WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 851–900 of 6,499 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 18 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.1 High	H5P Plugin `h5p`	Arbitrary File Deletion	`≤ 1.17.7` Fixed in `1.17.8`	Jun 26, 2026	`CVE-2026-57321`	Patchstack
7.1 High	FOX Plugin `woocommerce-currency-switcher`	Cross-Site Scripting No login needed	`≤ 1.4.8` Fixed in `1.4.9`	Jun 26, 2026	`CVE-2026-57319`	Patchstack
7.1 High	Simply Schedule Appointments Plugin `simply-schedule-appointments`	Cross-Site Scripting No login needed	`≤ 1.6.12.2` Fixed in `1.6.12.4`	Jun 26, 2026	`CVE-2026-57317`	Patchstack
8.5 High	Blocksy Companion Pro Plugin `blocksy-companion-pro`	Remote Code Execution	`≤ 2.1.45` Fixed in `2.1.46`	Jun 26, 2026	`CVE-2026-57315`	Patchstack
7.1 High	SureCart Plugin `surecart`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 4.3.2` Fixed in `4.3.3`	Jun 26, 2026	`CVE-2026-57314`	Patchstack
7.1 High	Everest Forms Plugin `everest-forms`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.4.8` Fixed in `3.5.0`	Jun 26, 2026	`CVE-2026-57312`	Patchstack
7.1 High	WoodMart Theme `woodmart`	Cross-Site Scripting No login needed	`≤ 8.5.3` Fixed in `8.5.4`	Jun 26, 2026	`CVE-2026-56072`	Patchstack
7.5 High	Toolset Forms Plugin `cred-frontend-editor`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 2.6.24` Fixed in `2.6.25`	Jun 26, 2026	`CVE-2026-56069`	Patchstack
8.5 High	Tourfic Plugin `tourfic`	SQL Injection	`≤ 2.22.5` Fixed in `2.22.6`	Jun 26, 2026	`CVE-2026-56064`	Patchstack
8.3 High	MailChimp Block Plugin `block-for-mailchimp`	Broken Access Control No login needed	`≤ 1.1.15` Fixed in `1.1.16`	Jun 26, 2026	`CVE-2026-56063`	Patchstack
7.5 High	Subscriptions for WooCommerce Plugin `subscriptions-for-woocommerce`	Broken Access Control No login needed	`≤ 1.9.5` Fixed in `1.9.6`	Jun 26, 2026	`CVE-2026-56061`	Patchstack
7.5 High	Print Invoice & Delivery Notes for WooCommerce Plugin `woocommerce-delivery-notes`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 7.1.1` Fixed in `7.1.2`	Jun 26, 2026	`CVE-2026-56060`	Patchstack
8.8 High	RealHomes Theme `realhomes`	PHP Object Injection	`≤ 4.5.3` Fixed in `4.5.4`	Jun 26, 2026	`CVE-2026-56055`	Patchstack
7.1 High	perfmatters Plugin `perfmatters`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.6.3` Fixed in `2.6.4`	Jun 26, 2026	`CVE-2026-56047`	Patchstack
7.1 High	Automatic Plugin `wp-automatic`	Cross-Site Scripting No login needed	`< 3.135.1` Fixed in `3.135.1`	Jun 26, 2026	`CVE-2026-56045`	Patchstack
7.1 High	Blog2Social Plugin `blog2social`	Cross-Site Scripting No login needed	`≤ 8.9.2` Fixed in `8.9.3`	Jun 26, 2026	`CVE-2026-56044`	Patchstack
7.1 High	Customer Reviews for WooCommerce Plugin `customer-reviews-woocommerce`	Cross-Site Scripting No login needed	`≤ 5.110.1` Fixed in `5.111.0`	Jun 26, 2026	`CVE-2026-56043`	Patchstack
7.1 High	Responsive Lightbox Plugin `responsive-lightbox`	Cross-Site Scripting No login needed	`≤ 2.7.6` Fixed in `2.7.7`	Jun 26, 2026	`CVE-2026-56041`	Patchstack
7.1 High	Gutenverse Form Plugin `gutenverse-form`	Cross-Site Scripting No login needed	`≤ 2.4.7` Fixed in `2.5.0`	Jun 26, 2026	`CVE-2026-56040`	Patchstack
7.1 High	Quick Interest Slider Plugin `quick-interest-slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.6` Fixed in `3.1.7`	Jun 26, 2026	`CVE-2026-56039`	Patchstack
8.8 High	Frisbii Pay Plugin `reepay-checkout-gateway`	Privilege Escalation	`≤ 1.8.2` Fixed in `1.8.2.1`	Jun 26, 2026	`CVE-2026-56038`	Patchstack
8.6 High	BitFire Security Plugin `bitfire`	Other Multiple Vulnerabilities No login needed	`≤ 5.0.3` Fixed in `5.0.4`	Jun 26, 2026	`CVE-2026-56035`	Patchstack
8.1 High	Uncanny Automator Plugin `uncanny-automator`	PHP Object Injection No login needed	`≤ 7.3.1.2` Fixed in `7.3.1.3`	Jun 26, 2026	`CVE-2026-56031`	Patchstack
7.5 High	CorvusPay WooCommerce Payment Gateway Plugin `corvuspay-woocommerce-integration`	Authentication Bypass Broken Authentication No login needed	`≤ 2.7.4` Fixed in `2.7.5`	Jun 26, 2026	`CVE-2026-56029`	Patchstack
7.5 High	Paymob for WooCommerce Plugin `paymob-for-woocommerce`	Broken Access Control No login needed	`≤ 4.1.2`	Jun 26, 2026	`CVE-2026-56025`	Patchstack
7.1 High	MapPress Maps Plugin `mappress-google-maps-for-wordpress`	Cross-Site Scripting No login needed	`≤ 2.97.3` Fixed in `2.97.4`	Jun 26, 2026	`CVE-2026-56011`	Patchstack
8.8 High	Abandoned Cart Pro for WooCommerce Plugin `woocommerce-abandon-cart-pro`	Privilege Escalation	`≤ 10.4.0` Fixed in `10.4.1`	Jun 26, 2026	`CVE-2026-56010`	Patchstack
8.8 High	Fusion Builder Plugin `fusion-builder`	Privilege Escalation	`≤ 3.15.4` Fixed in `3.15.5`	Jun 26, 2026	`CVE-2026-56008`	Patchstack
7.5 High	Stylish Cost Calculator Plugin `stylish-cost-calculator`	Broken Access Control No login needed	`≤ 8.3.9` Fixed in `8.3.10`	Jun 26, 2026	`CVE-2026-54847`	Patchstack
7.5 High	Syncee Premium Dropshipping & Wholesale Plugin `syncee-global-dropshipping`	Broken Access Control No login needed	`≤ 1.0.27` Fixed in `1.0.28`	Jun 26, 2026	`CVE-2026-54846`	Patchstack
7.3 High	Newsletters Plugin `newsletters-lite`	Broken Access Control No login needed	`≤ 4.13` Fixed in `4.14`	Jun 26, 2026	`CVE-2026-54840`	Patchstack
7.5 High	Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups Plugin `trinity-backup`	Information Disclosure Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure No login needed	`≤ 2.0.9` Fixed in `2.0.10`	Jun 26, 2026	`CVE-2026-54839`	Patchstack
7.5 High	Intranet & Private Site – All-In-One Intranet Plugin `all-in-one-intranet`	Broken Access Control All-In-One Intranet plugin <= 1.8.1 - Broken Access Control No login needed	`≤ 1.8.1` Fixed in `1.9.0`	Jun 26, 2026	`CVE-2026-54837`	Patchstack
7.5 High	Five Star Restaurant Menu Plugin `food-and-drink-menu`	Broken Access Control No login needed	`≤ 2.5.2` Fixed in `2.5.3`	Jun 26, 2026	`CVE-2026-54835`	Patchstack
7.5 High	Object Cache 4 everyone Plugin `object-cache-4-everyone`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.3.2` Fixed in `2.3.3`	Jun 26, 2026	`CVE-2026-54834`	Patchstack
7.4 High	Enable CORS Plugin `enable-cors`	Other Backdoor No login needed	`≤ 2.0.3` Fixed in `2.0.4`	Jun 26, 2026	`CVE-2026-54833`	Patchstack
7.5 High	Gutenverse Companion Plugin `gutenverse-companion`	Broken Access Control No login needed	`≤ 2.5.0` Fixed in `2.5.1`	Jun 26, 2026	`CVE-2026-54832`	Patchstack
7.6 High	SupportCandy Plugin `supportcandy`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 3.4.6` Fixed in `3.4.7`	Jun 26, 2026	`CVE-2026-54826`	Patchstack
7.5 High	Ads by WPQuads Plugin `quick-adsense-reloaded`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 3.0.3` Fixed in `3.0.4`	Jun 26, 2026	`CVE-2026-54824`	Patchstack
7.5 High	Goya Core Plugin `goya-core`	Local File Inclusion	`< 1.0.9.4` Fixed in `1.0.9.4`	Jun 26, 2026	`CVE-2025-68064`	Patchstack
7.5 High	Splash - Sport Club WordPress Theme for Basketball, Football, Hockey Theme `splash`	Local File Inclusion Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion	`≤ 4.4.3` Fixed in `4.4.4`	Jun 26, 2026	`CVE-2025-68063`	Patchstack
8.8 High	Eagle Booking Plugin `eagle-booking`	Cross-Site Request Forgery No login needed	`≤ 1.3.4.3`	Jun 26, 2026	`CVE-2025-68052`	Patchstack
8.3 High	APIExperts Square for WooCommerce Plugin `woosquare`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 4.7.3` Fixed in `4.7.4`	Jun 25, 2026	`CVE-2026-54848`	Patchstack
7.5 High	WP Photo Album Plus Plugin `wp-photo-album-plus`	SQL Injection No login needed	`≤ 9.1.13.005` Fixed in `9.2.01.001`	Jun 25, 2026	`CVE-2026-54829`	Patchstack
8.1 High	Royal MCP Plugin `royal-mcp`	Broken Access Control	`≤ 1.4.25` Fixed in `1.4.26`	Jun 25, 2026	`CVE-2026-54842`	Patchstack
7.1 High	Forminator Plugin `forminator`	Cross-Site Scripting No login needed	`≤ 1.53.1` Fixed in `1.53.2`	Jun 25, 2026	`CVE-2026-56071`	Patchstack
7.7 High	JS Help Desk Plugin `js-support-ticket`	Arbitrary File Deletion	`≤ 3.1.1` Fixed in `3.1.2`	Jun 25, 2026	`CVE-2026-56054`	Patchstack
8.8 High	EventPrime Plugin `eventprime-event-calendar-management`	PHP Object Injection	`≤ 4.3.4.1` Fixed in `4.3.4.2`	Jun 25, 2026	`CVE-2026-56053`	Patchstack
7.1 High	TablePress Plugin `tablepress`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.3.1` Fixed in `3.3.2`	Jun 25, 2026	`CVE-2026-56051`	Patchstack
8.5 High	Post Snippets Plugin `post-snippets`	Remote Code Execution	`≤ 4.0.19` Fixed in `4.1.0`	Jun 25, 2026	`CVE-2026-56049`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.