WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 471 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Appointment Booking Plugin – LatePoint | Calendar & Scheduling Plugin latepoint Broken Access Control LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification ≤ 5.6.9 CVE-2026-17538 Wordfence
4.3 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint < 4.0.0 Fixed in 4.0.0 CVE-2026-104049 WPScan
6.5 Medium TrueBooker Plugin truebooker-appointment-booking Broken Access Control Settings Change No login needed ≤ 1.2.9 CVE-2026-39798 Patchstack
9.3 Critical Radius Booking — Booking Calendar for Appointments & Services Plugin radius-booking SQL Injection No login needed ≤ 1.0.19 CVE-2026-39764 Patchstack
6.5 Medium Wappointment Plugin wappointment Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 2.7.7 CVE-2026-39756 Patchstack
9.3 Critical WooCommerce Appointments Plugin woocommerce-appointments SQL Injection No login needed ≤ 5.3.2 CVE-2026-32557 Patchstack
5.3 Medium Fast Courier Plugin fast-courier-shipping-freight Broken Access Control Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint No login needed ≤ 5.2.3 CVE-2026-89289 WPScan
8.5 High WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events SQL Injection ≤ 6.4.0 Fixed in 6.5.0 CVE-2026-103066 Patchstack
9.3 Critical WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events SQL Injection No login needed ≤ 6.4.0 Fixed in 6.5.0 CVE-2026-103352 Patchstack
9.1 Critical VikAppointments Services Booking Calendar Plugin vikappointments Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter No login needed ≤ 1.2.21 CVE-2026-87115 Wordfence
7.5 High Simple Membership Plugin simple-membership Broken Access Control Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints No login needed ≤ 4.8.3 CVE-2026-97337 Wordfence
7.2 High JetAppointment Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter No login needed ≤ 2.5.2.1 CVE-2026-93875 Wordfence
5.3 Medium Appointment Booking Plugin latepoint Broken Access Control Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter No login needed ≤ 5.7.1 CVE-2026-94432 Wordfence
8.8 High WPC Shop as a Customer for WooCommerce Plugin wpc-shop-as-customer Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endpoint ≤ 2.0.0 CVE-2026-95687 Wordfence
7.2 High Appointment Hour Booking Plugin appointment-hour-booking Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer No login needed ≤ 1.5.97 CVE-2026-96573 Wordfence
9.1 Critical Appointment Booking Plugin latepoint Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field No login needed ≤ 5.7.0 CVE-2026-92966 Wordfence
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter ≤ 1.6.12.31 CVE-2026-91109 Wordfence
7.5 High Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce No login needed ≤ 1.6.12.32 CVE-2026-92245 Wordfence
5.3 Medium Newsletter Plugin newsletter Information Disclosure Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure) No login needed ≤ 9.3.9 CVE-2026-92537 Wordfence
7.5 High Bookly Plugin bookly-responsive-appointment-booking-tool Broken Access Control No login needed ≤ 28.2 Fixed in 28.3 CVE-2026-96348 Patchstack
6.5 Medium Bookly Plugin bookly-responsive-appointment-booking-tool Broken Access Control Insecure Direct Object References (IDOR) ≤ 28.2 Fixed in 28.3 CVE-2026-96347 Patchstack
5.3 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.6.12.31 Fixed in 1.6.12.33 CVE-2026-94673 Patchstack
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.12.29 Fixed in 1.6.12.31 CVE-2026-94074 Patchstack
7.5 High Simply Schedule Appointments Plugin simply-schedule-appointments Local File Inclusion Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter ≤ 1.6.12.27 CVE-2026-89294 Wordfence
3.8 Low Bookly Plugin Information Disclosure Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR < 28.3 Fixed in 28.3 CVE-2026-86839 WPScan
9.1 Critical Online Scheduling and Appointment Booking System Plugin bookly-responsive-appointment-booking-tool Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter No login needed ≤ 28.2 CVE-2026-93399 Wordfence
5.3 Medium Online Scheduling and Appointment Booking System Plugin bookly-responsive-appointment-booking-tool Broken Access Control Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data No login needed ≤ 28.2 CVE-2026-92799 Wordfence
4.3 Medium OpenStation Plugin desktop-mode Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint ≤ 1.1.7 CVE-2026-19775 Wordfence
4.3 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points < 2.10.4 Fixed in 2.10.4 CVE-2026-93510 WPScan
5.3 Medium FluentBoards Plugin fluent-boards Information Disclosure Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints No login needed 1.95 – < 2.1.0 Fixed in 2.1.0 CVE-2026-89331 WPScan
5.4 Medium Directorist Plugin directorist-wpml-integration Broken Access Control Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint < 8.9.5 Fixed in 8.9.5 CVE-2026-84150 WPScan
4.3 Medium Directorist Plugin directorist-wpml-integration Broken Access Control Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint 8.9.1 – < 8.9.5 Fixed in 8.9.5 CVE-2026-84027 WPScan
5.3 Medium Directorist Plugin directorist-wpml-integration Information Disclosure Unauthenticated Sensitive Data Disclosure via REST Users Endpoint No login needed 8.1 – < 8.9.5 Fixed in 8.9.5 CVE-2026-84026 WPScan
4.3 Medium Directorist Plugin directorist-wpml-integration Information Disclosure Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint 8.5 – < 8.9.5 Fixed in 8.9.5 CVE-2026-77766 WPScan
5.3 Medium WordLift Plugin wordlift Information Disclosure Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints No login needed ≤ 3.54.10 CVE-2026-9289 Wordfence
6.5 Medium Easy Appointments Plugin easy-appointments Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action ≤ 3.12.27 CVE-2026-9232 Wordfence
5.3 Medium Payment Gateway of Stripe for WooCommerce Plugin payment-gateway-stripe-and-woocommerce-integration Other Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint No login needed ≤ 5.0.8 CVE-2026-9832 Wordfence
6.5 Medium Better Messages Plugin bp-better-messages Broken Access Control Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint ≤ 2.15.33 CVE-2026-89334 Wordfence
5.4 Medium WP Recipe Maker Plugin wp-recipe-maker Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint ≤ 10.8.1 CVE-2026-90884 Wordfence
4.3 Medium LatePoint Plugin latepoint Broken Access Control Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) ≤ 5.6.3 CVE-2026-13471 Wordfence
4.3 Medium Magazine Blocks Plugin magazine-blocks Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint ≤ 1.8.6 CVE-2026-75017 Wordfence
5.3 Medium Divi Theme Broken Access Control Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint No login needed ≤ 5.11.1 CVE-2026-91707 Wordfence
2.7 Low Bookit Plugin bookit-for-cal-com Information Disclosure Bookit Staff+ Appointment PII Disclosure < 2.6.0.5 Fixed in 2.6.0.5 CVE-2026-89008 WPScan
2.7 Low Bookit Plugin bookit-for-cal-com Broken Access Control Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization < 2.6.0.5 Fixed in 2.6.0.5 CVE-2026-89007 WPScan
5.3 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR No login needed 4.0 – < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87966 WPScan
4.8 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token No login needed < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87965 WPScan
6.4 Medium RT Mega Menu Plugin rt-mega-menu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute ≤ 1.5.2 CVE-2026-15650 Wordfence
4.3 Medium LatePoint - Appointment Booking & Scheduling Plugin latepoint Broken Access Control Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter ≤ 5.6.9 CVE-2026-18441 Wordfence
5.3 Medium Booking for Appointments and Events Calendar - Amelia Plugin Broken Access Control Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass No login needed ≤ 2.4.5 CVE-2026-16582 Wordfence
5.4 Medium Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Broken Access Control Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover ≤ 2.4.4 CVE-2026-14311 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only