WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,007 vulnerabilities, 1,391 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,148 High 8,901 Medium 17,624 Low 328 Not scored 6

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 5, 2026.

Showing 1–28 of 28 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Simple Membership Plugin simple-membership Broken Access Control Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints No login needed ≤ 4.8.3 CVE-2026-97337 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.8.2 Fixed in 4.8.3 CVE-2026-74000 Patchstack
5.4 Medium Simple Membership Plugin simple-membership Privilege Escalation Subscriber+ Membership Level Escalation via PayPal Standard subsc_ref < 4.7.8 Fixed in 4.7.8 CVE-2026-88764 WPScan
5.4 Medium Simple Membership MailChimp Integration Plugin simple-membership-mailchimp-integration Cross-Site Request Forgery API Key Update via CSRF No login needed < 1.9.8 Fixed in 1.9.8 CVE-2026-8151 WPScan
5.3 Medium Simple Membership Plugin simple-membership Authentication Bypass Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding No login needed ≤ 4.8.1 CVE-2026-77194 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Price Manipulation Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification No login needed < 4.7.7 Fixed in 4.7.7 CVE-2026-14936 WPScan
7.5 High Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.7.8 Fixed in 4.7.9 CVE-2026-66712 Patchstack
6.1 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored XSS via PayPal Subscription Subscriber Name No login needed < 4.7.8 Fixed in 4.7.8 CVE-2026-15931 WPScan
9.4 Critical Simple Membership Plugin simple-membership Privilege Escalation Unauthenticated Administrator Account Takeover via Registration Username Collision No login needed < 4.7.8 Fixed in 4.7.8 CVE-2026-15930 WPScan
8.8 High Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored XSS via Stripe Webhook API Version No login needed < 4.7.5 Fixed in 4.7.5 CVE-2026-11855 WPScan
5.3 Medium Simple Membership Plugin simple-membership Broken Access Control Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook No login needed ≤ 4.7.5 CVE-2026-12093 Wordfence
6.5 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.7.2 Fixed in 4.7.3 CVE-2026-42663 Patchstack
7.5 High Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2026-34886 Patchstack
6.5 Medium Simple Membership Plugin simple-membership Broken Access Control Unauthenticated Improper Handling of Missing Values No login needed ≤ 4.7.0 CVE-2026-1461 Wordfence
4.3 Medium Simple Membership Plugin simple-membership Broken Access Control ≤ 4.6.9 Fixed in 4.7.0 CVE-2026-25308 Patchstack
5.4 Medium Simple Membership WP user Import Plugin simple-membership-wp-user-import Cross-Site Request Forgery No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2026-24986 Patchstack
5.9 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.6.3 Fixed in 4.6.4 CVE-2025-49333 Patchstack
7.1 High Simple Membership Custom Messages Plugin simple-membership-custom-messages Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.4 Fixed in 2.5 CVE-2025-24660 Patchstack
5.3 Medium Simple Membership Plugin simple-membership Information Disclosure Exposure of Private Personal Information to an Unauthorized Actor No login needed ≤ 4.5.5 CVE-2024-11088 Wordfence
4.7 Medium Simple Membership Plugin simple-membership Open Redirect No login needed ≤ 4.5.3 Fixed in 4.5.4 CVE-2024-49682 Patchstack
4.7 Medium Simple Membership After Login Redirection Plugin simple-membership-after-login-redirection Open Redirect No login needed ≤ 1.6 Fixed in 1.7 CVE-2024-47354 Patchstack
8.6 High Simple Membership Plugin simple-membership Privilege Escalation Unauthenticated Membership Role Privilege Escalation No login needed ≤ 4.3.4 Fixed in 4.3.5 CVE-2023-41957 Patchstack
8.8 High Simple Membership Plugin simple-membership Privilege Escalation Authenticated Account Takeover ≤ 4.3.4 Fixed in 4.3.5 CVE-2023-41956 Patchstack
6.4 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.5 CVE-2024-4383 Wordfence
5.4 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 4.4.3 CVE-2024-3730 Wordfence
4.7 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored Self-Based Cross-Site Scripting No login needed ≤ 4.4.2 CVE-2024-1985 Wordfence
3.4 Low Simple Membership Plugin simple-membership Open Redirect WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection No login needed ≤ 4.4.1 Fixed in 4.4.2 CVE-2024-22308 Patchstack
6.1 Medium Simple Membership Plugin simple-membership Cross-Site Scripting Reflected Cross-Site Scripting Vulnerability via environment_mode No login needed ≤ 4.3.8 CVE-2023-6882 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only