WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–44 of 44 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation No login needed 5.0.1.8 – < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77826 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Zero Quantity No login needed 6.0.0.0 – < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77794 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Omitted Price Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77793 WPScan
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Unauthenticated Stored XSS via Rating Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77792 WPScan
7.4 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Broken Authentication No login needed ≤ 6.0.9.8 Fixed in 6.0.9.9 CVE-2026-82225 Patchstack
7.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.9.8 Fixed in 6.0.9.9 CVE-2026-82221 Patchstack
5.5 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager SQL Injection Admin+ SQLi via 'rm_sortby' Parameter < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-77790 WPScan
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection No login needed ≤ 6.0.9.7 Fixed in 6.0.9.8 CVE-2026-73341 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Amount-Blind PayPal Verification No login needed < 6.0.9.5 Fixed in 6.0.9.5 CVE-2026-15208 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Unauthenticated Form Submission and User Profile Modification No login needed < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-15257 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Information Disclosure Unauthenticated Form Submission Disclosure via IDOR No login needed < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-15255 WPScan
8.8 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter ≤ 6.0.9.1 CVE-2026-12158 Wordfence
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request No login needed ≤ 6.0.8.6 CVE-2026-9242 Wordfence
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Broken Authentication No login needed ≤ 6.0.8.6 Fixed in 6.0.8.7 CVE-2026-49764 Patchstack
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control No login needed ≤ <= 6.0.7.6 Fixed in 6.0.7.7 CVE-2026-32498 Patchstack
8.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation Account Takeover No login needed ≤ 6.0.7.1 Fixed in 6.0.7.2 CVE-2026-24373 Patchstack
5.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control ≤ 6.0.7.6 Fixed in 6.0.7.7 CVE-2026-32385 Patchstack
5.3 Medium RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment No login needed ≤ 6.0.6.9 CVE-2025-14444 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Subscriber+ Form Creation < 6.0.7.2 Fixed in 6.0.7.2 CVE-2026-0929 WPScan
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Information Disclosure Subscriber+ Sensitive Data Disclosure < 6.0.7.2 Fixed in 6.0.7.2 CVE-2025-15520 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Missing Authorization to Unauthenticated Arbitrary Settings Modification No login needed ≤ 6.0.7.4 CVE-2026-1054 Wordfence
5.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery No login needed ≤ 6.0.6.9 Fixed in 6.0.7.0 CVE-2026-24374 Patchstack
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation Unauthenticated Privilege Escalation via admin_order No login needed ≤ 6.0.7.1 CVE-2025-15403 Wordfence
6.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode ≤ 6.0.6.7 CVE-2025-13610 Wordfence
9.8 Critical RegistrationMagic - Custom Registration Forms Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection Custom Registration Forms <= 3.7.9.2 - PHP Object Injection No login needed < 3.7.9.3 Fixed in 3.7.9.3 CVE-2017-20208 Wordfence
7.2 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager SQL Injection Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection ≤ 6.0.6.2 CVE-2025-11204 Wordfence
4.8 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Stored XSS < 6.0.2.1 Fixed in 6.0.2.1 CVE-2024-9390 WPScan
6.4 Medium RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 6.0.4.3 CVE-2025-2836 Wordfence
7.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 6.0.3.3 Fixed in 6.0.3.4 CVE-2025-24686 Patchstack
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control No login needed ≤ 5.2.3.0 Fixed in 5.2.3.1 CVE-2023-49831 Patchstack
9.8 Critical RegistrationMagic – User Registration Plugin with Custom Registration Forms Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery No login needed ≤ 6.0.2.6 CVE-2024-10508 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.1.0 Fixed in 6.0.1.1 CVE-2024-43317 Patchstack
5.8 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.0.1 Fixed in 6.0.0.2 CVE-2024-39643 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Form Submission Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51544 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass IP Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51543 Patchstack
7.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 5.3.2.0 Fixed in 5.3.2.1 CVE-2024-33947 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Content Injection No login needed ≤ 5.1.9.2 Fixed in 5.1.9.3 CVE-2023-23989 Patchstack
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Arbitrary Price Change No login needed ≤ 5.1.9.2 Fixed in 5.1.9.3 CVE-2023-23976 Patchstack
8.8 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.0.0 - Authenticated (Subscriber+) Privilege Escalation ≤ 5.3.0.0 CVE-2024-1991 Wordfence
8.8 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager SQL Injection Custom Registration Forms, User Registration, Payment, and User Login <= 5.3.1.0 - Authenticated (Contributor+) SQL Injection via Shortcode ≤ 5.3.1.0 CVE-2024-1990 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery No login needed ≤ 5.3.0.0 Fixed in 5.3.1.0 CVE-2024-2951 Patchstack
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control ≤ 5.2.5.9 Fixed in 5.2.6.0 CVE-2024-25935 Patchstack
7.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.2.5.9 Fixed in 5.2.6.0 CVE-2024-29113 Patchstack
7.1 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS) No login needed ≤ 5.2.4.1 Fixed in 5.2.4.2 CVE-2023-51509 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only