WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 181 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Memberful - Membership Plugin memberful-wp Information Disclosure Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure ≤ 1.81.2 Fixed in 1.82.0 CVE-2026-104401 Patchstack
6.1 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Cross-Site Scripting Reflected Cross-Site Scripting via ppress_billing_address Filename Parameter No login needed ≤ 4.17.4 CVE-2026-92551 Wordfence
4.2 Medium MasterStudy LMS 1.9 Plugin Broken Access Control < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass 1.9 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88848 WPScan
5.3 Medium Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.8.2 Fixed in 4.8.3 CVE-2026-74000 Patchstack
5.3 Medium Paid Member Subscriptions Plugin Price Manipulation Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch No login needed < 3.0.9 Fixed in 3.0.9 CVE-2026-90922 WPScan
4.3 Medium FluentBoards Plugin fluent-boards Information Disclosure Subscriber+ Private Board Membership Disclosure via IDOR < 2.0.15 Fixed in 2.0.15 CVE-2026-85349 WPScan
5.4 Medium Simple Membership Plugin simple-membership Privilege Escalation Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref < 4.7.8 Fixed in 4.7.8 CVE-2026-88764 WPScan
4.7 Medium User Registration & Membership Plugin user-registration Open Redirect Unauthenticated Open Redirect via Login Redirect Parameters No login needed < 5.2.8 Fixed in 5.2.8 CVE-2026-80072 WPScan
6.1 Medium WP-Members Membership Plugin wp-members Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.5.6 CVE-2026-84960 Wordfence
5.3 Medium WCFM Membership Plugin wc-multivendor-membership Broken Access Control No login needed ≤ 2.11.11 Fixed in 2.12.0 CVE-2026-32480 Patchstack
5.4 Medium Simple Membership MailChimp Integration Plugin simple-membership-mailchimp-integration Cross-Site Request Forgery API Key Update via CSRF No login needed < 1.9.8 Fixed in 1.9.8 CVE-2026-8151 WPScan
5.3 Medium Simple Membership Plugin simple-membership Authentication Bypass Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding No login needed ≤ 4.8.1 CVE-2026-77194 Wordfence
4.3 Medium Frontend Admin by DynamiApps Plugin acf-frontend-form-element Broken Access Control Subscriber+ Arbitrary Membership Plan Deletion < 3.29.11 Fixed in 3.29.11 CVE-2026-81346 WPScan
4.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Subscriber+ Pending Email Change Cancellation via IDOR < 5.2.5 Fixed in 5.2.5 CVE-2026-79995 WPScan
5.3 Medium Membership For WooCommerce Plugin membership-for-woocommerce Information Disclosure Unauthenticated Member Data Disclosure via REST Consumer Secret Bypass No login needed < 3.1.2 Fixed in 3.1.2 CVE-2026-19709 WPScan
5.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field ≤ 4.16.19 CVE-2026-18385 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Price Manipulation Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification No login needed < 4.7.7 Fixed in 4.7.7 CVE-2026-14936 WPScan
4.3 Medium RealHomes Memberships Plugin inspiry-memberships Price Manipulation Subscriber+ Membership Payment Bypass < 3.1.0 Fixed in 3.1.0 CVE-2026-15246 WPScan
6.1 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored XSS via PayPal Subscription Subscriber Name No login needed < 4.7.8 Fixed in 4.7.8 CVE-2026-15931 WPScan
4.3 Medium RealHomes Memberships Plugin inspiry-memberships Broken Access Control Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action ≤ 3.0.9 CVE-2026-10782 Wordfence
5.3 Medium Klubraum Membership Request Plugin klubraum-membership-request Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update No login needed ≤ 1.1.0 CVE-2026-4604 Wordfence
6.4 Medium Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions Plugin Cross-Site Scripting Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 3.8.1 CVE-2026-15016 Wordfence
6.5 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Price Manipulation Unauthenticated Payment Bypass and Forced Group Membership via PayPal IPN Forgery No login needed < 5.9.9.7 Fixed in 5.9.9.7 CVE-2026-12688 WPScan
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Unauthenticated Limited User Deletion via Stripe Subscription Handler No login needed 4.2.3 – < 5.2.3 Fixed in 5.2.3 CVE-2026-11966 WPScan
5.3 Medium Members Plugin members Information Disclosure Unauthenticated Sensitive Information Disclosure via REST API Pagination Side Channel No login needed ≤ 3.2.22 CVE-2026-12426 Wordfence
5.3 Medium ARMember Plugin armember-membership Path Traversal Directory Traversal via X-FILENAME No login needed ≤ 4.0.27 CVE-2026-15302 Wordfence
5.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter No login needed ≤ 4.3.7 CVE-2026-12418 Wordfence
4.3 Medium Memberships and User Profiles for WooCommerce Plugin ecommerce-user-profiles-by-profilegrid Broken Access Control Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation ≤ 3.4 CVE-2026-11359 Wordfence
5.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Broken Access Control Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite No login needed ≤ 4.3.1 CVE-2026-5459 Wordfence
6.5 Medium User Registration & Membership Plugin user-registration Authentication Bypass Unauthenticated Paid Membership Bypass No login needed < 5.2.0 Fixed in 5.2.0 CVE-2026-11965 WPScan
4.4 Medium Team Members Plugin team-showcase-supreme Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter ≤ 8.7 CVE-2026-12114 Wordfence
6.5 Medium User Registration & Membership Plugin user-registration Broken Access Control Missing Authorization to Unauthenticated Payment Bypass No login needed ≤ 5.2.0 CVE-2026-1869 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Broken Access Control Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook No login needed ≤ 4.7.5 CVE-2026-12093 Wordfence
6.5 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.7.2 Fixed in 4.7.3 CVE-2026-42663 Patchstack
4.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation ≤ 4.3.2 CVE-2026-4058 Wordfence
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter No login needed ≤ 5.1.5 CVE-2026-7651 Wordfence
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter No login needed ≤ 5.1.5 CVE-2026-6145 Wordfence
4.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification ≤ 5.1.4 CVE-2026-3601 Wordfence
4.3 Medium ProfilePress Plugin wp-user-avatar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription ≤ 4.16.12 CVE-2026-4949 Wordfence
6.1 Medium User Registration & Membership Plugin user-registration Open Redirect Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter No login needed ≤ 5.1.4 CVE-2026-6203 Wordfence
6.5 Medium User Registration & Membership Plugin user-registration SQL Injection Authenticated (Subscriber+) SQL Injection via membership_ids[] ≤ 5.1.2 CVE-2026-1865 Wordfence
6.5 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Arbitrary Shortcode Execution ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields No login needed ≤ 4.16.11 CVE-2026-3309 Wordfence
5.4 Medium User Registration & Membership Plugin user-registration Broken Access Control Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation ≤ 5.1.4 CVE-2026-4056 Wordfence
4.3 Medium Membership Plugin – Restrict Content Plugin restrict-content Authentication Bypass Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect No login needed ≤ 3.2.24 CVE-2026-4136 Wordfence
5.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter No login needed ≤ 4.2.8 CVE-2026-2233 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery Cross-Site Request Forgery to Group Membership Request Approval/Denial No login needed ≤ 5.9.8.2 CVE-2026-2494 Wordfence
6.5 Medium WP-Members Membership Plugin wp-members SQL Injection Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute ≤ 3.5.5.1 CVE-2026-2363 Wordfence
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Insecure Direct Object Reference to Unauthenticated Limited User Deletion No login needed ≤ 5.1.2 CVE-2026-2356 Wordfence
6.5 Medium Simple Membership Plugin simple-membership Broken Access Control Unauthenticated Improper Handling of Missing Values No login needed ≤ 4.7.0 CVE-2026-1461 Wordfence
4.3 Medium Simple Membership Plugin simple-membership Broken Access Control ≤ 4.6.9 Fixed in 4.7.0 CVE-2026-25308 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only