WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 1–50 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Magee Shortcodes Plugin Other Unauthenticated Mail Relay via Contact Form No login needed ≤ 2.1.1 CVE-2026-105322 WPScan
5.4 Medium MetForm Plugin metform Content Injection Unauthenticated HTML Injection in Notification Emails via Field Shortcodes No login needed < 4.3.1 Fixed in 4.3.1 CVE-2026-86833 WPScan
5.3 Medium Name Directory Plugin name-directory Arbitrary Shortcode Execution No login needed ≤ 1.34.2 Fixed in 1.34.3 CVE-2026-104397 Patchstack
6.4 Medium Twenty20 Image Before-After Plugin twenty20 Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'offset' Shortcode Attribute ≤ 2.0.5 CVE-2026-92767 Wordfence
6.5 Medium WP Ultimate Review Plugin wp-ultimate-review Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter (Split-Shortcode / Late-Registered Shortcode) No login needed ≤ 2.4.3 CVE-2026-100157 Wordfence
5.4 Medium WP Ultimate Review Plugin wp-ultimate-review Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_reviw_summery' Parameter ≤ 2.4.3 CVE-2026-103519 Wordfence
6.4 Medium Responsive Plus Plugin responsive-add-ons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.5.3 CVE-2026-15795 Wordfence
6.5 Medium All in One SEO Plugin all-in-one-seo-pack Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 's' Search Query Parameter No login needed ≤ 5.0.2 CVE-2026-100152 Wordfence
6.5 Medium All in One SEO Plugin all-in-one-seo-pack Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Search Query No login needed < 5.0.2.1 Fixed in 5.0.2.1 CVE-2026-19856 WPScan
5.4 Medium Unlimited Elements For Elementor Plugin unlimited-elements-for-elementor Arbitrary Shortcode Execution Subscriber+ Arbitrary Shortcode Execution via get_addon_output_data < 2.0.21 Fixed in 2.0.21 CVE-2026-92924 WPScan
6.5 Medium The Events Calendar Plugin the-events-calendar Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter No login needed 6.12.0 – < 6.17.5.1 Fixed in 6.17.5.1 CVE-2026-84740 WPScan
4.7 Medium If-So Dynamic Content Plugin if-so Cross-Site Scripting Reflected XSS via render_ifso_shortcodes No login needed 1.8 – < 1.10.2 Fixed in 1.10.2 CVE-2026-87970 WPScan
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute ≤ 5.7.2 CVE-2026-6171 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute ≤ 5.7.2 CVE-2026-6170 Wordfence
6.5 Medium WPForms Lite Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation No login needed 1.5.0.1 – < 2.0.2.1 Fixed in 2.0.2.1 CVE-2026-84744 WPScan
6.4 Medium CSS & JavaScript Toolbox Plugin css-javascript-toolbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode ≤ 12.0.6 CVE-2025-14814 Wordfence
5.6 Medium Ninja Tables Plugin ninja-tables Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source No login needed < 5.2.17 Fixed in 5.2.17 CVE-2026-86612 WPScan
4.8 Medium GTranslate Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Email Translation No login needed < 5.0.1 Fixed in 5.0.1 CVE-2026-86604 WPScan
6.5 Medium WP Recipe Maker Plugin wp-recipe-maker Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Comment Content No login needed < 10.8.2 Fixed in 10.8.2 CVE-2026-86601 WPScan
6.5 Medium Advanced Contact form 7 DB Plugin Broken Access Control Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode ≤ 2.1.1 CVE-2026-6831 Wordfence
4.3 Medium WP Recipe Maker Plugin wp-recipe-maker Information Disclosure Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview 10.3.0 – < 10.8.2 Fixed in 10.8.2 CVE-2026-86602 WPScan
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content ≤ 2.1.21 CVE-2026-16778 Wordfence
6.5 Medium GiveWP Plugin give Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Donor Name No login needed 4.13.2 – < 4.16.9 Fixed in 4.16.9 CVE-2026-85113 WPScan
6.5 Medium Meow Gallery Plugin meow-gallery Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST Route No login needed < 5.5.5 Fixed in 5.5.5 CVE-2026-92422 WPScan
6.8 Medium Master Slider Plugin master-slider Cross-Site Scripting Contributor+ Stored XSS via ms_slider Shortcode Attributes ≤ 3.11.2 CVE-2026-14844 WPScan
6.4 Medium Real 3D Flipbook Plugin real3d-flipbook-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute ≤ 5.1.1 CVE-2026-15098 Wordfence
6.4 Medium WP Composer Plugin page-builder-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode ≤ 1.0.5 CVE-2026-2422 Wordfence
6.4 Medium WPComplete Plugin wpcomplete Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute ≤ 2.9.9.0 CVE-2026-77820 Wordfence
6.5 Medium Photo Gallery by 10Web Plugin photo-gallery SQL Injection Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute ≤ 1.8.44 CVE-2026-85652 Wordfence
6.4 Medium Strong Testimonials Plugin strong-testimonials Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute ≤ 3.3.8 CVE-2026-92622 Wordfence
6.5 Medium WP Inventory Manager Plugin wp-inventory-manager SQL Injection Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute ≤ 2.5.1 CVE-2026-17607 Wordfence
6.4 Medium Custom Twitter Feeds Plugin custom-twitter-feeds Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute ≤ 2.8.0 CVE-2026-84909 Wordfence
5.3 Medium Divi Theme Broken Access Control Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint No login needed ≤ 5.11.1 CVE-2026-91707 Wordfence
6.4 Medium Photo Gallery by 10Web – Mobile-Friendly Image Gallery Plugin photo-gallery Cross-Site Scripting Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.8.44 CVE-2026-86311 Wordfence
4.8 Medium Formidable Forms Plugin formidable Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token No login needed 6.34 – < 6.35 Fixed in 6.35 CVE-2026-19857 WPScan
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter ≤ 5.9.6 CVE-2026-5920 Wordfence
6.4 Medium Bridge - Creative Multipurpose Theme Cross-Site Scripting Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute ≤ 30.8.9.1 CVE-2026-15609 Wordfence
4.9 Medium Product XML Feed Manager for WooCommerce Plugin product-xml-feeds-for-woocommerce Broken Access Control Contributor+ Arbitrary Product Deletion via Shortcode < 3.1.1 Fixed in 3.1.1 CVE-2026-87919 WPScan
6.8 Medium WP Highlight Box Plugin Cross-Site Scripting Contributor+ Stored XSS via highlight-box Shortcode ≤ 1.0 CVE-2026-86790 WPScan
6.8 Medium Custom Menu Wizard Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcode Attributes ≤ 3.3.1 CVE-2026-83532 WPScan
6.5 Medium Simple CAPTCHA with Cloudflare Turnstile Plugin simple-cloudflare-turnstile Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation No login needed 1.2.2 – < 1.42.3 Fixed in 1.42.3 CVE-2026-85116 WPScan
6.4 Medium Media Library Assistant Plugin media-library-assistant Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter ≤ 3.35 CVE-2026-6641 Wordfence
6.4 Medium Bold Timeline Lite Plugin bold-timeline-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.2.8 CVE-2026-7438 Wordfence
6.4 Medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program Plugin mycred Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute ≤ 3.2.4 CVE-2026-17149 Wordfence
6.5 Medium Contact Form 7 Captcha Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation No login needed 0.1.7 – < 0.1.9 Fixed in 0.1.9 CVE-2026-85117 WPScan
4.8 Medium Hustle Plugin wordpress-popup Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders No login needed 7.0.0.1 – < 7.8.14.2 Fixed in 7.8.14.2 CVE-2026-80440 WPScan
6.5 Medium Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Comment Text No login needed < 6.87 Fixed in 6.87 CVE-2026-19855 WPScan
4.3 Medium WP Recipe Maker Plugin wp-recipe-maker Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode ≤ 10.8.0 CVE-2026-75905 Wordfence
6.4 Medium My Calendar Plugin my-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes ≤ 3.8.3 CVE-2026-77187 Wordfence
6.4 Medium My Calendar Plugin my-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute ≤ 3.8.3 CVE-2026-77186 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only