WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–26 of 26 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Divi Membership Plugin Privilege Escalation Unauthenticated Privilege Escalation via 'form_id' Parameter No login needed ≤ 2.2.0 CVE-2026-19652 Wordfence
9.8 Critical Divi Membership Plugin Authentication Bypass Unauthenticated Authentication Bypass via 'paypal_param' Parameter No login needed ≤ 2.3.0 CVE-2026-19660 Wordfence
9.8 Critical User Registration & Membership Pro Plugin user-registration-pro Privilege Escalation Account Takeover No login needed ≤ 5.4.5 Fixed in 5.4.6 CVE-2026-74001 Patchstack
9.3 Critical Membership Plugin – Kadence Memberships Plugin restrict-content Privilege Escalation Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover No login needed ≤ 4.0.0 CVE-2026-9273 Wordfence
9.4 Critical Simple Membership Plugin simple-membership Privilege Escalation Unauthenticated Administrator Account Takeover via Registration Username Collision No login needed < 4.7.8 Fixed in 4.7.8 CVE-2026-15930 WPScan
9.1 Critical User Registration & Membership Plugin user-registration Authentication Bypass Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation No login needed < 5.2.2 Fixed in 5.2.2 CVE-2026-11964 WPScan
9.8 Critical User Registration & Membership Plugin user-registration Privilege Escalation Unauthenticated Privilege Escalation via Membership Registration No login needed ≤ 5.1.2 CVE-2026-1492 Wordfence
9.8 Critical Elated Membership Plugin Authentication Bypass Authentication Bypass via Social Login No login needed ≤ 1.2 CVE-2025-13613 Wordfence
9.8 Critical CRM Memberships Plugin crm-memberships Broken Access Control Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint No login needed ≤ 2.6 CVE-2025-13313 Wordfence
9.8 Critical Tiare Membership Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.2 CVE-2025-13540 Wordfence
9.8 Critical FindAll Membership Plugin Authentication Bypass Authentication Bypass via Social Login No login needed ≤ 1.0.4 CVE-2025-13539 Wordfence
9.8 Critical UrbanGo Membership Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.0.4 CVE-2025-3278 Wordfence
9.8 Critical SetSail Membership Plugin Authentication Bypass Authentication Bypass via Account Takeover No login needed ≤ 1.0.3 CVE-2025-1564 Wordfence
9.8 Critical Academist Membership Plugin Authentication Bypass Authentication Bypass via Account Takeover No login needed ≤ 1.1.6 CVE-2025-1671 Wordfence
9.8 Critical Alloggio Membership Plugin Authentication Bypass Authentication Bypass via Social Login Account Takeover No login needed ≤ 1.1 CVE-2025-1638 Wordfence
9.8 Critical Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Authentication Bypass Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id No login needed ≤ 2.13.7 CVE-2024-12919 Wordfence
9.8 Critical Biagiotti Membership Plugin Authentication Bypass Authentication Bypass via biagiotti_membership_check_facebook_user No login needed ≤ 1.0.2 CVE-2024-12287 Wordfence
9.8 Critical WP Membership Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.6.2 CVE-2024-10547 Wordfence
9.8 Critical Indeed Membership Pro Plugin Authentication Bypass No login needed 7.3 – < 8.6.1 Fixed in 8.6.1 CVE-2020-36832 Wordfence
9.0 Critical Ultimate Membership Pro Plugin indeed-membership-pro PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 12.7 Fixed in 12.8 CVE-2024-43242 Patchstack
9.4 Critical Ultimate Membership Pro Plugin indeed-membership-pro Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 12.7 Fixed in 12.8 CVE-2024-43240 Patchstack
9.8 Critical UsersWP – Front-end login form, User Registration, User Profile & Members Directory Plugin userswp SQL Injection Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress <= 1.2.10 - Unauthenticated SQL Injection via 'uwp_sort_by' No login needed ≤ 1.2.10 CVE-2024-6265 Wordfence
9.1 Critical ARMember Plugin armember-membership Broken Access Control Membership Plugin plugin <= 4.0.28 - Broken Access Control No login needed ≤ 4.0.28 Fixed in 4.0.29 CVE-2024-32948 Patchstack
9.0 Critical ARMember Plugin armember-membership PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 4.0.26 Fixed in 4.0.27 CVE-2024-30223 Patchstack
9.8 Critical Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member SQL Injection User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sor… No login needed 2.1.3 – 2.8.2 CVE-2024-1071 Wordfence
9.6 Critical ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup Plugin armember-membership Cross-Site Request Forgery WordPress ARMember Plugin <= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection No login needed ≤ 4.0.22 Fixed in 4.0.23 CVE-2023-52200 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only