WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 551–600 of 16,788 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 12 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
10.0 Critical	Hash Form Plugin `hash-form`	Arbitrary File Upload No login needed	`≤ 1.4.2` Fixed in `1.4.3`	Aug 31, 2026	`CVE-2026-81780`	Patchstack
6.5 Medium	Kalles Addons Plugin `kalles-addons`	Cross-Site Scripting	`≤ 1.0.6`	Aug 31, 2026	`CVE-2026-81778`	Patchstack
7.1 High	Super Store Finder Plugin `superstorefinder-wp`	Cross-Site Scripting No login needed	`≤ 7.10` Fixed in `7.11`	Aug 31, 2026	`CVE-2026-81768`	Patchstack
7.1 High	Tailored Tools Plugin `tailored-tools`	Cross-Site Scripting No login needed	`≤ 3.0.2` Fixed in `3.0.3`	Aug 31, 2026	`CVE-2026-81765`	Patchstack
7.1 High	Email Essentials Plugin `email-essentials`	Cross-Site Scripting No login needed	`≤ 6.0.6` Fixed in `6.0.7`	Aug 31, 2026	`CVE-2026-81764`	Patchstack
9.3 Critical	Throws SPAM Away Plugin `throws-spam-away`	SQL Injection No login needed	`≤ 3.8.2` Fixed in `3.9`	Aug 31, 2026	`CVE-2026-81763`	Patchstack
6.5 Medium	Booking and Rental Manager Plugin `booking-and-rental-manager-for-woocommerce`	Broken Access Control	`≤ 2.7.6` Fixed in `2.7.7`	Aug 31, 2026	`CVE-2026-81762`	Patchstack
6.3 Medium	OwnerRez API Plugin `ownerrez`	Broken Access Control	`≤ 1.2.6` Fixed in `1.3.0`	Aug 31, 2026	`CVE-2026-81758`	Patchstack
9.3 Critical	Smart Marketing SMS and Newsletters Forms Plugin `smart-marketing-for-wp`	SQL Injection No login needed	`≤ 5.1.24` Fixed in `5.1.25`	Aug 31, 2026	`CVE-2026-81756`	Patchstack
7.1 High	LeadConnector Plugin `leadconnector`	Cross-Site Scripting No login needed	`≤ 4.0.5` Fixed in `4.0.6`	Aug 31, 2026	`CVE-2026-81298`	Patchstack
7.5 High	Fluent Forms Pro Add On Pack Plugin `fluentformpro`	Privilege Escalation	`≤ 6.2.12` Fixed in `6.2.13`	Aug 31, 2026	`CVE-2026-81297`	Patchstack
7.5 High	Fluent Forms Pro Add On Pack Plugin `fluentformpro`	Broken Access Control No login needed	`≤ 6.2.12` Fixed in `6.2.13`	Aug 31, 2026	`CVE-2026-81296`	Patchstack
9.3 Critical	WP Data Access Plugin `wp-data-access`	SQL Injection No login needed	`≤ 5.5.81` Fixed in `5.5.82`	Aug 31, 2026	`CVE-2026-81293`	Patchstack
7.1 High	Uncode Theme `uncode`	Cross-Site Scripting No login needed	`≤ 2.12.7` Fixed in `2.12.8`	Aug 31, 2026	`CVE-2026-81291`	Patchstack
7.1 High	Email Subscribers & Newsletters Plugin `email-subscribers`	Cross-Site Scripting No login needed	`≤ 5.9.33` Fixed in `5.9.34`	Aug 31, 2026	`CVE-2026-81290`	Patchstack
8.5 High	Charitable Plugin `charitable`	SQL Injection	`≤ 1.8.12.1` Fixed in `1.8.12.2`	Aug 31, 2026	`CVE-2026-81287`	Patchstack
5.4 Medium	MapSVG Plugin `mapsvg-lite-interactive-vector-maps`	Server-Side Request Forgery No login needed	`≤ 8.15.0`	Aug 31, 2026	`CVE-2026-82852`	Patchstack
6.5 Medium	Print Barcode Labels for your WooCommerce products/orders Plugin `a4-barcode-generator`	Information Disclosure Sensitive Data Exposure	`≤ 4.0.0` Fixed in `4.0.1`	Aug 31, 2026	`CVE-2026-81280`	Patchstack
7.5 High	Keep Backup Daily Plugin `keep-backup-daily`	Information Disclosure Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process No login needed	`< 2.1.4` Fixed in `2.1.4`	Aug 31, 2026	`CVE-2026-75133`	VulnCheck
8.1 High	ProfilePress Plugin `wp-user-avatar`	Remote Code Execution ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE No login needed	`< 4.17.2` Fixed in `4.17.2`	Aug 31, 2026	`CVE-2026-66047`	VulnCheck
10.0 Critical	WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin `gdpr-cookie-consent`	Arbitrary File Upload No login needed	`≤ 4.4.1` Fixed in `4.4.2`	Aug 31, 2026	`CVE-2026-82970`	Patchstack
5.3 Medium	bbPress Plugin `bbpress`	Broken Access Control No login needed	`≤ 2.6.14`	Aug 31, 2026	`CVE-2026-74010`	Patchstack
5.3 Medium	Forminator Plugin `forminator`	Other Other vulnerability Type No login needed	`≤ 1.57.1` Fixed in `1.57.2`	Aug 28, 2026	`CVE-2026-82220`	Patchstack
7.5 High	Simple Payment Plugin `simple-payment`	Broken Access Control No login needed	`≤ 2.5.2` Fixed in `2.5.3`	Aug 28, 2026	`CVE-2026-81767`	Patchstack
4.3 Medium	WpEvently Plugin `mage-eventpress`	Broken Access Control	`≤ 5.5.0` Fixed in `5.6.0`	Aug 28, 2026	`CVE-2026-81761`	Patchstack
7.1 High	JetEngine Plugin `jet-engine`	Cross-Site Scripting No login needed	`≤ 3.8.14.2` Fixed in `3.8.14.3`	Aug 28, 2026	`CVE-2026-81760`	Patchstack
5.4 Medium	WpEvently Plugin `mage-eventpress`	Broken Access Control	`≤ 5.5.0` Fixed in `5.6.0`	Aug 28, 2026	`CVE-2026-81759`	Patchstack
7.2 High	Rank Math SEO Plugin `seo-by-rank-math`	Remote Code Execution	`≤ 1.0.276` Fixed in `1.0.277`	Aug 28, 2026	`CVE-2026-81757`	Patchstack
4.3 Medium	WP Job Portal Plugin `wp-job-portal`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 2.5.9` Fixed in `2.6.0`	Aug 28, 2026	`CVE-2026-81299`	Patchstack
7.5 High	Smush Image Compression and Optimization Plugin `wp-smushit`	Denial of Service Denial of Service Attack No login needed	`≤ 4.2.0` Fixed in `4.3.0`	Aug 28, 2026	`CVE-2026-81285`	Patchstack
8.5 High	WPBulky Plugin `wpbulky-wp-bulk-edit-post-types`	SQL Injection	`≤ 1.2.2` Fixed in `1.2.3`	Aug 28, 2026	`CVE-2026-82227`	Patchstack
4.3 Medium	ACF Extended Plugin `acf-extended`	Broken Access Control	`≤ 0.9.2.6` Fixed in `0.9.2.7`	Aug 28, 2026	`CVE-2026-81284`	Patchstack
10.0 Critical	GiveWP Plugin `give`	Remote Code Execution No login needed	`≤ 4.16.7.1` Fixed in `4.16.7.2`	Aug 28, 2026	`CVE-2026-82222`	Patchstack
5.3 Medium	Essential Addons for Elementor Plugin `essential-addons-for-elementor-lite`	Authentication Bypass Bypass vulnerability No login needed	`≤ 6.8.0` Fixed in `6.8.1`	Aug 28, 2026	`CVE-2026-81777`	Patchstack
5.4 Medium	Spiffy Plugin	Cross-Site Scripting WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contribut…	Not stated	Aug 28, 2026	`CVE-2026-39071`	mitre
4.8 Medium	Bit Assist Plugin	Cross-Site Scripting WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exp…	Not stated	Aug 28, 2026	`CVE-2026-39070`	mitre
8.5 High	Suggestion Engine for WooCommerce Plugin `woo-suggestion-engine`	SQL Injection	`≤ 2.0.11` Fixed in `2.0.12`	Aug 27, 2026	`CVE-2026-81277`	Patchstack
5.3 Medium	Kali Forms Plugin `kali-forms`	Broken Access Control No login needed	`≤ 2.4.23` Fixed in `2.4.24`	Aug 27, 2026	`CVE-2026-81276`	Patchstack
5.3 Medium	Ditty Plugin `ditty-news-ticker`	Broken Access Control No login needed	`≤ 3.1.67` Fixed in `3.1.69`	Aug 27, 2026	`CVE-2026-81274`	Patchstack
8.1 High	FluentBooking Pro Plugin `fluent-booking-pro`	Cross-Site Request Forgery No login needed	`≤ 2.2.4` Fixed in `2.2.5`	Aug 27, 2026	`CVE-2026-81273`	Patchstack
4.9 Medium	FluentPlayer Pro Plugin `fluent-player-pro`	Broken Access Control	`≤ 1.3.2` Fixed in `1.4.0`	Aug 27, 2026	`CVE-2026-81272`	Patchstack
8.8 High	GeoDirectory Plugin `geodirectory`	Cross-Site Request Forgery No login needed	`≤ 2.8.176` Fixed in `2.8.177`	Aug 27, 2026	`CVE-2026-81271`	Patchstack
7.5 High	SureFeedback Client Site Plugin `projecthuddle-child-site`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.2.12` Fixed in `1.2.13`	Aug 27, 2026	`CVE-2026-80433`	Patchstack
7.1 High	WP w3all phpBB Plugin `wp-w3all-phpbb-integration`	Cross-Site Scripting No login needed	`≤ 3.0.6` Fixed in `3.0.7`	Aug 27, 2026	`CVE-2026-78293`	Patchstack
9.8 Critical	Hash Form Plugin `hash-form`	PHP Object Injection No login needed	`≤ 1.4.1` Fixed in `1.4.2`	Aug 27, 2026	`CVE-2026-78292`	Patchstack
7.1 High	CozyStay Theme `cozystay`	Cross-Site Scripting No login needed	`≤ 1.10.0` Fixed in `1.10.1`	Aug 27, 2026	`CVE-2026-78289`	Patchstack
9.3 Critical	Beautiful Taxonomy Filters Plugin `beautiful-taxonomy-filters`	SQL Injection No login needed	`≤ 2.4.6` Fixed in `2.4.7`	Aug 27, 2026	`CVE-2026-78288`	Patchstack
9.8 Critical	Geo Controller Plugin `cf-geoplugin`	PHP Object Injection No login needed	`≤ 8.9.8` Fixed in `8.9.9`	Aug 27, 2026	`CVE-2026-78286`	Patchstack
8.5 High	Like Button Rating Plugin `likebtn-like-button`	SQL Injection	`≤ 2.6.61` Fixed in `2.6.62`	Aug 27, 2026	`CVE-2026-78285`	Patchstack
7.1 High	Music Player for WooCommerce Plugin `music-player-for-woocommerce`	Cross-Site Scripting No login needed	`≤ 1.8.9` Fixed in `1.9.0`	Aug 27, 2026	`CVE-2026-78283`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.