WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 312 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Creator LMS Plugin creatorlms Path Traversal ≤ 1.2.19 Fixed in 1.2.20 CVE-2026-97244 Patchstack
5.4 Medium Creator LMS Plugin creatorlms Other Other vulnerability Type ≤ 1.2.19 Fixed in 1.2.20 CVE-2026-62083 Patchstack
4.2 Medium MasterStudy LMS 1.9 Plugin Broken Access Control < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass 1.9 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88848 WPScan
4.3 Medium MasterStudy LMS Plugin Broken Access Control Subscriber+ Lesson Completion Record Creation < 3.7.50 Fixed in 3.7.50 CVE-2026-88847 WPScan
5.3 Medium MasterStudy LMS 2.3.0 Plugin Broken Access Control < 3.7.50 - Unauthenticated Account Creation with Registration Disabled No login needed 2.3.0 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88846 WPScan
4.3 Medium MasterStudy LMS 2.3.0 Plugin Broken Access Control < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import 2.3.0 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88845 WPScan
7.2 High MasterStudy LMS 3.5.29 Plugin Local File Inclusion < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget 3.5.29 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88843 WPScan
4.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Subscriber+ Quiz Answer Key Disclosure < 3.4.2 Fixed in 3.4.2 CVE-2026-82850 WPScan
4.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Subscriber+ Arbitrary User Course Progress Disclosure via IDOR < 3.4.2 Fixed in 3.4.2 CVE-2026-82849 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Quiz Attempt Grade Disclosure via IDOR < 3.7.50 Fixed in 3.7.50 CVE-2026-81339 WPScan
4.6 Medium MasterStudy LMS Plugin Content Injection Subscriber+ Stored HTML Injection via Course Discussions < 3.7.50 Fixed in 3.7.50 CVE-2026-81338 WPScan
4.3 Medium Tutor LMS Plugin tutor Broken Access Control Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter ≤ 4.0.7 CVE-2026-18439 Wordfence
6.1 Medium Tutor LMS Plugin tutor Cross-Site Scripting Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters No login needed ≤ 4.0.8 CVE-2026-89081 Wordfence
4.3 Medium Tutor LMS Plugin tutor Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter ≤ 4.0.8 CVE-2026-88944 Wordfence
6.5 Medium Tutor LMS Plugin tutor Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter ≤ 4.0.8 CVE-2026-89333 Wordfence
2.7 Low MasterStudy LMS 3.6.2 Plugin Information Disclosure < 3.7.50 - Instructor+ Student PII Disclosure via IDOR 3.6.2 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88844 WPScan
3.8 Low MasterStudy LMS Plugin Broken Access Control Instructor+ Order Status Manipulation via IDOR < 3.7.50 Fixed in 3.7.50 CVE-2026-81340 WPScan
4.3 Medium Tutor LMS 4.0.0 Plugin Information Disclosure < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure 4.0.0 – < 4.0.8 Fixed in 4.0.8 CVE-2026-85572 WPScan
7.2 High Tutor LMS 2.7.1 Plugin Privilege Escalation < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification 2.7.1 – < 4.0.8 Fixed in 4.0.8 CVE-2026-85569 WPScan
5.3 Medium DT LMS Plugin dt-lms-lite Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions No login needed ≤ 1.1 CVE-2026-11355 Wordfence
8.8 High Tutor LMS Plugin tutor PHP Object Injection Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution ≤ 4.0.7 CVE-2026-78175 Wordfence
2.7 Low Masteriyo LMS Plugin learning-management-system Information Disclosure Instructor+ Arbitrary Post Disclosure via IDOR 1.14.0 – < 3.4.1 Fixed in 3.4.1 CVE-2026-82851 WPScan
6.8 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Course Highlights < 3.4.1 Fixed in 3.4.1 CVE-2026-82847 WPScan
9.9 Critical Masteriyo LMS Plugin learning-management-system PHP Object Injection Subscriber+ PHP Object Injection < 3.4.1 Fixed in 3.4.1 CVE-2026-82845 WPScan
5.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control LMS plugin <= 3.4.0 - Broken Access Control No login needed ≤ 3.4.0 Fixed in 3.4.1 CVE-2026-62132 Patchstack
8.8 High Masteriyo - LMS Plugin learning-management-system PHP Object Injection LMS plugin <= 3.4.0 - PHP Object Injection ≤ 3.4.0 Fixed in 3.4.1 CVE-2026-62107 Patchstack
5.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Unauthenticated Course Enrollment Disclosure No login needed 1.3.1 – < 3.4.0 Fixed in 3.4.0 CVE-2026-82848 WPScan
5.3 Medium Masteriyo LMS Plugin learning-management-system Broken Access Control Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion No login needed ≤ 2.2.0 CVE-2026-8279 Wordfence
5.4 Medium LearnDash LMS Plugin Broken Access Control Unauthenticated Arbitrary Course Enrollment via REST Endpoint 4.25.0 – 5.1.6 CVE-2026-12843 Wordfence
6.8 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Course Custom Fields 1.18.0 – < 3.4.0 Fixed in 3.4.0 CVE-2026-82846 WPScan
7.5 High LearnDash LMS Plugin Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler ≤ 5.1.5 CVE-2026-12483 Wordfence
8.1 High Agentimus – AI SEO, llms.txt & MCP for AI Agents Plugin agentimus Broken Access Control AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control ≤ 1.51.0 Fixed in 1.51.1 CVE-2026-84779 Patchstack
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Statistics Disclosure via student/stats REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81199 WPScan
3.8 Low MasterStudy LMS Plugin Broken Access Control Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR < 3.7.46 Fixed in 3.7.46 CVE-2026-81198 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Unpublished Course Title Disclosure via course-list REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81197 WPScan
2.7 Low MasterStudy LMS Plugin Information Disclosure Instructor+ Quiz Answer Disclosure via IDOR < 3.7.46 Fixed in 3.7.46 CVE-2026-81196 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Enrollment Disclosure via student-courses REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81195 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter < 3.7.46 Fixed in 3.7.46 CVE-2026-81194 WPScan
5.3 Medium Rank Math SEO Plugin seo-by-rank-math Information Disclosure Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt No login needed < 1.0.277.1 Fixed in 1.0.277.1 CVE-2026-77782 WPScan
4.7 Medium MasterStudy LMS Plugin Open Redirect Unauthenticated Open Redirect No login needed < 3.7.43 Fixed in 3.7.43 CVE-2026-81342 WPScan
2.7 Low MasterStudy LMS Plugin Information Disclosure Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR < 3.7.42 Fixed in 3.7.42 CVE-2026-81200 WPScan
4.8 Medium MasterStudy LMS Plugin Price Manipulation Unauthenticated Payment Bypass via PayPal IPN No login needed < 3.7.40 Fixed in 3.7.40 CVE-2026-81026 WPScan
6.5 Medium Tutor LMS Plugin tutor Remote Code Execution Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters No login needed ≤ 4.0.5 CVE-2026-16759 Wordfence
9.8 Critical Tutor LMS Plugin tutor Content Injection Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing No login needed 2.1.3 – < 4.0.6 Fixed in 4.0.6 CVE-2026-19092 WPScan
5.3 Medium Tutor LMS Plugin tutor SQL Injection Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters No login needed 4.0.0 – < 4.0.6 Fixed in 4.0.6 CVE-2026-19094 WPScan
4.3 Medium WP Courses LMS Plugin wp-courses Broken Access Control Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter ≤ 3.2.29 CVE-2026-10630 Wordfence
8.6 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system Arbitrary File Deletion No login needed ≤ 3.7.42 Fixed in 3.7.43 CVE-2026-78284 Patchstack
6.8 Medium Tutor LMS Plugin tutor Path Traversal Instructor+ Arbitrary File Read via Video Path < 4.0.6 Fixed in 4.0.6 CVE-2026-19093 WPScan
2.7 Low Tutor LMS Plugin tutor Information Disclosure Instructor+ Cross-Instructor Private Course Disclosure via IDOR < 4.0.6 Fixed in 4.0.6 CVE-2026-14187 WPScan
9.8 Critical Masteriyo - LMS Plugin learning-management-system Arbitrary File Upload LMS plugin <= 2.3.2 - Arbitrary File Upload No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-73996 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only