WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 8,651–8,700 of 29,694 vulnerabilities

Known WordPress vulnerabilities, page 174 of 594
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Twitter posts to Blog Plugin twitter-posts-to-blog Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Update No login needed ≤ 1.11.25 CVE-2026-1786 Wordfence
8.8 High Custom Block Builder – Lazy Blocks Plugin lazy-blocks Remote Code Execution Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution ≤ 4.2.0 CVE-2026-1560 Wordfence
6.4 Medium HTML Shortcodes Plugin html-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.1 CVE-2026-1809 Wordfence
4.3 Medium Invoct – PDF Invoices & Billing for WooCommerce Plugin kirilkirkov-pdf-invoice-manager Broken Access Control PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure ≤ 1.6 CVE-2026-1748 Wordfence
4.4 Medium WPlyr Media Block Plugin wplyr-media-block Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter ≤ 1.3.0 CVE-2026-0724 Wordfence
6.4 Medium BuddyHolis ListSearch Plugin listsearch Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute ≤ 1.1 CVE-2026-1853 Wordfence
4.3 Medium MMA Call Tracking Plugin mma-call-tracking Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 2.3.15 CVE-2026-1215 Wordfence
6.4 Medium Slideshow Wp Plugin slideshow-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute ≤ 1.1 CVE-2026-1885 Wordfence
6.4 Medium Microtango Plugin microtango Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.9.29 CVE-2026-1821 Wordfence
6.4 Medium WDES Responsive Popup Plugin wdes-responsive-popup Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute ≤ 1.3.6 CVE-2026-1804 Wordfence
7.2 High iONE360 configurator Plugin ione360-configurator Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Contact Form Parameters No login needed ≤ 2.0.57 CVE-2025-15440 Wordfence
6.5 Medium WP eCommerce Plugin PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 3.15.1 CVE-2026-1235 WPScan
6.5 Medium OpenPix Plugin openpix-for-woocommerce Broken Access Control Subscriber+ Payment Gateway Settings Reset ≤ 2.13.3 CVE-2025-15400 WPScan
9.8 Critical Migration, Backup, Staging Plugin wpvivid-backuprestore Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 0.9.123 CVE-2026-1357 Wordfence
6.4 Medium Orbisius Random Name Generator Plugin orbisius-random-name-generator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute ≤ 1.0.2 CVE-2026-1893 Wordfence
6.4 Medium Beaver Builder Page Builder – Drag and Drop Website Builder Plugin beaver-builder-lite-version Broken Access Control Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings ≤ 2.10.0.5 CVE-2026-1231 Wordfence
7.2 High Lucky Wheel Giveaway Plugin wp-lucky-wheel Remote Code Execution Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter ≤ 1.0.22 CVE-2025-14541 Wordfence
6.5 Medium SlimStat Analytics Plugin wp-slimstat SQL Injection Authenticated (Subscriber+) SQL Injection via `args` Parameter ≤ 5.3.1 CVE-2025-13431 Wordfence
4.3 Medium Gallery by FooGallery Plugin foogallery Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure ≤ 3.1.9 CVE-2025-15524 Wordfence
5.4 Medium PopupKit Plugin popup-builder-block Broken Access Control Missing Authorization to Sensitive Information Disclosure and Data Deletion ≤ 2.2.0 CVE-2025-14895 Wordfence
6.4 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.1.2 CVE-2026-1922 Wordfence
7.2 High Name Directory Plugin name-directory Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form No login needed ≤ 1.32.0 CVE-2026-1866 Wordfence
7.5 High Ninja Forms Plugin ninja-forms Information Disclosure Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action No login needed ≤ 3.14.0 CVE-2026-2268 Wordfence
5.3 Medium WCFM Marketplace Plugin wc-multivendor-marketplace Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation No login needed ≤ 3.7.0 CVE-2026-1722 Wordfence
6.4 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module ≤ 6.1.14 CVE-2026-0996 Wordfence
4.3 Medium WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Plugin wc-multivendor-membership Broken Access Control WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment ≤ 2.11.8 CVE-2025-15147 Wordfence
7.2 High WCFM - WooCommerce Frontend Manager Plugin wc-frontend-manager Broken Access Control WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update ≤ 6.7.24 CVE-2026-0845 Wordfence
5.4 Medium Fluent Forms Pro Add On Pack Plugin Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' ≤ 6.1.12 CVE-2026-0632 Wordfence
8.8 High JAY Login & Register Plugin jay-login-register Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via jay_panel_ajax_update_profile ≤ 2.6.03 CVE-2025-15100 Wordfence
9.8 Critical JAY Login & Register Plugin jay-login-register Privilege Escalation Unauthenticated Privilege Escalation via jay_login_register_ajax_create_final_user No login needed ≤ 2.6.03 CVE-2025-15027 Wordfence
6.4 Medium OMIGO Plugin omigo Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.3 CVE-2026-1573 Wordfence
6.5 Medium The Bucketlister Plugin the-bucketlister SQL Injection Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes ≤ 0.1.5 CVE-2025-15477 Wordfence
4.3 Medium The Bucketlister Plugin the-bucketlister Broken Access Control Missing Authorization to Authenticated (Subscriber+) Bucket List Modification ≤ 0.1.5 CVE-2025-15476 Wordfence
6.4 Medium Wonka Slide Plugin wonka-slide Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.3.3 CVE-2026-1613 Wordfence
6.4 Medium Wikiloops Track Player Plugin wikiloops-track-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.1 CVE-2026-1611 Wordfence
4.3 Medium TITLE ANIMATOR Plugin title-animator Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2026-1082 Wordfence
6.4 Medium Video Onclick Plugin video-onclick Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 0.4.7 CVE-2026-1608 Wordfence
6.4 Medium Premmerce Plugin premmerce Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint ≤ 1.3.20 CVE-2026-0555 Wordfence
5.3 Medium Advanced Country Blocker Plugin advanced-country-blocker Broken Access Control Unauthenticated Authorization Bypass via Insecure Default Secret Key No login needed ≤ 2.3.1 CVE-2026-1675 Wordfence
6.1 Medium MP-Ukagaka Plugin mp-ukagaka Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.5.2 CVE-2026-1643 Wordfence
6.1 Medium Subitem AL Slider Plugin subitem-al-slider Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed ≤ 1.0.0 CVE-2026-1634 Wordfence
6.4 Medium Simple Bible Verse via Shortcode Plugin simple-bible-verse-via-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.1 CVE-2026-1570 Wordfence
5.5 Medium Post Slides Plugin Local File Inclusion Contributor+ Local File Inclusion ≤ 1.0.1 CVE-2025-15491 WPScan
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid ≤ 5.5.3 CVE-2025-13463 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 5.4.8 CVE-2025-12159 Wordfence
6.4 Medium Bold Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode ≤ 5.5.1 CVE-2025-12803 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode ≤ 5.6.1 CVE-2025-15267 Wordfence
6.4 Medium Yoast SEO Plugin wordpress-seo Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute ≤ 26.8 CVE-2026-1293 Wordfence
4.3 Medium Code Snippets Plugin code-snippets Cross-Site Request Forgery Cross-Site Request Forgery to Cloud Snippet Download/Update Actions No login needed ≤ 3.9.4 CVE-2026-1785 Wordfence
6.4 Medium Events Listing Widget Plugin events-listing-widget Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field ≤ 1.3.4 CVE-2026-1252 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only