WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 86 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Popup Maker WP Plugin Broken Access Control Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization 1.2.2.1 – 1.4.5 CVE-2026-85005 WPScan
5.4 Medium Advanced Woo Labels – Product Labels & Badges for WooCommerce Plugin advanced-woo-labels Cross-Site Scripting Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 2.51 CVE-2026-12241 Wordfence
5.4 Medium AllAble Connector Plugin allable-connector Broken Access Control ≤ 0.13.4 Fixed in 0.13.6 CVE-2026-97243 Patchstack
4.3 Medium Search Atlas SEO Plugin metasync Broken Access Control Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function ≤ 2.6.23 CVE-2026-15946 Wordfence
5.3 Medium Bookit Plugin bookit-for-cal-com Information Disclosure Unauthenticated Appointment PII Disclosure via Availability Check No login needed < 2.6.0.1 Fixed in 2.6.0.1 CVE-2026-88995 WPScan
6.8 Medium BEAF Plugin Cross-Site Scripting Author+ Stored XSS via Before Label < 4.7.19 Fixed in 4.7.19 CVE-2025-15664 WPScan
6.8 Medium BEAF Plugin Cross-Site Scripting Author+ Stored XSS via After Label < 4.7.19 Fixed in 4.7.19 CVE-2025-15663 WPScan
6.5 Medium Print Barcode Labels for your WooCommerce products/orders Plugin a4-barcode-generator Information Disclosure Sensitive Data Exposure ≤ 4.0.0 Fixed in 4.0.1 CVE-2026-81280 Patchstack
6.5 Medium WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Plugin print-invoices-packing-slip-labels-for-woocommerce Path Traversal Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter ≤ 4.9.8 CVE-2026-18027 Wordfence
6.1 Medium Link Library Plugin link-library Cross-Site Scripting Reflected XSS via Thumbs-Rating likelabel No login needed < 7.9.4 Fixed in 7.9.4 CVE-2026-16535 WPScan
5.3 Medium DHL for WooCommerce Plugin Broken Access Control Unauthenticated Shipping Label Download via IDOR No login needed < 4.0.1 Fixed in 4.0.1 CVE-2026-16981 WPScan
6.4 Medium Advanced Woo Labels Plugin advanced-woo-labels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter ≤ 2.48 CVE-2026-15662 Wordfence
4.8 Medium Bit Form Plugin bit-form Cross-Site Scripting Admin+ Stored XSS via Conversational Form Progress Label < 3.1.4 Fixed in 3.1.4 CVE-2025-15669 WPScan
4.3 Medium Avada Custom Branding Plugin fusion-white-label-branding Broken Access Control ≤ 1.2 CVE-2026-65524 Patchstack
4.4 Medium White Label CMS Plugin white-label-cms Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Import Settings ≤ 2.7.12 CVE-2026-11898 Wordfence
4.3 Medium DHL eCommerce (Benelux) for WooCommerce Plugin dhlpwc Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions ≤ 2.2.3 CVE-2026-9235 Wordfence
6.4 Medium Appointment Booking Calendar Plugin creavi-booking-service Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label ≤ 1.4.4 CVE-2026-1856 Wordfence
4.3 Medium Multicollab: Content Team Collaboration and Editorial Workflow Plugin commenting-feature Broken Access Control Missing Authorization to Authenticated (Subscriber+) Collaboration Comment ≤ 5.2 CVE-2025-4202 Wordfence
4.4 Medium Call for Price for WooCommerce Plugin woocommerce-call-for-price Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings ≤ 4.2.0 CVE-2026-6447 Wordfence
4.4 Medium VideoZen Plugin videozen Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field ≤ 1.0.1 CVE-2026-6439 Wordfence
6.4 Medium Robo Gallery Plugin robo-gallery Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting ≤ 5.1.3 CVE-2026-4300 Wordfence
4.4 Medium CM Custom Reports Plugin cm-custom-reports Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels ≤ 1.2.7 CVE-2026-2432 Wordfence
4.3 Medium Atarim Plugin atarim-visual-collaboration Broken Access Control ≤ 4.3.2 Fixed in 4.3.3 CVE-2026-32447 Patchstack
6.4 Medium Dear Flipbook Plugin Cross-Site Scripting Authenticated (Auhtor+) Stored Cross-Site Scripting via PDF Page Labels ≤ 2.4.20 CVE-2026-2569 Wordfence
6.5 Medium Atarim Plugin atarim-visual-collaboration Broken Access Control No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2025-67993 Patchstack
4.4 Medium Private Comment Plugin private-comment Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting ≤ 0.0.4 CVE-2026-2281 Wordfence
6.4 Medium Orbisius Random Name Generator Plugin orbisius-random-name-generator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute ≤ 1.0.2 CVE-2026-1893 Wordfence
5.3 Medium Atarim Plugin atarim-visual-collaboration Broken Access Control No login needed ≤ 4.3.1 Fixed in 4.3.2 CVE-2026-25019 Patchstack
4.4 Medium Custom Post Type UI Plugin custom-post-type-ui Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter ≤ 1.18.1 CVE-2025-14056 Wordfence
6.4 Medium Canadian Nutrition Facts Label Plugin canadian-nutrition-facts-label Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Nutrition Label Custom Post Type ≤ 3.0 CVE-2025-12715 Wordfence
4.8 Medium Atarim Plugin atarim-visual-collaboration Arbitrary File Upload No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2025-60187 Patchstack
6.1 Medium Label Plugins Plugin label-plugins Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed ≤ 0.5 CVE-2025-12401 Wordfence
5.3 Medium Atarim Plugin atarim-visual-collaboration Information Disclosure Sensitive Data Exposure No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2025-62895 Patchstack
6.4 Medium Countdown Timer for Elementor Plugin countdown-timer-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label' ≤ 1.3.9 CVE-2025-8445 Wordfence
6.4 Medium Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Plugin master-addons Cross-Site Scripting Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox ≤ 2.0.9.0 CVE-2025-8874 Wordfence
6.4 Medium Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Plugin master-addons Cross-Site Scripting Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.8.2 CVE-2025-5284 Wordfence
6.4 Medium Slider, Gallery, and Carousel by MetaSlider Plugin ml-slider Cross-Site Scripting Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter ≤ 3.98.0 CVE-2025-5337 Wordfence
4.3 Medium AI Image Lab – Free AI Image Generator Plugin ai-image-generator-lab Cross-Site Request Forgery Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update No login needed ≤ 1.0.6 CVE-2025-4592 Wordfence
5.3 Medium FraudLabs Pro for WooCommerce Plugin fraudlabs-pro-for-woocommerce Broken Access Control No login needed ≤ 2.22.11 Fixed in 2.22.12 CVE-2025-49320 Patchstack
6.5 Medium Change Add to Cart Button Text for WooCommerce Plugin add-to-cart-button-labels-for-woocommerce Cross-Site Scripting ≤ 2.2.2 Fixed in 2.2.3 CVE-2025-48254 Patchstack
6.5 Medium Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) Plugin swatchly Broken Access Control WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update 1.2.8 – 1.4.0 CVE-2025-2719 Wordfence
6.5 Medium Advanced Woo Labels Plugin advanced-woo-labels Cross-Site Scripting ≤ 2.15 Fixed in 2.16 CVE-2025-32188 Patchstack
4.3 Medium Labinator Content Types Duplicator Plugin labinator-content-types-duplicator Cross-Site Request Forgery No login needed ≤ 1.1.3 CVE-2025-31809 Patchstack
5.5 Medium Groundhogg Plugin groundhogg Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via label Parameter ≤ 3.7.4.1 CVE-2025-1267 Wordfence
6.5 Medium Shipmondo – A complete shipping solution for WooCommerce Plugin pakkelabels-for-woocommerce Information Disclosure A complete shipping solution for WooCommerce plugin <= 5.0.3 - Authenticated Arbitrary WordPress Option Disclosure ≤ 5.0.3 Fixed in 5.0.4 CVE-2025-27001 Patchstack
4.1 Medium Product Labels For Woocommerce Plugin SQL Injection Admin+ SQLi < 1.5.9 Fixed in 1.5.9 CVE-2024-12109 WPScan
4.1 Medium Product Labels For Woocommerce Plugin SQL Injection Admin+ SQLi < 1.5.11 Fixed in 1.5.11 CVE-2024-10638 WPScan
4.3 Medium I Am Gloria Plugin gloria-assistant-by-webtronic-labs Cross-Site Request Forgery No login needed ≤ 1.1.4 CVE-2025-0990 Wordfence
6.5 Medium WP Responsive Auto Fit Text Plugin wp-responsive-slab-text Cross-Site Scripting ≤ 0.2 Fixed in 0.3 CVE-2025-26904 Patchstack
4.3 Medium Print Barcode Labels for your WooCommerce products/orders Plugin a4-barcode-generator Broken Access Control ≤ 3.4.10 Fixed in 3.4.11 CVE-2025-24603 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only