WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–11 of 11 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Newsletters Plugin `newsletters-lite`	Broken Access Control Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter	`≤ 4.17`	Aug 25, 2026	`CVE-2026-75908`	Wordfence
6.5 Medium	AcyMailing SMTP Newsletter Plugin `acymailing`	Cross-Site Scripting	`≤ 10.11.1` Fixed in `11.0.0`	Aug 13, 2026	`CVE-2026-28182`	Patchstack
6.5 Medium	AcyMailing SMTP Newsletter Plugin `acymailing`	Broken Access Control	`≤ 10.11.1` Fixed in `11.0.0`	Aug 13, 2026	`CVE-2026-28181`	Patchstack
6.1 Medium	Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) Plugin `mailin`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 3.1.77`	Jul 10, 2026	`CVE-2026-15297`	Wordfence
6.4 Medium	AcyMailing Plugin `acymailing`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute	`≤ 10.10.2`	Jul 9, 2026	`CVE-2026-12170`	Wordfence
6.5 Medium	Brevo - Email, SMS, Web Push, Chat, and more. Plugin `mailin`	Broken Access Control Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling No login needed	`≤ 3.3.0`	Feb 18, 2026	`CVE-2025-14799`	Wordfence
5.3 Medium	Email Subscribers & Newsletters Plugin `email-subscribers`	Denial of Service Missing Authentication to Unauthenticated Mailing Queue Trigger No login needed	`≤ 5.9.10`	Nov 19, 2025	`CVE-2025-12349`	Wordfence
6.5 Medium	Mailing Group Listserv Plugin `wp-mailing-group`	Cross-Site Request Forgery No login needed	`≤ 3.0.5`	Jun 20, 2025	`CVE-2025-50036`	Patchstack
6.1 Medium	SmartEmailing.cz Plugin `smartemailing`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 2.2.0`	Jan 7, 2025	`CVE-2024-12261`	Wordfence
4.3 Medium	Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) Plugin `mailin`	Cross-Site Request Forgery No login needed	`≤ 3.1.87`	Oct 10, 2024	`CVE-2024-8477`	Wordfence
4.3 Medium	Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue Plugin `mailin`	Cross-Site Request Forgery No login needed	`≤ 3.1.82` Fixed in `3.1.83`	Aug 26, 2024	`CVE-2024-43287`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.