WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 1–50 of 315 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.5 Medium | Image Photo Gallery Final Tiles Grid | Cross-Site Scripting |
≤ 3.6.13 Fixed in 3.6.14 |
CVE-2026-104409 |
Patchstack | |
| 5.3 Medium | ProfileGrid | Broken Access Control Insecure Direct Object References (IDOR) No login needed |
≤ 6.0.0.2 Fixed in 6.0.0.3 |
CVE-2026-62061 |
Patchstack | |
| 7.1 High | Post and Page Builder by BoldGrid | Cross-Site Scripting No login needed |
≤ 1.27.14 Fixed in 1.27.15 |
CVE-2026-100510 |
Patchstack | |
| 6.4 Medium | Bold Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute |
≤ 5.7.2 |
CVE-2026-6170 |
Wordfence | |
| 7.5 High | Modula Image Gallery | Broken Access Control Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters No login needed |
≤ 3.0.1 |
CVE-2026-89406 |
Wordfence | |
| 8.1 High | Modula Image Gallery | Broken Access Control Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter |
≤ 3.0.2 |
CVE-2026-92713 |
Wordfence | |
| 3.5 Low | The Post Grid | Content Injection Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening |
< 7.9.5 Fixed in 7.9.5 |
CVE-2026-84151 |
WPScan | |
| 6.5 Medium | The Post Grid | Cross-Site Scripting |
≤ 7.9.5 Fixed in 7.9.6 |
CVE-2026-94680 |
Patchstack | |
| 6.5 Medium | The Post Grid | Cross-Site Scripting |
≤ 7.9.5 Fixed in 7.9.6 |
CVE-2026-94671 |
Patchstack | |
| 9.8 Critical | Post Grid and Gutenberg Blocks – ComboBlocks | Remote Code Execution ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection No login needed |
2.2.85 – 2.3.32 |
CVE-2024-11080 |
Wordfence | |
| 6.8 Medium | King Addons for Elementor | Cross-Site Scripting Contributor+ Stored XSS via Magazine Grid Widget |
< 51.1.77 Fixed in 51.1.77 |
CVE-2026-84896 |
WPScan | |
| 6.5 Medium | Gallery PhotoBlocks | Cross-Site Scripting |
≤ 1.3.4 Fixed in 1.3.5 |
CVE-2026-84781 |
Patchstack | |
| 6.4 Medium | Image Photo Gallery Final Tiles Grid | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute |
≤ 3.6.12 |
CVE-2026-4559 |
Wordfence | |
| 6.8 Medium | Post Grid, Slider & Carousel Ultimate | Cross-Site Scripting Contributor+ Stored XSS via Header Title Field |
< 1.8.1 Fixed in 1.8.1 |
CVE-2026-16260 |
WPScan | |
| 8.8 High | The Grid | Privilege Escalation |
≤ 2.8.0 Fixed in 2.8.1 |
CVE-2026-28191 |
Patchstack | |
| 7.5 High | Total Upkeep | Information Disclosure Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret No login needed |
< 1.17.3 Fixed in 1.17.3 |
CVE-2026-16253 |
WPScan | |
| 8.2 High | Total Upkeep | Broken Access Control No login needed |
≤ 1.17.2 Fixed in 1.17.3 |
CVE-2026-66708 |
Patchstack | |
| 5.3 Medium | ProfileGrid | Information Disclosure Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group No login needed |
< 6.0.0.0 Fixed in 6.0.0.0 |
CVE-2026-16290 |
WPScan | |
| 4.3 Medium | ProfileGrid | Information Disclosure Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group |
< 6.0.0.0 Fixed in 6.0.0.0 |
CVE-2026-16289 |
WPScan | |
| 4.3 Medium | ProfileGrid | Broken Access Control Subscriber+ Arbitrary Notification Deletion via IDOR |
< 5.9.9.8 Fixed in 5.9.9.8 |
CVE-2026-16291 |
WPScan | |
| 6.1 Medium | King Addons for Elementor | Cross-Site Scripting Reflected XSS via Posts Grid Widget No login needed |
< 51.1.76 Fixed in 51.1.76 |
CVE-2026-14841 |
WPScan | |
| 7.5 High | ProfileGrid | Privilege Escalation Unauthenticated Privilege Escalation via Unrestricted Group ID No login needed |
< 5.9.9.8 Fixed in 5.9.9.8 |
CVE-2026-12687 |
WPScan | |
| 6.5 Medium | Gallery PhotoBlocks | Cross-Site Scripting |
≤ 1.3.3 Fixed in 1.3.4 |
CVE-2026-66448 |
Patchstack | |
| 3.8 Low | ProfileGrid | Broken Access Control Subscriber+ Premium License Tampering via Missing Authorization |
< 5.9.9.7 Fixed in 5.9.9.7 |
CVE-2026-12690 |
WPScan | |
| 5.4 Medium | ProfileGrid | Broken Access Control Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization |
< 5.9.9.7 Fixed in 5.9.9.7 |
CVE-2026-12689 |
WPScan | |
| 6.5 Medium | ProfileGrid | Price Manipulation Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery No login needed |
< 5.9.9.7 Fixed in 5.9.9.7 |
CVE-2026-12688 |
WPScan | |
| 6.4 Medium | Post Grid Gutenberg Blocks | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute |
≤ 5.0.32 |
CVE-2026-15100 |
Wordfence | |
| 6.5 Medium | Modula Image Gallery | Cross-Site Scripting |
2.14.25 – 2.14.30 Fixed in 2.14.31 |
CVE-2026-65475 |
Patchstack | |
| 6.4 Medium | Grid/List View for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute |
≤ 3.0.9 |
CVE-2026-15794 |
Wordfence | |
| 7.5 High | ProfileGrid | Authentication Bypass Broken Authentication No login needed |
≤ 5.9.9.6 Fixed in 5.9.9.7 |
CVE-2026-57697 |
Patchstack | |
| 8.8 High | WP Grid Builder | Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter |
≤ 2.3.3 |
CVE-2026-13756 |
Wordfence | |
| 4.3 Medium | Memberships and User Profiles for WooCommerce | Broken Access Control Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation |
≤ 3.4 |
CVE-2026-11359 |
Wordfence | |
| 6.4 Medium | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute |
≤ 5.0.31 |
CVE-2026-13253 |
Wordfence | |
| 8.8 High | ProfileGrid | Cross-Site Request Forgery No login needed |
≤ 6.0.0.2 Fixed in 6.0.0.3 |
CVE-2026-57759 |
Patchstack | |
| 9.8 Critical | ProfileGrid - User Profiles, Groups and Communities | Privilege Escalation User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite No login needed |
≤ 5.9.9.5 |
CVE-2026-12073 |
Wordfence | |
| 9.3 Critical | YMC Filter | SQL Injection No login needed |
≤ 3.11.5 Fixed in 3.11.6 |
CVE-2026-54836 |
Patchstack | |
| 6.4 Medium | ProfileGrid | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content |
≤ 5.9.9.2 |
CVE-2026-4610 |
Wordfence | |
| 7.5 High | JetEngine | SQL Injection Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint No login needed |
≤ 3.8.10.1 |
CVE-2026-12360 |
Wordfence | |
| 6.5 Medium | Modula Image Gallery | Cross-Site Scripting |
≤ 2.14.23 Fixed in 2.14.24 |
CVE-2026-42688 |
Patchstack | |
| 7.2 High | Modula Image Gallery | PHP Object Injection |
≤ 2.14.18 Fixed in 2.14.19 |
CVE-2026-39481 |
Patchstack | |
| 6.4 Medium | Easy Image Collage | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters |
≤ 1.13.6 |
CVE-2026-9019 |
Wordfence | |
| 4.3 Medium | The Post Grid | Broken Access Control |
≤ 7.9.2 |
CVE-2026-49054 |
Patchstack | |
| 5.4 Medium | ShopLentor - WooCommerce Builder for Elementor & Gutenberg | Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute |
≤ 3.3.8 |
CVE-2026-6287 |
Wordfence | |
| 4.3 Medium | Image Photo Gallery Final Tiles Grid | Broken Access Control |
≤ 3.6.11 Fixed in 3.6.12 |
CVE-2026-27424 |
Patchstack | |
| 7.1 High | ProfileGrid | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining |
≤ 5.9.8.4 |
CVE-2026-4609 |
Wordfence | |
| 4.3 Medium | ProfileGrid | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Group Settings Modification |
≤ 5.9.8.4 |
CVE-2026-4607 |
Wordfence | |
| 6.5 Medium | ProfileGrid | SQL Injection Authenticated (Subscriber+) SQL Injection via 'rid' Parameter |
≤ 5.9.8.4 |
CVE-2026-4608 |
Wordfence | |
| 6.4 Medium | Netroics Blog Posts Grid | Cross-Site Scripting WordPress Plugin Netroics Blog Posts Grid 1.0 Stored XSS |
1.0 |
CVE-2022-50946 |
VulnCheck | |
| 5.3 Medium | Total Upkeep | Broken Access Control Missing Authorization to Unauthenticated Rollback Cancellation No login needed |
≤ 1.17.1 |
CVE-2026-3143 |
Wordfence | |
| 5.3 Medium | Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX | Broken Access Control PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification No login needed |
≤ 5.0.5 |
CVE-2026-0718 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.