WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 141 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High Conversational Forms for ChatBot Plugin conversational-forms PHP Object Injection ≤ 1.5.0 Fixed in 1.5.1 CVE-2026-95531 Patchstack
7.2 High Quill Forms | Conversational Multi Step Forms, Surveys & quizzes Plugin quillforms Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value No login needed ≤ 5.7.1 CVE-2026-15664 Wordfence
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter ≤ 9.3.0 CVE-2026-75961 Wordfence
8.8 High Dictionary Plugin Cross-Site Scripting Unauthenticated Stored XSS via Direct Dictionary Update No login needed ≤ 1.0 CVE-2026-88792 WPScan
7.1 High Dictionary Plugin Cross-Site Scripting Reflected XSS via Multiple Parameters No login needed ≤ 1.0 CVE-2025-15697 WPScan
2.2 Low BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Information Disclosure Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR < 1.2.2 Fixed in 1.2.2 CVE-2026-84025 WPScan
4.3 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84024 WPScan
6.5 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84023 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Slider Elements' additional_settings < 5.9.9 Fixed in 5.9.9 CVE-2026-84028 WPScan
7.5 High Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Information Disclosure Unauthenticated Customer File Disclosure via getpublicfileupload No login needed < 1.2.176 Fixed in 1.2.176 CVE-2026-19728 WPScan
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Admin+) SQL Injection via 'additional_params' Parameter ≤ 9.2.4 CVE-2026-15602 Wordfence
7.2 High Cookie Banner for GDPR / CCPA Plugin gdpr-cookie-consent Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter No login needed ≤ 4.3.5 CVE-2026-13360 Wordfence
7.2 High HUSKY - Products Filter Professional for WooCommerce Plugin Local File Inclusion Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view < 1.4.1 Fixed in 1.4.1 CVE-2026-15244 WPScan
4.8 Medium Bit Form Plugin bit-form Cross-Site Scripting Admin+ Stored XSS via Conversational Form Progress Label < 3.1.4 Fixed in 3.1.4 CVE-2025-15669 WPScan
7.5 High Bit integrations Plugin bit-integrations Path Traversal Unauthenticated Arbitrary File Read via Optional CF7 File Field No login needed ≤ 2.9.0 CVE-2026-15006 Wordfence
6.5 Medium Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Broken Access Control No login needed ≤ 1.2.167 Fixed in 1.2.168 CVE-2026-57390 Patchstack
6.4 Medium bbp style pack Plugin bbp-style-pack Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields ≤ 6.4.5 CVE-2026-15010 Wordfence
6.4 Medium Advanced iFrame Plugin advanced-iframe Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute ≤ 2026.1 CVE-2026-6742 Wordfence
7.5 High Conversational Forms for ChatBot Plugin conversational-forms Path Traversal Arbitrary File Download No login needed ≤ 1.1.8 Fixed in 1.2.0 CVE-2024-32729 Patchstack
8.1 High Iona Theme iona Local File Inclusion No login needed ≤ 1.0.8 CVE-2025-69116 Patchstack
4.3 Medium FOX – Currency Switcher Professional for WooCommerce Plugin woocommerce-currency-switcher Broken Access Control Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter ≤ 1.4.6 CVE-2026-9241 Wordfence
8.1 High FOX – Currency Switcher Professional for WooCommerce Plugin woocommerce-currency-switcher Broken Access Control Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion ≤ 1.4.5 CVE-2026-4094 Wordfence
5.5 Medium Products Filter Professional for WooCommerce Plugin woocommerce-products-filter Cross-Site Scripting WOOF / Products Filter Professional for WooCommerce 1.2.3 Persistent XSS 1.2.3 CVE-2020-37174 VulnCheck
6.1 Medium International Sms For Contact Form Plugin cf7-international-sms-integration Cross-Site Scripting WordPress International Sms Contact Form 7 Integration 1.2 XSS No login needed 1.2 CVE-2022-50960 VulnCheck
7.5 High Conditional Fields for Contact Form 7 Plugin cf7-conditional-fields Denial of Service Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption No login needed < 2.7.3 Fixed in 2.7.3 CVE-2026-25863 VulnCheck
5.3 Medium Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Plugin fluentform Broken Access Control Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification No login needed 6.1.21 CVE-2026-4160 Wordfence
6.5 Medium BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Plugin woo-bulk-editor Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification No login needed ≤ 1.1.5 CVE-2026-1672 Wordfence
4.3 Medium BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Plugin woo-bulk-editor Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion No login needed ≤ 1.1.5 CVE-2026-1673 Wordfence
7.1 High Extra Fees Plugin for WooCommerce Plugin woo-conditional-product-fees-for-checkout Cross-Site Request Forgery No login needed ≤ 4.3.3 CVE-2026-39671 Patchstack
9.8 Critical Contact Form by Supsystic Plugin contact-form-by-supsystic Remote Code Execution Unauthenticated Server-Side Template Injection via Prefill Functionality No login needed ≤ 1.7.36 CVE-2026-4257 Wordfence
4.3 Medium Conditional Menus Plugin conditional-menus Cross-Site Request Forgery Cross-Site Request Forgery to Menu Options Update No login needed ≤ 1.2.6 CVE-2026-1032 Wordfence
9.3 Critical PublishPress Revisions Plugin revisionary SQL Injection No login needed ≤ <= 3.7.23 Fixed in 3.7.24 CVE-2026-32539 Patchstack
8.8 High Visionary Core Plugin noo-visionary-core PHP Object Injection ≤ 1.4.9 Fixed in 1.5.0 CVE-2026-24981 Patchstack
7.1 High Visionary Core Plugin noo-visionary-core Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.4.9 Fixed in 1.5.0 CVE-2026-24980 Patchstack
4.3 Medium Smart Custom Fields Plugin smart-custom-fields Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search ≤ 5.0.6 CVE-2026-4066 Wordfence
4.4 Medium Weaver Show Posts Plugin show-posts Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting ≤ 1.8.1 CVE-2026-2121 Wordfence
5.5 Medium Multi Functional Flexi Lightbox Plugin multi-functional-flexi-lightbox Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter ≤ 1.2 CVE-2026-3347 Wordfence
4.3 Medium Conditional CAPTCHA Plugin Open Redirect No login needed ≤ 4.0.0 CVE-2026-1369 WPScan
5.4 Medium PublishPress Revisions Plugin revisionary Cross-Site Request Forgery No login needed ≤ 3.7.22 Fixed in 3.7.23 CVE-2026-25322 Patchstack
7.2 High Product Addons for Woocommerce – Product Options with Custom Fields Plugin woo-custom-product-addons Remote Code Execution Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter ≤ 3.1.0 CVE-2026-2296 Wordfence
6.4 Medium Display During Conditional Shortcode Plugin display-during-conditional-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter ≤ 1.2 CVE-2025-6460 Wordfence
7.2 High Lucky Wheel Giveaway Plugin wp-lucky-wheel Remote Code Execution Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter ≤ 1.0.22 CVE-2025-14541 Wordfence
6.5 Medium Houzez Theme - Functionality Plugin houzez-theme-functionality Cross-Site Scripting Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) ≤ 4.2.6 Fixed in 4.2.7 CVE-2026-24355 Patchstack
7.6 High FireStorm Professional Real Estate Plugin fs-real-estate-plugin SQL Injection ≤ 2.7.11 CVE-2026-22470 Patchstack
4.4 Medium Multi-column Tag Map Plugin multi-column-tag-map Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parameter ≤ 17.0.39 CVE-2025-14057 Wordfence
9.8 Critical Optional Email Plugin optional-email Privilege Escalation Unauthenticated Privilege Escalation to Account Takeover No login needed ≤ 1.3.11 CVE-2025-15018 Wordfence
5.4 Medium Questionar for Elementor Plugin questionar-elementor Broken Access Control ≤ 1.1.7 CVE-2025-66155 Patchstack
7.2 High Lucky Wheel for WooCommerce – Spin a Sale Plugin woo-lucky-wheel Remote Code Execution Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags ≤ 1.1.13 CVE-2025-14509 Wordfence
4.3 Medium HUSKY – Products Filter Professional for WooCommerce Plugin woocommerce-products-filter Broken Access Control Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr' ≤ 1.3.7.3 CVE-2025-13110 Wordfence
4.3 Medium Porto Theme - Functionality Plugin porto-functionality Broken Access Control Functionality plugin < 3.7.3 - Broken Access Control ≤ 3.7.3 Fixed in 3.7.3 CVE-2025-63067 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only