WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 901–950 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 19 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content ≤ 2.8.4 CVE-2026-14472 Wordfence
8.8 High Mapster WP Maps Plugin mapster-wp-maps Privilege Escalation Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter ≤ 1.23.0 CVE-2026-12954 Wordfence
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter ≤ 9.3.0 CVE-2026-75961 Wordfence
7.5 High Printcart Web to Print Product Designer for WooCommerce Plugin printcart-integration Path Traversal Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters No login needed ≤ 2.8.5 CVE-2026-14323 Wordfence
6.4 Medium Strong Testimonials Plugin strong-testimonials Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute ≤ 3.3.8 CVE-2026-92622 Wordfence
6.1 Medium Newsletter Plugin newsletter Cross-Site Scripting Reflected Cross-Site Scripting via 'nn' Parameter No login needed ≤ 9.3.8 CVE-2026-90981 Wordfence
4.3 Medium LatePoint Plugin latepoint Broken Access Control Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) ≤ 5.6.3 CVE-2026-13471 Wordfence
6.1 Medium ShopLentor Plugin woolentor-addons Cross-Site Scripting Reflected Cross-Site Scripting via Query-String Parameter Name No login needed ≤ 3.5.1 CVE-2026-92554 Wordfence
7.5 High WCFM Marketplace Plugin wc-multivendor-marketplace SQL Injection Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' Parameter No login needed ≤ 3.8.2 CVE-2026-18442 Wordfence
6.5 Medium WP Inventory Manager Plugin wp-inventory-manager SQL Injection Authenticated (Contributor+) SQL Injection via 'where' Shortcode Attribute ≤ 2.5.1 CVE-2026-17607 Wordfence
6.4 Medium VK All in One Expansion Unit Plugin vk-all-in-one-expansion-unit Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta ≤ 9.118.0 CVE-2026-17586 Wordfence
6.1 Medium Booking Calendar Plugin booking Cross-Site Scripting Reflected Cross-Site Scripting via 'options' Parameter No login needed ≤ 11.8.2 CVE-2026-92561 Wordfence
6.1 Medium EmbedPress Plugin embedpress Cross-Site Scripting Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters No login needed ≤ 4.6.5 CVE-2026-89330 Wordfence
5.3 Medium GPTranslate Plugin gptranslate Information Disclosure Unauthenticated Sensitive Information Exposure in Public Frontend Inline Script No login needed ≤ 2.34.6 CVE-2026-89278 Wordfence
6.4 Medium Custom Twitter Feeds Plugin custom-twitter-feeds Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute ≤ 2.8.0 CVE-2026-84909 Wordfence
6.4 Medium Auto Upload Images Plugin auto-upload-images Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags ≤ 3.3.2 CVE-2026-12106 Wordfence
7.2 High Booking Calendar Plugin booking Privilege Escalation Authenticated (Editor+) Privilege Escalation to 'data_name' Parameter ≤ 11.8.2 CVE-2026-92619 Wordfence
4.3 Medium Magazine Blocks Plugin magazine-blocks Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint ≤ 1.8.6 CVE-2026-75017 Wordfence
5.3 Medium Divi Theme Broken Access Control Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint No login needed ≤ 5.11.1 CVE-2026-91707 Wordfence
4.3 Medium Filter Gallery Plugin filter-gallery Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action ≤ 1.1.4 CVE-2026-89138 Wordfence
6.5 Medium Download Manager Plugin download-manager Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'wpdm_duplicate' Parameter ≤ 3.3.68 CVE-2026-92714 Wordfence
6.4 Medium Magazine Blocks Plugin magazine-blocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute ≤ 1.8.6 CVE-2026-75016 Wordfence
4.3 Medium Foxtool All-in-One: Contact chat button, Custom login, Media optimize images Plugin foxtool Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action ≤ 2.5.3 CVE-2026-18317 Wordfence
8.1 High Filter Gallery Plugin filter-gallery Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter ≤ 1.1.4 CVE-2026-89413 Wordfence
6.5 Medium InfiniteWP Client Plugin iwp-client SQL Injection Authenticated (Admin+) SQL Injection via 'iwp_get_comments_*' Array Key ≤ 1.13.9 CVE-2026-17576 Wordfence
5.3 Medium Clean Login Plugin clean-login Authentication Bypass Unauthenticated CAPTCHA Bypass via Empty Session Comparison No login needed < 1.19 Fixed in 1.19 CVE-2026-90977 WPScan
5.3 Medium Clean Login Plugin clean-login Broken Access Control Unauthenticated Account Creation with Registration Disabled No login needed < 1.19 Fixed in 1.19 CVE-2026-90976 WPScan
6.6 Medium All Bootstrap Blocks Plugin Local File Inclusion Contributor+ LFI via lightspeed Block Attributes 1.3.20 – 1.3.31 CVE-2026-88994 WPScan
5.3 Medium WP Ghost (Hide My WP Ghost) Plugin Other Unauthenticated URL Hiding Bypass via Loopback Compatibility Check No login needed < 7.0.11 Fixed in 7.0.11 CVE-2026-86800 WPScan
5.3 Medium WP Ghost (Hide My WP Ghost) Plugin Other Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters No login needed 7.0.10 – < 7.0.11 Fixed in 7.0.11 CVE-2026-86796 WPScan
6.5 Medium Breeze Cache Plugin breeze Other Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters No login needed 1.2.5 – < 2.5.15 Fixed in 2.5.15 CVE-2026-79713 WPScan
5.8 Medium Generate PDF using Contact Form 7 Plugin generate-pdf-using-contact-form-7 Server-Side Request Forgery Unauthenticated Server-Side Request Forgery via Array-Valued Form Field No login needed < 4.2.2 Fixed in 4.2.2 CVE-2026-90984 WPScan
7.1 High Filter Gallery Plugin filter-gallery Broken Access Control Subscriber+ Arbitrary Post Overwrite and Plugin Option Deletion via Fail-Open Nonce Check 1.1.2 – < 1.1.5 Fixed in 1.1.5 CVE-2026-90978 WPScan
2.7 Low Bookit Plugin bookit-for-cal-com Information Disclosure Bookit Staff+ Appointment PII Disclosure < 2.6.0.5 Fixed in 2.6.0.5 CVE-2026-89008 WPScan
2.7 Low Bookit Plugin bookit-for-cal-com Broken Access Control Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization < 2.6.0.5 Fixed in 2.6.0.5 CVE-2026-89007 WPScan
6.8 Medium All Bootstrap Blocks Plugin Cross-Site Scripting Contributor+ Stored XSS via areoi/button type Attribute ≤ 1.3.31 CVE-2026-88993 WPScan
2.7 Low MasterStudy LMS 3.6.2 Plugin Information Disclosure < 3.7.50 - Instructor+ Student PII Disclosure via IDOR 3.6.2 – < 3.7.50 Fixed in 3.7.50 CVE-2026-88844 WPScan
8.8 High iGMS Direct Booking Plugin igms-direct-booking Cross-Site Scripting Unauthenticated Stored XSS via Widget Settings No login needed < 2.0 Fixed in 2.0 CVE-2026-88825 WPScan
5.3 Medium Really Simple Security (Free) Plugin Denial of Service Unauthenticated Unbounded Option Growth via Spoofed Client IP Header No login needed 8.1.6 – < 9.8.3 Fixed in 9.8.3 CVE-2026-88798 WPScan
5.3 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR No login needed 4.0 – < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87966 WPScan
4.8 Medium Easy Appointments Plugin easy-appointments Broken Access Control Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token No login needed < 4.0.2.2 Fixed in 4.0.2.2 CVE-2026-87965 WPScan
8.6 High Tz Weekly Radio Schedule Plugin SQL Injection Unauthenticated SQLi via tzwrs_update_cell No login needed ≤ 1.8.1 CVE-2026-87775 WPScan
8.6 High Tz Weekly Radio Schedule Plugin SQL Injection Unauthenticated SQL Injection via week No login needed ≤ 1.8.1 CVE-2026-87774 WPScan
8.6 High Product Question and Answer Plugin SQL Injection Unauthenticated SQL Injection via p_id and read No login needed ≤ 1.1.0 CVE-2026-87771 WPScan
8.6 High Price Drop Alert for WooCommerce Plugin SQL Injection Unauthenticated SQL Injection via product No login needed ≤ 1.1 CVE-2026-87770 WPScan
8.6 High WP Shortcut Link Plugin SQL Injection Unauthenticated SQL Injection via url No login needed ≤ 1.2.0 CVE-2026-87767 WPScan
5.3 Medium UpsellWP Plugin checkout-upsell-and-order-bumps Price Manipulation Unauthenticated Price Manipulation via Frequently Bought Together No login needed 1.4.4 – < 2.2.10 Fixed in 2.2.10 CVE-2026-85350 WPScan
8.8 High VikBooking Plugin Cross-Site Scripting Unauthenticated Stored XSS via SVG Chat Attachment No login needed 1.8.8 – < 1.8.15 Fixed in 1.8.15 CVE-2026-85127 WPScan
5.3 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control Unauthenticated Registration Policy Bypass via Login Form Type Confusion No login needed 4.0.0 – < 4.2.0 Fixed in 4.2.0 CVE-2026-85123 WPScan
8.8 High Easy Form Builder Plugin easy-form-builder Cross-Site Scripting Unauthenticated Stored XSS via Form Type Confusion No login needed 4.0.0 – < 4.2.0 Fixed in 4.2.0 CVE-2026-85122 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only