WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 651–700 of 30,513 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | WP Data Access | Information Disclosure Unauthenticated Sensitive Data Disclosure via Table Export No login needed |
< 5.5.84 Fixed in 5.5.84 |
CVE-2026-106099 |
WPScan | |
| 5.3 Medium | WP Data Access | Broken Access Control Unauthenticated Incorrect Authorization via Inline App Update No login needed |
< 5.5.77 Fixed in 5.5.77 |
CVE-2026-106098 |
WPScan | |
| 5.3 Medium | CamPay Shortcode Payment Gateway | Broken Access Control Unauthenticated Payment Status Forgery via external_reference No login needed |
< 1.7 Fixed in 1.7 |
CVE-2026-105975 |
WPScan | |
| 5.3 Medium | CodeAtoz B2B Suite for WooCommerce | Information Disclosure Unauthenticated Guest Quote Disclosure No login needed |
< 1.6.1 Fixed in 1.6.1 |
CVE-2026-105969 |
WPScan | |
| 6.8 Medium | PublishPress Future | Cross-Site Scripting Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes |
4.10.1 – < 4.10.6 Fixed in 4.10.6 |
CVE-2026-105261 |
WPScan | |
| 5.3 Medium | Rank Math SEO | Broken Access Control Unauthenticated SEO Analyzer Results Deletion No login needed |
< 1.0.280 Fixed in 1.0.280 |
CVE-2026-104751 |
WPScan | |
| 6.8 Medium | Image Photo Gallery Final Tiles Grid | Cross-Site Scripting Contributor+ Stored XSS via Gallery Configuration Update |
< 3.6.15 Fixed in 3.6.15 |
CVE-2026-104644 |
WPScan | |
| 8.6 High | Walletdoc Payment Gateway for WooCommerce | SQL Injection Unauthenticated SQLi and Order Payment Forgery via Webhook No login needed |
< 1.8.5 Fixed in 1.8.5 |
CVE-2026-103307 |
WPScan | |
| 6.4 Medium | Social Share Buttons & Analytics | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX |
≤ 4.5 |
CVE-2026-103369 |
Wordfence | |
| 6.5 Medium | Hyyan WooCommerce Polylang Integration | SQL Injection Authenticated (Subscriber+) SQL Injection via 'variation_ids' Parameter |
≤ 1.5.0 |
CVE-2026-101926 |
Wordfence | |
| 7.2 High | NewStatPress | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String No login needed |
≤ 1.4.5 |
CVE-2026-101924 |
Wordfence | |
| 7.2 High | NewStatPress | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field) No login needed |
≤ 1.4.5 |
CVE-2026-100153 |
Wordfence | |
| 5.3 Medium | Avada (Fusion) Builder | Information Disclosure Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token No login needed |
≤ 3.16.1 |
CVE-2026-97471 |
Wordfence | |
| 7.2 High | FV Flowplayer Video Player | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute No login needed |
≤ 7.5.54.7212 |
CVE-2026-97398 |
Wordfence | |
| 9.8 Critical | JTL-Connector for WooCommerce | Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'image.push' Method No login needed |
≤ 2.4.3 |
CVE-2026-87855 |
Wordfence | |
| 6.4 Medium | Directorist: AI-Powered Business Directory, Listings & Classified Ads | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field |
≤ 8.10.2.1 Fixed in 8.10.3 |
CVE-2026-100185 |
Wordfence | |
| 7.5 High | Form Maker by 10Web | SQL Injection Unauthenticated SQL Injection via 'inputs' Parameter No login needed |
≤ 1.15.48 Fixed in 1.15.49 |
CVE-2026-95808 |
Wordfence | |
| 7.2 High | Contact Form DB for Enfold | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values No login needed |
≤ 2.0.2 |
CVE-2026-83592 |
Wordfence | |
| 7.2 High | Smart Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter No login needed |
≤ 2.6.104 |
CVE-2026-95816 |
Wordfence | |
| 7.5 High | JTL-Connector for WooCommerce | SQL Injection Unauthenticated SQL Injection No login needed |
≤ 2.4.3 |
CVE-2026-78193 |
Wordfence | |
| 6.4 Medium | PO/MO Editor | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter |
≤ 1.4.2 |
CVE-2026-97020 |
Wordfence | |
| 7.2 High | Verified Reviews (Avis Vérifiés) | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire) No login needed |
≤ 2.4.6 |
CVE-2026-94377 |
Wordfence | |
| 7.2 High | Cryptocurrency Donation Box | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via data_object Parameter No login needed |
≤ 2.2.13 |
CVE-2026-93885 |
Wordfence | |
| 4.7 Medium | Tutor LMS | Cross-Site Scripting Reflected Cross-Site Scripting via 'tab' Parameter No login needed |
≤ 4.1.0 Fixed in 4.1.1 |
CVE-2026-100193 |
Wordfence | |
| 7.2 High | Document Gallery | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 5.1.1 |
CVE-2026-77114 |
Wordfence | |
| 6.4 Medium | Countdown Timer – Widget Countdown | Cross-Site Scripting Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute |
3.0.0 – 3.0.1 |
CVE-2026-16495 |
Wordfence | |
| 9.8 Critical | AGE-GATE | Remote Code Execution Unauthenticated Remote Code Execution via PHP Code Injection via 'width'/'height' Parameters to Standalone admin.php No login needed |
≤ 1.0 |
CVE-2026-104800 |
Wordfence | |
| 7.5 High | Gmedia Photo Gallery | SQL Injection Unauthenticated SQL Injection via 'gmedia__in' Parameter No login needed |
≤ 1.25.1 |
CVE-2026-96661 |
Wordfence | |
| 6.4 Medium | FV Player 8 | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute |
≤ 8.1.7 |
CVE-2026-95807 |
Wordfence | |
| 7.2 High | AnyComment | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'email' Parameter No login needed |
≤ 0.3.6 |
CVE-2026-103422 |
Wordfence | |
| 7.5 High | Abandoned Cart Pro for WooCommerce | SQL Injection Unauthenticated SQL Injection via AES-CTR Ciphertext Forgery in 'validate' Parameter No login needed |
≤ 10.8.0 |
CVE-2026-102251 |
Wordfence | |
| 9.8 Critical | Abandoned Cart Pro for WooCommerce | Authentication Bypass Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter No login needed |
≤ 10.8.0 |
CVE-2026-97657 |
Wordfence | |
| 9.8 Critical | Snazzy Social Media Feed | Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter No login needed |
≤ 2.5 |
CVE-2026-110002 |
Wordfence | |
| 9.8 Critical | Abandoned Cart Pro for WooCommerce | SQL Injection Unauthenticated SQL Injection via Guest Persistent Cart meta_value No login needed |
≤ 10.8.0 |
CVE-2026-97668 |
Wordfence | |
| 8.1 High | BP Profile Search | Local File Inclusion Unauthenticated Local File Inclusion to Remote Code Execution via 'bps_directory' Cookie 'ajax_template' Value No login needed |
≤ 5.9 Fixed in 6.0 |
CVE-2026-104995 |
Wordfence | |
| 9.1 Critical | Click to Chat | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via REQUEST_URI via {url} Placeholder No login needed |
≤ 4.44 Fixed in 4.45 |
CVE-2026-92097 |
Wordfence | |
| 8.1 High | Directorist: AI-Powered Business Directory, Listings & Classified Ads | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter |
≤ 8.10.2.1 Fixed in 8.10.3 |
CVE-2026-17092 |
Wordfence | |
| 5.3 Medium | Database Addon for Contact Form 7 | Arbitrary File Deletion Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field No login needed |
≤ 1.4.1 Fixed in 1.4.2 |
CVE-2026-107652 |
Wordfence | |
| 7.5 High | Membership & User Roles for WooCommerce (Automatic Role Changer) | Privilege Escalation Authenticated (Subscriber+) Privilege Escalation to Stale Foreign Role Cache |
≤ 20260828 Fixed in 20261007 |
CVE-2026-104767 |
Wordfence | |
| 7.5 High | Bit integrations | Privilege Escalation Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data No login needed |
≤ 2.10.6 Fixed in 2.10.7 |
CVE-2026-104749 |
Wordfence | |
| 6.4 Medium | Booking Package | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
≤ 1.7.29 Fixed in 1.7.30 |
CVE-2026-103425 |
Wordfence | |
| 9.8 Critical | Printcart Store - Web to Print Product Designer for WooCommerce (PCDesigner) | Arbitrary File Upload Web to Print Product Designer for WooCommerce (PCDesigner) <= 2.9.1 - Unauthenticated Arbitrary File Upload to Remote Code Execution via nbdesigner_copy_image_from_url No login needed |
≤ 2.9.1 Fixed in 2.9.2 |
CVE-2026-93388 |
Wordfence | |
| 7.5 High | Booking Package | Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0' No login needed |
≤ 1.7.29 Fixed in 1.7.30 |
CVE-2026-103423 |
Wordfence | |
| 5.3 Medium | WP Event Solution | Broken Access Control No login needed |
≤ 4.1.25 Fixed in 4.1.26 |
CVE-2026-109898 |
Patchstack | |
| 4.3 Medium | Download Monitor integration for WooCommerce | Broken Access Control |
≤ 1.0.3 Fixed in 1.0.4 |
CVE-2026-109896 |
Patchstack | |
| 5.3 Medium | Premium Addons for Elementor | Broken Access Control No login needed |
≤ 4.11.110 Fixed in 4.11.111 |
CVE-2026-109890 |
Patchstack | |
| 5.4 Medium | User Registration | Broken Access Control |
≤ 5.2.8 Fixed in 5.3.0 |
CVE-2026-109699 |
Patchstack | |
| 6.5 Medium | Books Gallery | Cross-Site Scripting |
≤ 4.8.4 Fixed in 4.8.5 |
CVE-2026-108487 |
Patchstack | |
| 5.3 Medium | User Registration | Information Disclosure Sensitive Data Exposure No login needed |
≤ 5.2.8 Fixed in 5.3.0 |
CVE-2026-106598 |
Patchstack | |
| 7.6 High | Link Whisper Free | SQL Injection |
≤ 0.9.7 Fixed in 0.9.8 |
CVE-2026-109687 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.