WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–48 of 48 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium WPFunnels Plugin wpfunnels Broken Access Control Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission No login needed 3.1.0 – < 3.13.0 Fixed in 3.13.0 CVE-2026-79632 WPScan
6.5 Medium Noptin Plugin Information Disclosure Unauthenticated Subscriber PII and confirm_key Disclosure via Actions Page No login needed 4.0.0 – < 4.3.3 Fixed in 4.3.3 CVE-2026-78146 WPScan
6.5 Medium MailOptin Plugin mailoptin Cross-Site Scripting ≤ 1.2.78.0 Fixed in 1.2.78.1 CVE-2026-66703 Patchstack
6.5 Medium Udimi Tools Plugin udimi-optin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action ≤ 3.2 CVE-2026-7456 Wordfence
7.2 High MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder Plugin mailchimp-subscribe-sm Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Form Field Values No login needed ≤ 4.3.3 CVE-2026-15052 Wordfence
7.5 High WowOptin Plugin Broken Access Control Unauthenticated Opt-in Deactivation and Template Row Injection No login needed < 1.4.38 Fixed in 1.4.38 CVE-2026-14603 WPScan
4.9 Medium WPForms Plugin wpforms-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content ≤ 2.0.0.1 CVE-2026-15782 Wordfence
7.1 High FunnelKit Plugin funnel-builder Cross-Site Scripting Reflected XSS via Divi Optin Form No login needed < 3.15.0.6 Fixed in 3.15.0.6 CVE-2026-12978 WPScan
9.8 Critical MailOptin Plugin mailoptin Privilege Escalation No login needed ≤ 1.2.77.3 Fixed in 1.2.78.0 CVE-2026-57813 Patchstack
7.2 High Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder Plugin popup-maker Broken Access Control Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation ≤ 1.22.0 CVE-2026-8848 Wordfence
4.9 Medium OptinCraft Plugin optincraft SQL Injection Authenticated (Administrator+) SQL Injection via 'order_by' Parameter ≤ 1.2.0 CVE-2026-8978 Wordfence
6.1 Medium WP Responsive Popup + Optin Plugin wp-popup-optin Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpo_image_url' Parameter No login needed ≤ 1.4 CVE-2026-4131 Wordfence
5.3 Medium WowOptin Plugin optin Broken Access Control No login needed ≤ 1.4.32 CVE-2026-39700 Patchstack
5.3 Medium Hustle – Email Marketing, Lead Generation, Optins, Popups Plugin wordpress-popup Broken Access Control Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation No login needed ≤ 7.8.10.2 CVE-2026-2263 Wordfence
6.4 Medium WPFunnels Plugin wpfunnels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode ≤ 3.7.9 CVE-2026-0626 Wordfence
7.2 High WowOptin: Next-Gen Popup Maker Plugin optin Server-Side Request Forgery Unauthenticated Server-Side Request Forgery via 'link' Parameter in REST API No login needed ≤ 1.4.29 CVE-2026-4302 Wordfence
8.8 High WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation Plugin optin Broken Access Control Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation ≤ 1.4.24 CVE-2026-1720 Wordfence
5.9 Medium MailOptin Plugin mailoptin Cross-Site Scripting ≤ 1.2.75.0 Fixed in 1.2.75.1 CVE-2025-58596 Patchstack
7.1 High Invisible Optin Plugin invisible-optin Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed ≤ 1.0 CVE-2025-48311 Patchstack
7.1 High Newsletter subscription optin module Plugin newsletter-subscription-widget-for-sendblaster Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed ≤ 1.2.9 CVE-2025-48308 Patchstack
5.9 Medium Noptin Plugin newsletter-optin-box Cross-Site Scripting ≤ 3.8.7 Fixed in 4.0.0 CVE-2025-49871 Patchstack
7.5 High Macro Calculator with Admin Email Optin & Data Plugin macro-admin-email-data-optin-calculator Information Disclosure Multiple Vulnerabilities No login needed ≤ 1.0 CVE-2025-26730 Patchstack
5.4 Medium WP Optin Wheel Plugin wp-optin-wheel Server-Side Request Forgery No login needed ≤ 1.4.7 Fixed in 1.4.8 CVE-2025-31824 Patchstack
7.1 High Top Bar – PopUps – by WPOptin Plugin wpoptin Cross-Site Scripting No login needed ≤ 2.0.8 CVE-2025-25118 Patchstack
6.5 Medium Caching Compatible Cookie Opt-In and JavaScript Plugin caching-compatible-cookie-optin-and-javascript Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 0.0.10 Fixed in 0.0.11 CVE-2025-24547 Patchstack
7.1 High ContentOptin Lite Plugin contentoptin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.1 CVE-2025-23589 Patchstack
6.5 Medium Feedburner Optin Form Plugin feedburner-optin-form Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 0.2.8 CVE-2025-23925 Patchstack
5.4 Medium Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder Plugin Cross-Site Scripting Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.20.2 CVE-2024-10583 Wordfence
6.1 Medium Campaign Monitor Forms by Optin Cat Plugin campaign-monitor-wp Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.5.7 CVE-2024-11326 Wordfence
5.2 Medium AWeber Forms by Optin Cat Plugin aweber-wp Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.5.7 CVE-2024-11325 Wordfence
5.3 Medium Hustle – Email Marketing, Lead Generation, Optins, Popups Plugin wordpress-popup Broken Access Control Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unauthorized Form Submission No login needed ≤ 7.8.5 CVE-2024-10580 Wordfence
4.3 Medium Hustle – Email Marketing, Lead Generation, Optins, Popups Plugin wordpress-popup Broken Access Control Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure ≤ 7.8.5 CVE-2024-10579 Wordfence
5.3 Medium Optinly Plugin optinly Broken Access Control No login needed ≤ 1.0.18 Fixed in 1.0.19 CVE-2024-37220 Patchstack
5.3 Medium Noptin Plugin newsletter-optin-box Broken Access Control Noptin plugin <= 3.4.2 - Broken Access Control No login needed ≤ 3.4.2 Fixed in 3.4.3 CVE-2024-37456 Patchstack
6.1 Medium Forms for Mailchimp by Optin Cat – Grow Your MailChimp List Plugin mailchimp-wp Cross-Site Scripting Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting No login needed ≤ 2.5.6 CVE-2024-8870 Wordfence
6.1 Medium GetResponse Forms by Optin Cat Plugin getresponse Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.5.7 CVE-2024-8740 Wordfence
7.5 High Top Bar – PopUps – by WPOptin Plugin wpoptin Local File Inclusion No login needed ≤ 2.0.1 Fixed in 2.0.2 CVE-2024-47645 Patchstack
4.4 Medium Forms for Mailchimp by Optin Cat Plugin mailchimp-wp Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via Form Color Parameters ≤ 2.5.7 CVE-2024-7489 Wordfence
6.1 Medium Easy WordPress Subscribe – Optin Hound Plugin opt-in-hound Cross-Site Scripting Optin Hound <= 1.4.3 - Reflected Cross-Site Scripting via add_query_arg Parameter No login needed ≤ 1.4.3 CVE-2024-9267 Wordfence
5.4 Medium Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, AWeber – MailOptin Plugin mailoptin Cross-Site Scripting MailOptin <= 1.2.70.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.2.70.3 CVE-2024-8628 Wordfence
6.5 Medium Icegram Plugin icegram Cross-Site Scripting Ultimate WP Popup Builder, Lead Generation, Optins, and CTA plugin <= 3.1.25 - Cross Site Scripting (XSS) ≤ 3.1.25 Fixed in 3.1.26 CVE-2024-43344 Patchstack
9.8 Critical Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin email-subscribers SQL Injection Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.23 - Unauthenticated SQL Injection via optin No login needed ≤ 5.7.23 CVE-2024-5756 Wordfence
6.4 Medium Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation Plugin optinmonster Cross-Site Scripting WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.16.1 CVE-2024-4045 Wordfence
4.3 Medium OptinMonster Plugin optinmonster Cross-Site Request Forgery Cross Site Request Forgery (CSRF) Notice Dismissal No login needed ≤ 2.15.3 Fixed in 2.16.0 CVE-2024-33691 Patchstack
6.5 Medium Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building Plugin icegram Cross-Site Scripting WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS) ≤ 3.1.19 Fixed in 3.1.20 CVE-2023-51532 Patchstack
5.9 Medium Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content Plugin brave-popup-builder Cross-Site Scripting WordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS) ≤ 0.6.2 Fixed in 0.6.3 CVE-2023-51534 Patchstack
5.3 Medium WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce Plugin wp-optin-wheel Information Disclosure WordPress WP Optin Wheel Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure No login needed ≤ 1.4.3 Fixed in 1.4.4 CVE-2023-51408 Patchstack
4.3 Medium Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building Plugin icegram Cross-Site Request Forgery WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 3.1.18 Fixed in 3.1.19 CVE-2023-52119 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only