WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–35 of 35 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	Payment Gateway of Stripe for WooCommerce Plugin `payment-gateway-stripe-and-woocommerce-integration`	Other Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint No login needed	`≤ 5.0.8`	Sep 19, 2026	`CVE-2026-9832`	Wordfence
10.0 Critical	CryptoPayment Gateway Plugin	Arbitrary File Deletion Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router No login needed	`1.2.1 – 1.2.2`	Sep 13, 2026	`CVE-2026-81648`	WPScan
7.5 High	InstaWP Connect Plugin `instawp-connect`	Information Disclosure Unauthenticated Cryptographic Key Disclosure No login needed	`≤ 0.1.3.6`	Aug 11, 2026	`CVE-2026-13457`	Wordfence
5.3 Medium	CorvusPay WooCommerce Payment Gateway Plugin `corvuspay-woocommerce-integration`	Price Manipulation Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint No login needed	`≤ 2.7.4`	Jul 9, 2026	`CVE-2026-9027`	Wordfence
7.5 High	ABC Crypto Checkout Plugin `payerurl-crypto-currency-payment-gateway-for-woocommerce`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.8.2` Fixed in `1.8.3`	Jun 15, 2026	`CVE-2026-52695`	Patchstack
6.4 Medium	Cryptocurrency Prijsvergelijking Widget Plugin `cryptocurrency-prijsvergelijking-widget`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute	`≤ 1.0`	May 27, 2026	`CVE-2026-8698`	Wordfence
7.5 High	MyCryptoCheckout Plugin `mycryptocheckout`	Broken Access Control No login needed	`≤ 2.161` Fixed in `2.162`	May 25, 2026	`CVE-2026-45209`	Patchstack
7.5 High	Payment Gateway for Redsys & WooCommerce Lite Plugin `woo-redsys-gateway-light`	Other Improper Verification of Cryptographic Signature to Unauthenticated Payment Status Manipulation No login needed	`≤ 7.0.0`	Apr 16, 2026	`CVE-2026-5050`	Wordfence
7.5 High	Accept Cryptocurrencies with Plisio Plugin `plisio-payment-gateway-for-woocommerce`	Price Manipulation Payment Bypass No login needed	`≤ 2.0.5`	Apr 15, 2026	`CVE-2026-6372`	Patchstack
5.3 Medium	Cryptocurrency Donation Box – Bitcoin & Crypto Donations Plugin `cryptocurrency-donation-box`	Broken Access Control Bitcoin & Crypto Donations plugin <= 2.2.13 - Broken Access Control No login needed	`≤ 2.2.13`	Apr 8, 2026	`CVE-2026-39691`	Patchstack
7.2 High	Sell BTC - Cryptocurrency Selling Calculator Plugin `sell-btc-by-hayyatapps`	Cross-Site Scripting Cryptocurrency Selling Calculator <= 1.5 - Unauthenticated Stored Cross-Site Scripting via 'orderform_data' AJAX Action No login needed	`≤ 1.5`	Jan 31, 2026	`CVE-2025-14554`	Wordfence
4.3 Medium	Simple Crypto Shortcodes Plugin `simple-crypto-shortcodes`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed	`≤ 1.0.2`	Jan 24, 2026	`CVE-2025-14903`	Wordfence
4.3 Medium	Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO Plugin `tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Contract Address Update	`≤ 2.4.7`	Nov 21, 2025	`CVE-2025-11773`	Wordfence
5.3 Medium	Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO Plugin `tokenico-cryptocurrency-token-launchpad-presale-ico-ido-airdrop`	Broken Access Control Missing Authentication to Unauthenticated Presale Update No login needed	`≤ 2.4.7`	Nov 21, 2025	`CVE-2025-11771`	Wordfence
5.3 Medium	Cryptocurrency Payment Gateway for WooCommerce Plugin `triplea-cryptocurrency-payment-gateway-for-woocommerce`	Broken Access Control Missing Authorization to Unauthenticated Tracking Status Update No login needed	`≤ 2.0.25`	Nov 18, 2025	`CVE-2025-12392`	Wordfence
5.3 Medium	Crypto Tool Plugin `crypto`	Information Disclosure Unauthenticated Information Exposure via Global Authentication State No login needed	`≤ 2.22`	Nov 11, 2025	`CVE-2025-11986`	Wordfence
5.3 Medium	Crypto Tool Plugin `crypto`	Arbitrary File Deletion Missing Authentication to Unauthenticated Limited File Deletion No login needed	`≤ 2.22`	Nov 11, 2025	`CVE-2025-11988`	Wordfence
7.5 High	Crypto Payment Gateway with Payeer for WooCommerce Plugin `crypto-payment-gateway-with-payeer-for-woocommerce`	Price Manipulation Unauthenticated Payment Bypass No login needed	`≤ 1.0.3`	Nov 4, 2025	`CVE-2025-11890`	Wordfence
9.3 Critical	Multi CryptoCurrency Payments Plugin `multi-crypto-currency-payment`	SQL Injection No login needed	`≤ 2.0.7`	Jun 9, 2025	`CVE-2025-48141`	Patchstack
6.5 Medium	CryptoCloud - Crypto Payment Gateway Plugin `cryptocloud-crypto-payment-gateway`	Broken Access Control Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control No login needed	`≤ 2.1.2` Fixed in `2.3.2`	Jun 9, 2025	`CVE-2025-48147`	Patchstack
6.5 Medium	Cryptocurrency Widgets Pack Plugin `cryptocurrency-widgets-pack`	Broken Access Control	`≤ 2.0.1`	Mar 31, 2025	`CVE-2025-31539`	Patchstack
6.1 Medium	Financial Stocks & Crypto Market Data Plugin `live-stock-prices-for-wordpress`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 1.10.3`	Jan 7, 2025	`CVE-2024-11690`	Wordfence
5.9 Medium	Cryptocurrency Price Widget Plugin `cryptocurrency-price-widget`	Cross-Site Scripting	`≤ 1.2.3` Fixed in `1.2.4`	Dec 13, 2024	`CVE-2024-54308`	Patchstack
5.3 Medium	Cryptocurrency Widgets – Price Ticker & Coins List Plugin `cryptocurrency-price-ticker-widget`	Broken Access Control Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control No login needed	`≤ 2.6.2` Fixed in `2.6.3`	Dec 13, 2024	`CVE-2023-36681`	Patchstack
5.3 Medium	Web3 Cryptocurrency Payments by DePay for WooCommerce Plugin	Broken Access Control Missing Authorization to Information Exposure No login needed	`≤ 2.12.17`	Dec 12, 2024	`CVE-2024-12265`	Wordfence
8.1 High	Cryptocurrency Widgets For Elementor Plugin `cryptocurrency-widgets-for-elementor`	Local File Inclusion No login needed	`≤ 1.6.4` Fixed in `1.6.5`	Nov 30, 2024	`CVE-2024-53739`	Patchstack
6.1 Medium	Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes Plugin `security-force`	Cross-Site Scripting Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting No login needed	`≤ 1.1.6`	Nov 21, 2024	`CVE-2024-11365`	Wordfence
8.8 High	Crypto Plugin `crypto`	Cross-Site Request Forgery Cross-Site Request Forgery to Authentication Bypass No login needed	`≤ 2.15`	Oct 29, 2024	`CVE-2024-9990`	Wordfence
9.8 Critical	Crypto Plugin `crypto`	Authentication Bypass Authentication Bypass via log_in No login needed	`≤ 2.18`	Oct 29, 2024	`CVE-2024-9989`	Wordfence
9.8 Critical	Crypto Plugin `crypto`	Authentication Bypass Authentication Bypass via register No login needed	`≤ 2.19`	Oct 29, 2024	`CVE-2024-9988`	Wordfence
7.1 High	Cryptocurrency Widgets – Price Ticker & Coins List Plugin `cryptocurrency-price-ticker-widget`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.8.0` Fixed in `2.8.1`	Aug 18, 2024	`CVE-2024-43304`	Patchstack
6.5 Medium	Crypto Converter Widget Plugin `crypto-converter-widget`	Cross-Site Scripting	`≤ 1.8.4` Fixed in `1.9.0`	Mar 27, 2024	`CVE-2024-29930`	Patchstack
4.7 Medium	Cryptocurrency Widgets – Price Ticker & Coins List Plugin `cryptocurrency-price-ticker-widget`	Broken Access Control Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control	`≤ 2.6.8` Fixed in `2.6.9`	Mar 13, 2024	`CVE-2024-27953`	Patchstack
9.8 Critical	Web3 – Crypto wallet Login & NFT token gating Plugin `web3-authentication`	Authentication Bypass Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass No login needed	`< 3.0.0` Fixed in `3.0.0`	Feb 12, 2024	`CVE-2023-6036`	WPScan
9.8 Critical	Cryptocurrency Widgets – Price Ticker & Coins List Plugin `cryptocurrency-price-ticker-widget`	SQL Injection Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in versions 2.0 to 2.6.5 due to insufficie… No login needed	`2.0 – 2.6.5`	Feb 5, 2024	`CVE-2024-0709`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.