WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 146 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High WP Ultimate Review Plugin wp-ultimate-review Cross-Site Scripting Unauthenticated Stored XSS via Review Submission No login needed < 2.4.4 Fixed in 2.4.4 CVE-2026-101159 WPScan
3.1 Low Otter Blocks Plugin otter-blocks Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget ≤ 3.2.6 CVE-2026-102002 Wordfence
7.2 High Ninja Forms Plugin ninja-forms Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission No login needed ≤ 3.15.4 CVE-2026-90438 Wordfence
4.3 Medium Image Optimizer by Elementor Plugin Information Disclosure Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks < 1.7.7 Fixed in 1.7.7 CVE-2026-90953 WPScan
7.2 High Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) No login needed ≤ 1.3.4 CVE-2026-96649 Wordfence
8.8 High Ninja Forms Plugin ninja-forms Cross-Site Scripting Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin No login needed 3.15.3 – < 3.15.4 Fixed in 3.15.4 CVE-2026-92438 WPScan
4.3 Medium Invisible Anti-Spam & CAPTCHA Plugin Broken Access Control Subscriber+ Arbitrary Form Submission Deletion 2.0.5 – < 5.1.1 Fixed in 5.1.1 CVE-2026-91010 WPScan
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Other Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission No login needed < 1.5.95 Fixed in 1.5.95 CVE-2026-86475 WPScan
8.8 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation No login needed 5.0.1.8 – < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77826 WPScan
5.3 Medium WPFunnels Plugin wpfunnels Broken Access Control Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission No login needed 3.1.0 – < 3.13.0 Fixed in 3.13.0 CVE-2026-79632 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Zero Quantity No login needed 6.0.0.0 – < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77794 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Omitted Price Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77793 WPScan
5.3 Medium PublishPress Permissions Plugin press-permit-core Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 4.8.3 Fixed in 4.8.4 CVE-2026-84771 Patchstack
5.3 Medium FormLayer Plugin formlayer Information Disclosure Unauthenticated Form Configuration Disclosure via Form Submission Response No login needed < 1.0.9 Fixed in 1.0.9 CVE-2026-78151 WPScan
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Unauthenticated Stored XSS via Rating Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77792 WPScan
7.4 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Broken Authentication No login needed ≤ 6.0.9.8 Fixed in 6.0.9.9 CVE-2026-82225 Patchstack
7.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.9.8 Fixed in 6.0.9.9 CVE-2026-82221 Patchstack
7.2 High Booking for Appointments and Events Calendar Plugin ameliabooking Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission No login needed ≤ 2.2 CVE-2026-6286 Wordfence
5.5 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager SQL Injection Admin+ SQLi via 'rm_sortby' Parameter < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-77790 WPScan
5.4 Medium Directorist Plugin directorist-wpml-integration Path Traversal Subscriber+ Arbitrary Image Move via REST v2 Listing Submission 8.5 – < 8.9.3 Fixed in 8.9.3 CVE-2026-77757 WPScan
8.8 High Security Hardener Plugin security-hardener Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite ≤ 2.4.4 CVE-2026-16149 Wordfence
9.8 Critical WS Form LITE Plugin ws-form PHP Object Injection Unauthenticated PHP Object Injection via Form Submission No login needed ≤ 1.10.80 CVE-2026-4703 Wordfence
5.3 Medium Dokan Plugin Information Disclosure Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint No login needed < 5.0.14 Fixed in 5.0.14 CVE-2026-16575 WPScan
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection No login needed ≤ 6.0.9.7 Fixed in 6.0.9.8 CVE-2026-73341 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Amount-Blind PayPal Verification No login needed < 6.0.9.5 Fixed in 6.0.9.5 CVE-2026-15208 WPScan
9.1 Critical Easy Post Submission Plugin easy-post-submission Broken Access Control Missing Authorization No login needed ≤ 2.3.0 CVE-2026-4431 Wordfence
2.7 Low MultiVendorX Plugin dc-woocommerce-multi-vendor Information Disclosure Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint < 5.0.11 Fixed in 5.0.11 CVE-2026-16746 WPScan
9.1 Critical Link Library Plugin link-library SQL Injection Unauthenticated SQL Injection via the Front-End Link Submission Form No login needed < 7.9.3 Fixed in 7.9.3 CVE-2026-16532 WPScan
6.5 Medium Pixel Tag Manager for WooCommerce Plugin pixel-manager-for-woocommerce Broken Access Control Unauthenticated Forged Conversion Event Submission No login needed < 2.2.1 Fixed in 2.2.1 CVE-2026-14315 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Unauthenticated Form Submission and User Profile Modification No login needed < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-15257 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Information Disclosure Unauthenticated Form Submission Disclosure via IDOR No login needed < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-15255 WPScan
3.7 Low Bit Form Plugin bit-form Broken Access Control Unauthenticated Inactive Form Submission No login needed < 3.1.2 Fixed in 3.1.2 CVE-2026-15054 WPScan
4.3 Medium Survey Form Block Plugin survey-form-block Broken Access Control Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export ≤ 1.0.1 CVE-2026-5626 Wordfence
8.2 High BookingPress Pro Plugin Information Disclosure Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug No login needed < 5.7.3 Fixed in 5.7.3 CVE-2026-9830 WPScan
8.8 High MDJM Event Management Plugin mobile-dj-manager Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers ≤ 1.7.8.4 CVE-2026-15017 Wordfence
6.5 Medium Ninja Forms Plugin ninja-forms Other Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler No login needed < 3.14.9 Fixed in 3.14.9 CVE-2026-65051 VulnCheck
6.5 Medium Ninja Forms Plugin ninja-forms Broken Access Control Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors < 3.14.9 Fixed in 3.14.9 CVE-2026-65050 VulnCheck
9.3 Critical Ninja Forms Plugin ninja-forms Cross-Site Scripting Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index No login needed 3.10.4 – < 3.14.9 Fixed in 3.14.9 CVE-2026-65048 VulnCheck
6.1 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder Cross-Site Scripting Unauthenticated Stored XSS via Form Submission No login needed < 9.2.3 Fixed in 9.2.3 CVE-2026-10525 WPScan
2.7 Low Fluent Forms Plugin fluentform Broken Access Control Form Manager+ Cross-Form Submission Entry Deletion via IDOR < 6.2.5 Fixed in 6.2.5 CVE-2026-11578 WPScan
8.8 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via 'rmc_assign_user_role_action' Parameter ≤ 6.0.9.1 CVE-2026-12158 Wordfence
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request No login needed ≤ 6.0.8.6 CVE-2026-9242 Wordfence
5.3 Medium Advanced Contact Form 7 Plugin advanced-contact-form-7-compact-db Broken Access Control Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter No login needed ≤ 1.0.0 CVE-2026-12094 Wordfence
8.1 High Mission Theme mission Local File Inclusion No login needed ≤ 1.22 CVE-2025-69143 Patchstack
6.5 Medium RTMKit Plugin rometheme-for-elementor Broken Access Control Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter ≤ 2.0.7 CVE-2026-5149 Wordfence
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Broken Authentication No login needed ≤ 6.0.8.6 Fixed in 6.0.8.7 CVE-2026-49764 Patchstack
7.2 High Integration for Freshsales Plugin crm-integration-freshworks-any-form Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Form Submission Data No login needed ≤ 1.0.15 CVE-2026-8901 Wordfence
6.5 Medium Kirki Plugin kirki Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action ≤ 6.0.6 CVE-2026-8096 Wordfence
6.4 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute ≤ 6.2.1 CVE-2026-6828 Wordfence
8.5 High Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend Plugin views-for-ninja-forms SQL Injection Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection ≤ 3.3.2 Fixed in 3.3.3 CVE-2026-42741 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only