WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 5,001–5,050 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 101 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin print-invoices-packing-slip-labels-for-woocommerce Information Disclosure Sensitive Data Exposure No login needed ≤ 4.9.4 Fixed in 4.9.5 CVE-2026-49056 Patchstack
7.1 High Drag and Drop Multiple File Upload – Contact Form 7 Plugin drag-and-drop-multiple-file-upload-contact-form-7 Arbitrary File Upload Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) No login needed ≤ 1.3.9.7 Fixed in 1.3.9.8 CVE-2026-49055 Patchstack
4.7 Medium WP Migrate Lite Plugin wp-migrate-db Cross-Site Request Forgery No login needed ≤ 2.7.8 Fixed in 2.7.9 CVE-2026-49043 Patchstack
8.1 High Really Simple SSL Plugin really-simple-ssl Authentication Bypass Broken Authentication No login needed ≤ 9.5.10 Fixed in 9.5.10.1 CVE-2026-48970 Patchstack
7.1 High Funnel Builder by FunnelKit Plugin funnel-builder Cross-Site Scripting No login needed ≤ 3.15.0.2 Fixed in 3.15.0.3 CVE-2026-48966 Patchstack
6.5 Medium XCloner Plugin xcloner-backup-and-restore Information Disclosure Sensitive Data Exposure No login needed ≤ 4.8.6 Fixed in 4.8.7 CVE-2026-48965 Patchstack
8.5 High ELEX WordPress HelpDesk & Customer Ticketing System Plugin elex-helpdesk-customer-support-ticket-system SQL Injection ≤ 3.3.6 Fixed in 3.3.7 CVE-2026-48964 Patchstack
8.8 High Amelia Plugin ameliabooking Privilege Escalation ≤ 2.3 Fixed in 2.4 CVE-2026-48889 Patchstack
6.5 Medium JS Help Desk Plugin js-support-ticket Broken Access Control No login needed ≤ 3.0.9 Fixed in 3.1.0 CVE-2026-48887 Patchstack
9.3 Critical JS Help Desk Plugin js-support-ticket SQL Injection No login needed ≤ 3.0.9 Fixed in 3.1.0 CVE-2026-48886 Patchstack
7.1 High HollerBox Plugin holler-box Cross-Site Scripting No login needed ≤ 2.3.10.1 Fixed in 2.3.11 CVE-2026-48885 Patchstack
7.5 High WPC Product Bundles for WooCommerce Plugin woo-product-bundle Broken Access Control No login needed ≤ 8.5.3 Fixed in 8.5.4 CVE-2026-48883 Patchstack
8.5 High WP Time Slots Booking Form Plugin wp-time-slots-booking-form SQL Injection ≤ 1.2.50 Fixed in 1.2.51 CVE-2026-48882 Patchstack
9.1 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control No login needed ≤ 1.1.9 Fixed in 1.2.0 CVE-2026-48881 Patchstack
6.5 Medium WP Job Portal Plugin wp-job-portal Cross-Site Scripting ≤ 2.5.2 Fixed in 2.5.3 CVE-2026-48880 Patchstack
6.5 Medium Visual Link Preview Plugin visual-link-preview Information Disclosure Sensitive Data Exposure ≤ 2.4.1 Fixed in 2.4.2 CVE-2026-48878 Patchstack
7.1 High Stop Spammers Plugin stop-spammer-registrations-plugin Cross-Site Scripting No login needed ≤ 2026.3 Fixed in 2026.4 CVE-2026-48876 Patchstack
8.5 High GamiPress Plugin gamipress SQL Injection ≤ 7.8.7 Fixed in 7.8.8 CVE-2026-48874 Patchstack
7.5 High Montonio for WooCommerce Plugin montonio-for-woocommerce Broken Access Control No login needed ≤ 10.1.2 Fixed in 10.1.3 CVE-2026-48873 Patchstack
7.5 High EmbedPress Plugin embedpress Information Disclosure Sensitive Data Exposure No login needed ≤ 4.5.2 Fixed in 4.5.3 CVE-2026-48872 Patchstack
7.1 High MW WP Form Plugin mw-wp-form Cross-Site Scripting No login needed ≤ 5.1.3 Fixed in 5.1.4 CVE-2026-48871 Patchstack
6.5 Medium King Addons for Elementor Plugin king-addons Cross-Site Scripting ≤ 51.1.62 Fixed in 51.1.63 CVE-2026-48870 Patchstack
7.5 High Simple Shopping Cart Plugin wordpress-simple-paypal-shopping-cart Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 5.2.9 Fixed in 5.3.0 CVE-2026-48868 Patchstack
7.1 High Quiz And Survey Master Plugin quiz-master-next Cross-Site Scripting No login needed ≤ 11.1.2 Fixed in 11.1.3 CVE-2026-48867 Patchstack
7.1 High Post SMTP Plugin post-smtp Cross-Site Scripting No login needed ≤ 3.6.2 Fixed in 3.6.3 CVE-2026-48838 Patchstack
10.0 Critical Easy Invoice Plugin easy-invoice Remote Code Execution No login needed ≤ 2.1.19 Fixed in 2.1.20 CVE-2026-48836 Patchstack
7.5 High Contact Form by WPForms Plugin wpforms-lite Broken Access Control No login needed ≤ 1.10.0.4 Fixed in 1.10.0.5 CVE-2026-48835 Patchstack
7.5 High WpEvently Plugin mage-eventpress Other Other Vulnerability Type No login needed ≤ 5.3.3 Fixed in 5.3.4 CVE-2026-45441 Patchstack
9.3 Critical Realtyna Organic IDX Plugin real-estate-listing-realtyna-wpl SQL Injection No login needed ≤ 5.1.0 Fixed in 5.2.0 CVE-2026-45439 Patchstack
7.1 High Product Filter Widget for Elementor Plugin product-filter-widget-for-elementor Cross-Site Scripting No login needed ≤ 1.0.6 CVE-2026-45437 Patchstack
7.1 High AutomatorWP Plugin automatorwp Cross-Site Scripting No login needed ≤ 5.7.2 Fixed in 5.7.3 CVE-2026-42775 Patchstack
6.5 Medium Stripe Payments Plugin stripe-payments Other Bypass Vulnerability No login needed ≤ 2.0.98 Fixed in 2.0.99 CVE-2026-42752 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Authentication Bypass LMS plugin <= 2.1.8 - Broken Authentication No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2026-42743 Patchstack
6.5 Medium Modula Image Gallery Plugin modula-best-grid-gallery Cross-Site Scripting ≤ 2.14.23 Fixed in 2.14.24 CVE-2026-42688 Patchstack
8.1 High EventPrime Plugin eventprime-event-calendar-management PHP Object Injection No login needed ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42687 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42686 Patchstack
7.5 High Email Marketing for WooCommerce by Omnisend Plugin omnisend-connect Authentication Bypass Broken Authentication No login needed ≤ 1.18.0 Fixed in 1.18.1 CVE-2026-42668 Patchstack
7.5 High Bookly Plugin bookly-responsive-appointment-booking-tool Information Disclosure Sensitive Data Exposure No login needed ≤ 27.4 Fixed in 27.5 CVE-2026-42667 Patchstack
7.5 High Salon booking system Plugin salon-booking-system Broken Access Control No login needed ≤ 10.30.25 Fixed in 10.30.26 CVE-2026-42666 Patchstack
9.3 Critical WP Data Access Plugin wp-data-access SQL Injection No login needed ≤ 5.5.70 Fixed in 5.5.71 CVE-2026-42665 Patchstack
8.2 High AI Product Search for WooCommerce – Motive Commerce Search Plugin motive-commerce-search Broken Access Control Motive Commerce Search plugin <= 1.38.2 - Broken Access Control No login needed ≤ 1.38.2 Fixed in 1.38.3 CVE-2026-42664 Patchstack
6.5 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.7.2 Fixed in 4.7.3 CVE-2026-42663 Patchstack
6.5 Medium Event Tickets Plugin event-tickets Authentication Bypass Bypass Vulnerability No login needed ≤ 5.27.5 Fixed in 5.27.6.1 CVE-2026-42662 Patchstack
8.8 High WP Customer Area Plugin customer-area Path Traversal ≤ 8.3.4 Fixed in 8.3.5 CVE-2026-42661 Patchstack
6.5 Medium Contest Gallery Plugin contest-gallery Information Disclosure Sensitive Data Exposure ≤ 28.1.7 Fixed in 29.0.0 CVE-2026-42660 Patchstack
6.5 Medium Advanced Form Integration Plugin advanced-form-integration Broken Access Control ≤ 1.126.12 Fixed in 1.127.0 CVE-2026-42659 Patchstack
7.1 High Classified Listing Plugin classified-listing Cross-Site Scripting No login needed ≤ 5.3.8 Fixed in 5.3.9 CVE-2026-42658 Patchstack
6.5 Medium Contest Gallery Plugin contest-gallery Other Other Vulnerability Type No login needed ≤ 28.1.7 Fixed in 29.0.0 CVE-2026-42657 Patchstack
6.5 Medium Contest Gallery Plugin contest-gallery Cross-Site Scripting ≤ 28.1.6 Fixed in 29.0.0 CVE-2026-42656 Patchstack
7.5 High Best Payments Plugin for WP Plugin wp-payment-form Price Manipulation Payment Bypass No login needed ≤ 4.6.19 Fixed in 4.6.20 CVE-2026-42655 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only