WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 344 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin mp3-music-player-by-sonaar Cross-Site Scripting ≤ 5.14.2 Fixed in 5.15 CVE-2026-104673 Patchstack
7.1 High If-So Dynamic Content Personalization Plugin if-so Cross-Site Scripting No login needed ≤ 1.10.1 Fixed in 1.10.2 CVE-2026-100507 Patchstack
8.8 High Conversational Forms for ChatBot Plugin conversational-forms PHP Object Injection ≤ 1.5.0 Fixed in 1.5.1 CVE-2026-95531 Patchstack
9.8 Critical Paytium: Mollie payment forms & donations Plugin paytium Privilege Escalation Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter No login needed ≤ 5.0.3 CVE-2026-18467 Wordfence
9.8 Critical Give Tributes Plugin PHP Object Injection Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter No login needed ≤ 2.3.1 CVE-2026-19658 Wordfence
7.2 High Quill Forms | Conversational Multi Step Forms, Surveys & quizzes Plugin quillforms Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value No login needed ≤ 5.7.1 CVE-2026-15664 Wordfence
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter ≤ 9.3.0 CVE-2026-75961 Wordfence
8.8 High Dictionary Plugin Cross-Site Scripting Unauthenticated Stored XSS via Direct Dictionary Update No login needed ≤ 1.0 CVE-2026-88792 WPScan
7.1 High Dictionary Plugin Cross-Site Scripting Reflected XSS via Multiple Parameters No login needed ≤ 1.0 CVE-2025-15697 WPScan
2.2 Low BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Information Disclosure Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR < 1.2.2 Fixed in 1.2.2 CVE-2026-84025 WPScan
4.3 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84024 WPScan
6.5 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84023 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Slider Elements' additional_settings < 5.9.9 Fixed in 5.9.9 CVE-2026-84028 WPScan
7.1 High MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin mp3-music-player-by-sonaar Cross-Site Scripting No login needed ≤ 5.13.1 Fixed in 5.14 CVE-2026-81289 Patchstack
6.4 Medium FundEngine Plugin wp-fundraising-donation Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter ≤ 1.8.1 CVE-2026-76063 Wordfence
4.3 Medium FundEngine Plugin wp-fundraising-donation Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter ≤ 1.8.1 CVE-2026-75930 Wordfence
5.3 Medium Charitable Plugin charitable Other Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass No login needed < 1.8.12 Fixed in 1.8.12 CVE-2026-16650 WPScan
9.8 Critical FundEngine Plugin wp-fundraising-donation PHP Object Injection No login needed ≤ 1.7.9 Fixed in 1.8.0 CVE-2026-73993 Patchstack
9.3 Critical Total Donations Plugin totaldonations SQL Injection No login needed ≤ 2.0.5 CVE-2026-73391 Patchstack
9.8 Critical Total Donations Plugin totaldonations Privilege Escalation No login needed ≤ 2.0.5 CVE-2026-73390 Patchstack
9.8 Critical FundEngine Plugin wp-fundraising-donation PHP Object Injection No login needed ≤ 1.7.9 Fixed in 1.8.0 CVE-2026-32470 Patchstack
7.5 High Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Information Disclosure Unauthenticated Customer File Disclosure via getpublicfileupload No login needed < 1.2.176 Fixed in 1.2.176 CVE-2026-19728 WPScan
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Admin+) SQL Injection via 'additional_params' Parameter ≤ 9.2.4 CVE-2026-15602 Wordfence
7.2 High Cookie Banner for GDPR / CCPA Plugin gdpr-cookie-consent Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'regionArray' Parameter No login needed ≤ 4.3.5 CVE-2026-13360 Wordfence
9.3 Critical If-So Dynamic Content Personalization Plugin if-so SQL Injection No login needed ≤ 1.10 Fixed in 1.10.0.1 CVE-2026-66446 Patchstack
9.8 Critical Personal QR Message Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.0 CVE-2026-16250 WPScan
8.8 High Pronamic Pay Plugin pronamic-ideal Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field ≤ 10.1.0 CVE-2026-16635 Wordfence
7.2 High HUSKY - Products Filter Professional for WooCommerce Plugin Local File Inclusion Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view < 1.4.1 Fixed in 1.4.1 CVE-2026-15244 WPScan
4.8 Medium Bit Form Plugin bit-form Cross-Site Scripting Admin+ Stored XSS via Conversational Form Progress Label < 3.1.4 Fixed in 3.1.4 CVE-2025-15669 WPScan
7.5 High Bit integrations Plugin bit-integrations Path Traversal Unauthenticated Arbitrary File Read via Optional CF7 File Field No login needed ≤ 2.9.0 CVE-2026-15006 Wordfence
6.8 Medium GiveWP Plugin give Cross-Site Scripting GiveWP Worker+ Stored XSS via Donation Form Template Settings < 4.16.3 Fixed in 4.16.3 CVE-2026-14318 WPScan
6.5 Medium FundEngine Plugin wp-fundraising-donation Broken Access Control ≤ 1.7.8 Fixed in 1.7.9 CVE-2026-59560 Patchstack
6.5 Medium Accept Donations with PayPal & Stripe Plugin easy-paypal-donation Cross-Site Scripting ≤ 1.5.5 Fixed in 1.5.6 CVE-2026-65518 Patchstack
5.3 Medium MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin mp3-music-player-by-sonaar Broken Access Control No login needed ≤ 5.12 Fixed in 5.13 CVE-2026-65506 Patchstack
6.5 Medium FundEngine Plugin wp-fundraising-donation Broken Access Control No login needed ≤ 1.7.6 Fixed in 1.7.7 CVE-2026-57406 Patchstack
6.5 Medium Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Broken Access Control No login needed ≤ 1.2.167 Fixed in 1.2.168 CVE-2026-57390 Patchstack
6.5 Medium Better Payment – Instant Payments, Donations, Fundraising with Subscriptions & More Plugin better-payment Other Instant Payments, Donations, Fundraising with Subscriptions & More plugin <= 2.2.0 - Other Vulnerability Type No login needed ≤ 2.2.0 Fixed in 2.2.1 CVE-2026-57364 Patchstack
6.4 Medium bbp style pack Plugin bbp-style-pack Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields ≤ 6.4.5 CVE-2026-15010 Wordfence
6.4 Medium Advanced iFrame Plugin advanced-iframe Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute ≤ 2026.1 CVE-2026-6742 Wordfence
5.3 Medium Donation Thermometer Plugin donation-thermometer Broken Access Control No login needed ≤ 2.2.7 CVE-2025-64636 Patchstack
5.3 Medium WP DSGVO Tools (GDPR) Plugin shapepress-dsgvo Broken Access Control Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters) No login needed ≤ 3.1.39 CVE-2026-10034 Wordfence
7.5 High Conversational Forms for ChatBot Plugin conversational-forms Path Traversal Arbitrary File Download No login needed ≤ 1.1.8 Fixed in 1.2.0 CVE-2024-32729 Patchstack
8.8 High Sonaar Theme sonaar Privilege Escalation ≤ 4.27.4 Fixed in 4.27.5 CVE-2025-59563 Patchstack
7.1 High Sonaar Theme sonaar Cross-Site Scripting No login needed ≤ 4.27.4 Fixed in 4.27.5 CVE-2025-59560 Patchstack
8.1 High Iona Theme iona Local File Inclusion No login needed ≤ 1.0.8 CVE-2025-69116 Patchstack
7.1 High Single Personal Message Plugin simple-personal-message SQL Injection Single Personal Message 1.0.3 WordPress Plugin SQL Injection 1.0.3 CVE-2016-20063 VulnCheck
4.3 Medium FOX – Currency Switcher Professional for WooCommerce Plugin woocommerce-currency-switcher Broken Access Control Currency Switcher Professional for WooCommerce <= 1.4.6 - Authenticated (Subscriber+) Authorization Bypass via User-Controlled Key to 'wooc_order_user_roles' Parameter ≤ 1.4.6 CVE-2026-9241 Wordfence
8.1 High FOX – Currency Switcher Professional for WooCommerce Plugin woocommerce-currency-switcher Broken Access Control Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion ≤ 1.4.5 CVE-2026-4094 Wordfence
5.5 Medium Products Filter Professional for WooCommerce Plugin woocommerce-products-filter Cross-Site Scripting WOOF / Products Filter Professional for WooCommerce 1.2.3 Persistent XSS 1.2.3 CVE-2020-37174 VulnCheck
6.1 Medium International Sms For Contact Form Plugin cf7-international-sms-integration Cross-Site Scripting WordPress International Sms Contact Form 7 Integration 1.2 XSS No login needed 1.2 CVE-2022-50960 VulnCheck

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only