WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–37 of 37 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Checkout Custom Fields Builder for WooCommerce Plugin `checkout-custom-fields-builder-for-woocommerce`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter	`≤ 1.1.5`	Sep 9, 2026	`CVE-2026-19802`	Wordfence
4.3 Medium	Real Estate Papi Theme	Cross-Site Request Forgery Subscriber+ Plugin Installation	`≤ 1.0.5`	Sep 6, 2026	`CVE-2026-13159`	WPScan
6.6 Medium	Really Simple Security Plugin `really-simple-ssl`	Remote Code Execution Multisite Subsite Admin+ Arbitrary Plugin Installation via rsp_upgrade_install_plugin	`< 9.8.0` Fixed in `9.8.0`	Aug 30, 2026	`CVE-2026-81766`	WPScan
4.3 Medium	Accelerate Theme `accelerate`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation	`≤ 1.5.3`	Aug 6, 2026	`CVE-2025-9266`	Wordfence
4.3 Medium	Catch Themes Demo Import Plugin `catch-themes-demo-import`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter	`≤ 3.3`	Jul 16, 2026	`CVE-2026-15336`	Wordfence
4.3 Medium	Memberships and User Profiles for WooCommerce Plugin `ecommerce-user-profiles-by-profilegrid`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation	`≤ 3.4`	Jul 9, 2026	`CVE-2026-11359`	Wordfence
4.3 Medium	FastX Theme `fastx`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation	`≤ 1.0.2`	May 22, 2026	`CVE-2026-2518`	Wordfence
4.3 Medium	HubSpot All-In-One Marketing - Forms, Popups, Live Chat Plugin `leadin`	Broken Access Control Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure	`≤ 11.3.32`	Apr 24, 2026	`CVE-2025-11762`	Wordfence
5.4 Medium	Restaurant Cafeteria Theme	Remote Code Execution Subscriber+ Arbitrary Plugin Installation/Activation	`≤ 0.4.6`	Mar 28, 2026	`CVE-2025-15445`	WPScan
5.4 Medium	Stål Theme `stal`	PHP Object Injection Arbitrary Object Instantiation	`≤ < 1.7` Fixed in `1.7`	Mar 25, 2026	`CVE-2026-32511`	Patchstack
5.3 Medium	Booktics Plugin `booktics`	Broken Access Control Missing Authorization to Addon Plugin Installation No login needed	`≤ 1.0.16`	Mar 10, 2026	`CVE-2026-1920`	Wordfence
4.3 Medium	Shopire Theme `shopire`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install	`≤ 1.0.57`	Feb 19, 2026	`CVE-2025-13091`	Wordfence
4.4 Medium	Postalicious Plugin `postalicious`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings	`≤ 3.0.1`	Jan 24, 2026	`CVE-2026-1266`	Wordfence
6.5 Medium	Doppler Forms Plugin	Broken Access Control Subscriber+ Limited Plugin Installation	`≤ 2.5.1`	Oct 29, 2025	`CVE-2025-9544`	WPScan
4.3 Medium	Newsup Theme `newsup`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Installation	`≤ 5.0.10`	Oct 11, 2025	`CVE-2025-8682`	Wordfence
5.4 Medium	Kubio AI Page Builder Plugin `kubio`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation	`≤ 2.6.3`	Sep 19, 2025	`CVE-2025-8487`	Wordfence
4.3 Medium	Blaze Demo Importer Plugin `blaze-demo-importer`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install	`≤ 1.0.12`	Sep 16, 2025	`CVE-2025-8446`	Wordfence
5.4 Medium	Easy Digital Downloads Plugin `easy-digital-downloads`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions No login needed	`≤ 3.5.0`	Aug 20, 2025	`CVE-2025-8102`	Wordfence
4.3 Medium	ColorMag Theme `colormag`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation	`≤ 4.0.19`	Aug 20, 2025	`CVE-2025-9202`	Wordfence
4.3 Medium	OceanWP Theme `oceanwp`	Cross-Site Request Forgery Cross-Site Request Forgery to Ocean Extra Plugin Installation No login needed	`4.0.9 – 4.1.1`	Aug 13, 2025	`CVE-2025-8891`	Wordfence
4.3 Medium	Memory Usage Plugin `wp-memory`	Cross-Site Request Forgery Cross-Site Request Forgery to Limited Plugin Installation via wpmemory_install_plugin Function No login needed	`≤ 3.98`	Jul 27, 2025	`CVE-2025-8104`	Wordfence
5.4 Medium	Splitit Plugin `splitit-installment-payments`	Broken Access Control Missing Authorization to Multiple Administrative Actions	`≤ 4.2.8`	May 21, 2025	`CVE-2025-4105`	Wordfence
4.3 Medium	SecuPress Free Plugin `secupress`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation	`≤ 2.3.9`	Apr 29, 2025	`CVE-2025-3452`	Wordfence
4.3 Medium	Sastra Essential Addons for Elementor – Free Elementor Addons, Widgets and Templates Plugin `sastra-essential-addons-for-elementor`	Broken Access Control Free Elementor Addons, Widgets and Templates <= 1.0.14 - Missing Authorization to Spexo Theme Install	`≤ 1.0.14`	Jan 24, 2025	`CVE-2024-13335`	Wordfence
5.4 Medium	Scratch & Win – Giveaways and Contests Plugin `scratch-win-giveaways-for-website-facebook`	Cross-Site Request Forgery Giveaways and Contests <= 2.7.1 - Cross-Site Request Forgery via reset_installation Function No login needed	`≤ 2.7.1`	Jan 4, 2025	`CVE-2024-12545`	Wordfence
4.3 Medium	File Manager Pro – Filester Plugin `filester`	Broken Access Control Filester <= 1.8.6 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation	`≤ 1.8.6`	Dec 19, 2024	`CVE-2024-12331`	Wordfence
4.3 Medium	WP Crowdfunding Plugin `wp-crowdfunding`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) WooCommerce Installation	`≤ 2.1.12`	Dec 13, 2024	`CVE-2024-11911`	Wordfence
6.5 Medium	Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera Plugin `wp-website-creator`	Cross-Site Scripting	`≤ 4.0`	Nov 18, 2024	`CVE-2024-52347`	Patchstack
4.3 Medium	WP Chat App Plugin `wp-whatsapp`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation	`≤ 3.6.8`	Nov 16, 2024	`CVE-2024-10533`	Wordfence
4.3 Medium	Tutor LMS Elementor Addons Plugin `tutor-lms-elementor-addons`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation	`≤ 2.1.5`	Nov 15, 2024	`CVE-2024-10897`	Wordfence
4.3 Medium	YITH Essential Kit for WooCommerce #1 Plugin `yith-essential-kit-for-woocommerce-1`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation	`≤ 2.34.0`	Jul 19, 2024	`CVE-2024-6799`	Wordfence
4.3 Medium	PropertyHive Plugin `propertyhive`	Broken Access Control Missing Authorization to Non-Arbitrary Plugin Installation	`≤ 2.0.6` Fixed in `2.0.7`	Mar 26, 2024	`CVE-2024-24718`	Patchstack
4.3 Medium	Colibri WP Theme `colibri-wp`	Cross-Site Request Forgery Cross-Site Request Forgery to Limited Plugin Installation No login needed	`≤ 1.0.94`	Feb 23, 2024	`CVE-2024-1360`	Wordfence
4.7 Medium	Database Reset Plugin `wordpress-database-reset`	Cross-Site Request Forgery Cross-Site Request Forgery to WP Reset Plugin Installation No login needed	`≤ 3.22`	Feb 21, 2024	`CVE-2024-1501`	Wordfence
6.5 Medium	10Web AI Assistant – AI content writing assistant Plugin `ai-assistant-by-10web`	Broken Access Control AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation	`≤ 1.0.18`	Feb 5, 2024	`CVE-2023-6985`	Wordfence
6.5 Medium	ColorMag Theme `colormag`	Broken Access Control Missing Authorization to Arbitrary Plugin Installation	`≤ 3.1.2`	Jan 20, 2024	`CVE-2024-0679`	Wordfence
4.3 Medium	GiveWP Plugin `give`	Cross-Site Request Forgery Cross-Site Request Forgery to plugin installation No login needed	`≤ 2.33.3`	Jan 11, 2024	`CVE-2023-4246`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.