WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 74 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 6.0.0.2 Fixed in 6.0.0.3 CVE-2026-62061 Patchstack
8.8 High Groups Plugin groups Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode ≤ 4.6.0 CVE-2026-77203 Wordfence
8.8 High Mapster WP Maps Plugin mapster-wp-maps Privilege Escalation Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter ≤ 1.23.0 CVE-2026-12954 Wordfence
5.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Information Disclosure Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group No login needed < 6.0.0.0 Fixed in 6.0.0.0 CVE-2026-16290 WPScan
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Information Disclosure Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group < 6.0.0.0 Fixed in 6.0.0.0 CVE-2026-16289 WPScan
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Subscriber+ Arbitrary Notification Deletion via IDOR < 5.9.9.8 Fixed in 5.9.9.8 CVE-2026-16291 WPScan
7.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Privilege Escalation Unauthenticated Privilege Escalation via Unrestricted Group ID No login needed < 5.9.9.8 Fixed in 5.9.9.8 CVE-2026-12687 WPScan
3.8 Low ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Subscriber+ Premium License Tampering via Missing Authorization < 5.9.9.7 Fixed in 5.9.9.7 CVE-2026-12690 WPScan
5.4 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization < 5.9.9.7 Fixed in 5.9.9.7 CVE-2026-12689 WPScan
6.5 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Price Manipulation Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery No login needed < 5.9.9.7 Fixed in 5.9.9.7 CVE-2026-12688 WPScan
7.1 High Tag Groups Plugin Cross-Site Scripting Reflected XSS via 'tag_groups_task' Parameter No login needed < 2.2.0 Fixed in 2.2.0 CVE-2026-9833 WPScan
7.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Authentication Bypass Broken Authentication No login needed ≤ 5.9.9.6 Fixed in 5.9.9.7 CVE-2026-57697 Patchstack
8.8 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery No login needed ≤ 6.0.0.2 Fixed in 6.0.0.3 CVE-2026-57759 Patchstack
9.8 Critical ProfileGrid - User Profiles, Groups and Communities Plugin Privilege Escalation User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite No login needed ≤ 5.9.9.5 CVE-2026-12073 Wordfence
4.3 Medium Product Specifications for Woocommerce Plugin product-specifications Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX Actions ≤ 0.8.9 CVE-2026-11364 Wordfence
6.4 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content ≤ 5.9.9.2 CVE-2026-4610 Wordfence
7.1 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining ≤ 5.9.8.4 CVE-2026-4609 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Missing Authorization to Authenticated (Subscriber+) Group Settings Modification ≤ 5.9.8.4 CVE-2026-4607 Wordfence
6.5 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection Authenticated (Subscriber+) SQL Injection via 'rid' Parameter ≤ 5.9.8.4 CVE-2026-4608 Wordfence
6.5 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting ≤ 5.9.8.1 Fixed in 5.9.8.2 CVE-2026-25417 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery Cross-Site Request Forgery to Group Membership Request Approval/Denial No login needed ≤ 5.9.8.2 CVE-2026-2494 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion ≤ 5.9.8.1 CVE-2026-2488 Wordfence
6.4 Medium Groups Plugin groups Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode ≤ 3.10.0 CVE-2026-0549 Wordfence
5.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification No login needed ≤ 5.9.7.2 CVE-2026-1271 Wordfence
4.3 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension ≤ 5.9.7.2 CVE-2025-13416 Wordfence
4.3 Medium Groups Plugin groups Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join ≤ 3.7.0 CVE-2025-11748 Wordfence
7.1 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.9.5.7 Fixed in 5.9.5.8 CVE-2025-4957 Patchstack
5.9 Medium Admin Menu Groups Plugin admin-menu-groups Cross-Site Scripting ≤ 0.1.2 CVE-2025-49035 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection ≤ 5.9.5.3 Fixed in 5.9.5.4 CVE-2025-49033 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection ≤ 5.9.5.2 Fixed in 5.9.5.3 CVE-2025-49876 Patchstack
6.1 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Scripting User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function No login needed ≤ 5.9.5.4 CVE-2025-6977 Wordfence
6.4 Medium PeepSo Core: Groups Plugin Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description ≤ 6.4.6.0 CVE-2024-9017 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Information Disclosure Full Path Disclosure (FPD) ≤ 5.9.5.2 Fixed in 5.9.5.3 CVE-2025-52719 Patchstack
4.9 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Server-Side Request Forgery ≤ 5.9.5.2 Fixed in 5.9.5.3 CVE-2025-49877 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection ≤ 5.9.5.0 Fixed in 5.9.5.1 CVE-2025-47478 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control ≤ 5.9.5.1 Fixed in 5.9.5.2 CVE-2025-48079 Patchstack
8.5 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities SQL Injection ≤ 5.9.4.8 Fixed in 5.9.4.9 CVE-2025-39586 Patchstack
7.1 High RDP inGroups+ Plugin rdp-ingroups Cross-Site Scripting No login needed ≤ 1.0.6 CVE-2025-23546 Patchstack
8.8 High ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities PHP Object Injection User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection ≤ 5.9.4.5 CVE-2025-0724 Wordfence
4.3 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management ≤ 5.9.4.4 CVE-2025-1408 Wordfence
6.5 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities SQL Injection User Profiles, Groups and Communities <= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection ≤ 5.9.4.7 CVE-2025-0723 Wordfence
8.8 High ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities PHP Object Injection ≤ 5.9.4.3 Fixed in 5.9.4.4 CVE-2025-26999 Patchstack
4.3 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.9.4.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private Messages Disclosure ≤ 5.9.4.2 CVE-2024-13740 Wordfence
5.4 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Server-Side Request Forgery User Profiles, Groups and Communities <= 5.9.4.2 - Authenticated (Subscriber+) Limited Server-Side Request Forgery ≤ 5.9.4.2 CVE-2024-13741 Wordfence
5.4 Medium BuddyPress Groups Extras Plugin buddypress-groups-extras Cross-Site Request Forgery No login needed ≤ 3.6.10 Fixed in 3.7.0 CVE-2025-24538 Patchstack
7.1 High FLX Dashboard Groups Plugin flx-dashboard-groups Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 0.0.7 CVE-2025-23730 Patchstack
7.1 High WordPress Tag Cloud Plugin – Tag Groups Plugin tag-groups Cross-Site Scripting Tag Groups plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) No login needed ≤ 2.0.4 Fixed in 2.0.5 CVE-2025-22735 Patchstack
6.5 Medium ProfileGrid – User Profiles, Groups and Communities Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities <= 5.9.3.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Meta Deletion ≤ 5.9.3.6 CVE-2024-10900 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Broken Access Control User Profiles, Groups and Communities plugin <= 5.8.7 - Broken Access Control ≤ 5.8.7 Fixed in 5.8.8 CVE-2024-37453 Patchstack
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery No login needed ≤ 5.9.3 Fixed in 5.9.3.1 CVE-2024-49273 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only