WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–27 of 27 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Forminator Forms Plugin forminator Other Unauthenticated Post Meta Injection on Submitted Posts No login needed < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87071 WPScan
5.3 Medium Forminator Forms Plugin forminator Other Unauthenticated Poll Vote Limit Bypass via IP Spoofing No login needed < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87070 WPScan
6.6 Medium Forminator Forms Plugin forminator Privilege Escalation Authenticated Privilege Escalation via Quiz Lead-Form Import 1.57.0 – < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87068 WPScan
5.3 Medium Forminator Plugin forminator Other Other vulnerability Type No login needed ≤ 1.57.1 Fixed in 1.57.2 CVE-2026-82220 Patchstack
6.6 Medium Forminator Forms Plugin forminator Privilege Escalation Authenticated Privilege Escalation via Registration Form Role Bypass < 1.57.0.7 Fixed in 1.57.0.7 CVE-2026-19222 WPScan
5.3 Medium Forminator Forms Plugin forminator Broken Access Control Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter No login needed ≤ 1.55.0.2 CVE-2026-12998 Wordfence
5.3 Medium Simple CAPTCHA with Cloudflare Turnstile Plugin simple-cloudflare-turnstile Other Unauthenticated Turnstile Protection Bypass via Reusable Forminator Cache Key No login needed < 1.42.0 Fixed in 1.42.0 CVE-2026-15239 WPScan
6.5 Medium Forminator Forms Plugin forminator Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook ≤ 1.53.0 CVE-2026-6214 Wordfence
5.3 Medium Forminator Forms Plugin forminator Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter ≤ 1.51.1 CVE-2026-6222 Wordfence
5.3 Medium Forminator – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter No login needed ≤ 1.52.0 CVE-2026-2729 Wordfence
5.3 Medium Forminator Plugin forminator Broken Access Control No login needed ≤ 1.50.2 Fixed in 1.50.3 CVE-2026-32409 Patchstack
4.4 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.50.2 CVE-2026-2002 Wordfence
5.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export ≤ 1.49.1 CVE-2025-14782 Wordfence
4.9 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator SQL Injection Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter ≤ 1.45.0 CVE-2025-7638 Wordfence
6.4 Medium Forminator Plugin forminator Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters ≤ 1.44.1 CVE-2025-5341 Wordfence
5.3 Medium Forminator Plugin forminator Other Order Replay No login needed ≤ 1.42.0 CVE-2025-3479 Wordfence
6.4 Medium Forminator Plugin forminator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' ≤ 1.42.0 CVE-2025-3487 Wordfence
6.4 Medium Forminator Plugin forminator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting 1.39.2 CVE-2025-0469 Wordfence
4.8 Medium Forminator Plugin Cross-Site Scripting Admin+ Stored XSS < 1.38.3 Fixed in 1.38.3 CVE-2024-7052 WPScan
6.1 Medium Forminator Plugin forminator Cross-Site Scripting Reflected Cross-Site Scripting via Title Parameter No login needed ≤ 1.38.2 CVE-2025-0470 Wordfence
5.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation No login needed ≤ 1.36.0 CVE-2024-9700 Wordfence
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation No login needed ≤ 1.35.1 CVE-2024-9351 Wordfence
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation No login needed ≤ 1.35.1 CVE-2024-9352 Wordfence
6.1 Medium Forminator Plugin forminator Cross-Site Scripting Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the… No login needed prior to 1.34.1 CVE-2024-45625 jpcert
5.3 Medium Forminator Plugin forminator Arbitrary File Upload Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive in… prior to 1.29.0 CVE-2024-28890 jpcert
5.4 Medium Forminator Plugin forminator Cross-Site Scripting Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page… No login needed prior to 1.15.4 CVE-2024-31857 jpcert
6.4 Medium Forminator – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode ≤ 1.29.2 CVE-2024-3053 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only