WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–50 of 176 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Request a Quote for WooCommerce Plugin get-a-quote-button-for-woocommerce Arbitrary File Upload Unauthenticated Arbitrary File Upload via AJAX Popup Handler No login needed ≤ 2.9.2 CVE-2026-18143 Wordfence
9.1 Critical Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter No login needed ≤ 5.120.0 CVE-2026-89055 Wordfence
9.8 Critical WooCommerce Online Product Designer 1.7.0 Plugin Arbitrary File Upload < 2.15.0 - Unauthenticated Arbitrary File Upload No login needed 1.7.0 – < 2.15.0 Fixed in 2.15.0 CVE-2026-82187 WPScan
9.8 Critical MIPL Grouped Checkout Fields for WooCommerce Plugin mipl-wc-checkout-fields Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.2.2 CVE-2026-8778 Wordfence
9.1 Critical zipMoney(Zip Co) Payments Plugin for WooCommerce Plugin zipmoney-payments-woocommerce Broken Access Control Unauthenticated Arbitrary Option Deletion No login needed < 2.4.0 Fixed in 2.4.0 CVE-2026-78361 WPScan
9.8 Critical YITH Request a Quote for WooCommerce Premium Plugin yith-woocommerce-request-a-quote-premium Broken Access Control No login needed < 4.46.0 Fixed in 4.46.0 CVE-2026-84238 Patchstack
9.8 Critical Custom User Registration Fields for WooCommerce Plugin Privilege Escalation Unauthenticated Privilege Escalation via 'afreg_select_user_role' Parameter in Store API Checkout No login needed ≤ 2.2.3 CVE-2026-15369 Wordfence
9.1 Critical Total Processing Card Payments for WooCommerce Plugin Server-Side Request Forgery Unauthenticated SSRF leading to Payment Bypass and Gateway Credential Disclosure No login needed ≤ 7.3 CVE-2026-16947 WPScan
9.8 Critical ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Plugin erp Arbitrary File Upload Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment No login needed ≤ 1.17.8 CVE-2026-18080 Wordfence
9.8 Critical Affiliate Pro - Affiliate Program for WooCommerce & Plugin wp-wc-affiliate-program Privilege Escalation Affiliate Program for WooCommerce & WordPress plugin <= 8.9.1 - Privilege Escalation No login needed ≤ 8.9.1 CVE-2026-32558 Patchstack
9.8 Critical Abandoned Cart Pro for WooCommerce Plugin woocommerce-abandon-cart-pro Privilege Escalation No login needed ≤ 10.4.0 CVE-2026-66682 Patchstack
9.8 Critical Cartify Theme cartify-multipurpose-woocommerce-wordpress-theme Privilege Escalation Account Takeover No login needed ≤ 1.3.0.1 CVE-2026-66465 Patchstack
9.3 Critical Active Products Tables for WooCommerce Plugin profit-products-tables-for-woocommerce SQL Injection No login needed ≤ 1.1.1 Fixed in 2.1.2 CVE-2026-66436 Patchstack
9.8 Critical Customer Email Verification for WooCommerce Plugin emails-verification-for-woocommerce Privilege Escalation Unauthenticated Account Takeover via Type-Juggling Authentication Bypass No login needed 2.4.0 – < 3.2.6 Fixed in 3.2.6 CVE-2026-14182 WPScan
9.8 Critical WooCommerce Subscriptions Plugin Remote Code Execution Unauthenticated RCE via PHP Object Injection No login needed 4.7.0 – < 9.1.0 Fixed in 9.1.0 CVE-2026-18391 WPScan
9.1 Critical TeraWallet - Wallet for WooCommerce Plugin Broken Access Control Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up No login needed < 1.6.10 Fixed in 1.6.10 CVE-2026-16538 WPScan
9.8 Critical Gift Cards For WooCommerce Pro Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed < 4.2.10 Fixed in 4.2.10 CVE-2026-15039 WPScan
9.8 Critical Product Input Fields for WooCommerce Plugin product-input-fields-for-woocommerce Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed 2.0.0 – < 2.0.2 Fixed in 2.0.2 CVE-2026-19089 WPScan
9.1 Critical CTX Feed Plugin webappick-product-feed-for-woocommerce Remote Code Execution ≤ 6.6.42 Fixed in 6.6.43 CVE-2026-66709 Patchstack
9.8 Critical Kadence WooCommerce Email Designer Plugin kadence-woocommerce-email-designer Privilege Escalation No login needed ≤ 1.5.19 Fixed in 1.5.19.1 CVE-2026-28005 Patchstack
9.1 Critical Drag and Drop Multiple File Upload for WooCommerce Plugin drag-and-drop-multiple-file-upload-for-woocommerce Arbitrary File Upload Unauthenticated File Deletion via Nonce Oracle No login needed < 1.1.8 Fixed in 1.1.8 CVE-2026-16054 WPScan
10.0 Critical Custom Fields for WooCommerce Plugin Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal No login needed < 1.5.1 Fixed in 1.5.1 CVE-2026-16940 WPScan
9.8 Critical WooCommerce - Social Login Plugin Authentication Bypass Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT No login needed ≤ 2.8.7 CVE-2026-8457 Wordfence
9.8 Critical Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Plugin excel-like-price-change-for-woocommerce-and-wp-e-commerce-light Broken Access Control Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account Creation No login needed ≤ 2.4.37 CVE-2025-10656 Wordfence
9.8 Critical Happy Coders OTP Login for WooCommerce Plugin happy-coders-otp-login Privilege Escalation Unauthenticated Account Takeover via hcotp_auto_login_user No login needed 1.5 – < 2.8 Fixed in 2.8 CVE-2026-12492 WPScan
9.1 Critical Printcart Web to Print Product Designer for WooCommerce Plugin printcart-integration Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 2.5.2 CVE-2026-9725 Wordfence
9.8 Critical Novalnet Payment Gateway for WooCommerce Plugin woocommerce-novalnet-gateway PHP Object Injection No login needed ≤ 12.10.3 Fixed in 12.10.4 CVE-2026-57677 Patchstack
9.3 Critical 워드프레스 결제 심플페이 Plugin pgall-for-woocommerce SQL Injection No login needed ≤ 5.5.6 Fixed in 5.5.7 CVE-2026-56036 Patchstack
9.9 Critical Booster for WooCommerce Plugin woocommerce-jetpack Arbitrary File Upload ≤ 8.0.1 Fixed in 8.0.2 CVE-2026-56027 Patchstack
9.3 Critical Premmerce Wishlist for WooCommerce Plugin premmerce-woocommerce-wishlist SQL Injection No login needed ≤ 1.1.11 Fixed in 1.1.12 CVE-2026-54849 Patchstack
9.8 Critical WooCommerce Plugin woocommerce Remote Code Execution WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php No login needed 7.1.0 CVE-2022-50972 VulnCheck
9.3 Critical Cargo Shipping Location for WooCommerce Plugin cargo-shipping-location-for-woocommerce SQL Injection No login needed ≤ 5.6 Fixed in 5.7 CVE-2026-54815 Patchstack
9.8 Critical Registration Form for WooCommerce Plugin registration-form-for-woocommerce Privilege Escalation No login needed ≤ 1.0.9 Fixed in 1.1.0 CVE-2026-54807 Patchstack
9.8 Critical WooCommerce Product Filters Plugin woocommerce-product-filters PHP Object Injection No login needed < 2.0.6 Fixed in 2.0.6 CVE-2026-40725 Patchstack
10.0 Critical WordPress & WooCommerce Scraper Plugin, Import Data from Any Site Plugin wp_scraper Arbitrary File Upload No login needed ≤ 1.0.7 CVE-2025-69129 Patchstack
9.3 Critical Order Delivery Date for WooCommerce Plugin order-delivery-date-for-woocommerce SQL Injection No login needed ≤ 4.5.1 Fixed in 4.5.2 CVE-2026-42386 Patchstack
9.3 Critical Feed KuantoKusta for WooCommerce – Free Plugin feed-kuantokusta-for-woocommerce SQL Injection Free plugin <= 5.3 - SQL Injection No login needed ≤ 5.3 Fixed in 5.3.1 CVE-2026-39441 Patchstack
10.0 Critical WooCommerce PDF Invoice Builder Plugin woo-pdf-invoice-builder Remote Code Execution No login needed ≤ 2.0.8 Fixed in 2.0.9 CVE-2026-52704 Patchstack
9.8 Critical Hippoo Mobile App for WooCommerce Plugin hippoo Privilege Escalation No login needed ≤ 1.9.4 Fixed in 1.9.5 CVE-2026-49060 Patchstack
9.8 Critical Hippoo Mobile App for WooCommerce Plugin hippoo Authentication Bypass Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API No login needed ≤ 1.9.4 CVE-2026-10580 Wordfence
10.0 Critical Product Slider Pro for WooCommerce Plugin woo-product-slider-pro Other Backdoor No login needed < 3.5.4 Fixed in 3.5.4 CVE-2026-49777 Patchstack
9.3 Critical Active Products Tables for WooCommerce Plugin profit-products-tables-for-woocommerce SQL Injection No login needed ≤ 1.0.9 Fixed in 1.1.0 CVE-2026-42761 Patchstack
9.3 Critical Active Products Tables for WooCommerce Plugin profit-products-tables-for-woocommerce SQL Injection No login needed ≤ 1.0.8 Fixed in 1.0.9 CVE-2026-42727 Patchstack
10.0 Critical Gift Cards For WooCommerce Pro Plugin giftware Arbitrary File Upload No login needed ≤ 4.2.6 Fixed in 4.2.7 CVE-2026-45444 Patchstack
9.1 Critical Order Notification for WooCommerce Plugin Authentication Bypass Unauthenticated WooCommerce REST Permission Bypass No login needed < 3.6.3 Fixed in 3.6.3 CVE-2025-15484 WPScan
9.3 Critical Product Rearrange for WooCommerce Plugin products-rearrange-woocommerce SQL Injection No login needed ≤ <= 1.2.2 CVE-2026-31920 Patchstack
9.3 Critical Advanced WooCommerce Product Sales Reporting Plugin webd-woocommerce-advanced-reporting-statistics SQL Injection No login needed ≤ 4.1.3 Fixed in 4.1.4 CVE-2026-24993 Patchstack
9.8 Critical Woocommerce Custom Product Addons Pro Plugin Remote Code Execution Unauthenticated Remote Code Execution via Custom Pricing Formula No login needed ≤ 5.4.1 CVE-2026-4001 Wordfence
9.0 Critical Woocommerce Wholesale Lead Capture Plugin woocommerce-wholesale-lead-capture Arbitrary File Upload No login needed ≤ 2.0.3.1 Fixed in 2.0.3.2 CVE-2026-27540 Patchstack
9.8 Critical Woocommerce Wholesale Lead Capture Plugin woocommerce-wholesale-lead-capture Privilege Escalation No login needed ≤ 2.0.3.1 Fixed in 2.0.3.2 CVE-2026-27542 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only