WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.
Showing 1–50 of 104 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.1 Medium | Payment Plugins for Stripe WooCommerce | Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment No login needed |
≤ 4.0.17 Fixed in 4.0.18 |
CVE-2026-89100 |
Wordfence | |
| 5.3 Medium | Easy PayPal & Stripe Buy Now Button | Price Manipulation Unauthenticated Payment Amount Manipulation via Client-Supplied Price No login needed |
1.8 – < 2.0.6 Fixed in 2.0.6 |
CVE-2026-90987 |
WPScan | |
| 7.5 High | WP Full Stripe Free | Broken Access Control No login needed |
≤ 8.5.6 Fixed in 8.5.7 |
CVE-2026-62073 |
Patchstack | |
| 5.3 Medium | Paymattic | Price Manipulation Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent No login needed |
4.6.20 – < 4.6.26 Fixed in 4.6.26 |
CVE-2026-89411 |
WPScan | |
| 6.8 Medium | WPForms Lite | Broken Access Control Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent No login needed |
1.8.8.2 – < 2.0.2 Fixed in 2.0.2 |
CVE-2026-74991 |
WPScan | |
| 3.1 Low | Forminator Forms | Broken Access Control Subscriber+ Form Stripe Field Migration via migrate_stripe |
1.38.1 – < 1.57.2.1 Fixed in 1.57.2.1 |
CVE-2026-87069 |
WPScan | |
| 8.6 High | JetFormBuilder Stripe Gateway | SQL Injection Unauthenticated Blind SQLi via Payment Token No login needed |
< 1.1.0 Fixed in 1.1.0 |
CVE-2022-4997 |
WPScan | |
| 4.3 Medium | WP User Manager | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback |
≤ 2.9.18 Fixed in 2.9.19 |
CVE-2026-18345 |
Wordfence | |
| 5.3 Medium | Handily | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter No login needed |
≤ 1.0.3 |
CVE-2025-14487 |
Wordfence | |
| 5.3 Medium | Payment Gateway of Stripe for WooCommerce | Other Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint No login needed |
≤ 5.0.8 Fixed in 5.0.9 |
CVE-2026-9832 |
Wordfence | |
| 5.3 Medium | Eventin | Price Manipulation Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay No login needed |
< 4.1.24 Fixed in 4.1.24 |
CVE-2026-84906 |
WPScan | |
| 7.2 High | MotoPress Hotel Booking | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' No login needed |
≤ 6.2.4 |
CVE-2026-90650 |
Wordfence | |
| 5.3 Medium | Payment Plugins for Stripe WooCommerce | Information Disclosure Unauthenticated Customer PII Disclosure via order-pay No login needed |
4.0.0 – < 4.0.12 Fixed in 4.0.12 |
CVE-2026-80339 |
WPScan | |
| 7.5 High | Event Tickets and Registration | Broken Access Control Missing Authorization to Unauthenticated Stripe Credentials Update No login needed |
≤ 5.27.4 |
CVE-2026-3174 |
Wordfence | |
| 5.3 Medium | Accept Stripe Payments | Broken Access Control Unauthenticated Product Substitution via IDOR No login needed |
< 2.1.4 Fixed in 2.1.4 |
CVE-2026-81424 |
WPScan | |
| 4.3 Medium | Accept Stripe Payments | Open Redirect Open Redirect via IPN Handler No login needed |
< 2.1.4 Fixed in 2.1.4 |
CVE-2026-81423 |
WPScan | |
| 4.3 Medium | Stripe Payment Forms by WP Full Pay | Broken Access Control Cross-Customer Subscription Cancellation via IDOR |
< 8.5.5 Fixed in 8.5.5 |
CVE-2026-80311 |
WPScan | |
| 4.3 Medium | Stripe Payment Forms by WP Full Pay | Broken Access Control Cross-Customer Subscription Modification via IDOR |
< 8.5.1 Fixed in 8.5.1 |
CVE-2026-77789 |
WPScan | |
| 5.3 Medium | Stripe Payment Forms by WP Full Pay | Information Disclosure Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session No login needed |
< 8.5.1 Fixed in 8.5.1 |
CVE-2026-77758 |
WPScan | |
| 7.1 High | Stripe Payments | Cross-Site Scripting No login needed |
≤ 2.1.2 Fixed in 2.1.3 |
CVE-2026-78282 |
Patchstack | |
| 6.5 Medium | Contact Form 7 – PayPal & Stripe Add-on | Broken Access Control PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control No login needed |
≤ 2.5.1 |
CVE-2026-66660 |
Patchstack | |
| 7.1 High | WP Full Stripe Free | Cross-Site Scripting No login needed |
≤ 8.5.0 Fixed in 8.5.1 |
CVE-2026-61960 |
Patchstack | |
| 7.5 High | Stripe Payment Forms by WP Full Pay | Price Manipulation Unauthenticated Payment Intent Amount Manipulation No login needed |
< 8.5.2 Fixed in 8.5.2 |
CVE-2026-16734 |
WPScan | |
| 7.5 High | Stripe For WooCommerce | Broken Access Control No login needed |
≤ 4.0.7 Fixed in 4.0.8 |
CVE-2026-59530 |
Patchstack | |
| 4.7 Medium | Contact Form 7 – PayPal & Stripe Add-on | Open Redirect PayPal & Stripe Add-on < 2.5 - Open Redirect No login needed |
< 2.5 Fixed in 2.5 |
CVE-2026-14236 |
WPScan | |
| 5.3 Medium | Payment Plugins for Stripe WooCommerce | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret No login needed |
≤ 4.0.7 Fixed in 4.0.8 |
CVE-2026-12654 |
Wordfence | |
| 6.5 Medium | Accept Donations with PayPal & Stripe | Cross-Site Scripting |
≤ 1.5.5 Fixed in 1.5.6 |
CVE-2026-65518 |
Patchstack | |
| 5.3 Medium | User Registration & Membership | Broken Access Control Unauthenticated Limited User Deletion via Stripe Subscription Handler No login needed |
4.2.3 – < 5.2.3 Fixed in 5.2.3 |
CVE-2026-11966 |
WPScan | |
| 7.5 High | SureForms – Drag and Drop Form Builder | Price Manipulation Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation No login needed |
≤ 2.2.1 Fixed in 2.2.2 |
CVE-2026-15288 |
Wordfence | |
| 7.5 High | LatePoint - Calendar Booking Plugin for Appointments and Events | Broken Access Control Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass No login needed |
≤ 5.4.0 Fixed in 5.4.1 |
CVE-2026-5356 |
Wordfence | |
| 8.8 High | Simple Membership | Cross-Site Scripting Unauthenticated Stored XSS via Stripe Webhook API Version No login needed |
< 4.7.5 Fixed in 4.7.5 |
CVE-2026-11855 |
WPScan | |
| 5.3 Medium | Stripe Payment Forms by WP Full Pay | Broken Access Control Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter No login needed |
≤ 8.4.3 Fixed in 8.5.0 |
CVE-2026-12432 |
Wordfence | |
| 6.5 Medium | FunnelKit Payment Gateway for Stripe WooCommerce | Cross-Site Request Forgery No login needed |
≤ 1.14.0.3 Fixed in 1.14.0.4 |
CVE-2026-57635 |
Patchstack | |
| 5.3 Medium | Simple Membership | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook No login needed |
≤ 4.7.5 Fixed in 4.7.6 |
CVE-2026-12093 |
Wordfence | |
| 8.2 High | User Registration Stripe | Broken Access Control No login needed |
≤ 1.3.12 Fixed in 1.3.13 |
CVE-2026-49081 |
Patchstack | |
| 8.2 High | User Registration Stripe | Broken Access Control No login needed |
≤ 1.3.14 Fixed in 1.3.15 |
CVE-2026-40726 |
Patchstack | |
| 6.5 Medium | WooCommerce Stripe Payment Gateway | Broken Access Control Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter No login needed |
≤ 10.7.0 Fixed in 10.7.1 |
CVE-2026-2381 |
Wordfence | |
| 6.5 Medium | Stripe Payments | Other Bypass Vulnerability No login needed |
≤ 2.0.98 Fixed in 2.0.99 |
CVE-2026-42752 |
Patchstack | |
| 6.5 Medium | WP Full Stripe Free | Authentication Bypass Broken Authentication |
≤ 8.4.1 Fixed in 8.4.2 |
CVE-2026-42378 |
Patchstack | |
| 6.4 Medium | Accept Stripe Payments | Cross-Site Scripting WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_code |
< 2.0.40 Fixed in 2.0.40 |
CVE-2021-47983 |
VulnCheck | |
| 6.4 Medium | Express Payment For Stripe | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.28.0 Fixed in 1.28.2 |
CVE-2026-8893 |
Wordfence | |
| 5.3 Medium | Contact Form 7 – PayPal & Stripe Add-on | Price Manipulation PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification) No login needed |
≤ 2.4.9 Fixed in 2.4.10 |
CVE-2026-9189 |
Wordfence | |
| 4.3 Medium | PeachPay | Cross-Site Request Forgery Cross-Site Request Forgery to Stripe Unlink No login needed |
≤ 1.120.46 Fixed in 1.120.47 |
CVE-2026-9618 |
Wordfence | |
| 6.5 Medium | Stripe Payment Gateway for WooCommerce | Authentication Bypass Broken Authentication No login needed |
≤ 5.0.7 Fixed in 5.0.8 |
CVE-2026-45217 |
Patchstack | |
| 5.3 Medium | Forminator – Contact Form, Payment Form & Custom Form Builder | Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter No login needed |
≤ 1.52.0 Fixed in 1.52.1 |
CVE-2026-2729 |
Wordfence | |
| 7.1 High | Paid Memberships Pro | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption |
≤ 3.6.5 |
CVE-2026-4100 |
Wordfence | |
| 5.3 Medium | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | Broken Access Control Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification No login needed |
6.1.21 Fixed in 6.2.0 |
CVE-2026-4160 |
Wordfence | |
| 5.3 Medium | Masteriyo LMS | Broken Access Control Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint No login needed |
≤ 2.1.7 Fixed in 2.1.8 |
CVE-2026-5167 |
Wordfence | |
| 5.3 Medium | Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More | Other Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook No login needed |
≤ 1.8.9.7 Fixed in 1.8.10 |
CVE-2026-3177 |
Wordfence | |
| 9.3 Critical | WP Attractive Donations System - Easy Stripe & Paypal donations | SQL Injection Easy Stripe & Paypal donations plugin <= 1.25 - SQL Injection No login needed |
≤ 1.25 |
CVE-2026-28115 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.