-8776`	Wordfence
5.9 Medium	MWW Disclaimer Buttons Plugin `mww-disclaimer-buttons`	Cross-Site Scripting	`≤ 3.41` Fixed in `3.5`	Sep 26, 2025	`CVE-2025-60154`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.