WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–21 of 21 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation ≤ 2.5.2 Fixed in 2.5.4 CVE-2026-94178 Patchstack
8.8 High Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields ≤ 2.4.17 CVE-2026-86583 Wordfence
7.2 High Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation Custom Role Privilege Escalation to Administrator via Frontend Importer < 2.5.2 Fixed in 2.5.2 CVE-2026-92541 WPScan
7.2 High Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation Custom Role Privilege Escalation to Administrator via caller_can_promote_users 2.4.16 – < 2.5.2 Fixed in 2.5.2 CVE-2026-92540 WPScan
4.1 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Server-Side Request Forgery Admin+ SSRF via bp_avatar < 2.4.5 Fixed in 2.4.5 CVE-2026-16542 WPScan
4.9 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Path Traversal Admin+ Arbitrary File Read < 2.4.3 Fixed in 2.4.3 CVE-2025-15673 WPScan
9.1 Critical Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation Custom Role Privilege Escalation to Administrator via CSV Import No login needed < 2.4.2 Fixed in 2.4.2 CVE-2026-16534 WPScan
4.3 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action ≤ 2.4.0 CVE-2026-15026 Wordfence
8.8 High Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Multisite Capability Meta Fields ≤ 2.0.8 CVE-2026-7641 Wordfence
8.1 High Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation Privilege Escalation to Administrator via save_extra_user_profile_fields No login needed ≤ 1.29.7 CVE-2026-3629 Wordfence
5.9 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Information Disclosure Sensitive Data Exposure No login needed ≤ 1.27.12 Fixed in 1.27.13 CVE-2025-24689 Patchstack
5.9 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Cross-Site Scripting ≤ 1.27.5 Fixed in 1.27.6 CVE-2024-50413 Patchstack
7.5 High Import and export users and customers Plugin import-users-from-csv-with-meta Information Disclosure Sensitive Information via Imported File No login needed ≤ 1.26.8 Fixed in 1.26.9 CVE-2024-38787 Patchstack
5.4 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Broken Access Control ≤ 1.26.5 Fixed in 1.26.6 CVE-2024-34815 Patchstack
5.3 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Broken Access Control No login needed ≤ 1.24.6 Fixed in 1.24.7 CVE-2024-22151 Patchstack
4.4 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.26.6.1 CVE-2024-4656 Wordfence
4.4 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.26.6.1 CVE-2024-4734 Wordfence
4.3 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Broken Access Control Missing Authorization ≤ 1.26.5 CVE-2024-1050 Wordfence
4.4 Medium Import and export users and customers Plugin import-users-from-csv-with-meta PHP Object Injection ≤ 1.26.2 Fixed in 1.26.3 CVE-2024-32817 Patchstack
6.6 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Path Traversal Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality ≤ 1.24.2 CVE-2023-6583 Wordfence
4.9 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode ≤ 1.24.3 CVE-2023-6624 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only