WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 5,951–6,000 of 29,262 vulnerabilities

Known WordPress vulnerabilities, page 120 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	Forminator Forms Plugin `forminator`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter	`≤ 1.51.1`	May 7, 2026	`CVE-2026-6222`	Wordfence
7.5 High	Gravity Bookings Plugin	SQL Injection Unauthenticated SQL Injection via 'category_id' Parameter No login needed	`≤ 2.5.9`	May 6, 2026	`CVE-2026-1719`	Wordfence
6.4 Medium	LatePoint Plugin `latepoint`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update	`≤ 5.5.0`	May 6, 2026	`CVE-2026-7457`	Wordfence
7.2 High	LatePoint Plugin `latepoint`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter No login needed	`≤ 5.5.0`	May 6, 2026	`CVE-2026-7332`	Wordfence
6.4 Medium	Affiliate Program Suite Plugin `slicewp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode	`≤ 1.2.7`	May 6, 2026	`CVE-2026-6672`	Wordfence
4.9 Medium	Fluent Forms Plugin `fluentform`	Path Traversal Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment	`≤ 6.2.1`	May 6, 2026	`CVE-2026-6344`	Wordfence
4.3 Medium	Ninja Tables Plugin `ninja-tables`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation	`≤ 5.2.6`	May 6, 2026	`CVE-2026-2306`	Wordfence
6.5 Medium	All-in-One WP Migration Unlimited Extension Plugin	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download	`≤ 2.83`	May 6, 2026	`CVE-2026-5753`	Wordfence
5.3 Medium	Mercado Pago payments for WooCommerce Plugin `woocommerce-mercadopago`	Broken Access Control Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure No login needed	`≤ 8.7.11`	May 6, 2026	`CVE-2026-3208`	Wordfence
7.5 High	WeePie Cookie Allow Plugin	SQL Injection Unauthenticated SQL Injection via 'consent' Parameter No login needed	`≤ 3.4.11`	May 5, 2026	`CVE-2026-4304`	Wordfence
8.8 High	Betheme Theme	Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload	`≤ 28.4`	May 5, 2026	`CVE-2026-6261`	Wordfence
6.5 Medium	Betheme Theme	Arbitrary File Deletion Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload'	`≤ 28.4`	May 5, 2026	`CVE-2026-6262`	Wordfence
7.5 High	WordPress Plugin Backup Migration Plugin	Information Disclosure WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download No login needed	`1.2.8`	May 5, 2026	`CVE-2023-54346`	VulnCheck
4.3 Medium	User Registration & Membership Plugin `user-registration`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification	`≤ 5.1.4`	May 5, 2026	`CVE-2026-3601`	Wordfence
7.5 High	Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Plugin `form-maker`	SQL Injection Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs' No login needed	`≤ 1.15.42`	May 5, 2026	`CVE-2026-3359`	Wordfence
9.3 Critical	WebinarIgnition Plugin `webinar-ignition`	SQL Injection No login needed	`≤ 4.08.253`	May 5, 2026	`CVE-2026-40797`	Patchstack
7.5 High	Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin `forminator`	Path Traversal Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' No login needed	`≤ 1.52.1`	May 5, 2026	`CVE-2026-5192`	Wordfence
5.3 Medium	Forminator – Contact Form, Payment Form & Custom Form Builder Plugin `forminator`	Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter No login needed	`≤ 1.52.0`	May 5, 2026	`CVE-2026-2729`	Wordfence
6.5 Medium	GenerateBlocks Plugin `generateblocks`	Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements	`≤ 2.2.0`	May 5, 2026	`CVE-2026-3454`	Wordfence
6.5 Medium	ElementsKit Elementor Addons Plugin `elementskit-lite`	Broken Access Control Missing Authorization to Unauthenticated Widget Content Overwrite No login needed	`≤ 3.8.2`	May 5, 2026	`CVE-2026-4362`	Wordfence
6.4 Medium	Royal Addons for Elementor Plugin `royal-elementor-addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter	`≤ 1.7.1056`	May 5, 2026	`CVE-2026-5159`	Wordfence
6.4 Medium	WP Carousel Free Plugin `wp-carousel-free`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute	`≤ 2.7.10`	May 5, 2026	`CVE-2026-4665`	Wordfence
6.5 Medium	EmailKit Plugin `emailkit`	Path Traversal Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter	`≤ 1.6.5`	May 5, 2026	`CVE-2026-5957`	Wordfence
7.2 High	Royal Addons for Elementor Plugin `royal-elementor-addons`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta No login needed	`≤ 1.7.1056`	May 5, 2026	`CVE-2026-4803`	Wordfence
9.8 Critical	GeekyBot Plugin `geeky-bot`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action No login needed	`≤ 1.2.2`	May 5, 2026	`CVE-2026-5294`	Wordfence
6.4 Medium	Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem Plugin `gutenverse`	Server-Side Request Forgery Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'	`≤ 3.5.3`	May 5, 2026	`CVE-2026-2948`	Wordfence
7.5 High	GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation Plugin `geeky-bot`	SQL Injection Unauthenticated SQL Injection via 'attributekey' No login needed	`≤ 1.2.0`	May 5, 2026	`CVE-2026-3456`	Wordfence
4.9 Medium	Loco Translate Plugin `loco-translate`	Path Traversal Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter	`≤ 2.8.2`	May 5, 2026	`CVE-2026-1921`	Wordfence
6.1 Medium	Blog Settings Plugin `blog-settings`	Cross-Site Scripting Reflected Cross-Site Scripting via 'page' Parameter No login needed	`≤ 1.0`	May 5, 2026	`CVE-2026-6704`	Wordfence
6.4 Medium	Simple Owl Shortcodes Plugin `simple-owl-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute	`≤ 2.1.1`	May 5, 2026	`CVE-2026-6255`	Wordfence
6.4 Medium	WP-Clippy Plugin `wp-clippy`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.0`	May 5, 2026	`CVE-2026-5505`	Wordfence
6.1 Medium	Publish 2 Ping.fm Plugin `publish-2-pingfm`	Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter No login needed	`≤ 1.1`	May 5, 2026	`CVE-2026-6702`	Wordfence
6.4 Medium	Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem Plugin `gutenverse`	Cross-Site Scripting Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG'	`≤ 3.5.3`	May 5, 2026	`CVE-2026-2868`	Wordfence
4.3 Medium	DX Sources Plugin `dx-sources`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed	`≤ 2.0.1`	May 5, 2026	`CVE-2026-6700`	Wordfence
5.5 Medium	Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories Plugin `post-expirator`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute	`≤ 4.10.0`	May 5, 2026	`CVE-2026-5247`	Wordfence
7.5 High	AWP Classifieds Plugin `another-wordpress-classifieds-plugin`	SQL Injection Unauthenticated SQL Injection via 'regions' No login needed	`≤ 4.4.5`	May 5, 2026	`CVE-2026-5100`	Wordfence
6.5 Medium	Subscribe To Comments Reloaded Plugin `subscribe-to-comments-reloaded`	Broken Access Control Improper Authorization to Unauthenticated Arbitrary Subscription Management No login needed	`≤ 240119`	May 5, 2026	`CVE-2026-4409`	Wordfence
9.8 Critical	Mentoring Plugin	Privilege Escalation Unauthenticated Privilege Escalation in mentoring_process_registration No login needed	`≤ 1.2.8`	May 5, 2026	`CVE-2025-13618`	Wordfence
4.3 Medium	addfreespace Plugin `addfreespace`	Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page No login needed	`≤ 0.1.3`	May 5, 2026	`CVE-2026-6701`	Wordfence
6.1 Medium	Zingaya Click-to-Call Plugin `zingaya-click-to-call`	Cross-Site Scripting Reflected Cross-Site Scripting via 'email' Parameter No login needed	`≤ 1.0`	May 5, 2026	`CVE-2026-6696`	Wordfence
6.4 Medium	Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website Plugin `charts-ninja-graphs-and-charts`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute	`≤ 2.1.0`	May 5, 2026	`CVE-2026-4730`	Wordfence
9.8 Critical	MoreConvert Pro Plugin `smart-wishlist-for-more-convert`	Authentication Bypass Authentication Bypass via Waitlist Guest Verification Token Reuse No login needed	`≤ 1.9.14`	May 5, 2026	`CVE-2026-5722`	Wordfence
7.5 High	Conditional Fields for Contact Form 7 Plugin `cf7-conditional-fields`	Denial of Service Conditional Fields for Contact Form 7 < 2.7.3 DoS via Uncontrolled Resource Consumption No login needed	`< 2.7.3` Fixed in `2.7.3`	May 4, 2026	`CVE-2026-25863`	VulnCheck
7.5 High	easy-paypal-events-tickets Plugin `easy-paypal-events-tickets`	Information Disclosure Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint No login needed	`< 1.4.0` Fixed in `1.4.0`	May 4, 2026	`CVE-2026-41471`	VulnCheck
7.5 High	easy-paypal-events-tickets Plugin `easy-paypal-events-tickets`	Authentication Bypass Easy PayPal Events & Tickets < 1.4 Authentication Bypass via QR Code Scanning No login needed	`< 1.4.0` Fixed in `1.4.0`	May 4, 2026	`CVE-2026-32834`	VulnCheck
5.3 Medium	Magic Export & Import Plugin `magic-export-import`	Information Disclosure Unauthenticated PII Disclosure No login needed	`< 1.2.0` Fixed in `1.2.0`	May 4, 2026	`CVE-2026-5335`	WPScan
6.5 Medium	Frontend File Manager Plugin	Broken Access Control Subscriber+ Arbitrary Download Access via IDOR	`≤ 23.6`	May 3, 2026	`CVE-2026-5337`	WPScan
7.2 High	NEX-Forms Plugin `nex-forms-express-wp-form-builder`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names No login needed	`≤ 9.1.11`	May 3, 2026	`CVE-2026-5063`	Wordfence
6.4 Medium	NextMove Lite - Thank You Page for WooCommerce Plugin `woo-thank-you-page-nextmove-lite`	Cross-Site Scripting Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode	`≤ 2.23.0`	May 2, 2026	`CVE-2026-0703`	Wordfence
5.3 Medium	Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Plugin `dokan-lite`	Information Disclosure Unauthenticated Information Disclosure in Store Reviews REST API Endpoint No login needed	`≤ 4.3.1`	May 2, 2026	`CVE-2026-3504`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.