WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,007 vulnerabilities, 1,391 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,148 High 8,901 Medium 17,624 Low 328 Not scored 6

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 5, 2026.

Showing 1–43 of 43 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium The Events Calendar Plugin the-events-calendar Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'view_data' Parameter No login needed 6.12.0 – < 6.17.5.1 Fixed in 6.17.5.1 CVE-2026-84740 WPScan
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control ≤ 6.17.5 Fixed in 6.17.5.1 CVE-2026-97285 Patchstack
3.8 Low The Events Calendar Plugin the-events-calendar Broken Access Control Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes 6.15.16.1 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84743 WPScan
2.7 Low The Events Calendar Plugin the-events-calendar Broken Access Control Contributor+ Content Publication via TEC V1 REST API 6.15.0 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84742 WPScan
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Unauthenticated Non-Public Venue and Organizer Disclosure via REST API No login needed 4.5 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84741 WPScan
9.8 Critical The Events Calendar Plugin the-events-calendar Remote Code Execution Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation No login needed ≤ 6.17.3 CVE-2026-78159 Wordfence
9.8 Critical The Events Calendar Plugin the-events-calendar PHP Object Injection Unauthenticated PHP Object Injection to Remote Code Execution No login needed ≤ 6.17.4 CVE-2026-78006 Wordfence
2.7 Low The Events Calendar Plugin the-events-calendar Information Disclosure Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API < 6.17.3.1 Fixed in 6.17.3.1 CVE-2026-84745 WPScan
9.8 Critical The Events Calendar Plugin the-events-calendar PHP Object Injection No login needed ≤ 6.17.2 Fixed in 6.17.3 CVE-2026-78265 Patchstack
5.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Unauthenticated Event Aggregator Import Status Manipulation No login needed < 6.16.5.1 Fixed in 6.16.5.1 CVE-2026-13390 WPScan
6.5 Medium Registrations for the Events Calendar Plugin registrations-for-the-events-calendar SQL Injection Authenticated (Contributor+) SQL Injection via 'standard' Parameter ≤ 3.2 CVE-2026-13119 Wordfence
9.3 Critical The Events Calendar Plugin the-events-calendar SQL Injection No login needed 6.15.12 – 6.16.2 Fixed in 6.16.3 CVE-2026-49772 Patchstack
7.5 High The Events Calendar Plugin the-events-calendar Path Traversal Authenticated (Author+) Arbitrary File Read via ajax_create_import No login needed ≤ 6.15.17 CVE-2026-3585 Wordfence
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Improper Authorization to Authenticated (Contributor+) Event/Organizer/Venue Update/Trash via REST API ≤ 6.15.16 CVE-2026-2694 Wordfence
6.4 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.1.2 CVE-2026-1922 Wordfence
6.5 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting ≤ 3.1.1 Fixed in 3.1.2 CVE-2026-24988 Patchstack
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Data Migration Control ≤ 6.15.13 CVE-2025-15043 Wordfence
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control ≤ 6.15.12.2 Fixed in 6.15.13 CVE-2025-69352 Patchstack
4.3 Medium The Events Calendar Countdown Addon Plugin countdown-for-the-events-calendar Broken Access Control ≤ 1.4.15 Fixed in 1.4.16 CVE-2025-69348 Patchstack
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure No login needed ≤ 6.15.9 CVE-2025-12192 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection via s No login needed 6.15.1.1 – 6.15.9 CVE-2025-12197 Wordfence
4.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure ≤ 6.15.9 CVE-2025-12175 Wordfence
5.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Unauthenticated Password-Protected Information Disclosure No login needed ≤ 6.15.2 CVE-2025-9808 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.15.1 CVE-2025-9807 Wordfence
6.4 Medium The Events Calendar Plugin the-events-calendar Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 6.13.2 CVE-2025-5144 Wordfence
6.5 Medium The Events Calendar Countdown Addon Plugin countdown-for-the-events-calendar Cross-Site Scripting ≤ 1.4.9 Fixed in 1.4.10 CVE-2025-49311 Patchstack
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control ≤ 6.11.2.1 Fixed in 6.12.0 CVE-2025-48246 Patchstack
4.8 Medium The Events Calendar Plugin the-events-calendar Cross-Site Scripting Admin+ Stored XSS < 6.6.4 Fixed in 6.6.4 CVE-2024-8493 WPScan
6.1 Medium Registrations for The Events Calendar Plugin registrations-for-the-events-calendar Cross-Site Scripting Admin+ Stored XSS No login needed < 2.13.4 Fixed in 2.13.4 CVE-2024-10703 WPScan
5.4 Medium The Events Calendar Plugin the-events-calendar Cross-Site Request Forgery No login needed ≤ 6.7.0 Fixed in 6.7.1 CVE-2025-24537 Patchstack
6.4 Medium The Events Calendar Plugin the-events-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.9.0 CVE-2024-12118 Wordfence
4.3 Medium The Events Calendar Plugin the-events-calendar Cross-Site Request Forgery No login needed ≤ 6.5.1.4 Fixed in 6.5.1.5 CVE-2024-37518 Patchstack
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Unauthenticated Password Protected Event Disclosure No login needed < 6.8.2.1 Fixed in 6.8.2.1 CVE-2024-5333 WPScan
5.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control No login needed ≤ 6.1.2.2 Fixed in 6.1.3 CVE-2023-35777 Patchstack
6.4 Medium Add infos to the events calendar Plugin add-infos-to-the-events-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.1 CVE-2024-11875 Wordfence
9.6 Critical Registrations for The Events Calendar Plugin registrations-for-the-events-calendar Cross-Site Scripting Unauthenticated Stored XSS No login needed < 2.12.4 Fixed in 2.12.4 CVE-2024-7982 WPScan
6.4 Medium Registrations for the Events Calendar Plugin registrations-for-the-events-calendar Broken Access Control ≤ 2.12.1 Fixed in 2.12.2 CVE-2024-43143 Patchstack
7.2 High The Events Calendar Plugin the-events-calendar Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 6.6.3 CVE-2024-6931 Wordfence
9.8 Critical The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection No login needed ≤ 6.6.4 CVE-2024-8275 Wordfence
8.5 High Registrations for the Events Calendar Plugin registrations-for-the-events-calendar SQL Injection ≤ 2.12.2 Fixed in 2.12.3 CVE-2024-39638 Patchstack
9.1 Critical The Events Calendar Plugin the-events-calendar Cross-Site Scripting Reflected XSS No login needed < 6.4.0.1 Fixed in 6.4.0.1 CVE-2024-4180 WPScan
4.3 Medium The Events Calendar Plugin the-events-calendar Cross-Site Request Forgery No login needed ≤ 6.3.0 Fixed in 6.3.1 CVE-2024-31433 Patchstack
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Unauthenticated Sensitive Information Exposure No login needed ≤ 6.2.8.2 CVE-2023-6557 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only