WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 5,751–5,800 of 29,262 vulnerabilities

Known WordPress vulnerabilities, page 116 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Easy Elements for Elementor Plugin easy-elements Privilege Escalation Unauthenticated Privilege Escalation via easyel_handle_register No login needed ≤ 1.4.4 CVE-2026-7284 Wordfence
7.5 High Creative Mail – Easier WordPress & WooCommerce Email Marketing Plugin creative-mail-by-constant-contact SQL Injection Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter No login needed ≤ 1.6.9 CVE-2026-3985 Wordfence
6.5 Medium Infility Global Plugin infility-global SQL Injection Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter ≤ 2.15.16 CVE-2026-8685 Wordfence
6.4 Medium Sticky Plugin sticky Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute ≤ 2.5.6 CVE-2026-6397 Wordfence
6.1 Medium LJ comments import: reloaded Plugin lj-comments-import-reloaded Cross-Site Scripting Reflected Cross-Site Scripting via PHP_SELF Parameter No login needed ≤ 0.97.1 CVE-2026-8624 Wordfence
9.8 Critical ProSolution WP Client Plugin prosolution-wp-client Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'files' No login needed ≤ 2.0.0 CVE-2026-6555 Wordfence
4.3 Medium Games Catalog Plugin game-catalog Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Game/Post Deletion No login needed ≤ 1.2.0 CVE-2026-8418 Wordfence
7.5 High Kirki Plugin kirki Path Traversal Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP No login needed ≤ 6.0.6 CVE-2026-8073 Wordfence
6.5 Medium Kirki Plugin kirki Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action ≤ 6.0.6 CVE-2026-8096 Wordfence
7.5 High Funnel Builder for WooCommerce Checkout Plugin funnel-builder Broken Access Control Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX No login needed < 3.15.0.3 Fixed in 3.15.0.3 CVE-2026-47100 VulnCheck
9.8 Critical Piotnet Forms Plugin piotnetforms Arbitrary File Upload Unauthenticated Arbitrary File Upload via Form File Upload No login needed ≤ 2.1.40 CVE-2026-4883 Wordfence
7.5 High Contest Gallery Plugin contest-gallery SQL Injection Unauthenticated SQL Injection No login needed ≤ 28.1.6 CVE-2026-8912 Wordfence
4.3 Medium Presto Player Plugin presto-player Broken Access Control ≤ 4.1.3 Fixed in 4.1.4 CVE-2026-45442 Patchstack
9.8 Critical Piotnet Addons for Elementor Pro Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via Form File Upload No login needed ≤ 7.1.70 CVE-2026-4885 Wordfence
7.5 High Fortis For WooCommerce Plugin fortis-for-woocommerce Information Disclosure Sensitive API Key Disclosure No login needed < 1.3.1 Fixed in 1.3.1 CVE-2025-15609 WPScan
7.1 High Ajax Load More Plugin ajax-load-more Cross-Site Scripting Reflected XSS No login needed < 7.8.4 Fixed in 7.8.4 CVE-2026-6495 WPScan
7.5 High WP Maps Plugin wp-google-map-plugin Local File Inclusion Subscriber+ Local File Inclusion < 4.9.3 Fixed in 4.9.3 CVE-2026-6381 WPScan
8.6 High WP Photo Album Plus Plugin wp-photo-album-plus SQL Injection Unauthenticated SQL Injection via 'wppa-supersearch' Parameter No login needed < 9.1.11.001 Fixed in 9.1.11.001 CVE-2026-6379 WPScan
8.8 High Multiple Plugins Plugin Cross-Site Scripting Unauthenticated Stored XSS via Minify Library No login needed < 3.1.15, < 2.4.2, < 7.7.9 Fixed in 3.1.15 CVE-2026-3220 WPScan
5.4 Medium Feeds for YouTube Plugin Broken Access Control Subscriber+ License Data Deletion < 2.6.4 Fixed in 2.6.4 CVE-2026-1631 WPScan
9.8 Critical Peugeot Music Plugin Arbitrary File Upload WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload No login needed 1.0 CVE-2018-25335 VulnCheck
7.5 High WP with Spritz Plugin Local File Inclusion WordPress Plugin WP with Spritz 1.0 Remote File Inclusion No login needed 1.0 CVE-2018-25329 VulnCheck
6.2 Medium Simple Fields Plugin Local File Inclusion Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath No login needed 0.2 – 0.3.5 CVE-2018-25324 VulnCheck
8.8 High AI Engine Plugin ai-engine Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Missing Authorization in MCP OAuth Bearer Token 3.4.9 CVE-2026-8719 Wordfence
7.5 High Malware Security and Bruteforce Firewall Plugin Path Traversal WordPress Anti-Malware Security Bruteforce Firewall <= 4.20.72 Directory Traversal No login needed ≤ 4.20.72 CVE-2021-47977 VulnCheck
8.8 High Backup and Restore Plugin backup-and-restore-for-wp Arbitrary File Deletion WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion 1.0.3 CVE-2021-47979 VulnCheck
7.2 High WP Learn Manager Plugin learn-manager Cross-Site Scripting WordPress Plugin WP Learn Manager 1.1.2 Stored XSS No login needed 1.1.2 CVE-2021-47975 VulnCheck
6.4 Medium Cookie Law Bar Plugin cookie-law-bar Cross-Site Scripting WordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msg 1.2.1 CVE-2021-47957 VulnCheck
6.2 Medium Backup Plugin Local File Inclusion WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion No login needed 2.3.9 CVE-2020-37246 VulnCheck
7.5 High Digital Publications Plugin Path Traversal WordPress Plugin Supsystic Digital Publications 1.6.9 Path Traversal XSS No login needed 1.6.9 CVE-2020-37245 VulnCheck
8.2 High Membership Plugin membership-for-woocommerce SQL Injection WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx No login needed 1.4.7 CVE-2020-37244 VulnCheck
8.2 High Pricing Table Plugin pricing-table-by-supsystic SQL Injection WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS No login needed 1.8.6, 1.8.7 CVE-2020-37243 VulnCheck
8.2 High Ultimate Maps Plugin ultimate-maps-by-supsystic SQL Injection WordPress Plugin Supsystic Ultimate Maps 1.1.12 SQL Injection via sidx No login needed 1.1.12 CVE-2020-37242 VulnCheck
6.4 Medium Theme Wibar Theme Cross-Site Scripting WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component 1.1.8 CVE-2020-37235 VulnCheck
6.4 Medium Buddypress Plugin buddypress Cross-Site Scripting WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting 6.2.0 CVE-2020-37233 VulnCheck
8.8 High HS Brand Logo Slider Plugin hs-brand-logo-slider Arbitrary File Upload WordPress Plugin HS Brand Logo Slider 2.1 Unrestricted File Upload 2.1 CVE-2020-37227 VulnCheck
4.3 Medium Multicollab: Content Team Collaboration and Editorial Workflow Plugin commenting-feature Broken Access Control Missing Authorization to Authenticated (Subscriber+) Collaboration Comment ≤ 5.2 CVE-2025-4202 Wordfence
5.3 Medium Essential Chat Support Plugin essential-chat-support Broken Access Control Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter No login needed ≤ 1.0.1 CVE-2026-8681 Wordfence
9.8 Critical WP Super Edit Plugin wp-super-edit Arbitrary File Upload WordPress Plugin WP Super Edit 2.5.4 Unrestricted File Upload No login needed ≤ 2.5.4 CVE-2021-47965 VulnCheck
7.5 High WPGraphQL Plugin wp-graphql Denial of Service WordPress Plugin WPGraphQL 1.3.5 Denial of Service No login needed 1.3.5 CVE-2021-47959 VulnCheck
4.3 Medium Classified Listing Plugin classified-listing Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions ≤ 5.3.10 CVE-2026-7563 Wordfence
4.3 Medium Notify Odoo Plugin notify-odoo Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0.1 CVE-2026-8425 Wordfence
6.4 Medium Advanced Custom Fields: Font Awesome Field Plugin advanced-custom-fields-font-awesome Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field ≤ 5.0.2 CVE-2026-6415 Wordfence
7.5 High Quick Playground Plugin quick-playground Path Traversal Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter No login needed ≤ 1.3.3 CVE-2026-6403 Wordfence
4.9 Medium NEX-Forms – Ultimate Forms Plugin nex-forms-express-wp-form-builder SQL Injection Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter ≤ 9.1.12 CVE-2026-7046 Wordfence
6.5 Medium Smartcat Translator for WPML Plugin smartcat-wpml Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Update No login needed ≤ 3.1.77 CVE-2026-4683 Wordfence
8.8 High Frontend Admin by DynamiApps Plugin acf-frontend-form-element Privilege Escalation Unauthenticated Privilege Escalation via Edit User Form ≤ 3.28.36 CVE-2026-6228 Wordfence
9.8 Critical Receive Notifications After Form Submitting – Form Notify for Any Forms Plugin form-notify Authentication Bypass Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback No login needed ≤ 1.1.10 CVE-2026-5229 Wordfence
8.1 High FOX – Currency Switcher Professional for WooCommerce Plugin woocommerce-currency-switcher Broken Access Control Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion ≤ 1.4.5 CVE-2026-4094 Wordfence
6.4 Medium The7 Theme dt-the7 Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter ≤ 14.3.2 CVE-2026-6646 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only