WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 135 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons Plugin `social-icons-widget-by-wpzoom`	Information Disclosure Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signature Domain-Separation Flaw in `/yamidoo/v1/customer`… No login needed	`≤ 4.7.3`	Oct 3, 2026	`CVE-2026-100149`	Wordfence
6.8 Medium	Unlimited Elements For Elementor Plugin `unlimited-elements-for-elementor`	Cross-Site Scripting Contributor+ Stored XSS via Icon Library Parameter	`< 2.0.21` Fixed in `2.0.21`	Oct 2, 2026	`CVE-2026-85016`	WPScan
6.1 Medium	Social Media Share Buttons & Social Sharing Icons Plugin `ultimate-social-media-icons`	Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via URL No login needed	`≤ 3.0.1`	Oct 1, 2026	`CVE-2026-89047`	Wordfence
6.4 Medium	Download Manager Plugin `download-manager`	Cross-Site Scripting Author+ Stored XSS via Package Icon	`< 3.3.71` Fixed in `3.3.71`	Oct 1, 2026	`CVE-2026-86610`	WPScan
7.2 High	WP Directory Kit Plugin `wpdirectorykit`	Cross-Site Scripting Listing Admin+ Stored XSS via Category and Location Title and Icon Fields	`< 1.5.8` Fixed in `1.5.8`	Sep 26, 2026	`CVE-2026-16591`	WPScan
6.1 Medium	Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button Plugin `chaty`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 3.5.9`	Sep 11, 2026	`CVE-2026-18964`	Wordfence
6.8 Medium	Bold Page Builder Plugin `bold-page-builder`	Cross-Site Scripting Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL	`< 5.9.8` Fixed in `5.9.8`	Sep 5, 2026	`CVE-2026-84021`	WPScan
7.1 High	Social Media Share Buttons & Social Sharing Icons Plugin `ultimate-social-media-icons`	Cross-Site Scripting Reflected XSS via Pin It Share Handler No login needed	`< 3.0.1` Fixed in `3.0.1`	Sep 2, 2026	`CVE-2026-19723`	WPScan
6.8 Medium	Social Media Share Buttons & Social Sharing Icons Plugin `ultimate-social-media-icons`	Cross-Site Scripting Contributor+ Stored XSS via Post Title	`< 3.0.1` Fixed in `3.0.1`	Sep 2, 2026	`CVE-2026-19719`	WPScan
6.4 Medium	Betheme Theme `betheme`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode	`≤ 28.4`	Aug 26, 2026	`CVE-2026-6178`	Wordfence
7.1 High	Social Media & Share Icons Plugin `ultimate-social-media-icons`	Cross-Site Scripting No login needed	`≤ 2.9.9` Fixed in `3.0.0`	Aug 24, 2026	`CVE-2026-66623`	Patchstack
5.4 Medium	Royal Elementor Addons Plugin	Cross-Site Scripting Contributor+ Stored XSS via Icon Box Widget	`< 1.7.1065` Fixed in `1.7.1065`	Aug 12, 2026	`CVE-2026-19217`	WPScan
6.8 Medium	YMC Filter Plugin `ymc-smart-filter`	Cross-Site Scripting Author+ Stored XSS via SVG Icon Upload	`< 3.12.9` Fixed in `3.12.9`	Aug 8, 2026	`CVE-2026-16559`	WPScan
7.5 High	CubeWP Framework Plugin `cubewp-framework`	Path Traversal Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter No login needed	`≤ 1.1.30`	Aug 1, 2026	`CVE-2026-13339`	Wordfence
6.4 Medium	Download Manager Plugin `download-manager`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute	`≤ 3.3.66`	Aug 1, 2026	`CVE-2026-16685`	Wordfence
6.4 Medium	Kadence Blocks Plugin `kadence-blocks`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute	`≤ 3.7.8`	Aug 1, 2026	`CVE-2026-18435`	Wordfence
6.5 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Path Traversal Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts No login needed	`< 3.21.4` Fixed in `3.21.4`	Jul 30, 2026	`CVE-2026-15382`	WPScan
6.4 Medium	Cozy Blocks Plugin `cozy-addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute	`≤ 2.2.11`	Jul 24, 2026	`CVE-2026-15334`	Wordfence
6.4 Medium	Ultimate Addons for Elementor Plugin `header-footer-elementor`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes	`≤ 2.9.1`	Jul 22, 2026	`CVE-2026-15787`	Wordfence
8.5 High	CWS SVGicons Plugin `cws-svgicons`	SQL Injection	`≤ 1.5.5`	Jul 13, 2026	`CVE-2026-57787`	Patchstack
6.4 Medium	Nexter Blocks Plugin `the-plus-addons-for-block-editor`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute	`≤ 4.7.4`	Jul 8, 2026	`CVE-2026-6740`	Wordfence
4.4 Medium	Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More Plugin `themeisle-companion`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu-item-icon' Parameter	`≤ 3.0.6`	Jun 18, 2026	`CVE-2026-11358`	Wordfence
4.3 Medium	Social Media & Share Icons Plugin `ultimate-social-media-icons`	Broken Access Control No login needed	`≤ 2.8.6` Fixed in `2.8.7`	Jun 17, 2026	`CVE-2024-31435`	Patchstack
7.1 High	Favicon Rotator Plugin `favicon-rotator`	Cross-Site Scripting No login needed	`≤ 1.2.11` Fixed in `1.2.12`	Jun 15, 2026	`CVE-2026-42649`	Patchstack
9.8 Critical	iControlWP Plugin `worpit-admin-dashboard-plugin`	Privilege Escalation No login needed	`≤ 5.5.3` Fixed in `5.5.4`	Jun 15, 2026	`CVE-2026-34901`	Patchstack
3.5 Low	Secure Copy Content Protection and Content Locking Plugin `secure-copy-content-protection`	Cross-Site Scripting Admin+ Stored XSS via ays_sccp_sub_icon_image Parameter	`< 5.1.5` Fixed in `5.1.5`	Jun 12, 2026	`CVE-2026-9269`	WPScan
6.1 Medium	WP Emoticon Rating Plugin `wp-emoticon-rating`	Cross-Site Request Forgery Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter No login needed	`≤ 1.0.1`	Jun 9, 2026	`CVE-2026-8910`	Wordfence
7.1 High	Favicon Plugin `favicon-by-realfavicongenerator`	Cross-Site Scripting No login needed	`≤ 1.3.46` Fixed in `1.3.47`	May 27, 2026	`CVE-2026-42754`	Patchstack
6.1 Medium	NS Product icon badge Plugin `product-icon-badge`	Cross-Site Scripting Reflected Cross-Site Scripting via PHP_SELF No login needed	`≤ 1.2.4`	May 27, 2026	`CVE-2026-8707`	Wordfence
9.3 Critical	eMagicOne Store Manager Plugin `store-manager-connector`	SQL Injection No login needed	`≤ 1.3.2`	May 25, 2026	`CVE-2026-42773`	Patchstack
4.9 Medium	WPB Floating Menu or Categories – Sticky Floating Side Menu & Categories with Icons Plugin `wpb-floating-menu-or-categories`	Cross-Site Scripting Sticky Floating Side Menu & Categories with Icons <= 1.0.8 - Authenticated (Editor+) Stored Cross-Site Scripting via 'Icon CSS Class' Category Field	`≤ 1.0.8`	May 21, 2026	`CVE-2026-4811`	Wordfence
6.4 Medium	Advanced Social Media Icons Plugin `advanced-social-media-icons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode	`≤ 1.2`	May 12, 2026	`CVE-2026-7659`	Wordfence
6.4 Medium	AccessPress Social Icons Plugin `accesspress-social-icons`	Cross-Site Scripting WordPress Plugin AccessPress Social Icons 1.8.2 Stored XSS	`1.8.2`	May 10, 2026	`CVE-2021-47910`	VulnCheck
8.8 High	Betheme Theme	Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload	`≤ 28.4`	May 5, 2026	`CVE-2026-6261`	Wordfence
6.5 Medium	Betheme Theme	Arbitrary File Deletion Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'	`≤ 28.4`	May 5, 2026	`CVE-2026-6262`	Wordfence
6.4 Medium	Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem Plugin `gutenverse`	Cross-Site Scripting Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'	`≤ 3.5.3`	May 5, 2026	`CVE-2026-2868`	Wordfence
6.4 Medium	WP Docs Plugin `wp-docs`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpdocs_options[icon_size]'	`≤ 2.2.9`	Apr 16, 2026	`CVE-2026-3878`	Wordfence
6.4 Medium	Xpro Addons — 140+ Widgets for Elementor Plugin `xpro-elementor-addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget	`≤ 1.4.24`	Apr 4, 2026	`CVE-2026-2949`	Wordfence
5.4 Medium	Archicon Theme `archicon`	PHP Object Injection Arbitrary Object Instantiation	`≤ < 1.7` Fixed in `1.7`	Mar 25, 2026	`CVE-2026-32506`	Patchstack
8.8 High	Apicona Theme `apicona`	PHP Object Injection	`≤ 24.1.0`	Mar 25, 2026	`CVE-2026-25400`	Patchstack
8.3 High	MimeTypes Link Icons Plugin `mimetypes-link-icons`	Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content No login needed	`≤ 3.2.20`	Mar 21, 2026	`CVE-2026-1313`	Wordfence
6.5 Medium	Icon List Block Plugin `icon-list-block`	Cross-Site Scripting	`≤ 1.2.3` Fixed in `1.2.4`	Mar 13, 2026	`CVE-2026-32359`	Patchstack
4.3 Medium	Social Icons Widget & Block Plugin `social-icons-widget-by-wpzoom`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sharing Configuration Creation	`≤ 4.5.8`	Mar 13, 2026	`CVE-2026-4063`	Wordfence
8.1 High	Muzicon Theme `muzicon`	Local File Inclusion No login needed	`≤ 1.9.0`	Mar 5, 2026	`CVE-2026-28107`	Patchstack
7.1 High	iContact for Gravity Forms Plugin `gravity-forms-icontact`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.3.2`	Feb 20, 2026	`CVE-2025-68863`	Patchstack
6.4 Medium	Menu Icons by ThemeIsle Plugin `menu-icons`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting	`≤ 0.13.20`	Feb 3, 2026	`CVE-2026-1755`	Wordfence
6.5 Medium	Gutenberg Thim Blocks Plugin `thim-blocks`	Path Traversal Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter	`≤ 1.0.1`	Jan 17, 2026	`CVE-2025-13725`	Wordfence
5.9 Medium	Category Icon Plugin `category-icon`	Cross-Site Scripting	`≤ 1.0.2` Fixed in `1.0.3`	Dec 24, 2025	`CVE-2025-68525`	Patchstack
6.4 Medium	Icon List Block – Add Icon-Based Lists with Custom Styles Plugin `icon-list-block`	Server-Side Request Forgery Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery	`≤ 1.2.1`	Nov 18, 2025	`CVE-2025-12376`	Wordfence
6.4 Medium	WP-Iconics Plugin `wp-iconics`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 0.0.4`	Nov 11, 2025	`CVE-2025-12671`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.