WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 751–800 of 30,513 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.4 Medium | VideoWhisper Site Manager for ChatGPT, Claude, Codex | Broken Access Control |
≤ 1.2.10 Fixed in 1.2.11 |
CVE-2026-107430 |
Patchstack | |
| 4.3 Medium | Paid Videochat Turnkey Site | Other Other vulnerability Type |
≤ 7.5.12 Fixed in 7.5.13 |
CVE-2026-107429 |
Patchstack | |
| 6.5 Medium | Event post | Broken Access Control Insecure Direct Object References (IDOR) |
≤ 6.1.1 Fixed in 6.1.2 |
CVE-2026-107427 |
Patchstack | |
| 5.3 Medium | Flexible Quantity – Measurement Price Calculator for WooCommerce | Other Measurement Price Calculator for WooCommerce plugin <= 2.3.22 - Other vulnerability Type No login needed |
≤ 2.3.22 Fixed in 2.3.23 |
CVE-2026-106605 |
Patchstack | |
| 6.5 Medium | WP Comment Cleaner | Broken Access Control Subscriber+ Bulk Comment Deletion via nav_delete_all_comment |
6.1 – < 7.2 Fixed in 7.2 |
CVE-2026-107791 |
WPScan | |
| 4.3 Medium | Hotel Booking | Information Disclosure Subscriber+ Booking Order PII Disclosure via IDOR |
≤ 3.8 |
CVE-2026-84167 |
WPScan | |
| 4.3 Medium | Hotel Booking | Cross-Site Request Forgery Booking Order Creation, Deletion, and Modification via CSRF No login needed |
≤ 3.8 |
CVE-2026-84166 |
WPScan | |
| 3.5 Low | WP Job Openings | Cross-Site Scripting Admin+ Stored XSS |
< 4.0.0 Fixed in 4.0.0 |
CVE-2025-15703 |
WPScan | |
| 4.3 Medium | WP-Invoice | Information Disclosure Subscriber+ User PII Disclosure via Unprotected AJAX Handlers |
≤ 4.3.1 |
CVE-2026-97183 |
WPScan | |
| 8.8 High | Piotnet Forms | Cross-Site Scripting Unauthenticated Stored XSS via File Upload No login needed |
≤ 1.0.30 |
CVE-2026-96227 |
WPScan | |
| 4.3 Medium | Veeqo for WooCommerce | Arbitrary File Upload Subscriber+ Arbitrary File Upload via start_veeqo_connection_process |
≤ 2.2.8 |
CVE-2026-93550 |
WPScan | |
| 7.1 High | Subscribe to Comments | Cross-Site Scripting Reflected XSS via 'ref' Parameter No login needed |
< 2.3.3 Fixed in 2.3.3 |
CVE-2026-91829 |
WPScan | |
| 6.5 Medium | Paymendo Bank Transfer | SQL Injection Subscriber+ SQLi via 'orderBy' Parameter |
≤ 1.1 |
CVE-2026-89305 |
WPScan | |
| 6.5 Medium | Paymendo Bank Transfer | SQL Injection Unauthenticated Blind SQLi via 'paymendo_bank_transfer_completed_payment' Parameter No login needed |
≤ 1.1 |
CVE-2026-89304 |
WPScan | |
| 8.6 High | Post Voting System | SQL Injection Unauthenticated SQLi via 'id' Parameter No login needed |
≤ 1.0 |
CVE-2026-89302 |
WPScan | |
| 8.6 High | WP Verify API | SQL Injection Unauthenticated SQLi via 'verify' Parameter No login needed |
≤ 1.0.0 |
CVE-2026-89299 |
WPScan | |
| 8.6 High | Loja Automática | SQL Injection Unauthenticated SQLi via 'id' Parameter No login needed |
≤ 1.0.0 |
CVE-2026-89297 |
WPScan | |
| 8.6 High | ASPL Product Quotation | SQL Injection Unauthenticated SQLi via 'quote_id' Parameter No login needed |
≤ 1.1.0 |
CVE-2026-89287 |
WPScan | |
| 8.6 High | Datalist it | SQL Injection Unauthenticated SQLi via dli_fronted_action No login needed |
≤ 0.0.3 |
CVE-2026-89285 |
WPScan | |
| 8.6 High | WP Posts Password Batch Manager | Broken Access Control Unauthenticated Bulk Post Password Rewrite No login needed |
≤ 1.1 |
CVE-2026-89283 |
WPScan | |
| 8.6 High | WP-Partner | SQL Injection Unauthenticated SQLi via 'id' Parameter No login needed |
≤ 1.2.1 |
CVE-2026-89234 |
WPScan | |
| 8.6 High | RecordBrowser | SQL Injection Unauthenticated SQLi via 'recordid' Parameter No login needed |
≤ 1.1.7 |
CVE-2026-89232 |
WPScan | |
| 8.6 High | WpCues Basic Quiz | SQL Injection Unauthenticated SQLi via Quiz Result Submission No login needed |
≤ 1.6.5 |
CVE-2026-89214 |
WPScan | |
| 8.6 High | Llavero.io | SQL Injection Unauthenticated Blind SQLi via 'cill_login' Parameter No login needed |
≤ 0.1.4 |
CVE-2026-89213 |
WPScan | |
| 8.6 High | Site Setup Wizard | SQL Injection Unauthenticated SQLi via ssw_check_admin_email_exists No login needed |
≤ 1.5.8 |
CVE-2026-89195 |
WPScan | |
| 8.6 High | Social Web Suite | SQL Injection Unauthenticated Blind SQLi via Unset Shared Secret No login needed |
≤ 4.1.12 |
CVE-2026-88930 |
WPScan | |
| 8.8 High | KeyWord Collector | Cross-Site Scripting Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings No login needed |
≤ 1.4 |
CVE-2026-88905 |
WPScan | |
| 8.8 High | Topcontent | Cross-Site Scripting Unauthenticated Stored XSS via Content Webhook No login needed |
≤ 1.2.1 |
CVE-2026-88903 |
WPScan | |
| 8.8 High | Disable Users | Authentication Bypass Disabled Account Authentication Bypass via XML-RPC and Application Passwords |
≤ 1.0.5 |
CVE-2026-88827 |
WPScan | |
| 8.8 High | SmugMug Embed | Cross-Site Scripting Unauthenticated Stored XSS via saveSelectedAlbums No login needed |
≤ 3.13 |
CVE-2026-88826 |
WPScan | |
| 4.7 Medium | Simple Membership | Information Disclosure Newly Registered Member Password Disclosure via URL Query String |
< 4.8.3 Fixed in 4.8.3 |
CVE-2026-88785 |
WPScan | |
| 8.8 High | BuddyPress Instant Chat | Cross-Site Scripting Unauthenticated Stored XSS via Chat Message No login needed |
≤ 1.6 |
CVE-2026-87764 |
WPScan | |
| 8.8 High | Adwised Web Push Notification | Cross-Site Scripting Unauthenticated Stored XSS via Secret Key Type Juggling No login needed |
≤ 2.5.7 |
CVE-2026-87762 |
WPScan | |
| 8.0 High | Adwised Web Push Notification | Cross-Site Scripting Subscriber+ Stored XSS via Pop-up Settings |
≤ 2.5.7 |
CVE-2026-87761 |
WPScan | |
| 8.8 High | Web Vitals Tracking | Cross-Site Scripting Unauthenticated Stored XSS via Tracking Beacon Metric Name No login needed |
≤ 5.4.2 |
CVE-2026-87760 |
WPScan | |
| 8.8 High | HootBoard | Cross-Site Scripting Unauthenticated Stored XSS via Board Configuration REST Endpoint No login needed |
≤ 3.1.4 |
CVE-2026-86798 |
WPScan | |
| 9.1 Critical | Insurify | Broken Access Control Unauthenticated Arbitrary Option Deletion via removeimg_popup No login needed |
≤ 1.0 |
CVE-2026-86717 |
WPScan | |
| 9.1 Critical | Quick quotes | Broken Access Control Unauthenticated Integer-Value Option Update No login needed |
≤ 1.0.0 |
CVE-2026-86706 |
WPScan | |
| 7.2 High | Crowdfundly | Privilege Escalation Crowdfundly Manager+ Privilege Escalation |
≤ 2.2.2 |
CVE-2026-85126 |
WPScan | |
| 9.1 Critical | Insurify | Broken Access Control Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign No login needed |
≤ 1.0 |
CVE-2026-85121 |
WPScan | |
| 9.8 Critical | AI Content Generator Marketing | Privilege Escalation Unauthenticated Privilege Escalation via Arbitrary Option Update and Deletion No login needed |
≤ 1.0.0 |
CVE-2026-85118 |
WPScan | |
| 9.8 Critical | Freeton WP | Privilege Escalation Unauthenticated Account Takeover via 'secod' Parameter No login needed |
≤ 1.0.0 |
CVE-2026-84737 |
WPScan | |
| 9.8 Critical | Mindstien Quick Login | Privilege Escalation Unauthenticated Administrator Account Takeover via 'mql_pass' Parameter No login needed |
≤ 1.0 |
CVE-2026-84734 |
WPScan | |
| 8.8 High | click5 CRM add-on to Contact Form 7 | Cross-Site Scripting Unauthenticated Stored XSS via post_notifications No login needed |
≤ 1.0.4 |
CVE-2026-84261 |
WPScan | |
| 8.8 High | click5 CRM add-on to Gravity Forms | Cross-Site Scripting Unauthenticated Stored XSS via post_notifications No login needed |
≤ 1.0.3 |
CVE-2026-84260 |
WPScan | |
| 8.8 High | click5 CRM add-on to WPForms | Cross-Site Scripting Unauthenticated Stored XSS via post_notifications No login needed |
≤ 1.0.3 |
CVE-2026-84259 |
WPScan | |
| 8.8 High | click5 CRM add-on to Ninja Forms | Cross-Site Scripting Unauthenticated Stored XSS via post_notifications No login needed |
≤ 1.0.1 |
CVE-2026-84258 |
WPScan | |
| 9.8 Critical | click5 CRM add-on to Contact Form 7 | Cross-Site Request Forgery Unauthenticated Arbitrary Options Update No login needed |
≤ 1.0.4 |
CVE-2026-84254 |
WPScan | |
| 9.8 Critical | click5 CRM add-on to Gravity Forms | Cross-Site Request Forgery Unauthenticated Arbitrary Options Update No login needed |
≤ 1.0.3 |
CVE-2026-84253 |
WPScan | |
| 9.8 Critical | click5 CRM add-on to WPForms | Cross-Site Request Forgery Unauthenticated Arbitrary Options Update No login needed |
≤ 1.0.3 |
CVE-2026-84252 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.