WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 284 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Memberful - Membership Plugin memberful-wp Information Disclosure Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure ≤ 1.81.2 Fixed in 1.82.0 CVE-2026-104401 Patchstack
7.5 High Simple Membership Plugin simple-membership Broken Access Control Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints No login needed ≤ 4.8.3 CVE-2026-97337 Wordfence
6.1 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Cross-Site Scripting Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter No login needed ≤ 4.17.4 CVE-2026-92551 Wordfence
8.8 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields ≤ 4.17.4 CVE-2026-92536 Wordfence
9.8 Critical Divi Membership Plugin Privilege Escalation Unauthenticated Privilege Escalation via 'form_id' Parameter No login needed ≤ 2.2.0 CVE-2026-19652 Wordfence
9.8 Critical Divi Membership Plugin Authentication Bypass Unauthenticated Authentication Bypass via 'paypal_param' Parameter No login needed ≤ 2.3.0 CVE-2026-19660 Wordfence
8.0 High Memberful - Membership Plugin memberful-wp Cross-Site Request Forgery Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) ≤ 1.81.0 Fixed in 1.81.1 CVE-2026-103067 Patchstack
4.2 Medium MasterStudy LMS 1.9 Plugin Broken Access Control < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass 1.9 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88848 WPScan
8.1 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) ≤ 4.17.2 CVE-2026-85658 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.8.2 Fixed in 4.8.3 CVE-2026-74000 Patchstack
5.3 Medium Paid Member Subscriptions Plugin Price Manipulation Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch No login needed < 3.0.9 Fixed in 3.0.9 CVE-2026-90922 WPScan
3.8 Low FluentBoards Plugin fluent-boards Broken Access Control Board Member+ Board Membership and Public Access Modification < 2.0.15 Fixed in 2.0.15 CVE-2026-89328 WPScan
4.3 Medium FluentBoards Plugin fluent-boards Information Disclosure Subscriber+ Private Board Membership Disclosure via IDOR < 2.0.15 Fixed in 2.0.15 CVE-2026-85349 WPScan
5.4 Medium Simple Membership Plugin simple-membership Privilege Escalation Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref < 4.7.8 Fixed in 4.7.8 CVE-2026-88764 WPScan
3.7 Low User Registration & Membership Plugin user-registration Information Disclosure Unauthenticated User Data Disclosure via Membership Thank You Page No login needed 5.0 – < 5.2.8 Fixed in 5.2.8 CVE-2026-86407 WPScan
7.5 High User Registration & Membership Plugin user-registration Privilege Escalation Subscriber+ Privilege Escalation via Membership Purchase 4.4.6 – < 5.2.8 Fixed in 5.2.8 CVE-2026-86406 WPScan
4.7 Medium User Registration & Membership Plugin user-registration Open Redirect Unauthenticated Open Redirect via Login Redirect Parameters No login needed < 5.2.8 Fixed in 5.2.8 CVE-2026-80072 WPScan
7.2 High User Registration & Membership Plugin user-registration Privilege Escalation Author+ Privilege Escalation to Administrator < 5.2.8 Fixed in 5.2.8 CVE-2026-80071 WPScan
8.1 High IDB Ecommerce (wpStoreCart 5) Plugin PHP Object Injection Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php No login needed ≤ 5.0.7 CVE-2026-84099 WPScan
6.1 Medium WP-Members Membership Plugin wp-members Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.5.6 CVE-2026-84960 Wordfence
5.3 Medium WCFM Membership Plugin wc-multivendor-membership Broken Access Control No login needed ≤ 2.11.11 Fixed in 2.12.0 CVE-2026-32480 Patchstack
7.1 High WCFM Membership Plugin wc-multivendor-membership Privilege Escalation ≤ 2.11.11 Fixed in 2.12.0 CVE-2026-84756 Patchstack
5.4 Medium Simple Membership MailChimp Integration Plugin simple-membership-mailchimp-integration Cross-Site Request Forgery API Key Update via CSRF No login needed < 1.9.8 Fixed in 1.9.8 CVE-2026-8151 WPScan
5.3 Medium Simple Membership Plugin simple-membership Authentication Bypass Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding No login needed ≤ 4.8.1 CVE-2026-77194 Wordfence
4.3 Medium Frontend Admin by DynamiApps Plugin acf-frontend-form-element Broken Access Control Subscriber+ Arbitrary Membership Plan Deletion < 3.29.11 Fixed in 3.29.11 CVE-2026-81346 WPScan
7.2 High User Registration & Membership Plugin user-registration Privilege Escalation Authenticated Privilege Escalation via Login Settings < 5.2.6 Fixed in 5.2.6 CVE-2026-79996 WPScan
4.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Subscriber+ Pending Email Change Cancellation via IDOR < 5.2.5 Fixed in 5.2.5 CVE-2026-79995 WPScan
9.8 Critical User Registration & Membership Pro Plugin user-registration-pro Privilege Escalation Account Takeover No login needed ≤ 5.4.5 Fixed in 5.4.6 CVE-2026-74001 Patchstack
8.5 High YITH WooCommerce Membership Premium Plugin yith-woocommerce-membership-premium SQL Injection ≤ 2.33.0 Fixed in 2.33.1 CVE-2026-32552 Patchstack
5.3 Medium Membership For WooCommerce Plugin membership-for-woocommerce Information Disclosure Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass No login needed < 3.1.2 Fixed in 3.1.2 CVE-2026-19709 WPScan
5.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field ≤ 4.16.19 CVE-2026-18385 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Price Manipulation Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification No login needed < 4.7.7 Fixed in 4.7.7 CVE-2026-14936 WPScan
7.5 High Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2026-66712 Patchstack
4.3 Medium RealHomes Memberships Plugin inspiry-memberships Price Manipulation Subscriber+ Membership Payment Bypass < 3.1.0 Fixed in 3.1.0 CVE-2026-15246 WPScan
7.5 High User Registration & Membership Plugin user-registration Broken Access Control Unauthenticated Account Creation While Registration Disabled No login needed < 5.2.6 Fixed in 5.2.6 CVE-2026-16736 WPScan
9.3 Critical Membership Plugin – Kadence Memberships Plugin restrict-content Privilege Escalation Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover No login needed ≤ 4.0.0 CVE-2026-9273 Wordfence
6.1 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored XSS via PayPal Subscription Subscriber Name No login needed < 4.7.8 Fixed in 4.7.8 CVE-2026-15931 WPScan
9.4 Critical Simple Membership Plugin simple-membership Privilege Escalation Unauthenticated Administrator Account Takeover via Registration Username Collision No login needed < 4.7.8 Fixed in 4.7.8 CVE-2026-15930 WPScan
4.3 Medium RealHomes Memberships Plugin inspiry-memberships Broken Access Control Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action ≤ 3.0.9 CVE-2026-10782 Wordfence
8.8 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Privilege Escalation Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta ≤ 2.0.0 CVE-2026-15414 Wordfence
5.3 Medium Klubraum Membership Request Plugin klubraum-membership-request Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update No login needed ≤ 1.1.0 CVE-2026-4604 Wordfence
6.4 Medium Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Plugin Cross-Site Scripting Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 3.8.1 CVE-2026-15016 Wordfence
6.5 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Price Manipulation Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery No login needed < 5.9.9.7 Fixed in 5.9.9.7 CVE-2026-12688 WPScan
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Unauthenticated Limited User Deletion via Stripe Subscription Handler No login needed 4.2.3 – < 5.2.3 Fixed in 5.2.3 CVE-2026-11966 WPScan
8.1 High User Registration & Membership Plugin user-registration Privilege Escalation Unauthenticated Privilege Escalation via Unbound members_data Membership ID No login needed < 5.2.3 Fixed in 5.2.3 CVE-2026-11961 WPScan
8.8 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary File Upload Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion ≤ 4.16.18 CVE-2026-13352 Wordfence
8.6 High Membership For WooCommerce Plugin membership-for-woocommerce Arbitrary File Deletion No login needed ≤ 3.1.0 Fixed in 3.1.1 CVE-2026-57709 Patchstack
9.1 Critical User Registration & Membership Plugin user-registration Authentication Bypass Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation No login needed < 5.2.2 Fixed in 5.2.2 CVE-2026-11964 WPScan
8.1 High User Registration & Membership Plugin user-registration Broken Access Control Subscriber+ Cross-User Role and Membership Tier Modification via IDOR < 5.2.2 Fixed in 5.2.2 CVE-2026-11963 WPScan
5.3 Medium Members Plugin members Information Disclosure Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel No login needed ≤ 3.2.22 CVE-2026-12426 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only