WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 87 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Image Optimizer by Elementor Plugin Information Disclosure Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks < 1.7.7 Fixed in 1.7.7 CVE-2026-90953 WPScan
4.3 Medium Invisible Anti-Spam & CAPTCHA Plugin Broken Access Control Subscriber+ Arbitrary Form Submission Deletion 2.0.5 – < 5.1.1 Fixed in 5.1.1 CVE-2026-91010 WPScan
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Other Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission No login needed < 1.5.95 Fixed in 1.5.95 CVE-2026-86475 WPScan
5.3 Medium WPFunnels Plugin wpfunnels Broken Access Control Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission No login needed 3.1.0 – < 3.13.0 Fixed in 3.13.0 CVE-2026-79632 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Zero Quantity No login needed 6.0.0.0 – < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77794 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Omitted Price Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77793 WPScan
5.3 Medium PublishPress Permissions Plugin press-permit-core Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 4.8.3 Fixed in 4.8.4 CVE-2026-84771 Patchstack
5.3 Medium FormLayer Plugin formlayer Information Disclosure Unauthenticated Form Configuration Disclosure via Form Submission Response No login needed < 1.0.9 Fixed in 1.0.9 CVE-2026-78151 WPScan
5.5 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager SQL Injection Admin+ SQLi via 'rm_sortby' Parameter < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-77790 WPScan
5.4 Medium Directorist Plugin directorist-wpml-integration Path Traversal Subscriber+ Arbitrary Image Move via REST v2 Listing Submission 8.5 – < 8.9.3 Fixed in 8.9.3 CVE-2026-77757 WPScan
5.3 Medium Dokan Plugin Information Disclosure Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint No login needed < 5.0.14 Fixed in 5.0.14 CVE-2026-16575 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Amount-Blind PayPal Verification No login needed < 6.0.9.5 Fixed in 6.0.9.5 CVE-2026-15208 WPScan
6.5 Medium Pixel Tag Manager for WooCommerce Plugin pixel-manager-for-woocommerce Broken Access Control Unauthenticated Forged Conversion Event Submission No login needed < 2.2.1 Fixed in 2.2.1 CVE-2026-14315 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Unauthenticated Form Submission and User Profile Modification No login needed < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-15257 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Information Disclosure Unauthenticated Form Submission Disclosure via IDOR No login needed < 6.0.9.4 Fixed in 6.0.9.4 CVE-2026-15255 WPScan
4.3 Medium Survey Form Block Plugin survey-form-block Broken Access Control Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export ≤ 1.0.1 CVE-2026-5626 Wordfence
6.5 Medium Ninja Forms Plugin ninja-forms Other Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler No login needed < 3.14.9 Fixed in 3.14.9 CVE-2026-65051 VulnCheck
6.5 Medium Ninja Forms Plugin ninja-forms Broken Access Control Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors < 3.14.9 Fixed in 3.14.9 CVE-2026-65050 VulnCheck
6.1 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder Cross-Site Scripting Unauthenticated Stored XSS via Form Submission No login needed < 9.2.3 Fixed in 9.2.3 CVE-2026-10525 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Authenticated (Subscriber+) Authentication Bypass via Forged PayPal IPN Request No login needed ≤ 6.0.8.6 CVE-2026-9242 Wordfence
5.3 Medium Advanced Contact Form 7 Plugin advanced-contact-form-7-compact-db Broken Access Control Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter No login needed ≤ 1.0.0 CVE-2026-12094 Wordfence
6.5 Medium RTMKit Plugin rometheme-for-elementor Broken Access Control Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries_id' Parameter ≤ 2.0.7 CVE-2026-5149 Wordfence
6.5 Medium Kirki Plugin kirki Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action ≤ 6.0.6 CVE-2026-8096 Wordfence
6.4 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute ≤ 6.2.1 CVE-2026-6828 Wordfence
6.5 Medium Forminator Forms Plugin forminator Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook ≤ 1.53.0 CVE-2026-6214 Wordfence
5.3 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Authentication Bypass Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter No login needed ≤ 5.103.0 CVE-2026-4664 Wordfence
4.3 Medium Advanced CF7 DB Plugin advanced-cf7-db Broken Access Control Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export ≤ 2.0.9 CVE-2026-0814 Wordfence
5.3 Medium RepairBuddy Plugin computer-repair-shop Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action No login needed ≤ 4.1132 CVE-2026-3567 Wordfence
5.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control ≤ 6.0.7.6 Fixed in 6.0.7.7 CVE-2026-32385 Patchstack
5.3 Medium RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment No login needed ≤ 6.0.6.9 CVE-2025-14444 Wordfence
6.1 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Open Redirect Unauthenticated Open Redirect via 'requested_page' Parameter No login needed 1.0.0 – 1.2.7 CVE-2026-1296 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Subscriber+ Form Creation < 6.0.7.2 Fixed in 6.0.7.2 CVE-2026-0929 WPScan
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Information Disclosure Subscriber+ Sensitive Data Disclosure < 6.0.7.2 Fixed in 6.0.7.2 CVE-2025-15520 WPScan
4.4 Medium WP Content Permission Plugin wp-content-permission Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter ≤ 1.2 CVE-2026-0743 Wordfence
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Missing Authorization to Unauthenticated Arbitrary Settings Modification No login needed ≤ 6.0.7.4 CVE-2026-1054 Wordfence
5.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery No login needed ≤ 6.0.6.9 Fixed in 6.0.7.0 CVE-2026-24374 Patchstack
4.3 Medium AMP for WP – Accelerated Mobile Pages Plugin accelerated-mobile-pages Cross-Site Request Forgery Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission No login needed ≤ 1.1.9 CVE-2025-14468 Wordfence
5.3 Medium Ninja Forms Plugin ninja-forms Information Disclosure Unauthenticated Token Generation and Submission Disclosure No login needed < 3.13.3 Fixed in 3.13.3 CVE-2025-14072 WPScan
5.3 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Broken Access Control Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed ≤ 1.2.6 CVE-2025-14913 Wordfence
5.3 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Modification No login needed ≤ 1.2.5 CVE-2025-14080 Wordfence
6.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode ≤ 6.0.6.7 CVE-2025-13610 Wordfence
4.3 Medium Ultra Addons for Contact Form 7 Plugin ultimate-addons-for-contact-form-7 Broken Access Control Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF ≤ 3.5.33 CVE-2025-14356 Wordfence
5.3 Medium Fluent Forms Plugin fluentform Broken Access Control Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id No login needed ≤ 6.1.7 CVE-2025-13748 Wordfence
5.3 Medium Zigaform Plugin zigaform-calculator-cost-estimation-form-builder-lite Information Disclosure Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint No login needed ≤ 7.6.5 CVE-2025-13696 Wordfence
5.3 Medium Easy Post Submission Plugin easy-post-submission Information Disclosure Sensitive Data Exposure ≤ 1.7.0 Fixed in 2.0.0 CVE-2025-62062 Patchstack
4.3 Medium WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Plugin wdesignkit Broken Access Control Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function ≤ 1.2.16 CVE-2025-9029 Wordfence
4.3 Medium CF7 Submissions Plugin cf7-submissions Broken Access Control ≤ 0.26 CVE-2025-58016 Patchstack
4.3 Medium WPeMatico RSS Feed Fetcher Plugin wpematico Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function No login needed ≤ 2.8.7 CVE-2025-8103 Wordfence
4.8 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Stored XSS < 6.0.2.1 Fixed in 6.0.2.1 CVE-2024-9390 WPScan
5.9 Medium Submission DOM tracking for Contact Form 7 Plugin cf7-submission-dom-tracking Cross-Site Scripting ≤ 2.1 Fixed in 2.2 CVE-2025-47626 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only