WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 1–50 of 91 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.9 Medium | NEX-Forms | SQL Injection Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter |
≤ 9.3.0 |
CVE-2026-75961 |
Wordfence | |
| 4.3 Medium | BEAR - Bulk Editor and Products Manager Professional for WooCommerce | Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF No login needed |
< 1.2.2 Fixed in 1.2.2 |
CVE-2026-84024 |
WPScan | |
| 6.5 Medium | BEAR - Bulk Editor and Products Manager Professional for WooCommerce | Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF No login needed |
< 1.2.2 Fixed in 1.2.2 |
CVE-2026-84023 |
WPScan | |
| 6.8 Medium | Bold Page Builder | Cross-Site Scripting Contributor+ Stored XSS via Slider Elements' additional_settings |
< 5.9.9 Fixed in 5.9.9 |
CVE-2026-84028 |
WPScan | |
| 4.9 Medium | NEX-Forms | SQL Injection Authenticated (Admin+) SQL Injection via 'additional_params' Parameter |
≤ 9.2.4 |
CVE-2026-15602 |
Wordfence | |
| 4.8 Medium | Bit Form | Cross-Site Scripting Admin+ Stored XSS via Conversational Form Progress Label |
< 3.1.4 Fixed in 3.1.4 |
CVE-2025-15669 |
WPScan | |
| 6.5 Medium | Extra Product Options Builder for WooCommerce | Broken Access Control No login needed |
≤ 1.2.167 Fixed in 1.2.168 |
CVE-2026-57390 |
Patchstack | |
| 6.4 Medium | bbp style pack | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields |
≤ 6.4.5 |
CVE-2026-15010 |
Wordfence | |
| 6.4 Medium | Advanced iFrame | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute |
≤ 2026.1 |
CVE-2026-6742 |
Wordfence | |
| 4.3 Medium | FOX – Currency Switcher Professional for WooCommerce | Broken Access Control Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter |
≤ 1.4.6 |
CVE-2026-9241 |
Wordfence | |
| 5.5 Medium | Products Filter Professional for WooCommerce | Cross-Site Scripting WOOF / Products Filter Professional for WooCommerce 1.2.3 Persistent XSS |
1.2.3 |
CVE-2020-37174 |
VulnCheck | |
| 6.1 Medium | International Sms For Contact Form | Cross-Site Scripting WordPress International Sms Contact Form 7 Integration 1.2 XSS No login needed |
1.2 |
CVE-2022-50960 |
VulnCheck | |
| 5.3 Medium | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | Broken Access Control Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification No login needed |
6.1.21 |
CVE-2026-4160 |
Wordfence | |
| 6.5 Medium | BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification No login needed |
≤ 1.1.5 |
CVE-2026-1672 |
Wordfence | |
| 4.3 Medium | BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net | Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion No login needed |
≤ 1.1.5 |
CVE-2026-1673 |
Wordfence | |
| 4.3 Medium | Conditional Menus | Cross-Site Request Forgery Cross-Site Request Forgery to Menu Options Update No login needed |
≤ 1.2.6 |
CVE-2026-1032 |
Wordfence | |
| 4.3 Medium | Smart Custom Fields | Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search |
≤ 5.0.6 |
CVE-2026-4066 |
Wordfence | |
| 4.4 Medium | Weaver Show Posts | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting |
≤ 1.8.1 |
CVE-2026-2121 |
Wordfence | |
| 5.5 Medium | Multi Functional Flexi Lightbox | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter |
≤ 1.2 |
CVE-2026-3347 |
Wordfence | |
| 4.3 Medium | Conditional CAPTCHA | Open Redirect No login needed |
≤ 4.0.0 |
CVE-2026-1369 |
WPScan | |
| 5.4 Medium | PublishPress Revisions | Cross-Site Request Forgery No login needed |
≤ 3.7.22 Fixed in 3.7.23 |
CVE-2026-25322 |
Patchstack | |
| 6.4 Medium | Display During Conditional Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter |
≤ 1.2 |
CVE-2025-6460 |
Wordfence | |
| 6.5 Medium | Houzez Theme - Functionality | Cross-Site Scripting Functionality plugin <= 4.2.6 - Cross Site Scripting (XSS) |
≤ 4.2.6 Fixed in 4.2.7 |
CVE-2026-24355 |
Patchstack | |
| 4.4 Medium | Multi-column Tag Map | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'mctm_css_conditional' Parameter |
≤ 17.0.39 |
CVE-2025-14057 |
Wordfence | |
| 5.4 Medium | Questionar for Elementor | Broken Access Control |
≤ 1.1.7 |
CVE-2025-66155 |
Patchstack | |
| 4.3 Medium | HUSKY – Products Filter Professional for WooCommerce | Broken Access Control Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr' |
≤ 1.3.7.3 |
CVE-2025-13110 |
Wordfence | |
| 4.3 Medium | Porto Theme - Functionality | Broken Access Control Functionality plugin < 3.7.3 - Broken Access Control |
≤ 3.7.3 Fixed in 3.7.3 |
CVE-2025-63067 |
Patchstack | |
| 6.5 Medium | Porto Theme - Functionality | Cross-Site Scripting Functionality plugin < 3.7.3 - Cross Site Scripting (XSS) |
≤ 3.7.3 Fixed in 3.7.3 |
CVE-2025-63066 |
Patchstack | |
| 4.3 Medium | HUSKY – Products Filter Professional for WooCommerce | Broken Access Control Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query' |
≤ 1.3.7.2 |
CVE-2025-13109 |
Wordfence | |
| 4.3 Medium | Conditional Maintenance Mode | Cross-Site Request Forgery No login needed |
≤ 1.0.0 |
CVE-2025-12586 |
Wordfence | |
| 6.5 Medium | Houzez Theme - Functionality | Cross-Site Scripting Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) |
≤ 4.2.0 Fixed in 4.2.0 |
CVE-2025-62058 |
Patchstack | |
| 4.3 Medium | Professional Contact Form | Cross-Site Request Forgery Cross-Site Request Forgery to Test Email Sending No login needed |
≤ 1.0.0 |
CVE-2025-9944 |
Wordfence | |
| 5.9 Medium | WooCommerce Additional Fees On Checkout (Free) | Cross-Site Scripting |
≤ 1.5.2 Fixed in 1.5.3 |
CVE-2025-57903 |
Patchstack | |
| 6.5 Medium | Additional Custom Product Tabs for WooCommerce | Cross-Site Scripting |
≤ 1.7.3 Fixed in 1.7.4 |
CVE-2025-58985 |
Patchstack | |
| 6.5 Medium | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | PHP Object Injection Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder 5.1.16 - 6.1.1 - Authenticated (Subscriber+) PHP Object Injection To Arbitrary File Read |
5.1.16 – 6.1.1 |
CVE-2025-9260 |
Wordfence | |
| 6.5 Medium | Simple Download Monitor | SQL Injection Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality |
≤ 3.9.33 |
CVE-2025-8977 |
Wordfence | |
| 6.1 Medium | Linux Promotional | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed |
≤ 1.4 |
CVE-2025-7668 |
Wordfence | |
| 5.3 Medium | Interactive Regional Map of Florida | Broken Access Control No login needed |
≤ 1.0 |
CVE-2025-49441 |
Patchstack | |
| 4.3 Medium | Interactive UK Regional Map | Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed |
≤ 2.0 |
CVE-2025-49445 |
Patchstack | |
| 4.3 Medium | Interactive Regional Map of Africa | Cross-Site Request Forgery No login needed |
≤ 1.0 |
CVE-2025-49449 |
Patchstack | |
| 6.4 Medium | Bold Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter |
≤ 5.3.6 |
CVE-2025-5286 |
Wordfence | |
| 6.5 Medium | Additional Custom Emails & Recipients for WooCommerce | Cross-Site Scripting |
≤ 3.5.1 Fixed in 3.5.2 |
CVE-2025-48251 |
Patchstack | |
| 6.5 Medium | Conditional Payments for WooCommerce | Cross-Site Request Forgery No login needed |
≤ 3.3.0 Fixed in 3.3.1 |
CVE-2025-39563 |
Patchstack | |
| 6.5 Medium | Conditional Shipping for WooCommerce | Cross-Site Request Forgery No login needed |
≤ 3.4.0 Fixed in 3.4.1 |
CVE-2025-39564 |
Patchstack | |
| 6.5 Medium | Additional Custom Product Tabs for WooCommerce | Cross-Site Scripting |
≤ 1.7.0 Fixed in 1.7.1 |
CVE-2025-26749 |
Patchstack | |
| 6.4 Medium | Link Library | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters |
≤ 7.7.3 |
CVE-2025-2889 |
Wordfence | |
| 5.3 Medium | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | Other Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 5.2.12 - IP-Spoofing No login needed |
≤ 5.2.12 |
CVE-2024-13666 |
Wordfence | |
| 5.3 Medium | Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More | Information Disclosure The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure No login needed |
≤ 2.5.0 |
CVE-2024-11153 |
Wordfence | |
| 6.1 Medium | Google Map Professional | Cross-Site Scripting Reflected XSS No login needed |
≤ 1.0 |
CVE-2024-13220 |
WPScan | |
| 6.5 Medium | Conversational Forms for ChatBot | Cross-Site Scripting |
≤ 1.4.2 Fixed in 1.4.3 |
CVE-2025-22813 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.