WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 601–650 of 8,907 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 13 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Flatsome Theme `flatsome`	Broken Access Control	`≤ 3.20.5`	Jul 2, 2026	`CVE-2026-57730`	Patchstack
4.3 Medium	Werkstatt Theme `werkstatt`	Cross-Site Request Forgery No login needed	`≤ 4.7.2`	Jul 2, 2026	`CVE-2026-57690`	Patchstack
4.3 Medium	Werkstatt Theme `werkstatt`	Broken Access Control	`≤ 4.7.2`	Jul 2, 2026	`CVE-2026-57689`	Patchstack
4.3 Medium	Martfury - WooCommerce Marketplace Theme `martfury`	Broken Access Control WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control	`≤ 3.2.8`	Jul 2, 2026	`CVE-2026-57685`	Patchstack
6.5 Medium	TheFox Theme `thefox`	Cross-Site Scripting	`≤ 3.9.70`	Jul 2, 2026	`CVE-2026-57684`	Patchstack
6.4 Medium	GeoDirectory Plugin `geodirectory`	Server-Side Request Forgery	`≤ 2.8.161` Fixed in `2.8.162`	Jul 2, 2026	`CVE-2026-57681`	Patchstack
6.5 Medium	Kirki Plugin `kirki`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 6.0.11` Fixed in `6.0.12`	Jul 2, 2026	`CVE-2026-57680`	Patchstack
6.5 Medium	Advanced Contact form 7 DB Plugin `advanced-cf7-db`	Broken Access Control	`≤ 2.0.9` Fixed in `2.1.0`	Jul 2, 2026	`CVE-2026-57669`	Patchstack
6.5 Medium	Classified Listing Plugin `classified-listing`	Broken Access Control	`≤ 5.4.2` Fixed in `5.4.3`	Jul 2, 2026	`CVE-2026-57355`	Patchstack
6.5 Medium	JetReviews Plugin `jet-reviews`	Cross-Site Scripting	`≤ 3.0.0.1` Fixed in `3.0.0.2`	Jul 2, 2026	`CVE-2026-57354`	Patchstack
6.5 Medium	Link Whisper Premium Plugin `link-whisper-premium`	Broken Access Control	`≤ 2.9.0` Fixed in `2.9.1`	Jul 2, 2026	`CVE-2026-57353`	Patchstack
4.8 Medium	ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce Plugin `woo-alidropship`	Authentication Bypass Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.0 - Broken Authentication No login needed	`≤ 2.2.0` Fixed in `2.2.1`	Jul 2, 2026	`CVE-2026-57352`	Patchstack
6.5 Medium	Hotel Booking Lite Plugin `motopress-hotel-booking-lite`	Information Disclosure Sensitive Data Exposure	`≤ 6.0.3` Fixed in `6.0.4`	Jul 2, 2026	`CVE-2026-57347`	Patchstack
6.5 Medium	ShortPixel Adaptive Images Plugin `shortpixel-adaptive-images`	Cross-Site Scripting	`≤ 3.11.3` Fixed in `3.11.4`	Jul 2, 2026	`CVE-2026-57342`	Patchstack
6.5 Medium	Tax Exempt for WooCommerce Plugin `woocommerce-tax-exempt-plugin`	Path Traversal	`< 1.9.5` Fixed in `1.9.5`	Jul 2, 2026	`CVE-2026-49779`	Patchstack
6.5 Medium	Motors Theme `motors`	Broken Access Control No login needed	`≤ 5.6.80`	Jul 2, 2026	`CVE-2026-27433`	Patchstack
6.5 Medium	Corpkit Theme `corpkit`	Information Disclosure Sensitive Data Exposure	`≤ 1.0.5`	Jul 2, 2026	`CVE-2025-69132`	Patchstack
5.3 Medium	Woostify Sites Library Plugin `woostify-sites-library`	Broken Access Control No login needed	`≤ 1.6.2`	Jul 2, 2026	`CVE-2025-66076`	Patchstack
6.5 Medium	Shortcodes and extra features for Phlox Plugin `auxin-elements`	Cross-Site Scripting	`≤ 2.17.16`	Jul 1, 2026	`CVE-2026-57737`	Patchstack
5.9 Medium	Enable Media Replace Plugin `enable-media-replace`	Cross-Site Scripting	`≤ 4.2.1` Fixed in `4.2.2`	Jul 1, 2026	`CVE-2026-57722`	Patchstack
5.3 Medium	ApplyOnline Plugin `apply-online`	Broken Access Control No login needed	`≤ 2.6.7.6` Fixed in `2.6.8`	Jul 1, 2026	`CVE-2026-57721`	Patchstack
4.3 Medium	ThumbPress Plugin `image-sizes`	Broken Access Control	`≤ 6.3.2` Fixed in `6.3.3`	Jul 1, 2026	`CVE-2026-57720`	Patchstack
5.3 Medium	Webba Booking Plugin `webba-booking-lite`	Broken Access Control No login needed	`≤ 6.4.13` Fixed in `6.4.14`	Jul 1, 2026	`CVE-2026-27409`	Patchstack
5.3 Medium	Woffice Theme `woffice`	Broken Access Control No login needed	`< 5.4.33` Fixed in `5.4.33`	Jul 1, 2026	`CVE-2026-27435`	Patchstack
6.4 Medium	FV Flowplayer Video Player Plugin `fv-wordpress-flowplayer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode	`≤ 7.5.51.7212`	Jul 1, 2026	`CVE-2026-12135`	Wordfence
6.5 Medium	Colissimo Officiel : Méthodes de livraison pour WooCommerce Plugin `colissimo-shipping-methods-for-woocommerce`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 2.9.0` Fixed in `2.10.0`	Jun 29, 2026	`CVE-2026-57341`	Patchstack
6.5 Medium	Japanized For WooCommerce Plugin `woocommerce-for-japan`	Broken Access Control No login needed	`≤ 2.9.12` Fixed in `2.9.13`	Jun 29, 2026	`CVE-2026-57340`	Patchstack
6.6 Medium	Business Directory Plugin `business-directory-plugin`	Broken Access Control No login needed	`≤ 6.4.23` Fixed in `6.4.24`	Jun 29, 2026	`CVE-2026-57339`	Patchstack
6.5 Medium	Ads by WPQuads Plugin `quick-adsense-reloaded`	Broken Access Control	`≤ 3.0.3` Fixed in `3.0.4`	Jun 29, 2026	`CVE-2026-57335`	Patchstack
6.5 Medium	WP User Frontend Plugin `wp-user-frontend`	Broken Access Control No login needed	`≤ 4.3.7` Fixed in `4.3.8`	Jun 29, 2026	`CVE-2026-57334`	Patchstack
6.5 Medium	MasterStudy LMS Plugin `masterstudy-lms-learning-management-system`	Cross-Site Scripting	`≤ 3.7.27` Fixed in `3.7.28`	Jun 29, 2026	`CVE-2026-57330`	Patchstack
6.5 Medium	WooCommerce Designer Pro Plugin `wc-designer-pro`	Cross-Site Scripting	`≤ 1.9.34` Fixed in `1.9.35`	Jun 29, 2026	`CVE-2026-57329`	Patchstack
6.5 Medium	Business Directory Plugin `business-directory-plugin`	Cross-Site Scripting	`≤ 6.4.22` Fixed in `6.4.23`	Jun 29, 2026	`CVE-2026-57328`	Patchstack
6.3 Medium	MainWP Plugin `mainwp`	Broken Access Control	`≤ 6.1.1` Fixed in `6.1.2`	Jun 29, 2026	`CVE-2026-57327`	Patchstack
6.5 Medium	Business Directory Plugin `business-directory-plugin`	Cross-Site Scripting No login needed	`≤ 6.4.22` Fixed in `6.4.23`	Jun 29, 2026	`CVE-2026-57326`	Patchstack
4.3 Medium	Simple User Avatar Plugin `simple-user-avatar`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 4.9` Fixed in `5.0`	Jun 29, 2026	`CVE-2026-57676`	Patchstack
4.8 Medium	Shariff Plugin	Cross-Site Scripting Admin+ Stored Cross-Site Scripting	`≤ 1.0.11`	Jun 27, 2026	`CVE-2026-9677`	WPScan
5.3 Medium	GravityView Plugin `gravityview`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 3.0.0` Fixed in `3.0.1`	Jun 26, 2026	`CVE-2026-57665`	Patchstack
4.3 Medium	Bopo – WooCommerce Product Bundle Builder Plugin `bopo-woo-product-bundle-builder`	Information Disclosure WooCommerce Product Bundle Builder plugin <= 1.1.6 - Sensitive Data Exposure	`≤ 1.1.6` Fixed in `1.2.0`	Jun 26, 2026	`CVE-2026-57664`	Patchstack
5.4 Medium	WPComplete Plugin `wpcomplete`	Broken Access Control	`≤ 2.9.5.5` Fixed in `2.9.5.6`	Jun 26, 2026	`CVE-2026-57661`	Patchstack
5.3 Medium	Booking and Rental Manager Plugin `booking-and-rental-manager-for-woocommerce`	Broken Access Control No login needed	`≤ 2.7.1` Fixed in `2.7.2`	Jun 26, 2026	`CVE-2026-57660`	Patchstack
4.3 Medium	Gmail SMTP Plugin `gmail-smtp`	Cross-Site Request Forgery No login needed	`≤ 1.2.3.19` Fixed in `1.2.3.20`	Jun 26, 2026	`CVE-2026-57657`	Patchstack
5.9 Medium	Hester Core Plugin `hester-core`	Cross-Site Scripting	`≤ 1.1.8` Fixed in `1.1.9`	Jun 26, 2026	`CVE-2026-57656`	Patchstack
6.5 Medium	Affiliates Manager Plugin `affiliates-manager`	Broken Access Control	`≤ 2.9.49` Fixed in `2.9.50`	Jun 26, 2026	`CVE-2026-57654`	Patchstack
5.3 Medium	JS Help Desk Plugin `js-support-ticket`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 3.1.0` Fixed in `3.1.1`	Jun 26, 2026	`CVE-2026-57652`	Patchstack
6.5 Medium	Ghost Kit Plugin `ghostkit`	Cross-Site Scripting	`≤ 3.6.0` Fixed in `3.6.1`	Jun 26, 2026	`CVE-2026-57651`	Patchstack
6.5 Medium	Magazine Blocks Plugin `magazine-blocks`	Cross-Site Scripting	`≤ 1.8.3` Fixed in `1.8.4`	Jun 26, 2026	`CVE-2026-57650`	Patchstack
4.3 Medium	Shoppable Images Lite Plugin `mabel-shoppable-images-lite`	Broken Access Control	`≤ 1.3` Fixed in `1.3.1`	Jun 26, 2026	`CVE-2026-57649`	Patchstack
4.3 Medium	Nelio Content Plugin `nelio-content`	Broken Access Control	`≤ 4.3.4` Fixed in `4.3.5`	Jun 26, 2026	`CVE-2026-57648`	Patchstack
5.4 Medium	Majestic Support Plugin `majestic-support`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 1.1.7` Fixed in `1.1.8`	Jun 26, 2026	`CVE-2026-57646`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.