WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 1,491 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Memberful - Membership Plugin memberful-wp Information Disclosure Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure ≤ 1.81.2 Fixed in 1.82.0 CVE-2026-104401 Patchstack
6.4 Medium ThemeREX Addons Plugin trx_addons Server-Side Request Forgery ≤ 2.46.0 Fixed in 2.47.0 CVE-2026-102797 Patchstack
5.4 Medium Photo Gallery by Supsystic Plugin gallery-by-supsystic Cross-Site Request Forgery No login needed ≤ 1.21.0 Fixed in 1.21.1 CVE-2026-102399 Patchstack
5.4 Medium Razorpay Payment Links for WooCommerce Plugin rzp-woocommerce Cross-Site Request Forgery No login needed ≤ 2.1.5 Fixed in 2.2.0 CVE-2026-97299 Patchstack
5.8 Medium Broken Link Notifier Plugin broken-link-notifier Server-Side Request Forgery Unauthenticated SSRF via Redirect Bypass No login needed 1.3.1 – < 2.0.0.1 Fixed in 2.0.0.1 CVE-2026-97316 WPScan
4.1 Medium WPeMatico RSS Feed Fetcher Plugin wpematico Server-Side Request Forgery Contributor+ SSRF via Campaign Preview < 2.8.27 Fixed in 2.8.27 CVE-2026-89003 WPScan
4.1 Medium WPeMatico RSS Feed Fetcher Plugin wpematico Server-Side Request Forgery Contributor+ SSRF via Campaign Run < 2.8.27 Fixed in 2.8.27 CVE-2026-89000 WPScan
5.8 Medium Testimonials Widget Plugin Server-Side Request Forgery Unauthenticated SSRF via Featured Image URL No login needed ≤ 4.0.4 CVE-2026-96533 WPScan
4.0 Medium Link Library Plugin link-library Server-Side Request Forgery Unauthenticated SSRF via Reciprocal Link Validation No login needed 7.8.8 – < 7.9.6 Fixed in 7.9.6 CVE-2026-78397 WPScan
5.0 Medium Directorist Plugin directorist-wpml-integration Server-Side Request Forgery Subscriber+ SSRF via Avatar URL < 8.9.5 Fixed in 8.9.5 CVE-2026-84046 WPScan
4.3 Medium Sign-up Sheets Plugin sign-up-sheets Cross-Site Request Forgery Arbitrary Sign-up Deletion via CSRF No login needed < 2.4.0 Fixed in 2.4.0 CVE-2026-92410 WPScan
4.1 Medium Import and export users and customers Plugin import-users-from-csv-with-meta Server-Side Request Forgery Admin+ SSRF via bp_avatar < 2.4.5 Fixed in 2.4.5 CVE-2026-16542 WPScan
5.4 Medium PublishPress Series Plugin organize-series Cross-Site Request Forgery No login needed ≤ 3.1.3 Fixed in 3.1.4 CVE-2026-74005 Patchstack
6.4 Medium Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin unlimited-elements-for-elementor Server-Side Request Forgery ≤ 2.0.19 Fixed in 2.0.20 CVE-2026-66608 Patchstack
4.3 Medium Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Cross-Site Request Forgery Subscription Cancellation via CSRF No login needed < 2.0.3 Fixed in 2.0.3 CVE-2026-87860 WPScan
6.5 Medium WPLP Cookie Consent Plugin gdpr-cookie-consent Cross-Site Request Forgery Arbitrary Post Deletion via CSRF No login needed < 4.4.4 Fixed in 4.4.4 CVE-2026-85131 WPScan
4.1 Medium WP Import Export Lite Plugin wp-import-export-lite Server-Side Request Forgery Admin+ SSRF via Import URL Handling < 3.9.33 Fixed in 3.9.33 CVE-2026-76559 WPScan
4.3 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84024 WPScan
6.5 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84023 WPScan
4.3 Medium Site Kit by Google Plugin google-site-kit Cross-Site Request Forgery No login needed ≤ 1.186.0 Fixed in 1.187.0 CVE-2026-62139 Patchstack
5.4 Medium RTMKit Plugin rometheme-for-elementor Cross-Site Request Forgery No login needed ≤ 2.1.5 Fixed in 2.1.6 CVE-2026-62133 Patchstack
4.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Server-Side Request Forgery Contributor+ SSRF via get-csv-to-json REST Endpoint < 13.2.0 Fixed in 13.2.0 CVE-2026-83543 WPScan
5.4 Medium SEOPress Plugin wp-seopress Server-Side Request Forgery ≤ 10.1 Fixed in 10.2 CVE-2026-85305 Patchstack
5.4 Medium Simple Membership MailChimp Integration Plugin simple-membership-mailchimp-integration Cross-Site Request Forgery API Key Update via CSRF No login needed < 1.9.8 Fixed in 1.9.8 CVE-2026-8151 WPScan
5.4 Medium Grand Tour Theme grandtour Cross-Site Request Forgery No login needed ≤ 5.5.1 CVE-2026-66652 Patchstack
5.5 Medium Broken Link Checker Plugin broken-link-checker Server-Side Request Forgery ≤ 2.4.14 Fixed in 2.4.14.1 CVE-2026-84772 Patchstack
4.3 Medium JetStyleManager Plugin jet-style-manager Cross-Site Request Forgery Skin Deletion and Modification via CSRF No login needed < 1.3.9 Fixed in 1.3.9 CVE-2026-81432 WPScan
4.3 Medium WC Vendors Plugin wc-vendors Cross-Site Request Forgery Order Shipment Status Change via CSRF No login needed < 2.7.2.1 Fixed in 2.7.2.1 CVE-2026-81426 WPScan
5.4 Medium MapSVG Plugin mapsvg-lite-interactive-vector-maps Server-Side Request Forgery No login needed ≤ 8.15.0 CVE-2026-82852 Patchstack
5.4 Medium Newsletters Plugin newsletters-lite Cross-Site Request Forgery Arbitrary Plugin Option Update via CSRF No login needed < 4.17 Fixed in 4.17 CVE-2026-17522 WPScan
5.9 Medium UpdraftPlus Plugin Cross-Site Request Forgery Backup Restoration via CSRF No login needed < 1.26.7 Fixed in 1.26.7 CVE-2026-76549 WPScan
4.3 Medium Hash Form Plugin hash-form Cross-Site Request Forgery No login needed ≤ 1.4.0 Fixed in 1.4.1 CVE-2026-78280 Patchstack
5.4 Medium Fluent Support Pro Plugin fluent-support-pro Cross-Site Request Forgery No login needed ≤ 2.3.1 Fixed in 2.3.2 CVE-2026-78279 Patchstack
4.9 Medium FluentCRM Pro Plugin fluentcampaign-pro Server-Side Request Forgery ≤ 3.1.12 Fixed in 3.1.13 CVE-2026-78277 Patchstack
6.4 Medium Shared Files Plugin shared-files Server-Side Request Forgery ≤ 1.7.69 Fixed in 1.7.70 CVE-2026-78269 Patchstack
4.2 Medium LitExtension: Store to WooCommerce Migration Plugin Cross-Site Request Forgery Connector Token Takeover via CSRF No login needed ≤ 1.2.5 CVE-2026-15046 WPScan
6.0 Medium [Aotuman] Grab WeChat Articles Plugin apoyl-grabweixin Server-Side Request Forgery ≤ 2.0.1 CVE-2026-32467 Patchstack
6.0 Medium Vehica Core Plugin vehica-core Server-Side Request Forgery ≤ 1.0.104 CVE-2026-66654 Patchstack
6.5 Medium Tourfic Plugin tourfic Broken Access Control ≤ 2.23.1 Fixed in 2.23.2 CVE-2026-27999 Patchstack
6.4 Medium ProSolution WP Client Plugin prosolution-wp-client Server-Side Request Forgery Subscriber+ SSRF via proSol_url_validate < 2.0.9 Fixed in 2.0.9 CVE-2026-19050 WPScan
5.4 Medium WP Umbrella Plugin wp-health Cross-Site Request Forgery No login needed 2.24.2 – 2.26.2 Fixed in 2.27.0 CVE-2026-66642 Patchstack
6.5 Medium Plugins Garbage Collector (Database Cleanup) Plugin plugins-garbage-collector Cross-Site Request Forgery No login needed ≤ 0.14 CVE-2026-66686 Patchstack
4.3 Medium Theme My Login Plugin theme-my-login Cross-Site Request Forgery No login needed ≤ 7.1.14 CVE-2026-66681 Patchstack
6.5 Medium Google Authenticator Plugin google-authenticator Cross-Site Request Forgery Google Authenticator < 0.56 - 2FA Secret Overwrite via CSRF No login needed < 0.56 Fixed in 0.56 CVE-2026-14204 WPScan
4.3 Medium GDPR Cookie Compliance Plugin gdpr-cookie-compliance Cross-Site Request Forgery Cookie Deletion and Forced Logout via CSRF No login needed < 5.1.0 Fixed in 5.1.0 CVE-2026-16613 WPScan
4.7 Medium Clearfy Plugin Open Redirect Open Redirect via Cyrlitera 404 Handler No login needed < 2.4.3 Fixed in 2.4.3 CVE-2026-16296 WPScan
4.3 Medium Clearfy Plugin Information Disclosure Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher < 2.4.3 Fixed in 2.4.3 CVE-2026-16295 WPScan
5.8 Medium EmbedPress Plugin embedpress Server-Side Request Forgery Unauthenticated Blind SSRF No login needed < 4.6.1 Fixed in 4.6.1 CVE-2026-10526 WPScan
5.3 Medium Simple Google Calendar Outlook Events Widget Plugin simple-google-icalendar-widget Server-Side Request Forgery Unauthenticated SSRF via calendar_id No login needed < 3.1.0 Fixed in 3.1.0 CVE-2026-16536 WPScan
4.1 Medium Clearfy Plugin PHP Object Injection Admin+ PHP Object Injection via Settings Import < 2.4.3 Fixed in 2.4.3 CVE-2026-16297 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only