WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 189 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Creator LMS Plugin creatorlms Other Other vulnerability Type ≤ 1.2.19 Fixed in 1.2.20 CVE-2026-62083 Patchstack
4.2 Medium MasterStudy LMS 1.9 Plugin Broken Access Control < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass 1.9 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88848 WPScan
4.3 Medium MasterStudy LMS Plugin Broken Access Control Subscriber+ Lesson Completion Record Creation < 3.7.50 Fixed in 3.7.50 CVE-2026-88847 WPScan
5.3 Medium MasterStudy LMS 2.3.0 Plugin Broken Access Control < 3.7.50 - Unauthenticated Account Creation with Registration Disabled No login needed 2.3.0 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88846 WPScan
4.3 Medium MasterStudy LMS 2.3.0 Plugin Broken Access Control < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import 2.3.0 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88845 WPScan
4.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Subscriber+ Quiz Answer Key Disclosure < 3.4.2 Fixed in 3.4.2 CVE-2026-82850 WPScan
4.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Subscriber+ Arbitrary User Course Progress Disclosure via IDOR < 3.4.2 Fixed in 3.4.2 CVE-2026-82849 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Quiz Attempt Grade Disclosure via IDOR < 3.7.50 Fixed in 3.7.50 CVE-2026-81339 WPScan
4.6 Medium MasterStudy LMS Plugin Content Injection Subscriber+ Stored HTML Injection via Course Discussions < 3.7.50 Fixed in 3.7.50 CVE-2026-81338 WPScan
4.3 Medium Tutor LMS Plugin tutor Broken Access Control Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter ≤ 4.0.7 CVE-2026-18439 Wordfence
6.1 Medium Tutor LMS Plugin tutor Cross-Site Scripting Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters No login needed ≤ 4.0.8 CVE-2026-89081 Wordfence
4.3 Medium Tutor LMS Plugin tutor Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter ≤ 4.0.8 CVE-2026-88944 Wordfence
6.5 Medium Tutor LMS Plugin tutor Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter ≤ 4.0.8 CVE-2026-89333 Wordfence
4.3 Medium Tutor LMS 4.0.0 Plugin Information Disclosure < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure 4.0.0 – < 4.0.8 Fixed in 4.0.8 CVE-2026-85572 WPScan
5.3 Medium DT LMS Plugin dt-lms-lite Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions No login needed ≤ 1.1 CVE-2026-11355 Wordfence
6.8 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Course Highlights < 3.4.1 Fixed in 3.4.1 CVE-2026-82847 WPScan
5.3 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control LMS plugin <= 3.4.0 - Broken Access Control No login needed ≤ 3.4.0 Fixed in 3.4.1 CVE-2026-62132 Patchstack
5.3 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Unauthenticated Course Enrollment Disclosure No login needed 1.3.1 – < 3.4.0 Fixed in 3.4.0 CVE-2026-82848 WPScan
5.3 Medium Masteriyo LMS Plugin learning-management-system Broken Access Control Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion No login needed ≤ 2.2.0 CVE-2026-8279 Wordfence
5.4 Medium LearnDash LMS Plugin Broken Access Control Unauthenticated Arbitrary Course Enrollment via REST Endpoint 4.25.0 – 5.1.6 CVE-2026-12843 Wordfence
6.8 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Course Custom Fields 1.18.0 – < 3.4.0 Fixed in 3.4.0 CVE-2026-82846 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Statistics Disclosure via student/stats REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81199 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Unpublished Course Title Disclosure via course-list REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81197 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Enrollment Disclosure via student-courses REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81195 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter < 3.7.46 Fixed in 3.7.46 CVE-2026-81194 WPScan
5.3 Medium Rank Math SEO Plugin seo-by-rank-math Information Disclosure Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt No login needed < 1.0.277.1 Fixed in 1.0.277.1 CVE-2026-77782 WPScan
4.7 Medium MasterStudy LMS Plugin Open Redirect Unauthenticated Open Redirect No login needed < 3.7.43 Fixed in 3.7.43 CVE-2026-81342 WPScan
4.8 Medium MasterStudy LMS Plugin Price Manipulation Unauthenticated Payment Bypass via PayPal IPN No login needed < 3.7.40 Fixed in 3.7.40 CVE-2026-81026 WPScan
6.5 Medium Tutor LMS Plugin tutor Remote Code Execution Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters No login needed ≤ 4.0.5 CVE-2026-16759 Wordfence
5.3 Medium Tutor LMS Plugin tutor SQL Injection Unauthenticated SQLi via 'offset' and 'item_per_page' Parameters No login needed 4.0.0 – < 4.0.6 Fixed in 4.0.6 CVE-2026-19094 WPScan
4.3 Medium WP Courses LMS Plugin wp-courses Broken Access Control Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter ≤ 3.2.29 CVE-2026-10630 Wordfence
6.8 Medium Tutor LMS Plugin tutor Path Traversal Instructor+ Arbitrary File Read via Video Path < 4.0.6 Fixed in 4.0.6 CVE-2026-19093 WPScan
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-73404 Patchstack
6.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Privilege Escalation ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-68568 Patchstack
6.1 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Quiz Description No login needed < 2.3.3 Fixed in 2.3.3 CVE-2026-19712 WPScan
4.3 Medium Tutor LMS Plugin tutor Information Disclosure Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass < 3.9.14 Fixed in 3.9.14 CVE-2026-14306 WPScan
6.5 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint < 3.8.3 Fixed in 3.8.3 CVE-2026-16563 WPScan
5.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control No login needed ≤ 3.7.39 Fixed in 3.7.40 CVE-2026-28145 Patchstack
4.3 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint ≤ 3.8.2 CVE-2026-12376 WPScan
5.4 Medium Tutor LMS Plugin tutor Information Disclosure Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection < 4.0.0 Fixed in 4.0.0 CVE-2026-14310 WPScan
4.3 Medium LifterLMS Plugin lifterlms Information Disclosure Subscriber+ Sensitive Information Disclosure via select2_query_posts < 10.0.10 Fixed in 10.0.10 CVE-2026-14231 WPScan
6.1 Medium LifterLMS Plugin lifterlms Cross-Site Scripting Instructor+ Stored XSS via Featured Pricing Information No login needed 9.2.3 – < 10.0.10 Fixed in 10.0.10 CVE-2026-14207 WPScan
6.5 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion ≤ 3.7.23 CVE-2026-5060 Wordfence
4.9 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter ≤ 4.0.1 CVE-2026-15444 Wordfence
5.4 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) ≤ 2.3.1 Fixed in 2.3.2 CVE-2026-65463 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Cross-Site Scripting LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) ≤ 2.3.0 Fixed in 2.3.1 CVE-2026-59513 Patchstack
4.3 Medium Tutor LMS Elementor Addons Plugin tutor-lms-elementor-addons Broken Access Control Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation ≤ 4.0.0 CVE-2026-1372 Wordfence
5.4 Medium Academy LMS Plugin academy Broken Access Control Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR < 3.8.1 Fixed in 3.8.1 CVE-2026-14184 WPScan
6.5 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array ≤ 4.0.0 CVE-2026-15022 Wordfence
4.3 Medium Academy LMS Plugin academy Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter ≤ 3.8.0 CVE-2026-9341 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only