WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 242 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
3.7 Low Booking Calendar Plugin booking Other Race Condition No login needed ≤ 11.8.4 Fixed in 11.9 CVE-2026-39601 Patchstack
7.2 High Visitors Traffic Real Time Statistics Pro Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title) No login needed ≤ 11.22 CVE-2026-93367 Wordfence
5.3 Medium Newsletter Plugin newsletter Information Disclosure Unauthenticated Insufficiently Protected Credentials via '/tnp/l/' Click-Tracking REST Endpoint (Raw Subscriber Token Cookie Disclosure) No login needed ≤ 9.3.9 CVE-2026-92537 Wordfence
6.5 Medium Pixel Manager for WooCommerce Plugin woocommerce-google-adwords-conversion-tracking-tag Cross-Site Scripting ≤ 1.69.0 Fixed in 1.69.1 CVE-2026-94674 Patchstack
8.8 High Import and export users and customers Plugin import-users-from-csv-with-meta Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields ≤ 2.4.17 CVE-2026-86583 Wordfence
8.1 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) ≤ 4.17.2 CVE-2026-85658 Wordfence
6.5 Medium Breeze Cache Plugin breeze Other Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters No login needed 1.2.5 – < 2.5.15 Fixed in 2.5.15 CVE-2026-79713 WPScan
4.8 Medium Newsletter Plugin newsletter Information Disclosure Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key No login needed < 9.3.8 Fixed in 9.3.8 CVE-2026-86824 WPScan
6.8 Medium Xpro Elementor Addons Plugin Cross-Site Scripting Contributor+ Stored XSS via Interactive Circle Widget < 1.7.9 Fixed in 1.7.9 CVE-2026-84088 WPScan
5.3 Medium 3D FlipBook Plugin interactive-3d-flipbook-powered-physics-engine Information Disclosure Unauthenticated Sensitive Information Exposure in 'id' Parameter No login needed ≤ 1.16.20 CVE-2026-15758 Wordfence
5.3 Medium Royal Addons for Elementor Plugin royal-elementor-addons Information Disclosure Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter No login needed ≤ 1.7.1066 CVE-2026-17585 Wordfence
7.1 High Interactive Geo Maps Plugin interactive-geo-maps Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.30 CVE-2026-81770 Patchstack
6.5 Medium WP Fastest Cache Plugin wp-fastest-cache Other Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters No login needed 0.8.7.7 – < 1.5.1 Fixed in 1.5.1 CVE-2026-74916 WPScan
7.2 High Master Addons for Elementor Plugin master-addons Broken Access Control Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction ≤ 3.1.9 CVE-2026-75921 Wordfence
5.4 Medium MapSVG Plugin mapsvg-lite-interactive-vector-maps Server-Side Request Forgery No login needed ≤ 8.15.0 CVE-2026-82852 Patchstack
5.3 Medium Document Embedder Plugin document-emberdder Broken Access Control Unauthenticated Private Document Download via Token Oracle No login needed < 2.3.1 Fixed in 2.3.1 CVE-2026-16567 WPScan
8.1 High Drag and Drop Multiple File Upload for Contact Form 7 Plugin drag-and-drop-multiple-file-upload-contact-form-7 Arbitrary File Upload Unauthenticated RCE via Control Character Filename Bypass No login needed < 1.3.9.9 Fixed in 1.3.9.9 CVE-2026-18781 WPScan
7.5 High Track Geolocation Of Users Using Contact Form 7 Plugin track-geolocation-of-users-using-contact-form-7 Information Disclosure Sensitive Data Exposure No login needed ≤ 3.0.2 CVE-2026-73386 Patchstack
5.3 Medium 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin interactive-3d-flipbook-powered-physics-engine Information Disclosure PDF Flipbook Viewer, Flipbook Image Gallery plugin <= 1.16.20 - Sensitive Data Exposure No login needed ≤ 1.16.20 CVE-2026-74007 Patchstack
6.4 Medium Loco Translate Plugin loco-translate Cross-Site Scripting Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments ≤ 2.8.7 CVE-2026-15066 Wordfence
6.5 Medium AfterShip Tracking Plugin aftership-woocommerce-tracking Cross-Site Scripting ≤ 1.18.1 CVE-2026-66460 Patchstack
8.1 High Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect Plugin ventraconnect-social-login Authentication Bypass Passwordless Login by VentraConnect <= 1.4.3 - Unauthenticated Authentication Bypass via Spotify OAuth Callback No login needed ≤ 1.4.3 CVE-2026-18961 Wordfence
7.5 High Formidable Forms Signature Online Contract Automation Plugin forms-signature-formidable-online-contract-automation Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 2.0.1 Fixed in 2.0.2 CVE-2026-65523 Patchstack
7.1 High Tracking Code Manager Plugin tracking-code-manager Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 2.6.0 Fixed in 2.7.0 CVE-2026-28172 Patchstack
9.1 Critical WPCargo Track & Trace Plugin wpcargo SQL Injection Unauthenticated SQL Injection via wpcargo_tracking_number No login needed < 8.0.4 Fixed in 8.0.4 CVE-2026-12713 WPScan
9.1 Critical Drag and Drop Multiple File Upload for WooCommerce Plugin drag-and-drop-multiple-file-upload-for-woocommerce Arbitrary File Upload Unauthenticated File Deletion via Nonce Oracle No login needed < 1.1.8 Fixed in 1.1.8 CVE-2026-16054 WPScan
9.1 Critical Super Store Finder Plugin SQL Injection Unauthenticated SQL Injection via ssf_tracking No login needed < 7.11 Fixed in 7.11 CVE-2026-12965 WPScan
7.2 High GTM4WP Plugin duracelltomi-google-tag-manager Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields No login needed ≤ 1.22.3 CVE-2026-16597 Wordfence
4.3 Medium Facturación Electrónica Costa Rica Plugin factura-electronica-cr Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 2.0.2 CVE-2026-9720 Wordfence
9.3 Critical MapSVG Plugin mapsvg-lite-interactive-vector-maps SQL Injection No login needed ≤ 8.14.0 Fixed in 8.14.1 CVE-2026-59527 Patchstack
5.3 Medium Quiz And Survey Master Plugin Information Disclosure Unauthenticated User Enumeration and Password Oracle via Quiz Login No login needed < 11.1.3 Fixed in 11.1.3 CVE-2026-14820 WPScan
6.4 Medium MapSVG Lite Plugin mapsvg-lite-interactive-vector-maps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.14.0 CVE-2025-9205 Wordfence
9.1 Critical MapSVG Plugin mapsvg-lite-interactive-vector-maps Arbitrary File Upload ≤ 8.14.0 Fixed in 8.14.1 CVE-2026-65455 Patchstack
8.5 High MapSVG Plugin mapsvg-lite-interactive-vector-maps SQL Injection ≤ 8.14.0 Fixed in 8.14.1 CVE-2026-65450 Patchstack
6.5 Medium MapSVG Plugin mapsvg-lite-interactive-vector-maps Cross-Site Scripting ≤ 8.14.0 Fixed in 8.14.1 CVE-2026-65449 Patchstack
7.2 High MapSVG Plugin mapsvg-lite-interactive-vector-maps Arbitrary File Upload Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint ≤ 8.14.0 CVE-2026-1771 Wordfence
8.1 High Passwordless Login by VentraConnect Plugin Privilege Escalation Unauthenticated Account Takeover via Email OTP Brute Force No login needed < 1.4.1 Fixed in 1.4.1 CVE-2026-13142 WPScan
7.6 High Advanced Shipment Tracking for WooCommerce Plugin woo-advanced-shipment-tracking SQL Injection ≤ 4.0 Fixed in 4.0.1 CVE-2026-57773 Patchstack
9.3 Critical Advanced Ads – Tracking Plugin advanced-ads-tracking SQL Injection Tracking plugin < 3.0.7 - SQL Injection No login needed < 3.0.7 Fixed in 3.0.7 CVE-2025-59554 Patchstack
9.9 Critical RD Station Plugin integracao-rd-station Remote Code Execution ≤ 5.6.0 Fixed in 5.7.0 CVE-2026-49774 Patchstack
6.5 Medium Shipment Tracker for Woocommerce Plugin shipment-tracker-for-woocommerce Cross-Site Scripting ≤ 1.5.3.2 Fixed in 1.5.3.3 CVE-2026-39540 Patchstack
5.4 Medium Iptanus File Upload Plugin wp-file-upload Arbitrary File Upload File Overwrite via Race Condition < 5.1.7 Fixed in 5.1.7 CVE-2025-15546 WPScan
4.3 Medium WooCommerce Conversion Tracking Plugin woocommerce-conversion-tracking Cross-Site Request Forgery No login needed ≤ 2.0.10 Fixed in 2.0.11 CVE-2022-47150 Patchstack
8.1 High Racquet Theme racquet Local File Inclusion No login needed ≤ 1.12.0 CVE-2025-69369 Patchstack
7.5 High Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity Plugin logtivity Information Disclosure Sensitive Data Exposure No login needed ≤ 3.3.6 Fixed in 3.3.7 CVE-2026-42673 Patchstack
7.5 High Simple History – Track, Log, and Audit WordPress Changes Plugin simple-history Privilege Escalation Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint ≤ 5.26.0 CVE-2026-7459 Wordfence
6.5 Medium Independent Analytics Plugin independent-analytics Server-Side Request Forgery Unauthenticated Server-Side Request Forgery via Tracking Route No login needed ≤ 2.14.9 CVE-2026-5737 Wordfence
6.1 Medium MapGeo - Interactive Geo Maps Plugin Cross-Site Scripting Interactive Geo Maps <= 1.6.27 - Reflected Cross-Site Scripting via 'map' Parameter No login needed ≤ 1.6.27 CVE-2025-15345 Wordfence
5.3 Medium Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity Plugin logtivity Information Disclosure Unauthenticated Information Disclosure via REST API No login needed ≤ 3.3.6 CVE-2026-8198 Wordfence
5.3 Medium 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery Plugin interactive-3d-flipbook-powered-physics-engine Broken Access Control PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure No login needed ≤ 1.16.17 CVE-2026-1314 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only