WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 54 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium WPBase Cache Plugin wpbase-cache Denial of Service Denial of Service Attack ≤ 5.5.6 CVE-2026-39767 Patchstack
5.3 Medium Two Factor Plugin two-factor Denial of Service Denial of Service Attack No login needed ≤ 0.16.0 Fixed in 0.17.0 CVE-2026-100508 Patchstack
5.9 Medium WP Store Locator Plugin wp-store-locator Denial of Service Denial of Service Attack No login needed < 3.0.0 Fixed in 3.0.0 CVE-2026-94681 Patchstack
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title ≤ 5.7.2 CVE-2026-88037 Wordfence
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Internal Notes Disclosure via Service and Category REST Routes No login needed < 1.2.8 Fixed in 1.2.8 CVE-2026-87907 WPScan
5.3 Medium Booktics – Booking Calendar for Appointments and Service Businesses Plugin booktics Broken Access Control Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization No login needed ≤ 1.0.23 CVE-2026-11446 Wordfence
6.4 Medium Builderall Plugin builderall-cheetah-for-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting ≤ 3.0.2 CVE-2026-15796 Wordfence
5.4 Medium Search Atlas SEO Plugin metasync Broken Access Control Subscriber+ Google Service Account Credential Overwrite/Deletion < 2.6.24 Fixed in 2.6.24 CVE-2026-15247 WPScan
5.3 Medium WP Go Maps Plugin wp-google-maps Denial of Service Denial of Service Attack No login needed ≤ 10.1.08 Fixed in 10.1.09 CVE-2026-84780 Patchstack
5.3 Medium Really Simple SSL Plugin really-simple-ssl Denial of Service Denial of Service Attack No login needed ≤ 9.8.0 Fixed in 9.8.1 CVE-2026-84775 Patchstack
5.3 Medium Booking Package Plugin booking-package Price Manipulation Unauthenticated Price Manipulation via Service and Option Cost Parameters No login needed < 1.7.25 Fixed in 1.7.25 CVE-2026-16986 WPScan
6.5 Medium WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting ≤ 6.3.2 Fixed in 6.4.0 CVE-2026-73402 Patchstack
6.5 Medium WpBookingly Plugin service-booking-manager Cross-Site Scripting ≤ 1.3.2 Fixed in 1.4.0 CVE-2026-66687 Patchstack
6.5 Medium Service Finder Booking Plugin sf-booking Broken Access Control ≤ 6.2 CVE-2026-28159 Patchstack
6.5 Medium WP Maps Plugin wp-google-map-plugin Denial of Service Subscriber+ Denial of Service < 4.9.7 Fixed in 4.9.7 CVE-2026-16265 WPScan
5.3 Medium LatePoint Plugin latepoint Broken Access Control Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter No login needed ≤ 5.6.2 CVE-2026-12657 Wordfence
6.4 Medium Appointment Booking Calendar Plugin creavi-booking-service Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label ≤ 1.4.4 CVE-2026-1856 Wordfence
6.4 Medium Services Section Block Plugin services-section Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Block Attribute ≤ 1.4.4 CVE-2026-11402 Wordfence
5.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Denial of Service Unauthenticated Denial of Service No login needed ≤ 1.6.11.5 CVE-2026-7493 Wordfence
4.3 Medium WpBookingly Plugin service-booking-manager Broken Access Control ≤ 1.2.9 Fixed in 1.3.0 CVE-2026-25444 Patchstack
6.5 Medium WpBookingly Plugin service-booking-manager Broken Access Control ≤ 1.2.9 Fixed in 1.3.0 CVE-2026-27405 Patchstack
4.3 Medium SEO Plugin by Squirrly SEO Plugin squirrly-seo Broken Access Control Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection ≤ 12.4.14 CVE-2025-14342 Wordfence
5.3 Medium CallbackKiller service widget Plugin callbackkiller-service-widget Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update No login needed ≤ 1.2 CVE-2026-1944 Wordfence
5.4 Medium Electrician - Electrical Service Plugin electrician Server-Side Request Forgery Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) No login needed ≤ 5.6 CVE-2026-22358 Patchstack
5.4 Medium Pool Services Theme pool-services Server-Side Request Forgery No login needed ≤ 3.3 CVE-2025-62741 Patchstack
4.4 Medium twinklesmtp – Email Service Provider Plugin twinklesmtp Cross-Site Scripting Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings ≤ 1.03 CVE-2025-14887 Wordfence
4.3 Medium Co-marquage service-public.fr Plugin co-marquage-service-public Cross-Site Request Forgery No login needed ≤ 0.5.77 CVE-2025-62113 Patchstack
6.5 Medium Opal Service Plugin opal-service Cross-Site Scripting ≤ 1.9.1 CVE-2025-62913 Patchstack
4.3 Medium Image optimization service by Optimole Plugin Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Media Offload ≤ 4.1.0 CVE-2025-11519 Wordfence
6.5 Medium WP Ticket Customer Service Software & Support Ticket System Plugin wp-ticket Cross-Site Scripting ≤ 6.0.2 Fixed in 6.0.3 CVE-2025-60157 Patchstack
5.4 Medium Car Repair Services Plugin car-repair-services Server-Side Request Forgery No login needed ≤ 5.0 CVE-2025-30997 Patchstack
6.5 Medium Home Services Plugin home-services Cross-Site Scripting ≤ 1.2.6 CVE-2025-26930 Patchstack
6.4 Medium Amazing service box Addons For WPBakery Page Builder Plugin amazing-service-box-visual-composer-addons Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.0.0 CVE-2025-2573 Wordfence
6.1 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting Reflected XSS No login needed < 5.0.0 Fixed in 5.0.0 CVE-2024-12737 WPScan
6.5 Medium Services Section block Plugin services-section Cross-Site Scripting ≤ 1.3.4 Fixed in 1.3.5 CVE-2025-26947 Patchstack
4.3 Medium ShipWorks Connector for Woocommerce Plugin shipworks-e-commerce-bridge Cross-Site Request Forgery Cross-Site Request Forgery to Service Password/Username Update No login needed ≤ 5.2.5 CVE-2024-13317 Wordfence
6.5 Medium SetMore Theme – Custom Post Types Plugin service-provider-profile-cpt Cross-Site Scripting Custom Post Types plugin <= 1.1 - Stored Cross Site Scripting (XSS) ≤ 1.1 CVE-2025-22748 Patchstack
6.4 Medium Service Box Plugin service-boxs Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.9 CVE-2024-12699 Wordfence
6.5 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db ≤ 4.9.2 CVE-2024-12558 Wordfence
5.3 Medium Calculated Fields Form Plugin calculated-fields-form Denial of Service No login needed ≤ 5.2.63 CVE-2024-12601 Wordfence
6.1 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting Reflected Cross-Site Scripting via status Parameter No login needed ≤ 4.9.1 CVE-2024-12469 Wordfence
5.3 Medium Minify HTML Plugin minify-html-markup Denial of Service - Regular Expressions Denial of Service No login needed ≤ 2.1.10 CVE-2024-12579 Wordfence
6.1 Medium WP Service Payment Form With Authorize.net Plugin wp-service-payment-form-with-authorizenet Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.6.3 CVE-2024-12258 Wordfence
6.1 Medium Co-marquage service-public.fr Plugin co-marquage-service-public Cross-Site Scripting Reflected Cross-Site Scripting via add_query_arg Parameter No login needed ≤ 0.5.76 CVE-2024-10522 Wordfence
5.3 Medium WP Easy Pay (Free) Plugin wp-easy-pay Broken Access Control Missing Authorization to Unauthenticated Service Disconnection No login needed ≤ 4.2.3 CVE-2024-5861 Wordfence
6.4 Medium Orbit Fox by ThemeIsle Plugin themeisle-companion Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Services and Post Type Grid Widgets ≤ 2.10.34 CVE-2024-2484 Wordfence
6.5 Medium Scheduling Plugin – Online Booking Plugin calendar-booking Broken Access Control Online Booking for WordPress <= 3.5.10 - Missing Authorization to Unauthenticated Service Disconnection No login needed ≤ 3.5.10 CVE-2024-1634 Wordfence
5.3 Medium WP Go Maps (formerly WP Google Maps) Plugin Information Disclosure Information Exposure to Potential Denial of Service No login needed ≤ 9.0.34 CVE-2023-6777 Wordfence
6.5 Medium OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Plugin stepbyteservice-openstreetmap Cross-Site Scripting ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-30450 Patchstack
6.5 Medium Co-marquage service-public.fr Plugin co-marquage-service-public Cross-Site Scripting ≤ 0.5.71 Fixed in 0.5.72 CVE-2024-29908 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only