WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 701–750 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 15 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Premium Packages Plugin wpdm-premium-packages Authentication Bypass Unauthenticated PayPal Webhook Signature Verification Bypass No login needed 7.0.0 – < 7.2.1 Fixed in 7.2.1 CVE-2026-93511 WPScan
4.3 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points < 2.10.4 Fixed in 2.10.4 CVE-2026-93510 WPScan
8.1 High WC Fields Factory Plugin wc-fields-factory Broken Access Control Subscriber+ Arbitrary Post Meta Manipulation via AJAX < 4.1.11 Fixed in 4.1.11 CVE-2026-93508 WPScan
3.3 Low WC Fields Factory Plugin wc-fields-factory Information Disclosure Contributor+ Arbitrary Post Cloning and Private Content Disclosure < 4.1.11 Fixed in 4.1.11 CVE-2026-93507 WPScan
2.7 Low Event Booking Manager for WooCommerce Plugin mage-eventpress Information Disclosure Contributor+ Unpublished Event Disclosure via mpwem_load_event_list 5.3.6 – < 5.7.3 Fixed in 5.7.3 CVE-2026-91077 WPScan
6.8 Medium Subscribe Forms Plugin wp-subscribe-form Cross-Site Scripting Author+ Stored XSS via Attention Effect Form Setting 1.4.1 – < 1.6.3 Fixed in 1.6.3 CVE-2026-91073 WPScan
4.3 Medium Booking Manager Plugin booking-manager Broken Access Control Subscriber+ Arbitrary User Plugin Meta Modification via IDOR < 2.1.21 Fixed in 2.1.21 CVE-2026-91025 WPScan
6.8 Medium Booking Manager Plugin booking-manager SQL Injection Author+ SQLi via ICS Import Feed UID (sync_gid) < 2.1.21 Fixed in 2.1.21 CVE-2026-91024 WPScan
5.3 Medium WPC Smart Compare for WooCommerce Plugin woo-smart-compare Information Disclosure Unauthenticated Password-Protected Product Description Disclosure via woosc_load No login needed < 6.6.1 Fixed in 6.6.1 CVE-2026-90985 WPScan
3.7 Low Paid Member Subscriptions Plugin Broken Access Control Unauthenticated In-Flight Checkout State Deletion via pms_process_payment No login needed < 3.1.0 Fixed in 3.1.0 CVE-2026-90951 WPScan
5.3 Medium FluentBoards Plugin fluent-boards Information Disclosure Unauthenticated Board Member Email Address Disclosure via Public Board Endpoints No login needed 1.95 – < 2.1.0 Fixed in 2.1.0 CVE-2026-89331 WPScan
6.8 Medium JSM Show Post Metadata Plugin jsm-show-post-meta Cross-Site Scripting Contributor+ Stored XSS via Custom Field Meta Key < 4.9.1 Fixed in 4.9.1 CVE-2026-88997 WPScan
5.3 Medium Sale Booster Plugin Information Disclosure Unauthenticated Non-Public Product Disclosure No login needed 7.0.0 – < 7.5.2 Fixed in 7.5.2 CVE-2026-88929 WPScan
4.7 Medium Paymob for WooCommerce Plugin paymob-for-woocommerce Broken Access Control Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions < 4.1.14 Fixed in 4.1.14 CVE-2026-87981 WPScan
5.3 Medium Paymob for WooCommerce Plugin paymob-for-woocommerce Broken Access Control Unauthenticated Saved Card Token Write to Any User via Webhook No login needed < 4.1.14 Fixed in 4.1.14 CVE-2026-87979 WPScan
3.7 Low Forminator Forms Plugin forminator Broken Access Control Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link No login needed 1.17.1 – < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87074 WPScan
3.1 Low Forminator Forms Plugin forminator Broken Access Control Subscriber+ Form Stripe Field Migration via migrate_stripe 1.38.1 – < 1.57.2.1 Fixed in 1.57.2.1 CVE-2026-87069 WPScan
6.8 Medium Real3D Flipbook Lite Plugin Cross-Site Scripting Author+ Content Deletion and Stored XSS via Global Settings Overwrite < 5.4 Fixed in 5.4 CVE-2026-86842 WPScan
5.3 Medium PostX Plugin Information Disclosure Unauthenticated Custom Field Key Disclosure via REST API No login needed < 5.0.41 Fixed in 5.0.41 CVE-2026-86783 WPScan
8.2 High WP Recipe Maker Plugin wp-recipe-maker Denial of Service Unauthenticated DoS via Unbounded User Meta Insertion No login needed 9.8.0 – < 10.8.2 Fixed in 10.8.2 CVE-2026-86608 WPScan
4.3 Medium WP Recipe Maker Plugin wp-recipe-maker Information Disclosure Subscriber+ Non-Public List Title Disclosure via wprm_search_lists < 10.8.2 Fixed in 10.8.2 CVE-2026-86603 WPScan
4.3 Medium WP Recipe Maker Plugin wp-recipe-maker Information Disclosure Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview 10.3.0 – < 10.8.2 Fixed in 10.8.2 CVE-2026-86602 WPScan
6.8 Medium Happy Addons for Elementor Plugin Cross-Site Scripting Contributor+ Stored XSS via Creative Button Widget < 3.50.0 Fixed in 3.50.0 CVE-2026-85006 WPScan
3.8 Low The Events Calendar Plugin the-events-calendar Broken Access Control Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes 6.15.16.1 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84743 WPScan
2.7 Low The Events Calendar Plugin the-events-calendar Broken Access Control Contributor+ Content Publication via TEC V1 REST API 6.15.0 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84742 WPScan
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Unauthenticated Non-Public Venue and Organizer Disclosure via REST API No login needed 4.5 – < 6.17.5 Fixed in 6.17.5 CVE-2026-84741 WPScan
5.3 Medium Easy Hide Login Plugin easy-hide-login Information Disclosure Login Page Protection Bypass / Hidden URL Disclosure No login needed < 1.7 Fixed in 1.7 CVE-2026-84168 WPScan
5.4 Medium Directorist Plugin directorist-wpml-integration Broken Access Control Subscriber+ Cross-User Favorites Read and Write via REST Favorites Endpoint < 8.9.5 Fixed in 8.9.5 CVE-2026-84150 WPScan
6.5 Medium Directorist Plugin directorist-wpml-integration Broken Access Control Subscriber+ Arbitrary Listing Deletion via remove_listing 3.1.0 – < 8.9.5 Fixed in 8.9.5 CVE-2026-84098 WPScan
5.0 Medium Directorist Plugin directorist-wpml-integration Server-Side Request Forgery Subscriber+ SSRF via Avatar URL < 8.9.5 Fixed in 8.9.5 CVE-2026-84046 WPScan
4.3 Medium Directorist Plugin directorist-wpml-integration Broken Access Control Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint 8.9.1 – < 8.9.5 Fixed in 8.9.5 CVE-2026-84027 WPScan
5.3 Medium Directorist Plugin directorist-wpml-integration Information Disclosure Unauthenticated Sensitive Data Disclosure via REST Users Endpoint No login needed 8.1 – < 8.9.5 Fixed in 8.9.5 CVE-2026-84026 WPScan
5.3 Medium Email Subscribers by Icegram Express Plugin Broken Access Control Unauthenticated Subscription Status Change via Missing Token Verification No login needed < 5.9.35 Fixed in 5.9.35 CVE-2026-83555 WPScan
9.0 Critical WP OAuth Server Plugin Privilege Escalation Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution < 6.4.0 Fixed in 6.4.0 CVE-2026-82843 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Quiz Attempt Grade Disclosure via IDOR < 3.7.50 Fixed in 3.7.50 CVE-2026-81339 WPScan
4.6 Medium MasterStudy LMS Plugin Content Injection Subscriber+ Stored HTML Injection via Course Discussions < 3.7.50 Fixed in 3.7.50 CVE-2026-81338 WPScan
6.5 Medium Payment Plugins for PayPal WooCommerce Plugin pymntpl-paypal-woocommerce Broken Access Control Unauthenticated Payment Hijacking via Unvalidated PayPal Order ID No login needed < 2.0.27 Fixed in 2.0.27 CVE-2026-80342 WPScan
4.3 Medium Directorist Plugin directorist-wpml-integration Information Disclosure Subscriber+ Order and Financial Record Disclosure via REST Orders Endpoint 8.5 – < 8.9.5 Fixed in 8.9.5 CVE-2026-77766 WPScan
5.3 Medium Better Payment Plugin better-payment Price Manipulation Unauthenticated Payment Amount Manipulation No login needed < 2.3.4 Fixed in 2.3.4 CVE-2026-77765 WPScan
9.0 Critical YAHMAN Add-ons Plugin yahman-add-ons Arbitrary File Upload Unauthenticated Arbitrary File Upload via Blog Card Cache No login needed < 0.9.31 Fixed in 0.9.31 CVE-2026-75799 WPScan
4.3 Medium Zportals Plugin Information Disclosure Subscriber+ User Email Disclosure < 6.4.2 Fixed in 6.4.2 CVE-2026-18365 WPScan
4.3 Medium Zportals Plugin Broken Access Control Subscriber+ Arbitrary Plugin Settings Update < 6.4.2 Fixed in 6.4.2 CVE-2026-18364 WPScan
6.5 Medium Newsletters Plugin newsletters-lite Information Disclosure Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR No login needed < 4.18.1 Fixed in 4.18.1 CVE-2026-16264 WPScan
8.2 High Divi Dash Plugin Denial of Service Unauthenticated Denial of Service via IP Address Spoofing No login needed < 1.0.7 Fixed in 1.0.7 CVE-2026-14321 WPScan
6.8 Medium Real3D Flipbook Lite Plugin Cross-Site Scripting Author+ Stored XSS < 5.4 Fixed in 5.4 CVE-2025-15696 WPScan
8.6 High JetFormBuilder Stripe Gateway Plugin SQL Injection Unauthenticated Blind SQLi via Payment Token No login needed < 1.1.0 Fixed in 1.1.0 CVE-2022-4997 WPScan
5.3 Medium Social Commerce for WooCommerce Plugin Broken Access Control Unauthenticated Plugin Option and Product Sync Status Update No login needed ≤ 2.5.4 CVE-2026-86785 WPScan
6.5 Medium MarketKing Plugin marketking-multivendor-marketplace-for-woocommerce Broken Access Control MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX < 2.1.72 Fixed in 2.1.72 CVE-2026-93344 VulnCheck
6.5 Medium MarketKing Plugin marketking-multivendor-marketplace-for-woocommerce Broken Access Control MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax < 2.1.72 Fixed in 2.1.72 CVE-2026-93343 VulnCheck
5.4 Medium MarketKing Plugin marketking-multivendor-marketplace-for-woocommerce Broken Access Control MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX < 2.1.72 Fixed in 2.1.72 CVE-2026-93342 VulnCheck

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only