WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,007 vulnerabilities, 1,391 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,148 High 8,901 Medium 17,624 Low 328 Not scored 6

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 5, 2026.

Showing 1–50 of 58 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.2 High Forminator Forms Plugin forminator Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter No login needed ≤ 1.57.2 CVE-2026-92144 Wordfence
7.2 High Forminator Forms Plugin forminator Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field No login needed ≤ 1.57.2 CVE-2026-85235 Wordfence
5.3 Medium Forminator Forms Plugin forminator Other Unauthenticated Post Meta Injection on Submitted Posts No login needed < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87071 WPScan
5.3 Medium Forminator Forms Plugin forminator Other Unauthenticated Poll Vote Limit Bypass via IP Spoofing No login needed < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87070 WPScan
3.7 Low Forminator Forms Plugin forminator Broken Access Control Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link No login needed 1.17.1 – < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87074 WPScan
3.1 Low Forminator Forms Plugin forminator Broken Access Control Subscriber+ Form Stripe Field Migration via migrate_stripe 1.38.1 – < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87069 WPScan
6.6 Medium Forminator Forms Plugin forminator Privilege Escalation Authenticated Privilege Escalation via Quiz Lead-Form Import 1.57.0 – < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87068 WPScan
8.5 High Forminator Forms Plugin forminator Remote Code Execution Authenticated RCE via XML-RPC PHP Object Injection 1.57.0.7 – < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87067 WPScan
9.1 Critical Forminator Forms Plugin forminator Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter No login needed ≤ 1.57.2 CVE-2026-92229 Wordfence
5.3 Medium Forminator Plugin forminator Other Other vulnerability Type No login needed ≤ 1.57.1 Fixed in 1.57.2 CVE-2026-82220 Patchstack
7.2 High Forminator Forms Plugin forminator Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field No login needed ≤ 1.57.0.1 CVE-2026-18324 Wordfence
3.7 Low Forminator Forms Plugin forminator Privilege Escalation Unauthenticated Multisite Site Creation and Privilege Escalation No login needed < 1.57.1 Fixed in 1.57.1 CVE-2026-19220 WPScan
7.2 High Forminator Forms Plugin forminator Cross-Site Scripting Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter No login needed ≤ 1.57.0 CVE-2026-18328 Wordfence
7.2 High Forminator Forms Plugin forminator Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) No login needed ≤ 1.57.0.2 CVE-2026-18323 Wordfence
6.6 Medium Forminator Forms Plugin forminator Privilege Escalation Authenticated Privilege Escalation via Registration Form Role Bypass < 1.57.0.7 Fixed in 1.57.0.7 CVE-2026-19222 WPScan
7.2 High Forminator Forms Plugin forminator Remote Code Execution Admin+ Network-Wide RCE via Hub Connector API Key on Multisite 1.40.0 – < 1.57.0.5 Fixed in 1.57.0.5 CVE-2026-19221 WPScan
9.8 Critical Forminator Plugin forminator PHP Object Injection No login needed ≤ 1.57.0 Fixed in 1.57.1 CVE-2026-66583 Patchstack
9.8 Critical Forminator Forms Plugin forminator Arbitrary File Upload Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration No login needed ≤ 1.56.1 CVE-2026-15748 Wordfence
5.3 Medium Forminator Forms Plugin forminator Broken Access Control Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter No login needed ≤ 1.55.0.2 CVE-2026-12998 Wordfence
5.3 Medium Simple CAPTCHA with Cloudflare Turnstile Plugin simple-cloudflare-turnstile Other Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key No login needed < 1.42.0 Fixed in 1.42.0 CVE-2026-15239 WPScan
7.1 High Forminator Plugin forminator Cross-Site Scripting No login needed ≤ 1.56.0 Fixed in 1.56.1 CVE-2026-28143 Patchstack
8.8 High Forminator Plugin forminator Privilege Escalation ≤ 1.56.0 Fixed in 1.56.0.1 CVE-2026-28111 Patchstack
7.2 High Forminator Forms Plugin forminator Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field No login needed ≤ 1.56.1 CVE-2026-18325 Wordfence
8.1 High Uncanny Automator Plugin uncanny-automator PHP Object Injection Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token No login needed ≤ 7.3.1.4 CVE-2026-15008 Wordfence
7.5 High Forminator Plugin forminator Path Traversal Arbitrary File Download No login needed ≤ 1.55.0.2 Fixed in 1.55.1 CVE-2026-57815 Patchstack
7.1 High Forminator Plugin forminator Cross-Site Scripting No login needed ≤ 1.55.0.1 Fixed in 1.55.0.2 CVE-2026-57814 Patchstack
7.1 High Forminator Plugin forminator Cross-Site Scripting No login needed ≤ 1.53.1 Fixed in 1.53.2 CVE-2026-56071 Patchstack
6.5 Medium Forminator Forms Plugin forminator Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook ≤ 1.53.0 CVE-2026-6214 Wordfence
5.3 Medium Forminator Forms Plugin forminator Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter ≤ 1.51.1 CVE-2026-6222 Wordfence
7.5 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Path Traversal Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' No login needed ≤ 1.52.1 CVE-2026-5192 Wordfence
5.3 Medium Forminator – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter No login needed ≤ 1.52.0 CVE-2026-2729 Wordfence
5.3 Medium Forminator Plugin forminator Broken Access Control No login needed ≤ 1.50.2 Fixed in 1.50.3 CVE-2026-32409 Patchstack
8.8 High Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Plugin tablesome Broken Access Control Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation 0.5.4 – 1.2.1 CVE-2025-12845 Wordfence
4.4 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.50.2 CVE-2026-2002 Wordfence
5.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export ≤ 1.49.1 CVE-2025-14782 Wordfence
9.8 Critical Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Plugin tablesome Arbitrary File Upload Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload No login needed ≤ 1.1.32 CVE-2025-11499 Wordfence
4.9 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator SQL Injection Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter ≤ 1.45.0 CVE-2025-7638 Wordfence
7.5 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator PHP Object Injection Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion No login needed ≤ 1.44.2 CVE-2025-6464 Wordfence
8.8 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Arbitrary File Deletion Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion No login needed ≤ 1.44.2 CVE-2025-6463 Wordfence
6.4 Medium Forminator Plugin forminator Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters ≤ 1.44.1 CVE-2025-5341 Wordfence
5.3 Medium Forminator Plugin forminator Other Order Replay No login needed ≤ 1.42.0 CVE-2025-3479 Wordfence
6.4 Medium Forminator Plugin forminator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' ≤ 1.42.0 CVE-2025-3487 Wordfence
6.4 Medium Forminator Plugin forminator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting 1.39.2 CVE-2025-0469 Wordfence
4.8 Medium Forminator Plugin Cross-Site Scripting Admin+ Stored XSS < 1.38.3 Fixed in 1.38.3 CVE-2024-7052 WPScan
6.1 Medium Forminator Plugin forminator Cross-Site Scripting Reflected Cross-Site Scripting via Title Parameter No login needed ≤ 1.38.2 CVE-2025-0470 Wordfence
7.1 High GSheetConnector for Forminator Forms Plugin gsheetconnector-forminator Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0.12 Fixed in 1.0.13 CVE-2025-22752 Patchstack
5.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation No login needed ≤ 1.36.0 CVE-2024-9700 Wordfence
7.5 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation ≤ 1.35.1 CVE-2024-10402 Wordfence
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation No login needed ≤ 1.35.1 CVE-2024-9351 Wordfence
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation No login needed ≤ 1.35.1 CVE-2024-9352 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only