WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–39 of 39 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Mailchimp for WooCommerce Plugin mailchimp-for-woocommerce Broken Access Control Unauthenticated Abandoned Cart Modification and Deletion No login needed < 6.3 Fixed in 6.3 CVE-2026-92437 WPScan
5.3 Medium Mailchimp for WooCommerce Plugin mailchimp-for-woocommerce Information Disclosure Unauthenticated Customer Email and Cart Disclosure via IDOR No login needed < 6.3 Fixed in 6.3 CVE-2026-92436 WPScan
6.1 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Cross-Site Scripting Reflected Cross-Site Scripting via 'data' Dynamic Content Tag No login needed ≤ 4.14.0 CVE-2026-87917 Wordfence
5.3 Medium Mailchimp for WooCommerce Plugin mailchimp-for-woocommerce Broken Access Control Unauthenticated Broken Access Control in REST API No login needed < 6.1.1 Fixed in 6.1.1 CVE-2026-92435 WPScan
5.4 Medium Simple Membership MailChimp Integration Plugin simple-membership-mailchimp-integration Cross-Site Request Forgery API Key Update via CSRF No login needed < 1.9.8 Fixed in 1.9.8 CVE-2026-8151 WPScan
6.4 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages ≤ 4.12.0 CVE-2026-4561 Wordfence
5.3 Medium GutenKit Plugin gutenkit-blocks-addon Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints No login needed ≤ 2.4.12 CVE-2026-15827 Wordfence
6.4 Medium Single Mailchimp Plugin single-mailchimp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.4 CVE-2026-8868 Wordfence
6.5 Medium Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms Plugin cf7-mailchimp Broken Access Control ≤ 1.2.2 Fixed in 1.2.3 CVE-2026-25430 Patchstack
6.5 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Broken Access Control Missing Authorization to Unauthenticated Arbitrary Subscription Deletion No login needed ≤ 4.11.1 CVE-2026-1781 Wordfence
4.3 Medium Mailchimp List Subscribe Form Plugin mailchimp Cross-Site Request Forgery Cross-Site Request Forgery to Mailchimp List Change No login needed ≤ 2.0.0 CVE-2025-12172 Wordfence
5.3 Medium MailChimp Campaigns Plugin olalaweb-mailchimp-campaign-manager Broken Access Control Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection No login needed ≤ 3.2.4 CVE-2026-1303 Wordfence
4.3 Medium contact-form-7-mailchimp-extension Plugin contact-form-7-mailchimp-extension Information Disclosure Sensitive Data Exposure ≤ 0.9.68 Fixed in 0.9.69 CVE-2025-68989 Patchstack
4.3 Medium FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) Plugin fusewp Broken Access Control WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation ≤ 1.1.23.0 CVE-2025-11975 Wordfence
4.3 Medium FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) Plugin fusewp Cross-Site Request Forgery WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation No login needed ≤ 1.1.23.0 CVE-2025-11976 Wordfence
4.0 Medium Block For Mailchimp – Easy Mailchimp Form Integration Plugin block-for-mailchimp Server-Side Request Forgery Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery No login needed ≤ 1.1.12 CVE-2025-10735 Wordfence
5.3 Medium CF7 7 Mailchimp Add-on Plugin cf7-mailchimp-addon Broken Access Control No login needed ≤ 2.4 Fixed in 2.4 CVE-2025-29012 Patchstack
6.5 Medium Nmedia MailChimp Plugin nmedia-mailchimp-widget Cross-Site Scripting ≤ 5.4 CVE-2025-30613 Patchstack
6.5 Medium MailChimp Subscribe Forms Plugin mailchimp-subscribe-sm Cross-Site Scripting ≤ 4.1 Fixed in 4.2 CVE-2025-22727 Patchstack
5.3 Medium Popup – MailChimp, GetResponse and ActiveCampaign Intergrations Plugin ultimate-popup-creator Broken Access Control MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation No login needed ≤ 3.2.6 CVE-2024-12158 Wordfence
4.3 Medium MailChimp Forms by MailMunch Plugin mailchimp-forms-by-mailmunch Broken Access Control No login needed ≤ 3.1.4 Fixed in 3.1.5 CVE-2023-40203 Patchstack
6.1 Medium MailChimp Forms by MailMunch Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.2.3 CVE-2024-8726 Wordfence
5.9 Medium MailChimp Subscribe Forms Plugin mailchimp-subscribe-sm Cross-Site Scripting Stored Cross-Site Scripting ≤ 4.0.9.9 CVE-2024-43211 Patchstack
6.1 Medium Forms for Mailchimp by Optin Cat – Grow Your MailChimp List Plugin mailchimp-wp Cross-Site Scripting Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting No login needed ≤ 2.5.6 CVE-2024-8870 Wordfence
4.4 Medium Forms for Mailchimp by Optin Cat Plugin mailchimp-wp Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters ≤ 2.5.7 CVE-2024-7489 Wordfence
6.1 Medium MC4WP: Mailchimp Top Bar Plugin mailchimp-top-bar Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.0 CVE-2024-9210 Wordfence
5.4 Medium Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin Plugin mailoptin Cross-Site Scripting MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.70.3 CVE-2024-8628 Wordfence
4.4 Medium MailChimp Plugin mailchimp-for-wp Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 4.9.16 CVE-2024-8680 Wordfence
6.1 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Cross-Site Scripting Reflected Cross-Site Scripting No login needed 4.9.9 – 4.9.16 CVE-2024-8850 Wordfence
4.2 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification ≤ 5.1.18 CVE-2024-5053 Wordfence
4.3 Medium Getwid – Gutenberg Blocks Plugin getwid Broken Access Control Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update ≤ 2.0.10 CVE-2024-6491 Wordfence
5.3 Medium MC4WP Plugin mailchimp-for-wp Broken Access Control No login needed ≤ 4.9.9 Fixed in 4.9.10 CVE-2023-51682 Patchstack
5.3 Medium Easy Forms for Mailchimp Plugin yikes-inc-easy-mailchimp-extender Broken Access Control No login needed ≤ 6.9.0 CVE-2024-35742 Patchstack
4.3 Medium Contact Form 7 Extension For Mailchimp Plugin contact-form-7-mailchimp-extension Cross-Site Request Forgery No login needed ≤ 0.5.70 CVE-2024-33677 Patchstack
5.4 Medium MailChimp Forms by MailMunch Plugin mailchimp-forms-by-mailmunch Cross-Site Request Forgery No login needed ≤ 3.2.1 Fixed in 3.2.2 CVE-2024-31378 Patchstack
5.3 Medium Paid Memberships Pro – Mailchimp Add On Plugin pmpro-mailchimp Information Disclosure Mailchimp Add On plugin <= 2.3.4 - Sensitive Data Exposure No login needed ≤ 2.3.4 Fixed in 2.3.5 CVE-2024-30523 Patchstack
6.5 Medium MailChimp Forms by MailMunch Plugin mailchimp-forms-by-mailmunch Cross-Site Scripting ≤ 3.2.2 Fixed in 3.2.3 CVE-2024-29793 Patchstack
4.9 Medium Contact Form 7 Extension For Mailchimp Plugin contact-form-7-mailchimp-extension Server-Side Request Forgery WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF) ≤ 0.5.70 CVE-2024-22134 Patchstack
4.8 Medium Easy Forms for Mailchimp Plugin Cross-Site Scripting Admin+ Stored Cross-Site Scripting ≤ 6.8.10 CVE-2023-4925 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only