WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 8,551–8,600 of 29,694 vulnerabilities

Known WordPress vulnerabilities, page 172 of 594
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium EmailKit – Email Customizer for WooCommerce & WP Plugin emailkit Broken Access Control Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification ≤ 1.6.2 CVE-2026-1925 Wordfence
8.6 High ShopLentor Plugin woolentor-addons Content Injection Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action No login needed ≤ 3.3.2 CVE-2026-1714 Wordfence
4.7 Medium URL Shortify Plugin url-shortify Open Redirect Unauthenticated Open Redirect via 'redirect_to' Parameter No login needed ≤ 1.12.1 CVE-2026-1277 Wordfence
4.4 Medium WP 404 Auto Redirect Plugin wp-404-auto-redirect-to-similar-post Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 1.0.5 CVE-2025-12037 Wordfence
6.4 Medium Display During Conditional Shortcode Plugin display-during-conditional-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter ≤ 1.2 CVE-2025-6460 Wordfence
7.2 High Rent Fetch Plugin rentfetch Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter No login needed ≤ 0.32.6 CVE-2026-1931 Wordfence
6.1 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Open Redirect Unauthenticated Open Redirect via 'requested_page' Parameter No login needed 1.0.0 – 1.2.7 CVE-2026-1296 Wordfence
4.3 Medium Order Splitter for WooCommerce Plugin wc-order-splitter Broken Access Control Missing Authorization to Authenticated (Subscriber+) Order Information Exposure ≤ 5.3.5 CVE-2025-12075 Wordfence
6.4 Medium Filestack Plugin filepicker-media-uploader Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 2.0.8 CVE-2025-13959 Wordfence
4.3 Medium Frontend User Notes Plugin frontend-user-notes Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification ≤ 2.1.0 CVE-2025-12071 Wordfence
5.3 Medium Context Blog Theme context-blog Information Disclosure Unauthenticated Private Post Disclosure No login needed ≤ 1.2.5 CVE-2025-12074 Wordfence
6.5 Medium SP Project & Document Manager Plugin sp-client-document-manager Broken Access Control Broken Access Control to XSS ≤ 4.70 CVE-2024-31118 Patchstack
6.5 Medium Custom Content by Country (by Shield Security) Plugin custom-content-by-country Broken Access Control No login needed ≤ 3.1.2 CVE-2022-41650 Patchstack
4.3 Medium Gutenberg Blocks by Kadence Blocks Plugin kadence-blocks Broken Access Control Missing Authorization ≤ 3.5.32 CVE-2026-2608 Wordfence
7.2 High RSS Aggregator Plugin wp-rss-aggregator Cross-Site Scripting Reflected Cross-Site Scripting via 'template' Parameter No login needed ≤ 5.0.10 CVE-2026-1216 Wordfence
5.8 Medium Frontend File Manager Plugin Information Disclosure Unauthenticated Arbitrary Email Sending No login needed ≤ 23.5 CVE-2026-0829 WPScan
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint No login needed ≤ 4.2.8.4 CVE-2026-1657 Wordfence
7.7 High Zarinpal Gateway for WooCommerce Plugin zarinpal-woocommerce-payment-gateway Broken Access Control Improper Access Control to Payment Status Update No login needed ≤ 5.0.16 CVE-2026-2592 Wordfence
4.4 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.50.2 CVE-2026-2002 Wordfence
8.8 High WP Maps Plugin wp-google-map-plugin Local File Inclusion Authenticated (Subscriber+) Limited Local File Inclusion ≤ 4.8.6 CVE-2025-12062 Wordfence
8.8 High WowRevenue Plugin revenue Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation ≤ 2.1.3 CVE-2026-2001 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Subscriber+ Form Creation < 6.0.7.2 Fixed in 6.0.7.2 CVE-2026-0929 WPScan
6.5 Medium Element Pack Addons for Elementor Plugin bdthemes-element-pack-lite Path Traversal Authenticated (Contributor+) Arbitrary File Read ≤ 8.3.17 CVE-2026-1793 Wordfence
8.8 High Ecwid by Lightspeed Ecommerce Shopping Cart Plugin ecwid-shopping-cart Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access ≤ 7.0.7 CVE-2026-1750 Wordfence
9.8 Critical Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin cleantalk-spam-protect Broken Access Control Authorization Bypass via Reverse DNS (PTR record) Spoofing to Unauthenticated Arbitrary Plugin Installation No login needed ≤ 6.71 CVE-2026-1490 Wordfence
4.3 Medium Media Library Folders Plugin media-library-plus Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename ≤ 8.3.6 CVE-2026-2312 Wordfence
6.4 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget ≤ 6.5.9 CVE-2026-1512 Wordfence
4.9 Medium Mail Mint Plugin mail-mint SQL Injection Authenticated (Administrator+) SQL Injection via Multiple API Endpoints ≤ 1.19.2 CVE-2026-1258 Wordfence
7.2 High Super Page Cache Plugin wp-cloudflare-page-cache Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Activity Log No login needed ≤ 5.2.2 CVE-2026-1843 Wordfence
6.4 Medium myCred Plugin mycred Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode ≤ 2.9.7.3 CVE-2026-0550 Wordfence
9.8 Critical Truelysell Core Plugin Privilege Escalation Unauthenticated Privilege Escalation via Registration No login needed ≤ 1.8.7 CVE-2025-8572 Wordfence
4.3 Medium Modula Image Gallery – Photo Grid & Video Gallery Plugin modula-best-grid-gallery Broken Access Control Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing ≤ 2.13.6 CVE-2026-1254 Wordfence
5.0 Medium MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Plugin mp3-music-player-by-sonaar Server-Side Request Forgery Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery 5.3 – 5.10 CVE-2026-1249 Wordfence
7.5 High Flexi Product Slider and Grid for WooCommerce Plugin flexi-product-slider-grid Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute ≤ 1.0.5 CVE-2026-1988 Wordfence
5.4 Medium Scheduler Widget Plugin scheduler-widget Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification ≤ 0.1.6 CVE-2026-1987 Wordfence
6.4 Medium Simple Plyr Plugin simple-plyr Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute ≤ 0.0.1 CVE-2026-1915 Wordfence
6.4 Medium ZoomifyWP Free Plugin tz-zoomifywp-free Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute ≤ 1.1 CVE-2026-1187 Wordfence
6.4 Medium Chatbot for WordPress by Collect.chat ⚡️ Plugin collectchat Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field ≤ 2.4.8 CVE-2026-0736 Wordfence
6.4 Medium Press3D Plugin press3d Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block ≤ 1.0.2 CVE-2026-1985 Wordfence
7.2 High Super Simple Contact Form Plugin super-simple-contact-form Cross-Site Scripting Reflected Cross-Site Scripting via 'sscf_name' Parameter No login needed ≤ 1.6.2 CVE-2026-0753 Wordfence
9.8 Critical midi-Synth Plugin midi-synth Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'export' AJAX Action No login needed ≤ 1.1.0 CVE-2026-1306 Wordfence
4.4 Medium User Language Switch Plugin user-language-switch Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter ≤ 1.6.10 CVE-2026-0735 Wordfence
4.4 Medium Link Hopper Plugin link-hopper Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter ≤ 2.5 CVE-2025-15483 Wordfence
6.4 Medium UpMenu Plugin upmenu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute ≤ 3.1 CVE-2026-1910 Wordfence
5.3 Medium MailChimp Campaigns Plugin olalaweb-mailchimp-campaign-manager Broken Access Control Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection No login needed ≤ 3.2.4 CVE-2026-1303 Wordfence
6.4 Medium Best-wp-google-map Plugin best-wp-google-map Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute ≤ 2.1 CVE-2026-1096 Wordfence
4.4 Medium Allow HTML in Category Descriptions Plugin allow-html-in-category-descriptions Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions ≤ 1.2.4 CVE-2026-0693 Wordfence
6.4 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Cross-Site Scripting for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode ≤ 3.7.11 CVE-2026-0559 Wordfence
6.4 Medium Sphere Manager Plugin sphere-manager Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute ≤ 1.0.2 CVE-2026-1905 Wordfence
4.3 Medium WP Quick Contact Us Plugin wp-quick-contact-us Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2026-1394 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only