WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–36 of 36 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.5 High Paid Member Subscriptions Plugin paid-member-subscriptions SQL Injection ≤ 3.1.1 Fixed in 3.1.2 CVE-2026-105317 Patchstack
8.8 High Download Manager Pro Plugin Cross-Site Scripting Unauthenticated Stored XSS via Email Lock Subscription No login needed 4.0.0 – < 7.5.6 Fixed in 7.5.6 CVE-2026-86609 WPScan
8.8 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Remote Code Execution Shop Manager+ Arbitrary Plugin Installation < 2.0.1 Fixed in 2.0.1 CVE-2026-15215 WPScan
8.8 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Privilege Escalation Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta ≤ 2.0.0 CVE-2026-15414 Wordfence
7.2 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Broken Access Control Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action ≤ 2.0.0 CVE-2026-15397 Wordfence
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.0.7 Fixed in 3.0.8 CVE-2026-59539 Patchstack
7.1 High tagDiv Opt-In Builder Plugin td-subscription Cross-Site Scripting No login needed ≤ 1.7.4 CVE-2026-57732 Patchstack
7.2 High Paid Member Subscriptions Plugin paid-member-subscriptions Server-Side Request Forgery No login needed ≤ 3.0.4 Fixed in 3.0.5 CVE-2026-57348 Patchstack
8.1 High ProfilePress Plugin Broken Access Control Subscriber+ Subscription Cancellation via IDOR < 4.16.17 Fixed in 4.16.17 CVE-2026-10820 WPScan
7.5 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Broken Access Control No login needed ≤ 1.9.5 Fixed in 1.9.6 CVE-2026-56061 Patchstack
7.1 High Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.17.3 Fixed in 3.0.0 CVE-2026-39514 Patchstack
8.1 High WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Plugin wc-frontend-manager Broken Access Control Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion ≤ 6.7.25 CVE-2026-2554 Wordfence
7.5 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Authentication Bypass Bypass Vulnerability No login needed ≤ 1.8.10 Fixed in 1.9.0 CVE-2026-24372 Patchstack
8.6 High WPSubscription Plugin subscription Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.8.10 Fixed in 1.8.11 CVE-2025-69347 Patchstack
7.1 High tagDiv Opt-In Builder Plugin td-subscription Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.7.3 Fixed in 1.7.4 CVE-2025-53222 Patchstack
8.1 High wpDiscuz Plugin wpdiscuz SQL Injection SQL Injection in getAllSubscriptions() No login needed < 7.6.47 Fixed in 7.6.47 CVE-2026-22193 VulnCheck
8.1 High ProfilePress Plugin wp-user-avatar Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration ≤ 4.16.11 CVE-2026-3453 Wordfence
7.2 High Brevo for WooCommerce Plugin woocommerce-sendinblue-newsletter-subscription Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.0.49 CVE-2025-14436 Wordfence
7.2 High Easy Email Subscription Plugin email-subscription-with-secure-captcha Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.3 CVE-2025-11994 Wordfence
7.1 High Newsletter subscription optin module Plugin newsletter-subscription-widget-for-sendblaster Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed ≤ 1.2.9 CVE-2025-48308 Patchstack
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions Local File Inclusion No login needed ≤ 2.15.4 Fixed in 2.15.5 CVE-2025-54017 Patchstack
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions SQL Injection No login needed ≤ 2.15.1 Fixed in 2.15.2 CVE-2025-49870 Patchstack
7.1 High Icegram Collect Plugin icegram-rainmaker Broken Access Control Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control ≤ 1.3.18 Fixed in 1.3.19 CVE-2025-47527 Patchstack
7.5 High WP Subscription Forms Plugin wp-subscription-forms Local File Inclusion ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-32692 Patchstack
8.5 High WP Subscription Forms Plugin wp-subscription-forms SQL Injection ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-30784 Patchstack
7.6 High Super Simple Subscriptions Plugin super-simple-subscriptions SQL Injection ≤ 1.1.0 CVE-2025-30523 Patchstack
7.6 High Email Subscription Popup Plugin email-subscribe SQL Injection ≤ 1.2.23 Fixed in 1.2.24 CVE-2025-24587 Patchstack
7.1 High Subscription DNA Plugin subscriptiondna Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 2.1 Fixed in 2.2 CVE-2025-24555 Patchstack
7.1 High 10CentMail Plugin 10centmail-subscription-management-and-analytics Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.1.50 CVE-2024-56030 Patchstack
8.8 High s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions Plugin s2member Information Disclosure Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information Exposure ≤ 241114 CVE-2024-8326 Wordfence
8.5 High WPForms Plugin wpforms-lite Broken Access Control Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation 1.8.4 – 1.9.2.1 CVE-2024-11205 Wordfence
7.3 High Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Arbitrary Shortcode Execution Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.0 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.13.0 CVE-2024-10261 Wordfence
7.5 High WP Newsletter Subscription Plugin wp-newsletter-subscription Local File Inclusion No login needed ≤ 1.1 CVE-2024-44012 Patchstack
8.8 High WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Plugin wc-frontend-manager Broken Access Control Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.12 - Insecure Direct Object Reference to Account Takeover/Privilege Escalation ≤ 6.7.12 CVE-2024-8290 Wordfence
8.5 High Sendinblue for WooCommerce Plugin woocommerce-sendinblue-newsletter-subscription Path Traversal Arbitrary File Download and Deletion ≤ 4.0.17 Fixed in 4.0.18 CVE-2024-32807 Patchstack
7.1 High Email Subscription Popup Plugin email-subscribe Cross-Site Scripting No login needed ≤ 1.2.20 Fixed in 1.2.21 CVE-2024-27960 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only