WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–32 of 32 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium WP Directory Kit Plugin wpdirectorykit SQL Injection Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter ≤ 1.5.4 CVE-2026-16596 Wordfence
7.2 High WP Directory Kit Plugin wpdirectorykit Cross-Site Scripting Listing Admin+ Stored XSS via Category and Location Title and Icon Fields < 1.5.8 Fixed in 1.5.8 CVE-2026-16591 WPScan
6.5 Medium WP Directory Kit Plugin wpdirectorykit SQL Injection Authenticated (Custom+) SQL Injection via 'order_by' Parameter ≤ 1.5.4 CVE-2026-16588 Wordfence
5.3 Medium WP Directory Kit Plugin wpdirectorykit Information Disclosure Unauthenticated Unpublished Listing Disclosure via map_infowindow No login needed ≤ 1.5.7 CVE-2026-18232 WPScan
6.8 Medium WP Directory Kit Plugin wpdirectorykit SQL Injection Editor+ SQL Injection via Elementor Category and Location Widget Settings ≤ 1.5.7 CVE-2026-16593 WPScan
2.7 Low WP Directory Kit Plugin wpdirectorykit Information Disclosure Contributor+ Non-Public Listing Field Disclosure via Shortcodes ≤ 1.5.7 CVE-2026-16592 WPScan
5.3 Medium WP Directory Kit Plugin wpdirectorykit Information Disclosure Unauthenticated User Email Disclosure via select_2_ajax_user No login needed < 1.5.7 Fixed in 1.5.7 CVE-2026-18231 WPScan
7.2 High WP Directory Kit Plugin wpdirectorykit SQL Injection Admin+ SQL Injection via section Parameter < 1.5.7 Fixed in 1.5.7 CVE-2026-18653 WPScan
9.3 Critical WP Directory Kit Plugin wpdirectorykit SQL Injection No login needed ≤ 1.5.4 Fixed in 1.5.5 CVE-2026-28001 Patchstack
7.5 High WP Directory Kit Plugin wpdirectorykit SQL Injection No login needed ≤ 1.5.4 Fixed in 1.5.5 CVE-2026-27538 Patchstack
8.6 High WP Directory Kit Plugin wpdirectorykit SQL Injection Unauthenticated SQL Injection via search_location and search_category No login needed < 1.5.6 Fixed in 1.5.6 CVE-2026-18474 WPScan
8.1 High WP Directory Kit Plugin wpdirectorykit SQL Injection Subscriber+ SQL Injection via section Parameter < 1.5.6 Fixed in 1.5.6 CVE-2026-18230 WPScan
9.1 Critical WP Directory Kit Plugin wpdirectorykit SQL Injection Unauthenticated SQL Injection via 'field_search' Parameter No login needed 1.5.4 – < 1.5.5 Fixed in 1.5.5 CVE-2026-18473 WPScan
6.5 Medium WP Directory Kit Plugin wpdirectorykit Information Disclosure Subscriber+ User and Unpublished Listing Disclosure < 1.5.5 Fixed in 1.5.5 CVE-2026-16595 WPScan
7.5 High WP Directory Kit Plugin wpdirectorykit Information Disclosure Subscriber+ Plugin Settings and API Key Disclosure No login needed < 1.5.5 Fixed in 1.5.5 CVE-2026-16594 WPScan
6.5 Medium WP Directory Kit Plugin wpdirectorykit Information Disclosure Subscriber+ Contact Message and User Data Disclosure < 1.5.5 Fixed in 1.5.5 CVE-2026-16590 WPScan
7.7 High WP Directory Kit Plugin wpdirectorykit SQL Injection Subscriber+ SQL Injection via data_fields_list Parameter < 1.5.5 Fixed in 1.5.5 CVE-2026-16589 WPScan
7.5 High WP Directory Kit Plugin wpdirectorykit Broken Access Control No login needed ≤ 1.5.0 Fixed in 1.5.1 CVE-2026-39534 Patchstack
9.3 Critical WP Directory Kit Plugin wpdirectorykit SQL Injection No login needed ≤ 1.5.1 Fixed in 1.5.2 CVE-2026-42672 Patchstack
9.3 Critical WP Directory Kit Plugin wpdirectorykit SQL Injection No login needed ≤ 1.5.0 Fixed in 1.5.1 CVE-2026-39531 Patchstack
5.3 Medium WP Directory Kit Plugin wpdirectorykit Information Disclosure Unauthenticated Email Exposure via wdk_public_action No login needed ≤ 1.4.9 CVE-2025-13920 Wordfence
7.5 High WP Directory Kit Plugin wpdirectorykit SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.4.7 CVE-2025-13089 Wordfence
10.0 Critical WP Directory Kit Plugin wpdirectorykit Authentication Bypass Authentication Bypass to Privilege Escalation via Account Takeover No login needed 1.4.0 – 1.4.4 CVE-2025-13390 Wordfence
4.9 Medium WP Directory Kit Plugin wpdirectorykit SQL Injection Authenticated (Admin+) SQL Injection ≤ 1.4.6 CVE-2025-13090 Wordfence
6.1 Medium WP Directory Kit Plugin wpdirectorykit Cross-Site Scripting Reflected Cross-Site Scripting via 'order_by' Parameter No login needed ≤ 1.4.5 CVE-2025-13525 Wordfence
7.5 High WP Directory Kit Plugin wpdirectorykit SQL Injection Unauthenticated SQL Injection via select_2_ajax() Function No login needed ≤ 1.4.3 CVE-2025-13138 Wordfence
5.3 Medium WP Directory Kit Plugin wpdirectorykit Broken Access Control No login needed ≤ 1.4.0 Fixed in 1.4.1 CVE-2025-60120 Patchstack
5.3 Medium WP Directory Kit Plugin wpdirectorykit Broken Access Control No login needed ≤ 1.2.6 Fixed in 1.2.7 CVE-2023-41875 Patchstack
7.1 High WP Directory Kit Plugin wpdirectorykit Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-37487 Patchstack
2.7 Low WP Directory Kit Plugin wpdirectorykit Content Injection HTML Injection ≤ 1.3.6 Fixed in 1.3.7 CVE-2024-37253 Patchstack
8.8 High WP Directory Kit Plugin wpdirectorykit SQL Injection Authenticated (Subscriber+) SQL Injection ≤ 1.3.0 CVE-2024-3217 Wordfence
7.1 High WP Directory Kit Plugin wpdirectorykit Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.9 Fixed in 1.3.0 CVE-2024-29774 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only