WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 8,251–8,300 of 29,413 vulnerabilities

Known WordPress vulnerabilities, page 166 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.2 High Product Addons for Woocommerce – Product Options with Custom Fields Plugin woo-custom-product-addons Remote Code Execution Product Options with Custom Fields <= 3.1.0 - Authenticated (Shop Manager+) Code Injection via Conditional Logic 'operator' Parameter ≤ 3.1.0 CVE-2026-2296 Wordfence
4.3 Medium Gutenberg Blocks with AI by Kadence WP Plugin kadence-blocks Broken Access Control Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload ≤ 3.6.1 CVE-2026-2633 Wordfence
4.4 Medium Private Comment Plugin private-comment Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Label Text Setting ≤ 0.0.4 CVE-2026-2281 Wordfence
4.3 Medium Taskbuilder Plugin taskbuilder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation ≤ 5.0.2 CVE-2026-1640 Wordfence
7.2 High YayMail Plugin yaymail Broken Access Control Missing Authorization to Authenticated (Shop Manager+) Arbitrary Options Update via 'yaymail_import_state' AJAX Action ≤ 4.3.2 CVE-2026-1937 Wordfence
6.4 Medium InteractiveCalculator Plugin interactivecalculator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute ≤ 1.0.3 CVE-2026-1807 Wordfence
4.3 Medium Gutenberg Blocks with AI by Kadence WP Plugin kadence-blocks Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter ≤ 3.6.1 CVE-2026-1857 Wordfence
6.1 Medium Download Manager Plugin download-manager Cross-Site Scripting Reflected Cross-Site Scripting via 'redirect_to' Parameter No login needed ≤ 3.3.46 CVE-2026-1666 Wordfence
7.2 High Cart All In One For WooCommerce Plugin woo-cart-all-in-one Remote Code Execution Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting ≤ 1.1.21 CVE-2026-2019 Wordfence
7.5 High Video Conferencing with Zoom API Plugin Authentication Bypass Unauthenticated SDK Signature Generation No login needed < 4.6.6 Fixed in 4.6.6 CVE-2026-1368 WPScan
4.4 Medium Membership Plugin – Restrict Content Plugin restrict-content Cross-Site Scripting Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings ≤ 3.2.18 CVE-2026-1304 Wordfence
4.3 Medium Tickera – WordPress Event Ticketing Plugin tickera-event-ticketing-system Broken Access Control WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update ≤ 3.5.6.4 CVE-2025-12356 Wordfence
6.4 Medium Popup Box – Easily Create WordPress Popups Plugin popup-box Cross-Site Scripting Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.12 CVE-2025-12122 Wordfence
4.3 Medium PDF Invoices & Packing Slips for WooCommerce Plugin woocommerce-pdf-invoices-packing-slips Broken Access Control Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification ≤ 5.6.0 CVE-2026-1906 Wordfence
4.3 Medium Keybase.io Verification Plugin wp-keybase-verification Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.4.5 CVE-2026-1072 Wordfence
6.5 Medium Taskbuilder Plugin taskbuilder SQL Injection Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters ≤ 5.0.2 CVE-2026-1639 Wordfence
6.4 Medium VK All in One Expansion Unit Plugin vk-all-in-one-expansion-unit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title ≤ 9.112.3 CVE-2025-11737 Wordfence
4.3 Medium WP Plugin Info Card Plugin wp-plugin-info-card Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation No login needed ≤ 6.2.0 CVE-2026-2023 Wordfence
7.5 High Business Directory Plugin business-directory-plugin SQL Injection Unauthenticated SQL Injection via payment Parameter No login needed ≤ 6.4.21 CVE-2026-2576 Wordfence
4.3 Medium EmailKit – Email Customizer for WooCommerce & WP Plugin emailkit Broken Access Control Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification ≤ 1.6.2 CVE-2026-1925 Wordfence
8.6 High ShopLentor Plugin woolentor-addons Content Injection Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action No login needed ≤ 3.3.2 CVE-2026-1714 Wordfence
4.7 Medium URL Shortify Plugin url-shortify Open Redirect Unauthenticated Open Redirect via 'redirect_to' Parameter No login needed ≤ 1.12.1 CVE-2026-1277 Wordfence
4.4 Medium WP 404 Auto Redirect Plugin wp-404-auto-redirect-to-similar-post Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 1.0.5 CVE-2025-12037 Wordfence
6.4 Medium Display During Conditional Shortcode Plugin display-during-conditional-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter ≤ 1.2 CVE-2025-6460 Wordfence
7.2 High Rent Fetch Plugin rentfetch Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter No login needed ≤ 0.32.6 CVE-2026-1931 Wordfence
6.1 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Open Redirect Unauthenticated Open Redirect via 'requested_page' Parameter No login needed 1.0.0 – 1.2.7 CVE-2026-1296 Wordfence
4.3 Medium Order Splitter for WooCommerce Plugin wc-order-splitter Broken Access Control Missing Authorization to Authenticated (Subscriber+) Order Information Exposure ≤ 5.3.5 CVE-2025-12075 Wordfence
6.4 Medium Filestack Plugin filepicker-media-uploader Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 2.0.8 CVE-2025-13959 Wordfence
4.3 Medium Frontend User Notes Plugin frontend-user-notes Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification ≤ 2.1.0 CVE-2025-12071 Wordfence
5.3 Medium Context Blog Theme context-blog Information Disclosure Unauthenticated Private Post Disclosure No login needed ≤ 1.2.5 CVE-2025-12074 Wordfence
6.5 Medium SP Project & Document Manager Plugin sp-client-document-manager Broken Access Control Broken Access Control to XSS ≤ 4.70 CVE-2024-31118 Patchstack
6.5 Medium Custom Content by Country (by Shield Security) Plugin custom-content-by-country Broken Access Control No login needed ≤ 3.1.2 CVE-2022-41650 Patchstack
4.3 Medium Gutenberg Blocks by Kadence Blocks Plugin kadence-blocks Broken Access Control Missing Authorization ≤ 3.5.32 CVE-2026-2608 Wordfence
7.2 High RSS Aggregator Plugin wp-rss-aggregator Cross-Site Scripting Reflected Cross-Site Scripting via 'template' Parameter No login needed ≤ 5.0.10 CVE-2026-1216 Wordfence
5.8 Medium Frontend File Manager Plugin Information Disclosure Unauthenticated Arbitrary Email Sending No login needed ≤ 23.5 CVE-2026-0829 WPScan
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint No login needed ≤ 4.2.8.4 CVE-2026-1657 Wordfence
7.7 High Zarinpal Gateway for WooCommerce Plugin zarinpal-woocommerce-payment-gateway Broken Access Control Improper Access Control to Payment Status Update No login needed ≤ 5.0.16 CVE-2026-2592 Wordfence
4.4 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.50.2 CVE-2026-2002 Wordfence
8.8 High WP Maps Plugin wp-google-map-plugin Local File Inclusion Authenticated (Subscriber+) Limited Local File Inclusion ≤ 4.8.6 CVE-2025-12062 Wordfence
8.8 High WowRevenue Plugin revenue Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation ≤ 2.1.3 CVE-2026-2001 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Subscriber+ Form Creation < 6.0.7.2 Fixed in 6.0.7.2 CVE-2026-0929 WPScan
6.5 Medium Element Pack Addons for Elementor Plugin bdthemes-element-pack-lite Path Traversal Authenticated (Contributor+) Arbitrary File Read ≤ 8.3.17 CVE-2026-1793 Wordfence
8.8 High Ecwid by Lightspeed Ecommerce Shopping Cart Plugin ecwid-shopping-cart Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access ≤ 7.0.7 CVE-2026-1750 Wordfence
9.8 Critical Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin cleantalk-spam-protect Broken Access Control Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation No login needed ≤ 6.71 CVE-2026-1490 Wordfence
4.3 Medium Media Library Folders Plugin media-library-plus Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename ≤ 8.3.6 CVE-2026-2312 Wordfence
6.4 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget ≤ 6.5.9 CVE-2026-1512 Wordfence
4.9 Medium Mail Mint Plugin mail-mint SQL Injection Authenticated (Administrator+) SQL Injection via Multiple API Endpoints ≤ 1.19.2 CVE-2026-1258 Wordfence
7.2 High Super Page Cache Plugin wp-cloudflare-page-cache Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Activity Log No login needed ≤ 5.2.2 CVE-2026-1843 Wordfence
6.4 Medium myCred Plugin mycred Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode ≤ 2.9.7.3 CVE-2026-0550 Wordfence
9.8 Critical Truelysell Core Plugin Privilege Escalation Unauthenticated Privilege Escalation via Registration No login needed ≤ 1.8.7 CVE-2025-8572 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only