WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 72 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.5 High	Easy Digital Downloads Plugin `easy-digital-downloads`	Broken Access Control No login needed	`≤ 3.7.1`	Oct 6, 2026	`CVE-2026-42638`	Patchstack
7.6 High	Easy Digital Downloads Plugin `easy-digital-downloads`	SQL Injection	`≤ 3.7.0` Fixed in `3.7.1`	Sep 23, 2026	`CVE-2026-95522`	Patchstack
6.5 Medium	Premium Packages – Sell Digital Products Securely Plugin `wpdm-premium-packages`	Broken Access Control Sell Digital Products Securely < 7.0.7 - Subscriber+ Arbitrary Amount Withdrawal Request	`< 7.0.7` Fixed in `7.0.7`	Aug 16, 2026	`CVE-2026-19711`	WPScan
9.8 Critical	Formidable Digital Signatures Plugin	Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Signature Field No login needed	`≤ 3.0.6`	Aug 11, 2026	`CVE-2026-16230`	Wordfence
7.2 High	Easy Digital Downloads Plugin `easy-digital-downloads`	Arbitrary File Upload Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter	`≤ 3.6.9`	Jul 29, 2026	`CVE-2026-12476`	Wordfence
4.9 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Arbitrary File Deletion	`≤ 3.6.9`	Jul 27, 2026	`CVE-2026-66476`	Patchstack
6.5 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Authentication Bypass Broken Authentication No login needed	`≤ 3.6.7` Fixed in `3.6.8`	Jul 23, 2026	`CVE-2026-59524`	Patchstack
6.4 Medium	Equalize Digital Accessibility Checker Plugin `accessibility-checker`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter	`≤ 1.46.0`	Jul 23, 2026	`CVE-2026-14481`	Wordfence
7.2 High	Kali Forms Plugin `kali-forms`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'digitalSignature' Field Value No login needed	`≤ 2.4.18`	Jul 17, 2026	`CVE-2026-15395`	Wordfence
4.3 Medium	Equalize Digital Accessibility Checker Plugin `accessibility-checker`	Broken Access Control Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter	`≤ 1.42.1`	Jun 18, 2026	`CVE-2026-9199`	Wordfence
8.1 High	Gita Theme `gita`	Local File Inclusion No login needed	`≤ 1.11`	Jun 16, 2026	`CVE-2025-69160`	Patchstack
7.5 High	Signature Add-On for WooCommerce Plugin `woocommerce-digital-signature`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.0` Fixed in `2.0.1`	Jun 15, 2026	`CVE-2026-52694`	Patchstack
7.5 High	Easy Digital Downloads Plugin `easy-digital-downloads`	Broken Access Control No login needed	`≤ 3.6.5` Fixed in `3.6.6`	Jun 15, 2026	`CVE-2026-39503`	Patchstack
4.3 Medium	Equalize Digital Accessibility Checker Plugin `accessibility-checker`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action	`≤ 1.42.0`	May 28, 2026	`CVE-2026-9015`	Wordfence
4.3 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Cross-Site Request Forgery Cross-Site Request Forgery to Payment Account Hijacking via 'square_tokens' Parameter No login needed	`≤ 3.6.7`	May 28, 2026	`CVE-2026-7533`	Wordfence
7.1 High	Themebox - Digital Products Ecommerce Theme `themebox`	Cross-Site Scripting Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) No login needed	`≤ 1.4.2`	May 27, 2026	`CVE-2025-52747`	Patchstack
7.5 High	Digital Publications Plugin	Path Traversal WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS No login needed	`1.6.9`	May 16, 2026	`CVE-2020-37245`	VulnCheck
5.3 Medium	Digital Download Plugin `digital-download`	Broken Access Control No login needed	`≤ 1.1.4` Fixed in `1.1.5`	Mar 13, 2026	`CVE-2026-32382`	Patchstack
7.1 High	DeepDigital Theme `deepdigital`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.2`	Mar 5, 2026	`CVE-2026-22467`	Patchstack
5.3 Medium	DeepDigital Theme `deepdigital`	Arbitrary Shortcode Execution No login needed	`≤ 1.0.2`	Jan 22, 2026	`CVE-2026-22469`	Patchstack
7.1 High	PRIMER by chloédigital Plugin `primer-by-chloedigital`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.0.25`	Jan 8, 2026	`CVE-2025-68873`	Patchstack
6.5 Medium	Kalender.digital Plugin `kalender-digital`	Cross-Site Scripting	`≤ 1.0.13` Fixed in `1.0.14`	Dec 31, 2025	`CVE-2025-62752`	Patchstack
4.3 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Authentication Bypass Unvalidated Redirect in Password Reset Flow via edd_redirect No login needed	`≤ 3.6.2`	Dec 31, 2025	`CVE-2025-14783`	Wordfence
5.3 Medium	Easy Digital Download Plugin	Other Insufficient Verification to Order Manipulation No login needed	`≤ 3.5.2`	Nov 6, 2025	`CVE-2025-11271`	Wordfence
7.1 High	Flytedesk Digital Plugin `flytedesk-digital`	Cross-Site Request Forgery No login needed	`≤ 20181101`	Sep 26, 2025	`CVE-2025-60172`	Patchstack
6.4 Medium	Digital Events Calendar Plugin `digital-events-calendar`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter	`≤ 1.0.8`	Sep 11, 2025	`CVE-2025-5801`	Wordfence
4.3 Medium	Accessibility Checker by Equalize Digital Plugin `accessibility-checker`	Broken Access Control	`≤ 1.31.0` Fixed in `1.31.1`	Sep 9, 2025	`CVE-2025-58976`	Patchstack
5.4 Medium	Accessibility Checker by Equalize Digital Plugin `accessibility-checker`	Broken Access Control	`≤ 1.31.0` Fixed in `1.31.1`	Sep 9, 2025	`CVE-2025-58981`	Patchstack
5.4 Medium	Accessibility Checker by Equalize Digital Plugin `accessibility-checker`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 1.30.0` Fixed in `1.30.1`	Aug 22, 2025	`CVE-2025-57886`	Patchstack
5.4 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions No login needed	`≤ 3.5.0`	Aug 20, 2025	`CVE-2025-8102`	Wordfence
5.9 Medium	DigitalOcean Spaces Sync Plugin `do-spaces-sync`	Cross-Site Scripting	`≤ 2.2.1`	Aug 14, 2025	`CVE-2025-49047`	Patchstack
4.3 Medium	MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin `paid-membership`	Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed	`≤ 3.2.0`	Jun 28, 2025	`CVE-2025-5937`	Wordfence
8.1 High	MBStore - Digital WooCommerce Plugin `mbstore`	Local File Inclusion Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion No login needed	`≤ 2.3`	Jun 27, 2025	`CVE-2025-28947`	Patchstack
5.3 Medium	Digital Marketing and Agency Templates Addons for Elementor Plugin `digital-marketing-agency-templates-for-elementor`	Cross-Site Request Forgery Cross-Site Request Forgery to Import No login needed	`≤ 1.1.1`	Jun 13, 2025	`CVE-2025-5938`	Wordfence
6.4 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via edd_receipt Shortcode	`≤ 3.3.8.1`	May 29, 2025	`CVE-2025-4670`	Wordfence
5.4 Medium	Easy Digital Downloads Google Sheet Connector Plugin	Cross-Site Request Forgery Access Code Update via CSRF	`< 1.4, < 1.6.6` Fixed in `1.4`	May 15, 2025	`CVE-2023-2334`	WPScan
6.1 Medium	Digital License Manager Plugin `digital-license-manager`	Cross-Site Scripting Reflected Cross-Site Scripting via remove_query_arg Function No login needed	`≤ 1.7.3`	Mar 25, 2025	`CVE-2025-2635`	Wordfence
5.3 Medium	Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Plugin `easy-digital-downloads`	Information Disclosure eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure No login needed	`≤ 3.3.6.1`	Mar 25, 2025	`CVE-2025-2252`	Wordfence
7.6 High	WPDM – Premium Packages Plugin `wpdm-premium-packages`	SQL Injection Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection	`≤ 5.9.6` Fixed in `5.9.7`	Jan 24, 2025	`CVE-2025-24659`	Patchstack
4.4 Medium	Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) Plugin	Cross-Site Scripting Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via Title	`≤ 3.3.2`	Jan 18, 2025	`CVE-2024-13517`	Wordfence
6.4 Medium	MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet Plugin	Cross-Site Scripting Fans Paysite: Paid Creator Subscriptions, Digital Assets, Tokens Wallet <= 2.9.29 - Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 2.9.29`	Jan 18, 2025	`CVE-2024-13391`	Wordfence
6.5 Medium	Sell Digital Downloads Plugin `sell-digital-downloads`	Cross-Site Scripting	`≤ 2.2.7`	Jan 9, 2025	`CVE-2025-22826`	Patchstack
6.1 Medium	WooCommerce Digital Content Delivery (incl. DRM) – FlickRocket Plugin `woocommerce-digital-content-delivery-with-drm-flickrocket`	Cross-Site Scripting FlickRocket <= 4.75 - Reflected Cross-Site Scripting No login needed	`≤ 4.75`	Jan 7, 2025	`CVE-2024-12438`	Wordfence
4.9 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Path Traversal Authenticated (Admin+) Arbitrary File Download	`≤ 3.3.2`	Dec 21, 2024	`CVE-2024-12875`	Wordfence
3.7 Low	Easy Digital Downloads Plugin `easy-digital-downloads`	Broken Access Control Improper Authorization to Paywall Bypass No login needed	`3.1 – 3.3.4`	Dec 17, 2024	`CVE-2024-9654`	Wordfence
5.3 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Broken Access Control No login needed	`≤ 3.1.5` Fixed in `3.2.0`	Dec 13, 2024	`CVE-2023-40005`	Patchstack
6.1 Medium	Premium Packages – Sell Digital Products Securely Plugin `wpdm-premium-packages`	Cross-Site Scripting Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg No login needed	`≤ 5.9.3`	Nov 22, 2024	`CVE-2024-11225`	Wordfence
6.4 Medium	Premium Packages - Sell Digital Products Securely Plugin `wpdm-premium-packages`	Cross-Site Scripting Sell Digital Products Securely <= 5.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdmpp_pay_link Shortcode	`≤ 5.9.3`	Nov 21, 2024	`CVE-2024-10164`	Wordfence
6.5 Medium	Wezido Plugin `wezido-elementor-addon-based-on-easy-digital-downloads`	Cross-Site Scripting	`≤ 1.2`	Nov 19, 2024	`CVE-2024-51836`	Patchstack
7.6 High	WPDM – Premium Packages Plugin `wpdm-premium-packages`	SQL Injection Sell Digital Products Securely plugin <= 6.0.5 - SQL Injection	`≤ 6.0.5` Fixed in `6.0.6`	Nov 18, 2024	`CVE-2024-52435`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.