WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 1–50 of 66 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 2
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.1 Medium	Payment Plugins for Stripe WooCommerce Plugin `woo-stripe-payment`	Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment No login needed	`≤ 4.0.17` Fixed in `4.0.18`	Oct 10, 2026	`CVE-2026-89100`	Wordfence
5.3 Medium	Easy PayPal & Stripe Buy Now Button Plugin `wp-ecommerce-paypal`	Price Manipulation Unauthenticated Payment Amount Manipulation via Client-Supplied Price No login needed	`1.8 – < 2.0.6` Fixed in `2.0.6`	Oct 2, 2026	`CVE-2026-90987`	WPScan
5.3 Medium	Paymattic Plugin `wp-payment-form`	Price Manipulation Unauthenticated Payment Bypass via Unbound Stripe PaymentIntent No login needed	`4.6.20 – < 4.6.26` Fixed in `4.6.26`	Sep 28, 2026	`CVE-2026-89411`	WPScan
6.8 Medium	WPForms Lite Plugin	Broken Access Control Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent No login needed	`1.8.8.2 – < 2.0.2` Fixed in `2.0.2`	Sep 24, 2026	`CVE-2026-74991`	WPScan
4.3 Medium	WP User Manager Plugin `wp-user-manager`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback	`≤ 2.9.18` Fixed in `2.9.19`	Sep 22, 2026	`CVE-2026-18345`	Wordfence
5.3 Medium	Handily Plugin	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter No login needed	`≤ 1.0.3`	Sep 22, 2026	`CVE-2025-14487`	Wordfence
5.3 Medium	Payment Gateway of Stripe for WooCommerce Plugin `payment-gateway-stripe-and-woocommerce-integration`	Other Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint No login needed	`≤ 5.0.8` Fixed in `5.0.9`	Sep 19, 2026	`CVE-2026-9832`	Wordfence
5.3 Medium	Eventin Plugin `wp-event-solution`	Price Manipulation Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay No login needed	`< 4.1.24` Fixed in `4.1.24`	Sep 16, 2026	`CVE-2026-84906`	WPScan
5.3 Medium	Payment Plugins for Stripe WooCommerce Plugin `woo-stripe-payment`	Information Disclosure Unauthenticated Customer PII Disclosure via order-pay No login needed	`4.0.0 – < 4.0.12` Fixed in `4.0.12`	Sep 9, 2026	`CVE-2026-80339`	WPScan
5.3 Medium	Accept Stripe Payments Plugin `stripe-payments`	Broken Access Control Unauthenticated Product Substitution via IDOR No login needed	`< 2.1.4` Fixed in `2.1.4`	Sep 5, 2026	`CVE-2026-81424`	WPScan
4.3 Medium	Accept Stripe Payments Plugin `stripe-payments`	Open Redirect Open Redirect via IPN Handler No login needed	`< 2.1.4` Fixed in `2.1.4`	Sep 5, 2026	`CVE-2026-81423`	WPScan
4.3 Medium	Stripe Payment Forms by WP Full Pay Plugin `wp-full-stripe-free`	Broken Access Control Cross-Customer Subscription Cancellation via IDOR	`< 8.5.5` Fixed in `8.5.5`	Aug 29, 2026	`CVE-2026-80311`	WPScan
4.3 Medium	Stripe Payment Forms by WP Full Pay Plugin `wp-full-stripe-free`	Broken Access Control Cross-Customer Subscription Modification via IDOR	`< 8.5.1` Fixed in `8.5.1`	Aug 26, 2026	`CVE-2026-77789`	WPScan
5.3 Medium	Stripe Payment Forms by WP Full Pay Plugin `wp-full-stripe-free`	Information Disclosure Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed Session No login needed	`< 8.5.1` Fixed in `8.5.1`	Aug 26, 2026	`CVE-2026-77758`	WPScan
6.5 Medium	Contact Form 7 – PayPal & Stripe Add-on Plugin `contact-form-7-paypal-add-on`	Broken Access Control PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control No login needed	`≤ 2.5.1`	Aug 13, 2026	`CVE-2026-66660`	Patchstack
4.7 Medium	Contact Form 7 – PayPal & Stripe Add-on Plugin `contact-form-7-paypal-add-on`	Open Redirect PayPal & Stripe Add-on < 2.5 - Open Redirect No login needed	`< 2.5` Fixed in `2.5`	Jul 27, 2026	`CVE-2026-14236`	WPScan
5.3 Medium	Payment Plugins for Stripe WooCommerce Plugin `woo-stripe-payment`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret No login needed	`≤ 4.0.7` Fixed in `4.0.8`	Jul 24, 2026	`CVE-2026-12654`	Wordfence
6.5 Medium	Accept Donations with PayPal & Stripe Plugin `easy-paypal-donation`	Cross-Site Scripting	`≤ 1.5.5` Fixed in `1.5.6`	Jul 23, 2026	`CVE-2026-65518`	Patchstack
5.3 Medium	User Registration & Membership Plugin `user-registration`	Broken Access Control Unauthenticated Limited User Deletion via Stripe Subscription Handler No login needed	`4.2.3 – < 5.2.3` Fixed in `5.2.3`	Jul 17, 2026	`CVE-2026-11966`	WPScan
5.3 Medium	Stripe Payment Forms by WP Full Pay Plugin `wp-full-stripe-free`	Broken Access Control Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter No login needed	`≤ 8.4.3` Fixed in `8.5.0`	Jun 27, 2026	`CVE-2026-12432`	Wordfence
6.5 Medium	FunnelKit Payment Gateway for Stripe WooCommerce Plugin `funnelkit-stripe-woo-payment-gateway`	Cross-Site Request Forgery No login needed	`≤ 1.14.0.3` Fixed in `1.14.0.4`	Jun 26, 2026	`CVE-2026-57635`	Patchstack
5.3 Medium	Simple Membership Plugin `simple-membership`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook No login needed	`≤ 4.7.5` Fixed in `4.7.6`	Jun 18, 2026	`CVE-2026-12093`	Wordfence
6.5 Medium	WooCommerce Stripe Payment Gateway Plugin `woocommerce-gateway-stripe`	Broken Access Control Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter No login needed	`≤ 10.7.0` Fixed in `10.7.1`	Jun 16, 2026	`CVE-2026-2381`	Wordfence
6.5 Medium	Stripe Payments Plugin `stripe-payments`	Other Bypass Vulnerability No login needed	`≤ 2.0.98` Fixed in `2.0.99`	Jun 15, 2026	`CVE-2026-42752`	Patchstack
6.5 Medium	WP Full Stripe Free Plugin `wp-full-stripe-free`	Authentication Bypass Broken Authentication	`≤ 8.4.1` Fixed in `8.4.2`	Jun 15, 2026	`CVE-2026-42378`	Patchstack
6.4 Medium	Accept Stripe Payments Plugin `stripe-payments`	Cross-Site Scripting WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_code	`< 2.0.40` Fixed in `2.0.40`	Jun 8, 2026	`CVE-2021-47983`	VulnCheck
6.4 Medium	Express Payment For Stripe Plugin `wp-stripe-express`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.28.0` Fixed in `1.28.2`	Jun 5, 2026	`CVE-2026-8893`	Wordfence
5.3 Medium	Contact Form 7 – PayPal & Stripe Add-on Plugin `contact-form-7-paypal-add-on`	Price Manipulation PayPal & Stripe Add-on <= 2.4.9 - Unauthenticated Payment Bypass via Insufficient Verification of Data Authenticity via PayPal IPN Handler ('invoice'/'mc_gross' Verification) No login needed	`≤ 2.4.9` Fixed in `2.4.10`	May 29, 2026	`CVE-2026-9189`	Wordfence
4.3 Medium	PeachPay Plugin `peachpay-for-woocommerce`	Cross-Site Request Forgery Cross-Site Request Forgery to Stripe Unlink No login needed	`≤ 1.120.46` Fixed in `1.120.47`	May 28, 2026	`CVE-2026-9618`	Wordfence
6.5 Medium	Stripe Payment Gateway for WooCommerce Plugin `payment-gateway-stripe-and-woocommerce-integration`	Authentication Bypass Broken Authentication No login needed	`≤ 5.0.7` Fixed in `5.0.8`	May 25, 2026	`CVE-2026-45217`	Patchstack
5.3 Medium	Forminator – Contact Form, Payment Form & Custom Form Builder Plugin `forminator`	Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter No login needed	`≤ 1.52.0` Fixed in `1.52.1`	May 5, 2026	`CVE-2026-2729`	Wordfence
5.3 Medium	Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder Plugin `fluentform`	Broken Access Control Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification No login needed	`6.1.21` Fixed in `6.2.0`	Apr 16, 2026	`CVE-2026-4160`	Wordfence
5.3 Medium	Masteriyo LMS Plugin `learning-management-system`	Broken Access Control Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint No login needed	`≤ 2.1.7` Fixed in `2.1.8`	Apr 8, 2026	`CVE-2026-5167`	Wordfence
5.3 Medium	Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Plugin `charitable`	Other Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook No login needed	`≤ 1.8.9.7` Fixed in `1.8.10`	Apr 7, 2026	`CVE-2026-3177`	Wordfence
6.4 Medium	Payment Page \| Payment Form for Stripe Plugin `payment-page`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter	`≤ 1.4.6`	Feb 14, 2026	`CVE-2026-0751`	Wordfence
6.4 Medium	Stripe Green Downloads Plugin	Cross-Site Scripting Stripe Green Downloads Wordpress Plugin 2.03 Persistent XSS via Settings	`2.03`	Feb 1, 2026	`CVE-2022-50797`	VulnCheck
5.3 Medium	PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) Plugin `peachpay-for-woocommerce`	Broken Access Control Missing Authorization to Unauthenticated Order Status Modification No login needed	`≤ 1.119.8`	Jan 20, 2026	`CVE-2025-14978`	Wordfence
4.7 Medium	Accept Donations with PayPal & Stripe Plugin `easy-paypal-donation`	Open Redirect No login needed	`≤ 1.5.2` Fixed in `1.5.3`	Dec 24, 2025	`CVE-2025-68602`	Patchstack
4.3 Medium	WP Attractive Donations System - Easy Stripe & Paypal donations Plugin `wp_attractivedonationssystem`	Cross-Site Request Forgery Easy Stripe & Paypal donations plugin <= 1.25 - Cross Site Request Forgery (CSRF) No login needed	`≤ 1.25`	Dec 16, 2025	`CVE-2025-58999`	Patchstack
6.1 Medium	Accept Stripe Payments Using Contact Form 7 Plugin `accept-stripe-payments-using-contact-form-7`	Cross-Site Scripting Reflected Cross-Site Scripting via failure_message No login needed	`≤ 3.1`	Dec 12, 2025	`CVE-2025-12834`	Wordfence
4.3 Medium	Contest Gallery – Upload, Vote & Sell with PayPal and Stripe Plugin `contest-gallery`	Content Injection Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injection No login needed	`≤ 27.0.3` Fixed in `28.0.0`	Oct 11, 2025	`CVE-2025-11254`	Wordfence
6.4 Medium	Contest Gallery – Upload, Vote & Sell with PayPal and Stripe Plugin `contest-gallery`	Cross-Site Scripting Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting	`≤ 27.0.2` Fixed in `27.0.3`	Oct 4, 2025	`CVE-2025-10383`	Wordfence
6.5 Medium	Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net Plugin `peachpay-for-woocommerce`	SQL Injection Authenticated (Contributor+) SQL Injection via order_by Parameter	`≤ 1.117.5` Fixed in `1.117.6`	Sep 10, 2025	`CVE-2025-9463`	Wordfence
5.3 Medium	Accept Stripe Payments Using Contact Form 7 Plugin `accept-stripe-payments-using-contact-form-7`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 3.0` Fixed in `3.1`	Jun 27, 2025	`CVE-2025-53309`	Patchstack
5.9 Medium	Contact Form 7 – PayPal & Stripe Add-on Plugin `contact-form-7-paypal-add-on`	Cross-Site Scripting PayPal & Stripe Add-on plugin <= 2.3.4 - Cross Site Scripting (XSS)	`≤ 2.3.4` Fixed in `2.4.1`	May 7, 2025	`CVE-2025-47518`	Patchstack
6.4 Medium	ThemeMakers Stripe Checkout Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 1.0.1`	Feb 27, 2025	`CVE-2025-1690`	Wordfence
6.1 Medium	Accept Donations with PayPal & Stripe Plugin `easy-paypal-donation`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 1.4.4`	Feb 23, 2025	`CVE-2024-13728`	Wordfence
6.4 Medium	Online Payments – Get Paid with PayPal, Square & Stripe Plugin `paypal-payment-button-by-vcita`	Cross-Site Scripting Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 3.20.0` Fixed in `3.30.0`	Feb 18, 2025	`CVE-2024-11895`	Wordfence
6.5 Medium	Online Payments – Get Paid with PayPal, Square & Stripe Plugin `paypal-payment-button-by-vcita`	Cross-Site Scripting	`≤ 3.20.0` Fixed in `3.30.0`	Jan 21, 2025	`CVE-2025-22661`	Patchstack
5.3 Medium	Accept Stripe Payments Using Contact Form 7 Plugin `accept-stripe-payments-using-contact-form-7`	Information Disclosure Unauthenticated Information Exposure No login needed	`≤ 2.5`	Dec 12, 2024	`CVE-2024-12255`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.