WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 8,151–8,200 of 29,413 vulnerabilities

Known WordPress vulnerabilities, page 164 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Grand Restaurant Plugin grandrestaurant PHP Object Injection No login needed ≤ 7.0.10 Fixed in 7.0.11 CVE-2026-23542 Patchstack
7.5 High Mail Mint Plugin mail-mint Broken Access Control No login needed ≤ 1.19.4 Fixed in 1.19.5 CVE-2026-23541 Patchstack
5.3 Medium Everest Forms Plugin everest-forms Arbitrary Shortcode Execution No login needed ≤ 3.4.1 Fixed in 3.4.2 CVE-2026-22422 Patchstack
7.2 High YITH WooCommerce Compare Plugin yith-woocommerce-compare PHP Object Injection Deserialization of untrusted data ≤ 3.6.0 Fixed in 3.7.0 CVE-2026-22333 Patchstack
4.3 Medium iThemes Sync Plugin ithemes-sync Broken Access Control ≤ 3.2.8 Fixed in 3.2.9 CVE-2026-27056 Patchstack
9.8 Critical s2Member Plugin s2member Privilege Escalation Unauthenticated Privilege Escalation via Account Takeover No login needed ≤ 260127 CVE-2026-1994 Wordfence
4.4 Medium TalkJS Plugin talkjs Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'welcomeMessage' Parameter ≤ 0.1.15 CVE-2026-1055 Wordfence
6.5 Medium Shield Security Plugin wp-simple-firewall Cross-Site Request Forgery Cross-Site Request Forgery to SQL Injection No login needed ≤ 21.0.8 CVE-2026-0722 Wordfence
9.8 Critical Buyent Theme (with Buyent Classified Plugin) Plugin Privilege Escalation Unauthenticated Privilege Escalation via User Registration No login needed ≤ 1.0.7 CVE-2025-13851 Wordfence
5.4 Medium News Element Elementor Blog Magazine Plugin news-element Broken Access Control Missing Authorization to Authenticated (Subscriber+) Data Loss ≤ 1.0.8 CVE-2026-2284 Wordfence
6.4 Medium Easy Author Image Plugin easy-author-image Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Picture URL ≤ 1.7 CVE-2026-1373 Wordfence
4.3 Medium Whatsiplus Scheduled Notification for Woocommerce Plugin whatsiplus-scheduled-notification-for-woocommerce Cross-Site Request Forgery Cross-Site Request Forgery to 'wsnfw_save_users_settings' AJAX Action No login needed ≤ 1.0.1 CVE-2026-1455 Wordfence
6.4 Medium Image Hotspot by DevVN Plugin devvn-image-hotspot Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Meta ≤ 1.2.9 CVE-2025-14445 Wordfence
9.8 Critical Prodigy Commerce Plugin prodigy-commerce Local File Inclusion Unauthenticated Local File Inclusion via parameters[template_name] No login needed ≤ 3.3.0 CVE-2026-0926 Wordfence
5.3 Medium Mega Store Woocommerce Theme mega-store-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation and Settings Change No login needed ≤ 5.9 CVE-2025-14357 Wordfence
4.3 Medium Dealia – Request a quote Plugin dealia-request-a-quote Broken Access Control Request a quote <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Plugin Configuration Reset ≤ 1.0.7 CVE-2026-2504 Wordfence
6.1 Medium Shield Security Plugin wp-simple-firewall Cross-Site Scripting Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter No login needed ≤ 21.0.8 CVE-2026-0561 Wordfence
7.2 High WP Customer Reviews Plugin wp-customer-reviews Cross-Site Scripting Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter No login needed ≤ 3.7.5 CVE-2025-14452 Wordfence
6.4 Medium Advanced Custom Fields: Font Awesome Plugin advanced-custom-fields-font-awesome Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.0.1 CVE-2025-14983 Wordfence
8.8 High Orderable Plugin orderable Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation ≤ 1.20.0 CVE-2026-0974 Wordfence
2.7 Low OneClick Chat to Order Plugin oneclick-whatsapp-order Broken Access Control Missing Authorization to Authenticated (Editor+) Plugin Settings Update ≤ 1.0.9 CVE-2025-14270 Wordfence
4.3 Medium Remove Post Type Slug Plugin remove-post-type-slug Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0.2 CVE-2025-14167 Wordfence
6.4 Medium YaMaps Plugin yamaps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters ≤ 0.6.40 CVE-2025-14851 Wordfence
9.8 Critical Lizza LMS Pro Plugin Privilege Escalation Unauthenticated Privilege Escalation No login needed ≤ 1.0.3 CVE-2025-13563 Wordfence
4.4 Medium Tennis Court Bookings Plugin tennis-court-bookings Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings and Calendar Parameters ≤ 1.2.7 CVE-2026-1044 Wordfence
4.3 Medium Shield Security: Blocks Bots, Protects Users, and Prevents Security Breaches Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Email MFA Update ≤ 21.0.9 CVE-2025-14427 Wordfence
4.3 Medium Virusdie Plugin virusdie Broken Access Control Missing Authorization to Authenticated (Subscriber+) API Key Disclosure ≤ 1.1.7 CVE-2025-14864 Wordfence
4.3 Medium Shopire Theme shopire Broken Access Control Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install ≤ 1.0.57 CVE-2025-13091 Wordfence
4.4 Medium PostmarkApp Email Integrator Plugin postmarkapp-email-integrator Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings ≤ 2.4 CVE-2026-1043 Wordfence
8.8 High WP AUDIO GALLERY Plugin wp-audio-gallery Path Traversal Authenticated (Subscriber+) Arbitrary File Read via .htaccess Manipulation ≤ 2.0 CVE-2025-13603 Wordfence
4.3 Medium SEO Plugin by Squirrly SEO Plugin squirrly-seo Broken Access Control Missing Authorization to Authenticated (Subscriber+) Cloud Service Disconnection ≤ 12.4.14 CVE-2025-14342 Wordfence
6.1 Medium iXML – Google XML sitemap generator Plugin ixml Cross-Site Scripting Google XML sitemap generator <= 0.6 - Reflected Cross-Site Scripting via 'iXML_email' Parameter No login needed ≤ 0.6 CVE-2025-14076 Wordfence
6.4 Medium Groups Plugin groups Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode ≤ 3.10.0 CVE-2026-0549 Wordfence
6.4 Medium Easy Table of Contents Plugin easy-table-of-contents Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.78 CVE-2025-13738 Wordfence
6.4 Medium XO Event Calendar Plugin xo-event-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode ≤ 3.2.10 CVE-2026-0556 Wordfence
4.3 Medium Page Title, Description & Open Graph Updater Plugin page-title-description-open-graph-updater Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Page Title Modification No login needed ≤ 1.02 CVE-2025-13438 Wordfence
4.4 Medium salavat counter Plugin salavat-counter Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'image_url' Parameter ≤ 0.9.5 CVE-2026-1047 Wordfence
5.3 Medium Breadcrumb NavXT Plugin breadcrumb-navxt Broken Access Control Missing Authorization to Sensitive Information Exposure No login needed ≤ 7.5.0 CVE-2025-13842 Wordfence
5.3 Medium Breeze – WordPress Cache Plugin breeze Broken Access Control WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion No login needed ≤ 2.2.21 CVE-2025-13864 Wordfence
6.4 Medium Apollo13 Framework Extension Plugin apollo13-framework-extensions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter ≤ 1.9.8 CVE-2025-13617 Wordfence
4.4 Medium Slidorion Plugin slidorion Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Slidorion Settings ≤ 1.0.2 CVE-2026-2282 Wordfence
8.8 High IDonate Plugin idonate Broken Access Control Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_profile Function 2.1.5 – 2.1.9 CVE-2025-4521 Wordfence
8.8 High Toret Manager Plugin toret-manager Broken Access Control Authenticated (Subscriber+) Arbitrary Options Update via AJAX actions ≤ 1.2.7 CVE-2026-0912 Wordfence
7.2 High CTX Feed – WooCommerce Product Feed Manager Plugin webappick-product-feed-for-woocommerce Broken Access Control WooCommerce Product Feed Manager <= 6.6.11 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation ≤ 6.6.11 CVE-2025-12975 Wordfence
9.8 Critical Slider Future Plugin slider-future Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.0.5 CVE-2026-1405 Wordfence
6.4 Medium Album and Image Gallery Plus Lightbox Plugin album-and-image-gallery-plus-lightbox Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode ≤ 2.1.7 CVE-2025-13612 Wordfence
6.4 Medium Advance Block Extend Plugin advance-block-extend Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute ≤ 1.0.4 CVE-2026-1646 Wordfence
5.3 Medium Checkout Field Manager (Checkout Manager) for WooCommerce Plugin woocommerce-checkout-manager Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed ≤ 7.8.5 CVE-2025-13930 Wordfence
7.2 High BackWPup Plugin backwpup Privilege Escalation Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update ≤ 5.6.2 CVE-2025-15041 Wordfence
5.3 Medium Razorpay for WooCommerce Plugin woo-razorpay Broken Access Control Missing Authentication to Unauthenticated Order Modification No login needed ≤ 4.7.8 CVE-2025-14294 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only