WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 6,551–6,600 of 29,262 vulnerabilities

Known WordPress vulnerabilities, page 132 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Simple Shopping Cart Plugin wordpress-simple-paypal-shopping-cart Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode ≤ 5.2.4 CVE-2026-0552 Wordfence
6.4 Medium Xpro Addons — 140+ Widgets for Elementor Plugin xpro-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.20 CVE-2025-13368 Wordfence
6.4 Medium Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode ≤ 7.4.8 CVE-2026-0738 Wordfence
6.4 Medium Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode ≤ 7.4.7 CVE-2026-0737 Wordfence
6.4 Medium ElementsKit Elementor Addons and Templates Plugin elementskit-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget ≤ 3.7.9 CVE-2026-2600 Wordfence
6.4 Medium Royal Elementor Addons Plugin royal-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via REST API Meta Bypass ≤ 1.7.1049 CVE-2026-0664 Wordfence
6.4 Medium Ultimate Member Plugin ultimate-member Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets ≤ 2.11.1 CVE-2025-15064 Wordfence
6.4 Medium Xpro Addons — 140+ Widgets for Elementor Plugin xpro-elementor-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Box Widget ≤ 1.4.24 CVE-2026-2949 Wordfence
6.4 Medium Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem Plugin gutenverse Cross-Site Scripting Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' ≤ 3.4.6 CVE-2026-2924 Wordfence
6.5 Medium Pie Register – User Registration, Profiles & Content Restriction Plugin pie-register Broken Access Control User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modification No login needed ≤ 3.8.4.8 CVE-2026-3571 Wordfence
8.1 High Perfmatters Plugin Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter ≤ 2.5.9.1 CVE-2026-4350 Wordfence
6.5 Medium MSTW League Manager Plugin mstw-league-manager Cross-Site Scripting ≤ 2.10 CVE-2026-34890 Patchstack
7.5 High W3 Total Cache Plugin w3-total-cache Information Disclosure Unauthenticated Security Token Exposure via User-Agent Header No login needed ≤ 2.9.3 CVE-2026-5032 Wordfence
7.2 High Webmention Plugin webmention Server-Side Request Forgery Unauthenticated Blind Server-Side Request Forgery No login needed ≤ 5.6.2 CVE-2026-0686 Wordfence
6.4 Medium Webmention Plugin webmention Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery ≤ 5.6.2 CVE-2026-0688 Wordfence
7.2 High Spam Protect for Contact Form 7 Plugin wp-contact-form-7-spam-blocker Remote Code Execution Editor+ Remote Code Execution < 1.2.10 Fixed in 1.2.10 CVE-2026-1540 WPScan
8.1 High MW WP Form Plugin mw-wp-form Remote Code Execution Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir No login needed ≤ 5.1.0 CVE-2026-4347 Wordfence
6.4 Medium King Addons for Elementor Plugin king-addons Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets ≤ 51.1.53 CVE-2025-13535 Wordfence
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting < 3.21.4 Fixed in 3.21.4 CVE-2026-34889 Patchstack
5.3 Medium Export All URLs Plugin export-all-urls Information Disclosure Unauthenticated Sensitive Data Exposure No login needed < 5.1 Fixed in 5.1 CVE-2026-2696 WPScan
9.1 Critical Order Notification for WooCommerce Plugin Authentication Bypass Unauthenticated WooCommerce REST Permission Bypass No login needed < 3.6.3 Fixed in 3.6.3 CVE-2025-15484 WPScan
4.3 Medium Database for Contact Form 7, WPforms, Elementor forms Plugin contact-form-entries Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode ≤ 1.4.9 CVE-2026-3831 Wordfence
6.5 Medium Amelia Plugin ameliabooking SQL Injection Authenticated (Manager+) SQL Injection via 'sort' Parameter ≤ 2.1.2 CVE-2026-4668 Wordfence
6.4 Medium WP Shortcodes Plugin — Shortcodes Ultimate Plugin shortcodes-ultimate Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute ≤ 7.4.10 CVE-2026-2480 Wordfence
7.2 High Query Monitor Plugin query-monitor Cross-Site Scripting Reflected Cross-Site Scripting via Request URI No login needed ≤ 3.20.3 CVE-2026-4267 Wordfence
5.4 Medium Minify HTML Plugin minify-html-markup Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 2.1.12 CVE-2026-3191 Wordfence
4.3 Medium User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Plugin profile-builder Broken Access Control Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field ≤ 3.15.5 CVE-2026-3139 Wordfence
6.5 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting ≤ 2.7.0 Fixed in 2.7.1 CVE-2026-34887 Patchstack
5.8 Medium Performance Monitor Plugin Server-Side Request Forgery Unauthenticated Blind SSRF No login needed ≤ 1.0.6 CVE-2026-3881 WPScan
6.1 Medium Auto Post Scheduler Plugin auto-post-scheduler Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page No login needed ≤ 1.84 CVE-2026-1877 Wordfence
6.4 Medium Ibtana - WordPress Website Builder Plugin ibtana-visual-editor Cross-Site Scripting WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.2.5.7 CVE-2026-1834 Wordfence
6.1 Medium Loco Translate Plugin loco-translate Cross-Site Scripting Reflected Cross-Site Scripting via 'update_href' Parameter No login needed ≤ 2.8.2 CVE-2026-4146 Wordfence
6.5 Medium WooPayments Plugin woocommerce-payments Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax No login needed ≤ 10.5.1 CVE-2026-1710 Wordfence
5.3 Medium Truebooker - Appointment Booking and Scheduler Plugin truebooker-appointment-booking Information Disclosure Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files No login needed ≤ 1.1.4 CVE-2026-1797 Wordfence
7.5 High Gravity SMTP Plugin gravitysmtp Information Disclosure Unauthenticated Sensitive Information Exposure via REST API No login needed ≤ 2.1.4 CVE-2026-4020 Wordfence
9.8 Critical Everest Forms Pro Plugin everest-forms Remote Code Execution Unauthenticated Remote Code Execution via Calculation Field No login needed ≤ 1.9.12 CVE-2026-3300 Wordfence
8.8 High Debugger & Troubleshooter Plugin debugger-troubleshooter Privilege Escalation Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation ≤ 1.3.2 CVE-2026-5130 Wordfence
9.8 Critical Contact Form by Supsystic Plugin contact-form-by-supsystic Remote Code Execution Unauthenticated Server-Side Template Injection via Prefill Functionality No login needed ≤ 1.7.36 CVE-2026-4257 Wordfence
7.5 High Download Monitor Plugin download-monitor Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary Order Completion via 'token' and 'order_id' No login needed ≤ 5.1.7 CVE-2026-3124 Wordfence
6.4 Medium Twentig Plugin twentig Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'featuredImageSizeWidth' ≤ 1.9.7 CVE-2026-2602 Wordfence
5.4 Medium Quads Ads Manager for Google AdSense Plugin quick-adsense-reloaded Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Ad Metadata Parameters ≤ 2.0.98.1 CVE-2026-2595 Wordfence
5.3 Medium Pagelayer Plugin pagelayer Content Injection Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email' No login needed ≤ 2.0.7 CVE-2026-2442 Wordfence
6.5 Medium Ninja Forms Plugin ninja-forms Information Disclosure Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token ≤ 3.14.1 CVE-2026-1307 Wordfence
5.4 Medium Restaurant Cafeteria Theme Remote Code Execution Subscriber+ Arbitrary Plugin Installation/Activation ≤ 0.4.6 CVE-2025-15445 WPScan
7.2 High Oxygen Theme oxygen Server-Side Request Forgery Unauthenticated Server-Side Request Forgery via route_path No login needed ≤ 6.0.8 CVE-2025-12886 Wordfence
7.5 High SureForms Plugin sureforms Other Unauthenticated Payment Amount Validation Bypass via 'form_id' No login needed ≤ 2.5.2 CVE-2026-4987 Wordfence
8.0 High Ultimate Member Plugin ultimate-member Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag ≤ 2.11.2 CVE-2026-4248 Wordfence
5.4 Medium OpenStreetMap Plugin osm Cross-Site Scripting WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with… prior to 6.1.15 CVE-2026-33559 jpcert
6.5 Medium Smart Slider 3 Plugin smart-slider-3 Path Traversal Authenticated (Subscriber+) Arbitrary File Read via actionExportAll ≤ 3.5.1.33 CVE-2026-3098 Wordfence
4.9 Medium Complianz – GDPR/CCPA Cookie Consent Plugin complianz-gdpr Cross-Site Scripting GDPR/CCPA Cookie Consent <= 7.4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Content Filter ≤ 7.4.4.2 CVE-2026-2389 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only