WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.
Showing 801–850 of 17,674 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | EmbedPress | Broken Access Control Unauthenticated Google Reviews API Quota Consumption and Database Bloat No login needed |
4.6.0 – < 4.6.4 Fixed in 4.6.4 |
CVE-2026-84936 |
WPScan | |
| 6.8 Medium | Joli Table Of Contents | Cross-Site Scripting Author+ Stored XSS via joli-toc Shortcode Theme Attribute |
< 3.0.3 Fixed in 3.0.3 |
CVE-2026-84931 |
WPScan | |
| 6.8 Medium | CatFolders Document Gallery | Cross-Site Scripting Author+ Stored XSS via titleTag Block Attribute |
< 2.0.7 Fixed in 2.0.7 |
CVE-2026-84930 |
WPScan | |
| 4.9 Medium | Eventin | Broken Access Control Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization |
< 4.1.22 Fixed in 4.1.22 |
CVE-2026-84901 |
WPScan | |
| 6.8 Medium | VikWidgetsLoader | Cross-Site Scripting Contributor+ Stored XSS via Gutenberg Block class_suffix |
1.11.0 – < 1.12.0 Fixed in 1.12.0 |
CVE-2026-84899 |
WPScan | |
| 6.6 Medium | Eventin | Local File Inclusion Contributor+ LFI via Event Layout Meta |
< 4.1.21 Fixed in 4.1.21 |
CVE-2026-84898 |
WPScan | |
| 6.8 Medium | King Addons for Elementor | Cross-Site Scripting Contributor+ Stored XSS via Magazine Grid Widget |
< 51.1.77 Fixed in 51.1.77 |
CVE-2026-84896 |
WPScan | |
| 6.8 Medium | Kirki | SQL Injection Editor+ SQLi via Content Manager Field ID |
6.0.0 – < 6.3.0 Fixed in 6.3.0 |
CVE-2026-84221 |
WPScan | |
| 6.8 Medium | Bold Page Builder | Cross-Site Scripting Contributor+ Stored XSS via Multiple Shortcode Element Attributes |
< 5.9.8 Fixed in 5.9.8 |
CVE-2026-84022 |
WPScan | |
| 6.8 Medium | Bold Page Builder | Cross-Site Scripting Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL |
< 5.9.8 Fixed in 5.9.8 |
CVE-2026-84021 |
WPScan | |
| 6.8 Medium | Greenshift | Cross-Site Scripting Contributor+ Stored XSS via Block Animation customProps Attribute |
< 13.2.0 Fixed in 13.2.0 |
CVE-2026-83544 |
WPScan | |
| 4.1 Medium | Greenshift | Server-Side Request Forgery Contributor+ SSRF via get-csv-to-json REST Endpoint |
< 13.2.0 Fixed in 13.2.0 |
CVE-2026-83543 |
WPScan | |
| 6.8 Medium | Masteriyo LMS | Cross-Site Scripting Instructor+ Stored XSS via Course Custom Fields |
1.18.0 – < 3.4.0 Fixed in 3.4.0 |
CVE-2026-82846 |
WPScan | |
| 5.3 Medium | Accept Stripe Payments | Broken Access Control Unauthenticated Product Substitution via IDOR No login needed |
< 2.1.4 Fixed in 2.1.4 |
CVE-2026-81424 |
WPScan | |
| 4.3 Medium | Accept Stripe Payments | Open Redirect Open Redirect via IPN Handler No login needed |
< 2.1.4 Fixed in 2.1.4 |
CVE-2026-81423 |
WPScan | |
| 5.3 Medium | Post Carousel | Information Disclosure Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_id No login needed |
4.0.0 – < 4.0.8 Fixed in 4.0.8 |
CVE-2026-78149 |
WPScan | |
| 4.7 Medium | JetFormBuilder | Cross-Site Scripting Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails No login needed |
< 3.6.5.2 Fixed in 3.6.5.2 |
CVE-2026-19861 |
WPScan | |
| 5.4 Medium | Search Atlas SEO | Broken Access Control Subscriber+ Google Service Account Credential Overwrite/Deletion |
< 2.6.24 Fixed in 2.6.24 |
CVE-2026-15247 |
WPScan | |
| 6.4 Medium | Social Chat | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box |
≤ 8.6.2 |
CVE-2026-18404 |
Wordfence | |
| 4.3 Medium | Theme My Login | Broken Access Control Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage |
≤ 7.1.15 |
CVE-2026-83628 |
Wordfence | |
| 6.4 Medium | Dear Flipbook | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML |
≤ 2.4.30 |
CVE-2026-8625 |
Wordfence | |
| 5.4 Medium | Events Manager - Calendar, Bookings, Tickets, and more! | Cross-Site Scripting Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes No login needed |
≤ 7.3.3 |
CVE-2025-14945 |
Wordfence | |
| 6.4 Medium | Dear Flipbook | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute |
≤ 2.4.30 |
CVE-2026-8623 |
Wordfence | |
| 5.3 Medium | JetPopup | Broken Access Control No login needed |
≤ 2.0.20.2 Fixed in 2.0.20.3 |
CVE-2026-27347 |
Patchstack | |
| 5.3 Medium | E-cab Taxi Booking Manager for Woocommerce | Price Manipulation Unauthenticated Price Manipulation via mptbm_add_to_cart No login needed |
2.0.1 – < 2.0.5 Fixed in 2.0.5 |
CVE-2026-84045 |
WPScan | |
| 5.3 Medium | Restaurant Menu and Food Ordering | Price Manipulation Unauthenticated Payment Bypass via Forged PayPal IPN No login needed |
< 2.4.12 Fixed in 2.4.12 |
CVE-2026-84044 |
WPScan | |
| 5.3 Medium | ePayco Payment Gateway for WooCommerce | Other Unauthenticated Payment Confirmation Bypass No login needed |
< 8.4.7 Fixed in 8.4.7 |
CVE-2026-84043 |
WPScan | |
| 6.5 Medium | WoodMart | Cross-Site Scripting |
< 8.3.8 Fixed in 8.3.8 |
CVE-2026-27086 |
Patchstack | |
| 5.4 Medium | WP Rentals | Broken Access Control Insecure Direct Object References (IDOR) |
< 3.16.0 Fixed in 3.16.0 |
CVE-2026-27432 |
Patchstack | |
| 5.3 Medium | MarketKing | Broken Access Control No login needed |
≤ 2.1.60 Fixed in 2.1.70 |
CVE-2026-85311 |
Patchstack | |
| 5.3 Medium | WCFM Membership | Broken Access Control No login needed |
≤ 2.11.11 Fixed in 2.12.0 |
CVE-2026-32480 |
Patchstack | |
| 5.3 Medium | Xpro Elementor Addons | Information Disclosure Unauthenticated Draft/Private Product Disclosure via Quick View No login needed |
< 1.7.8 Fixed in 1.7.8 |
CVE-2026-84146 |
WPScan | |
| 5.5 Medium | WPvivid Backup & Migration | Arbitrary File Deletion Admin+ Arbitrary File Deletion via Path Traversal |
< 0.9.134 Fixed in 0.9.134 |
CVE-2026-82194 |
WPScan | |
| 5.5 Medium | WPvivid Backup & Migration | Path Traversal Admin+ File Write Outside the Backup Directory via Path Traversal |
0.9.113 – < 0.9.134 Fixed in 0.9.134 |
CVE-2026-82193 |
WPScan | |
| 4.1 Medium | WPLP Cookie Consent | SQL Injection Admin+ SQLi via 'offset' Parameter |
3.0.0 – < 4.4.2 Fixed in 4.4.2 |
CVE-2026-82186 |
WPScan | |
| 5.9 Medium | Frontend Admin by DynamiApps | Path Traversal Unauthenticated .htaccess and index.php Deletion via Custom Directory Path Traversal No login needed |
< 3.29.13 Fixed in 3.29.13 |
CVE-2026-81347 |
WPScan | |
| 5.9 Medium | Ninja Forms | Information Disclosure Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API |
3.14.0 – < 3.15.2 Fixed in 3.15.2 |
CVE-2026-80438 |
WPScan | |
| 5.3 Medium | WPFunnels | Broken Access Control Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission No login needed |
3.1.0 – < 3.13.0 Fixed in 3.13.0 |
CVE-2026-79632 |
WPScan | |
| 5.3 Medium | WPFunnels | Information Disclosure Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files No login needed |
2.6.0 – < 3.13.0 Fixed in 3.13.0 |
CVE-2026-79631 |
WPScan | |
| 5.3 Medium | WPFunnels | Price Manipulation Unauthenticated Price Manipulation via Order Bump Product ID Substitution No login needed |
< 3.13.0 Fixed in 3.13.0 |
CVE-2026-79630 |
WPScan | |
| 6.8 Medium | Pods | Path Traversal Author+ Arbitrary File Read via Shortcode Display Callback |
3.1.0 – < 3.3.9.2 Fixed in 3.3.9.2 |
CVE-2026-74853 |
WPScan | |
| 5.3 Medium | Content Views | Information Disclosure Unauthenticated Non-Public Post Content Disclosure via Views Status Filter No login needed |
< 4.5.1.2 Fixed in 4.5.1.2 |
CVE-2026-17517 |
WPScan | |
| 5.3 Medium | WPFunnels | Broken Access Control Unauthenticated User Registration via Opt-in Forms No login needed |
3.6.3 – < 3.13.0 Fixed in 3.13.0 |
CVE-2025-15691 |
WPScan | |
| 5.4 Medium | LearnPress | Cross-Site Scripting LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles |
< 4.4.6 Fixed in 4.4.6 |
CVE-2026-82024 |
VulnCheck | |
| 4.3 Medium | LearnPress | Broken Access Control LearnPress WordPress Plugin < 4.4.6 Broken Object-Level Authorization via Quiz Answer Insert |
< 4.4.6 Fixed in 4.4.6 |
CVE-2026-82023 |
VulnCheck | |
| 5.3 Medium | Unlimited Elements For Elementor (Free Widgets, Addons, Templates) | Broken Access Control No login needed |
≤ 2.0.17 Fixed in 2.0.18 |
CVE-2026-85304 |
Patchstack | |
| 5.3 Medium | Ultimate Maps by Supsystic | Broken Access Control No login needed |
≤ 1.5.3 Fixed in 1.5.4 |
CVE-2026-85309 |
Patchstack | |
| 5.3 Medium | SureForms | Broken Access Control Insecure Direct Object References (IDOR) No login needed |
≤ 2.12.5 Fixed in 2.12.6 |
CVE-2026-85308 |
Patchstack | |
| 5.3 Medium | KP Agent Ready | Information Disclosure Sensitive Data Exposure No login needed |
< 1.2.08 Fixed in 1.2.08 |
CVE-2026-85307 |
Patchstack | |
| 6.5 Medium | MountDev AI MCP Connector | Broken Access Control |
≤ 1.6.5 Fixed in 1.6.6 |
CVE-2026-85306 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.