WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 275 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Appointment Booking Plugin – LatePoint | Calendar & Scheduling Plugin latepoint Broken Access Control LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification ≤ 5.6.9 CVE-2026-17538 Wordfence
4.3 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint < 4.0.0 Fixed in 4.0.0 CVE-2026-104049 WPScan
6.5 Medium TrueBooker Plugin truebooker-appointment-booking Broken Access Control Settings Change No login needed ≤ 1.2.9 CVE-2026-39798 Patchstack
6.5 Medium Wappointment Plugin wappointment Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 2.7.7 CVE-2026-39756 Patchstack
5.3 Medium Fast Courier Plugin fast-courier-shipping-freight Broken Access Control Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint No login needed ≤ 5.2.3 CVE-2026-89289 WPScan
5.3 Medium Appointment Booking Plugin latepoint Broken Access Control Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter No login needed ≤ 5.7.1 CVE-2026-94432 Wordfence
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter ≤ 1.6.12.31 CVE-2026-91109 Wordfence
5.3 Medium Newsletter Plugin newsletter Information Disclosure Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure) No login needed ≤ 9.3.9 CVE-2026-92537 Wordfence
6.5 Medium Bookly Plugin bookly-responsive-appointment-booking-tool Broken Access Control Insecure Direct Object References (IDOR) ≤ 28.2 Fixed in 28.3 CVE-2026-96347 Patchstack
5.3 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.6.12.31 Fixed in 1.6.12.33 CVE-2026-94673 Patchstack
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.12.29 Fixed in 1.6.12.31 CVE-2026-94074 Patchstack
5.3 Medium Online Scheduling and Appointment Booking System Plugin bookly-responsive-appointment-booking-tool Broken Access Control Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data No login needed ≤ 28.2 CVE-2026-92799 Wordfence
4.3 Medium OpenStation Plugin desktop-mode Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint ≤ 1.1.7 CVE-2026-19775 Wordfence
4.3 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points < 2.10.4 Fixed in 2.10.4 CVE-2026-93510 WPScan
5.3 Medium FluentBoards Plugin fluent-boards Information Disclosure Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints No login needed 1.95 – < 2.1.0 Fixed in 2.1.0 CVE-2026-89331 WPScan
5.4 Medium Directorist Plugin directorist-wpml-integration Broken Access Control Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint < 8.9.5 Fixed in 8.9.5 CVE-2026-84150 WPScan
4.3 Medium Directorist Plugin directorist-wpml-integration Broken Access Control Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint 8.9.1 – < 8.9.5 Fixed in 8.9.5 CVE-2026-84027 WPScan
5.3 Medium Directorist Plugin directorist-wpml-integration Information Disclosure Unauthenticated Sensitive Data Disclosure via REST Users Endpoint No login needed 8.1 – < 8.9.5 Fixed in 8.9.5 CVE-2026-84026 WPScan
4.3 Medium Directorist Plugin directorist-wpml-integration Information Disclosure Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint 8.5 – < 8.9.5 Fixed in 8.9.5 CVE-2026-77766 WPScan
5.3 Medium WordLift Plugin wordlift Information Disclosure Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints No login needed ≤ 3.54.10 CVE-2026-9289 Wordfence
6.5 Medium Easy Appointments Plugin easy-appointments Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action ≤ 3.12.27 CVE-2026-9232 Wordfence
5.3 Medium Payment Gateway of Stripe for WooCommerce Plugin payment-gateway-stripe-and-woocommerce-integration Other Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint No login needed ≤ 5.0.8 CVE-2026-9832 Wordfence
6.5 Medium Better Messages Plugin bp-better-messages Broken Access Control Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint ≤ 2.15.33 CVE-2026-89334 Wordfence
5.4 Medium WP Recipe Maker Plugin wp-recipe-maker Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint ≤ 10.8.1 CVE-2026-90884 Wordfence
4.3 Medium LatePoint Plugin latepoint Broken Access Control Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) ≤ 5.6.3 CVE-2026-13471 Wordfence
4.3 Medium Magazine Blocks Plugin magazine-blocks Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint ≤ 1.8.6 CVE-2026-75017 Wordfence
5.3 Medium Divi Theme Broken Access Control Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint No login needed ≤ 5.11.1 CVE-2026-91707 Wordfence
5.3 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR No login needed 4.0 – < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87966 WPScan
4.8 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token No login needed < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87965 WPScan
6.4 Medium RT Mega Menu Plugin rt-mega-menu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute ≤ 1.5.2 CVE-2026-15650 Wordfence
4.3 Medium LatePoint - Appointment Booking & Scheduling Plugin latepoint Broken Access Control Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter ≤ 5.6.9 CVE-2026-18441 Wordfence
5.3 Medium Booking for Appointments and Events Calendar - Amelia Plugin Broken Access Control Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass No login needed ≤ 2.4.5 CVE-2026-16582 Wordfence
5.4 Medium Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Broken Access Control Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover ≤ 2.4.4 CVE-2026-14311 Wordfence
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Other Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission No login needed < 1.5.95 Fixed in 1.5.95 CVE-2026-86475 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Internal Notes Disclosure via Service and Category REST Routes No login needed < 1.2.8 Fixed in 1.2.8 CVE-2026-87907 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Staff PII Disclosure via Agent REST Route No login needed < 1.2.8 Fixed in 1.2.8 CVE-2026-87896 WPScan
5.3 Medium Bookit Plugin bookit-for-cal-com Information Disclosure Unauthenticated Appointment PII Disclosure via Availability Check No login needed < 2.6.0.1 Fixed in 2.6.0.1 CVE-2026-88995 WPScan
6.4 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter ≤ 2.4.9 CVE-2026-10148 Wordfence
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Customer PII Disclosure via IDOR No login needed 1.0.9 – < 1.2.3 Fixed in 1.2.3 CVE-2026-87894 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Price Manipulation Unauthenticated Price Manipulation and Payment Method Restriction Bypass No login needed < 1.2.0 Fixed in 1.2.0 CVE-2026-87892 WPScan
6.5 Medium Rox Appointment Booking Plugin rox-appointment-booking Broken Access Control Unauthenticated Holiday Schedule Modification via REST API No login needed < 1.2.0 Fixed in 1.2.0 CVE-2026-87891 WPScan
5.3 Medium Booktics – Booking Calendar for Appointments and Service Businesses Plugin booktics Broken Access Control Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization No login needed ≤ 1.0.23 CVE-2026-11446 Wordfence
6.4 Medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program Plugin mycred Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute ≤ 3.2.4 CVE-2026-17149 Wordfence
5.4 Medium Eventin Plugin wp-event-solution Broken Access Control Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint ≤ 4.1.17 CVE-2026-11821 Wordfence
5.4 Medium Online Scheduling and Appointment Booking System – Bookly Plugin bookly-responsive-appointment-booking-tool Broken Access Control Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update ≤ 27.2 CVE-2026-2520 Wordfence
5.4 Medium LearnDash LMS Plugin Broken Access Control Unauthenticated Arbitrary Course Enrollment via REST Endpoint 4.25.0 – 5.1.6 CVE-2026-12843 Wordfence
4.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Server-Side Request Forgery Contributor+ SSRF via get-csv-to-json REST Endpoint < 13.2.0 Fixed in 13.2.0 CVE-2026-83543 WPScan
4.3 Medium GamiPress Plugin gamipress Broken Access Control Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners < 7.9.9.6 Fixed in 7.9.9.6 CVE-2026-77764 WPScan
5.3 Medium MultiVendorX Plugin dc-woocommerce-multi-vendor Information Disclosure Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint No login needed 5.0.13 – < 5.0.15 Fixed in 5.0.15 CVE-2026-74927 WPScan
5.3 Medium Appointment Booking Lite Plugin Broken Access Control Unauthenticated Arbitrary Reservation Deletion No login needed < 2.4.8 Fixed in 2.4.8 CVE-2026-15232 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only