WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 378 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.1 Critical VikAppointments Services Booking Calendar Plugin vikappointments Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter No login needed ≤ 1.2.21 CVE-2026-87115 Wordfence
3.7 Low Booking Calendar Plugin booking Other Race Condition No login needed ≤ 11.8.4 Fixed in 11.9 CVE-2026-39601 Patchstack
6.5 Medium The Events Calendar Plugin the-events-calendar Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter No login needed 6.12.0 – < 6.17.5.1 Fixed in 6.17.5.1 CVE-2026-84740 WPScan
7.2 High Appointment Hour Booking Plugin appointment-hour-booking Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer No login needed ≤ 1.5.97 CVE-2026-96573 Wordfence
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control ≤ 6.17.5 Fixed in 6.17.5.1 CVE-2026-97285 Patchstack
7.5 High Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Broken Access Control No login needed ≤ 4.6.0 Fixed in 4.6.3 CVE-2026-95513 Patchstack
3.8 Low The Events Calendar Plugin the-events-calendar Broken Access Control Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes 6.15.16.1 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84743 WPScan
2.7 Low The Events Calendar Plugin the-events-calendar Broken Access Control Contributor+ Content Publication via TEC V1 REST API 6.15.0 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84742 WPScan
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Unauthenticated Non-Public Venue and Organizer Disclosure via REST API No login needed 4.5 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84741 WPScan
6.1 Medium Booking Calendar Plugin booking Cross-Site Scripting Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter No login needed ≤ 11.8.3 CVE-2026-93655 Wordfence
6.1 Medium Booking Calendar Plugin booking Cross-Site Scripting Reflected Cross-Site Scripting via 'options' Parameter No login needed ≤ 11.8.2 CVE-2026-92561 Wordfence
7.2 High Booking Calendar Plugin booking Privilege Escalation Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter ≤ 11.8.2 CVE-2026-92619 Wordfence
5.3 Medium Booking for Appointments and Events Calendar - Amelia Plugin Broken Access Control Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass No login needed ≤ 2.4.5 CVE-2026-16582 Wordfence
5.4 Medium Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Broken Access Control Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover ≤ 2.4.4 CVE-2026-14311 Wordfence
5.3 Medium Booking Calendar Plugin booking Broken Access Control No login needed ≤ 11.7 Fixed in 11.8 CVE-2026-74002 Patchstack
5.4 Medium Blog2Social Plugin blog2social Broken Access Control Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post < 9.1.0 Fixed in 9.1.0 CVE-2026-89031 VulnCheck
7.5 High Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Plugin wp-event-solution Privilege Escalation Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter ≤ 4.1.23 CVE-2026-75983 Wordfence
6.4 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter ≤ 2.4.9 CVE-2026-10148 Wordfence
9.8 Critical The Events Calendar Plugin the-events-calendar Remote Code Execution Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation No login needed ≤ 6.17.3 CVE-2026-78159 Wordfence
9.8 Critical The Events Calendar Plugin the-events-calendar PHP Object Injection Unauthenticated PHP Object Injection to Remote Code Execution No login needed ≤ 6.17.4 CVE-2026-78006 Wordfence
5.3 Medium Booktics – Booking Calendar for Appointments and Service Businesses Plugin booktics Broken Access Control Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization No login needed ≤ 1.0.23 CVE-2026-11446 Wordfence
4.3 Medium Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) Plugin wp-event-solution Broken Access Control Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption ≤ 4.1.22 CVE-2026-15398 Wordfence
6.4 Medium My Calendar Plugin my-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes ≤ 3.8.3 CVE-2026-77187 Wordfence
6.4 Medium My Calendar Plugin my-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute ≤ 3.8.3 CVE-2026-77186 Wordfence
2.7 Low The Events Calendar Plugin the-events-calendar Information Disclosure Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API < 6.17.3.1 Fixed in 6.17.3.1 CVE-2026-84745 WPScan
5.4 Medium Events Manager - Calendar, Bookings, Tickets, and more! Plugin events-manager Cross-Site Scripting Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes No login needed ≤ 7.3.3 CVE-2025-14945 Wordfence
9.3 Critical VikAppointments Services Booking Calendar Plugin vikappointments SQL Injection No login needed ≤ 1.2.20 Fixed in 1.2.21 CVE-2026-84768 Patchstack
9.8 Critical Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Privilege Escalation Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' No login needed 8.0 – 9.6.2 CVE-2026-9055 Wordfence
7.2 High Booking for Appointments and Events Calendar Plugin ameliabooking Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission No login needed ≤ 2.2 CVE-2026-6286 Wordfence
9.8 Critical The Events Calendar Plugin the-events-calendar PHP Object Injection No login needed ≤ 6.17.2 Fixed in 6.17.3 CVE-2026-78265 Patchstack
8.8 High Booking calendar, Appointment Booking System Plugin Cross-Site Scripting Unauthenticated Stored XSS via SVG File Upload No login needed 3.2.18 – 3.2.36 CVE-2026-14334 WPScan
6.5 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.2.36 CVE-2026-73395 Patchstack
9.3 Critical Modern Events Calendar Plugin modern-events-calendar SQL Injection No login needed < 7.35.0 Fixed in 7.35.0 CVE-2026-73339 Patchstack
6.5 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure ≤ 1.6.12.10 CVE-2026-13358 Wordfence
5.3 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action No login needed ≤ 3.2.36 CVE-2026-8840 Wordfence
7.2 High Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter No login needed ≤ 4.6.0 CVE-2026-14433 Wordfence
4.8 Medium Salon Booking System – Free Version Plugin Broken Access Control Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback No login needed ≤ 10.30.33 CVE-2026-17023 WPScan
7.5 High VikAppointments – Services Booking Calendar Plugin vikappointments SQL Injection Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection No login needed ≤ 1.2.19 CVE-2026-15918 Wordfence
5.3 Medium Simple Google Calendar Outlook Events Widget Plugin simple-google-icalendar-widget Server-Side Request Forgery Unauthenticated SSRF via calendar_id No login needed < 3.1.0 Fixed in 3.1.0 CVE-2026-16536 WPScan
4.3 Medium Hotel Booking Lite Plugin Information Disclosure Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action < 6.0.4 Fixed in 6.0.4 CVE-2026-15235 WPScan
7.1 High Booking Calendar Plugin booking Cross-Site Scripting No login needed ≤ 11.4.2 Fixed in 11.4.3 CVE-2026-59558 Patchstack
6.8 Medium Calendar Plugin Cross-Site Scripting Contributor+ Stored XSS via event_link Parameter < 1.3.18 Fixed in 1.3.18 CVE-2026-14827 WPScan
5.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Unauthenticated Event Aggregator Import Status Manipulation No login needed < 6.16.5.1 Fixed in 6.16.5.1 CVE-2026-13390 WPScan
6.7 Medium QuickCal - Appointment Booking Calendar Plugin quickcal Broken Access Control Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control ≤ 1.0.16 CVE-2026-27377 Patchstack
6.5 Medium Registrations for the Events Calendar Plugin registrations-for-the-events-calendar SQL Injection Authenticated (Contributor+) SQL Injection via 'standard' Parameter ≤ 3.2 CVE-2026-13119 Wordfence
8.6 High Modern Events Calendar (Lite & Pro) Plugin SQL Injection Unauthenticated SQL Injection via mec_list_load_more No login needed < 7.34.0 Fixed in 7.34.0 CVE-2026-11349 WPScan
4.9 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking SQL Injection Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import ≤ 2.4.3 CVE-2026-14782 Wordfence
7.1 High ICS Calendar Plugin ics-calendar Cross-Site Scripting No login needed ≤ 12.1.1 Fixed in 12.1.1.1 CVE-2026-59516 Patchstack
5.3 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control No login needed ≤ 3.2.36 CVE-2026-57778 Patchstack
6.4 Medium Starboard Suite Reservation Calendars Plugin starboard-suite-reservation-calendars Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.1.4 CVE-2025-13968 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only