WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 73 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Simple Membership Plugin simple-membership Broken Access Control Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints No login needed ≤ 4.8.3 CVE-2026-97337 Wordfence
8.8 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure via Shortcode Injection via Nickname and Biographical Info Profile Fields ≤ 4.17.4 CVE-2026-92536 Wordfence
8.0 High Memberful - Membership Plugin memberful-wp Cross-Site Request Forgery Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) ≤ 1.81.0 Fixed in 1.81.1 CVE-2026-103067 Patchstack
8.1 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) ≤ 4.17.2 CVE-2026-85658 Wordfence
7.5 High User Registration & Membership Plugin user-registration Privilege Escalation Subscriber+ Privilege Escalation via Membership Purchase 4.4.6 – < 5.2.8 Fixed in 5.2.8 CVE-2026-86406 WPScan
7.2 High User Registration & Membership Plugin user-registration Privilege Escalation Author+ Privilege Escalation to Administrator < 5.2.8 Fixed in 5.2.8 CVE-2026-80071 WPScan
8.1 High IDB Ecommerce (wpStoreCart 5) Plugin PHP Object Injection Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php No login needed ≤ 5.0.7 CVE-2026-84099 WPScan
7.1 High WCFM Membership Plugin wc-multivendor-membership Privilege Escalation ≤ 2.11.11 Fixed in 2.12.0 CVE-2026-84756 Patchstack
7.2 High User Registration & Membership Plugin user-registration Privilege Escalation Authenticated Privilege Escalation via Login Settings < 5.2.6 Fixed in 5.2.6 CVE-2026-79996 WPScan
8.5 High YITH WooCommerce Membership Premium Plugin yith-woocommerce-membership-premium SQL Injection ≤ 2.33.0 Fixed in 2.33.1 CVE-2026-32552 Patchstack
7.5 High Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2026-66712 Patchstack
7.5 High User Registration & Membership Plugin user-registration Broken Access Control Unauthenticated Account Creation While Registration Disabled No login needed < 5.2.6 Fixed in 5.2.6 CVE-2026-16736 WPScan
8.8 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Privilege Escalation Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta ≤ 2.0.0 CVE-2026-15414 Wordfence
8.1 High User Registration & Membership Plugin user-registration Privilege Escalation Unauthenticated Privilege Escalation via Unbound members_data Membership ID No login needed < 5.2.3 Fixed in 5.2.3 CVE-2026-11961 WPScan
8.8 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary File Upload Authenticated (Author+) Limited Unsafe File Upload via upload_mimes Filter Expansion ≤ 4.16.18 CVE-2026-13352 Wordfence
8.6 High Membership For WooCommerce Plugin membership-for-woocommerce Arbitrary File Deletion No login needed ≤ 3.1.0 Fixed in 3.1.1 CVE-2026-57709 Patchstack
8.1 High User Registration & Membership Plugin user-registration Broken Access Control Subscriber+ Cross-User Role and Membership Tier Modification via IDOR < 5.2.2 Fixed in 5.2.2 CVE-2026-11963 WPScan
7.5 High Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member SQL Injection User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection No login needed ≤ 2.10.1 CVE-2026-15290 Wordfence
8.1 High WCFM - WooCommerce Multivendor Membership Plugin wc-multivendor-membership Broken Access Control WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite ≤ 2.11.10 CVE-2026-3688 Wordfence
8.8 High Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored XSS via Stripe Webhook API Version No login needed < 4.7.5 Fixed in 4.7.5 CVE-2026-11855 WPScan
8.8 High Paid Memberships Pro - Add Member From Admin Plugin pmpro-add-member-admin Cross-Site Request Forgery Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) No login needed ≤ 0.7.2 Fixed in 0.7.3 CVE-2026-57659 Patchstack
7.5 High Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2026-34886 Patchstack
7.3 High WCFM Membership Plugin wc-multivendor-membership Broken Access Control No login needed ≤ 2.11.10 Fixed in 2.11.11 CVE-2026-42753 Patchstack
8.2 High Membership Plugin membership-for-woocommerce SQL Injection WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx No login needed 1.4.7 CVE-2020-37244 VulnCheck
8.8 High User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend PHP Object Injection Authenticated (Subscriber+) PHP Object Injection ≤ 4.3.1 CVE-2026-5127 Wordfence
7.1 High Paid Memberships Pro Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption ≤ 3.6.5 CVE-2026-4100 Wordfence
7.5 High ARMember Plugin armember-membership SQL Injection Unauthenticated SQL Injection via 'orderby' Parameter No login needed ≤ 4.0.60 CVE-2026-7649 Wordfence
8.8 High Advanced Members for ACF Plugin advanced-members Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal ≤ 1.2.5 CVE-2026-3243 Wordfence
7.1 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Broken Access Control ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass ≤ 4.16.11 CVE-2026-3445 Wordfence
7.1 High Vayvo Theme vayvo-progression Cross-Site Scripting Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) No login needed ≤ 6.8 Fixed in 6.8 CVE-2026-25373 Patchstack
8.1 High Ultimate Membership Pro Plugin indeed-membership-pro Privilege Escalation Account Takeover No login needed ≤ 13.7 Fixed in 13.7.1 CVE-2026-25357 Patchstack
8.1 High Membership Plugin – Restrict Content Plugin restrict-content Privilege Escalation Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level' No login needed ≤ 3.2.20 CVE-2026-1321 Wordfence
8.8 High User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload ≤ 4.2.8 CVE-2026-1565 Wordfence
8.1 High User Registration & Membership Plugin user-registration Authentication Bypass No login needed ≤ 5.1.2 CVE-2026-1779 Wordfence
8.8 High WP Membership Plugin wp-membership Privilege Escalation ≤ 1.6.4 CVE-2025-69292 Patchstack
7.3 High WP Membership Plugin wp-membership Broken Access Control No login needed ≤ 1.6.4 CVE-2025-69193 Patchstack
8.2 High Membership Plugin – Restrict Content Plugin restrict-content Broken Access Control Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure No login needed ≤ 3.2.16 CVE-2025-14844 Wordfence
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.0.3 Fixed in 3.0.4 CVE-2025-67909 Patchstack
7.1 High Team Members Showcase Plugin wps-team Cross-Site Scripting Reflected XSS No login needed < 3.5.0 Fixed in 3.5.0 CVE-2025-11560 WPScan
7.5 High wpForo Forum Plugin wpforo SQL Injection Unauthenticated SQL Injection via get_members Function No login needed ≤ 2.4.8 CVE-2025-4203 Wordfence
7.1 High SUMO Memberships for WooCommerce Plugin sumomemberships Cross-Site Request Forgery No login needed ≤ 7.8.0 Fixed in 7.8.0 CVE-2025-62005 Patchstack
8.8 High SUMO Memberships for WooCommerce Plugin sumomemberships Privilege Escalation ≤ 7.8.0 Fixed in 7.9.0 CVE-2025-60222 Patchstack
8.8 High StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More Plugin storeengine Arbitrary File Upload Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload ≤ 1.5.0 CVE-2025-9216 Wordfence
8.1 High Wptobe-memberships Plugin wptobe-memberships Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion ≤ 3.4.2 CVE-2025-9048 Wordfence
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control No login needed ≤ 2.9.0 Fixed in 3.0.0 CVE-2025-54692 Patchstack
7.5 High Membership For WooCommerce Plugin membership-for-woocommerce Broken Access Control No login needed ≤ 2.8.1 Fixed in 2.8.2 CVE-2025-49265 Patchstack
8.1 High User Registration & Membership Plugin user-registration Authentication Bypass No login needed < 4.1.3 Fixed in 4.1.3 CVE-2025-2594 WPScan
8.8 High Team Members Plugin wps-team PHP Object Injection ≤ 3.4.4 Fixed in 3.4.5 CVE-2025-32686 Patchstack
8.1 High User Registration & Membership Plugin user-registration Privilege Escalation User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation No login needed < 4.1.2 Fixed in 4.1.2 CVE-2025-2563 WPScan
7.1 High MemberSpace Plugin memberspace Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.1.13 Fixed in 2.1.14 CVE-2025-26874 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only