WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 98 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.1 High	Vayu X Theme `vayu-x`	Broken Access Control Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation	`< 1.0.6` Fixed in `1.0.6`	Sep 30, 2026	`CVE-2026-88797`	WPScan
7.2 High	PublishPress Capabilities Plugin `capability-manager-enhanced`	Privilege Escalation Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant	`≤ 2.50.0`	Sep 9, 2026	`CVE-2026-75927`	Wordfence
4.3 Medium	Checkout Custom Fields Builder for WooCommerce Plugin `checkout-custom-fields-builder-for-woocommerce`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter	`≤ 1.1.5`	Sep 9, 2026	`CVE-2026-19802`	Wordfence
4.3 Medium	Real Estate Papi Theme	Cross-Site Request Forgery Subscriber+ Plugin Installation	`≤ 1.0.5`	Sep 6, 2026	`CVE-2026-13159`	WPScan
8.8 High	DevKit Pro Plugin	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter	`≤ 2.3.0`	Sep 2, 2026	`CVE-2026-14357`	Wordfence
8.1 High	ProfilePress Plugin `wp-user-avatar`	Remote Code Execution ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE No login needed	`< 4.17.2` Fixed in `4.17.2`	Aug 31, 2026	`CVE-2026-66047`	VulnCheck
6.6 Medium	Really Simple Security Plugin `really-simple-ssl`	Remote Code Execution Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin	`< 9.8.0` Fixed in `9.8.0`	Aug 30, 2026	`CVE-2026-81766`	WPScan
7.2 High	Dokan Plugin	Broken Access Control Shop Manager+ Arbitrary Plugin Installation/Activation via REST API	`< 5.0.14` Fixed in `5.0.14`	Aug 21, 2026	`CVE-2026-16576`	WPScan
9.8 Critical	WPMU DEV Dashboard Plugin	Remote Code Execution Remote Code Execution via Hub Install Action No login needed	`< 5.0.1` Fixed in `5.0.1`	Aug 12, 2026	`CVE-2026-16051`	WPScan
8.8 High	Subscriptions for WooCommerce Plugin `subscriptions-for-woocommerce`	Remote Code Execution Shop Manager+ Arbitrary Plugin Installation	`< 2.0.1` Fixed in `2.0.1`	Aug 7, 2026	`CVE-2026-15215`	WPScan
4.3 Medium	Accelerate Theme `accelerate`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation	`≤ 1.5.3`	Aug 6, 2026	`CVE-2025-9266`	Wordfence
8.1 High	WPMU DEV Dashboard Plugin	Authentication Bypass Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint No login needed	`≤ 5.0.0`	Aug 6, 2026	`CVE-2026-15459`	Wordfence
7.2 High	Subscriptions for WooCommerce Plugin `subscriptions-for-woocommerce`	Broken Access Control Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action	`≤ 2.0.0`	Jul 30, 2026	`CVE-2026-15397`	Wordfence
4.3 Medium	Catch Themes Demo Import Plugin `catch-themes-demo-import`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter	`≤ 3.3`	Jul 16, 2026	`CVE-2026-15336`	Wordfence
8.8 High	Divi Torque Lite Plugin `addons-for-divi`	Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint No login needed	`≤ 4.2.3`	Jul 9, 2026	`CVE-2026-4275`	Wordfence
7.2 High	Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder Plugin `popup-maker`	Broken Access Control Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation	`≤ 1.22.0`	Jul 9, 2026	`CVE-2026-8848`	Wordfence
4.3 Medium	Memberships and User Profiles for WooCommerce Plugin `ecommerce-user-profiles-by-profilegrid`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation	`≤ 3.4`	Jul 9, 2026	`CVE-2026-11359`	Wordfence
9.8 Critical	WP Learn Manager Plugin `learn-manager`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action No login needed	`≤ 1.1.8`	Jul 8, 2026	`CVE-2026-12153`	Wordfence
8.8 High	Thim Core Plugin `thim-core`	Broken Access Control Arbitrary plugin Installation	`≤ 2.3.3`	Jun 2, 2026	`CVE-2025-53345`	Patchstack
4.3 Medium	FastX Theme `fastx`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation	`≤ 1.0.2`	May 22, 2026	`CVE-2026-2518`	Wordfence
9.8 Critical	GeekyBot Plugin `geeky-bot`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action No login needed	`≤ 1.2.2`	May 5, 2026	`CVE-2026-5294`	Wordfence
4.3 Medium	HubSpot All-In-One Marketing - Forms, Popups, Live Chat Plugin `leadin`	Broken Access Control Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure	`≤ 11.3.32`	Apr 24, 2026	`CVE-2025-11762`	Wordfence
7.2 High	ExactMetrics Plugin `google-analytics-dashboard-for-wp`	Broken Access Control Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process	`≤ 9.1.2`	Apr 23, 2026	`CVE-2026-5464`	Wordfence
9.8 Critical	Riaxe Product Customizer Plugin `riaxe-product-customizer`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action No login needed	`≤ 2.1.2`	Apr 16, 2026	`CVE-2026-3596`	Wordfence
7.1 High	Gravity SMTP Plugin	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Uninstall	`≤ 2.1.4`	Apr 10, 2026	`CVE-2026-4162`	Wordfence
8.8 High	Vertex Addons for Elementor Plugin `addons-for-elementor-builder`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'	`≤ 1.6.4`	Apr 9, 2026	`CVE-2026-4326`	Wordfence
8.8 High	SpicePress Plugin `spicepress`	Cross-Site Request Forgery CSRF to Arbitrary Plugin Installation No login needed	`≤ 2.3.2.5`	Apr 8, 2026	`CVE-2026-39621`	Patchstack
9.6 Critical	Bluestreet Plugin `bluestreet`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Arbitrary Plugin Installation No login needed	`≤ 1.7.3`	Apr 8, 2026	`CVE-2026-39617`	Patchstack
5.4 Medium	Restaurant Cafeteria Theme	Remote Code Execution Subscriber+ Arbitrary Plugin Installation/Activation	`≤ 0.4.6`	Mar 28, 2026	`CVE-2025-15445`	WPScan
5.4 Medium	Stål Theme `stal`	PHP Object Injection Arbitrary Object Instantiation	`≤ < 1.7` Fixed in `1.7`	Mar 25, 2026	`CVE-2026-32511`	Patchstack
8.8 High	ExactMetrics Plugin `google-analytics-dashboard-for-wp`	Broken Access Control Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation	`8.0.0 – 9.0.2`	Mar 11, 2026	`CVE-2026-1992`	Wordfence
5.3 Medium	Booktics Plugin `booktics`	Broken Access Control Missing Authorization to Addon Plugin Installation No login needed	`≤ 1.0.16`	Mar 10, 2026	`CVE-2026-1920`	Wordfence
8.8 High	WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation Plugin `optin`	Broken Access Control Create Stunning Popups and Optins for Lead Generation <= 1.4.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 1.4.24`	Mar 5, 2026	`CVE-2026-1720`	Wordfence
8.8 High	Orderable Plugin `orderable`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 1.20.0`	Feb 19, 2026	`CVE-2026-0974`	Wordfence
4.3 Medium	Shopire Theme `shopire`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install	`≤ 1.0.57`	Feb 19, 2026	`CVE-2025-13091`	Wordfence
7.2 High	CTX Feed – WooCommerce Product Feed Manager Plugin `webappick-product-feed-for-woocommerce`	Broken Access Control WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation	`≤ 6.6.11`	Feb 19, 2026	`CVE-2025-12975`	Wordfence
8.8 High	NewsBlogger Theme `newsblogger`	Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Plugin Installation No login needed	`0.2.5.6 – 0.2.5.9`	Feb 19, 2026	`CVE-2025-12821`	Wordfence
2.7 Low	YayMail Plugin `yaymail`	Broken Access Control Missing Authorization to Authenticated (Shop Manager+) Plugin Installation and Activation	`≤ 4.3.2`	Feb 18, 2026	`CVE-2026-1831`	Wordfence
8.8 High	WowRevenue Plugin `revenue`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation	`≤ 2.1.3`	Feb 16, 2026	`CVE-2026-2001`	Wordfence
9.8 Critical	Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin `cleantalk-spam-protect`	Broken Access Control Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation No login needed	`≤ 6.71`	Feb 15, 2026	`CVE-2026-1490`	Wordfence
4.4 Medium	Postalicious Plugin `postalicious`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings	`≤ 3.0.1`	Jan 24, 2026	`CVE-2026-1266`	Wordfence
9.8 Critical	Dreamer Blog Theme	Broken Access Control Subscriber+ Arbitrary Plugin Installation No login needed	`≤ 1.2`	Jan 13, 2026	`CVE-2025-10915`	WPScan
8.1 High	Stallion Theme `stallion`	Local File Inclusion No login needed	`≤ 1.17`	Dec 18, 2025	`CVE-2025-58927`	Patchstack
6.5 Medium	Doppler Forms Plugin	Broken Access Control Subscriber+ Limited Plugin Installation	`≤ 2.5.1`	Oct 29, 2025	`CVE-2025-9544`	WPScan
8.8 High	Classified Pro Theme	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 1.0.14`	Oct 16, 2025	`CVE-2025-10706`	Wordfence
8.8 High	GSheetConnector For Gravity Forms Plugin `gsheetconnector-gravity-forms`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 1.3.27`	Oct 11, 2025	`CVE-2025-8593`	Wordfence
4.3 Medium	Newsup Theme `newsup`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Installation	`≤ 5.0.10`	Oct 11, 2025	`CVE-2025-8682`	Wordfence
5.4 Medium	Kubio AI Page Builder Plugin `kubio`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation	`≤ 2.6.3`	Sep 19, 2025	`CVE-2025-8487`	Wordfence
9.8 Critical	Goza - Nonprofit Charity Theme	Broken Access Control Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation No login needed	`≤ 3.2.2`	Sep 19, 2025	`CVE-2025-10690`	Wordfence
8.1 High	Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages Plugin	Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation	`≤ 3.4.3`	Sep 18, 2025	`CVE-2025-8565`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.