WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–48 of 48 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.3 Critical Radius Booking — Booking Calendar for Appointments & Services Plugin radius-booking SQL Injection No login needed ≤ 1.0.19 CVE-2026-39764 Patchstack
9.3 Critical WooCommerce Appointments Plugin woocommerce-appointments SQL Injection No login needed ≤ 5.3.2 CVE-2026-32557 Patchstack
9.3 Critical WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events SQL Injection No login needed ≤ 6.4.0 Fixed in 6.5.0 CVE-2026-103352 Patchstack
9.1 Critical VikAppointments Services Booking Calendar Plugin vikappointments Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter No login needed ≤ 1.2.21 CVE-2026-87115 Wordfence
9.1 Critical Appointment Booking Plugin latepoint Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field No login needed ≤ 5.7.0 CVE-2026-92966 Wordfence
9.1 Critical Online Scheduling and Appointment Booking System Plugin bookly-responsive-appointment-booking-tool Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter No login needed ≤ 28.2 CVE-2026-93399 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action No login needed ≤ 1.2.3 CVE-2026-14349 Wordfence
9.3 Critical VikAppointments Services Booking Calendar Plugin vikappointments SQL Injection No login needed ≤ 1.2.20 Fixed in 1.2.21 CVE-2026-84768 Patchstack
9.8 Critical Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Privilege Escalation Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' No login needed 8.0 – 9.6.2 CVE-2026-9055 Wordfence
9.8 Critical WPLP Cookie Consent Plugin gdpr-cookie-consent Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint No login needed ≤ 4.4.1 CVE-2026-75865 Wordfence
9.3 Critical BookingPress Appointment Booking Pro Plugin bookingpress-appointment-booking-pro SQL Injection No login needed ≤ 6.0.2 CVE-2026-68566 Patchstack
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter No login needed ≤ 1.2.6 CVE-2026-18315 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Privilege Escalation No login needed ≤ 1.2.6 Fixed in 1.2.7 CVE-2026-73347 Patchstack
9.8 Critical TrueBooker Appointment Booking Plugin Privilege Escalation Unauthenticated Account Takeover via Multiple AJAX Actions No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18776 WPScan
9.3 Critical JetAppointment Plugin jet-appointments-booking SQL Injection No login needed ≤ 2.5.2 Fixed in 2.5.2.1 CVE-2026-73365 Patchstack
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Privilege Escalation Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter No login needed ≤ 1.2.6 CVE-2026-16142 Wordfence
10.0 Critical WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Remote Code Execution Arbitrary Code Execution No login needed ≤ 6.3.0 Fixed in 6.3.1 CVE-2026-61962 Patchstack
9.8 Critical Ajax Search Lite Plugin ajax-search-lite PHP Object Injection Unauthenticated PHP Object Injection via Search Statistics REST Endpoint No login needed < 4.14.5 Fixed in 4.14.5 CVE-2026-16258 WPScan
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' No login needed ≤ 1.2.3 CVE-2026-14364 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' No login needed ≤ 1.2.3 CVE-2026-14365 Wordfence
9.3 Critical Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection No login needed ≤ 1.6.12.10 Fixed in 1.6.12.11 CVE-2026-65508 Patchstack
9.8 Critical TrueBooker Appointment Booking Plugin Privilege Escalation Unauthenticated Account Takeover via Password Reset No login needed < 1.2.4 Fixed in 1.2.4 CVE-2026-14545 WPScan
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Privilege Escalation No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2026-61951 Patchstack
9.3 Critical TrueBooker Plugin truebooker-appointment-booking SQL Injection No login needed ≤ 1.2.3 Fixed in 1.2.4 CVE-2026-61950 Patchstack
9.3 Critical Bookly Plugin bookly-responsive-appointment-booking-tool SQL Injection No login needed ≤ 27.7 Fixed in 27.8 CVE-2026-61949 Patchstack
9.8 Critical MountDev AI MCP Connector Plugin mountdev-ai-mcp-connector Privilege Escalation Unauthenticated Privilege Escalation via OAuth Authorization Endpoint No login needed ≤ 1.6.1 CVE-2026-15015 Wordfence
9.8 Critical Easy Form Builder by WhiteStudio Plugin easy-form-builder Privilege Escalation Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint No login needed ≤ 4.0.11 CVE-2026-13439 Wordfence
9.3 Critical LatePoint Plugin latepoint SQL Injection No login needed ≤ 5.6.3 Fixed in 5.6.4 CVE-2026-57714 Patchstack
9.8 Critical Instant Appointment Plugin instant-appointment Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.2 CVE-2026-15282 Wordfence
9.1 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control No login needed ≤ 1.1.9 Fixed in 1.2.0 CVE-2026-48881 Patchstack
9.3 Critical Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection No login needed ≤ 1.6.9.27 Fixed in 1.6.9.29 CVE-2026-39493 Patchstack
9.8 Critical User Verification by PickPlugins Plugin user-verification Authentication Bypass Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint No login needed ≤ 2.0.46 CVE-2026-7458 Wordfence
9.6 Critical Appointment Plugin appointment Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Arbitrary File Upload No login needed ≤ 3.5.5 CVE-2026-39620 Patchstack
10.0 Critical ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Plugin elementskit-lite Broken Access Control ElementsKit Elementor Addons < 3.7.9 Unauthenticated Mailchimp REST Endpoint No login needed < 3.7.9 Fixed in 3.7.9 CVE-2026-23693 VulnCheck
9.8 Critical CRM Memberships Plugin crm-memberships Broken Access Control Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint No login needed ≤ 2.6 CVE-2025-13313 Wordfence
9.8 Critical Appointments Plugin appointments PHP Object Injection Unauthenticated PHP Object Injection No login needed < 2.2.2 Fixed in 2.2.2 CVE-2017-20206 Wordfence
9.8 Critical Latepoint Plugin Local File Inclusion Unauthenticated LFI No login needed < 5.1.94 Fixed in 5.1.94 CVE-2025-6715 WPScan
9.8 Critical bSecure Plugin bsecure Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via order_info REST Endpoint No login needed 1.3.7 – 1.7.9 CVE-2025-6187 Wordfence
9.8 Critical Profitori Plugin profitori Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint No login needed 2.0.6.0 – 2.1.1.3 CVE-2025-4631 Wordfence
9.8 Critical Oliver POS – A WooCommerce Point of Sale (POS) Plugin oliver-pos Information Disclosure A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation No login needed ≤ 2.4.2.3 CVE-2024-13513 Wordfence
9.8 Critical WooCommerce Point of Sale Plugin Broken Access Control Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change No login needed ≤ 6.1.0 CVE-2024-11281 Wordfence
9.3 Critical Instant Appointment Plugin instant-appointment SQL Injection No login needed ≤ 1.2 CVE-2024-54361 Patchstack
9.8 Critical WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin timetics Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover No login needed ≤ 1.0.25 CVE-2024-9263 Wordfence
9.8 Critical LatePoint Plugin Authentication Bypass No login needed ≤ 5.0.12 CVE-2024-8943 Wordfence
9.8 Critical LatePoint Plugin SQL Injection Unauthenticated Arbitrary User Password Change via SQL Injection No login needed ≤ 5.0.11 CVE-2024-8911 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking SQL Injection Multiple Unauthenticated SQLi No login needed < 1.0.3 Fixed in 1.0.3 CVE-2024-6924 WPScan
9.8 Critical Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress Plugin bookingpress-appointment-booking Authentication Bypass BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover No login needed 1.1.6 – 1.1.7 CVE-2024-7350 Wordfence
9.1 Critical LatePoint Plugin Broken Access Control Missing Authorization and Sensitive Information Exposure via IDOR No login needed ≤ 4.9.9 CVE-2024-2472 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only