WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 901–950 of 17,674 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 19 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Theme My Login Plugin theme-my-login Broken Access Control Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation 7.0 – < 7.2.0 Fixed in 7.2.0 CVE-2026-81583 WPScan
4.3 Medium JetStyleManager Plugin jet-style-manager Cross-Site Request Forgery Skin Deletion and Modification via CSRF No login needed < 1.3.9 Fixed in 1.3.9 CVE-2026-81432 WPScan
6.5 Medium WC Vendors Plugin wc-vendors Broken Access Control Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR < 2.7.2.1 Fixed in 2.7.2.1 CVE-2026-81428 WPScan
4.3 Medium WC Vendors Plugin wc-vendors Broken Access Control Vendor+ Cross-Vendor Order Shipment Status Change < 2.7.2.1 Fixed in 2.7.2.1 CVE-2026-81427 WPScan
4.3 Medium WC Vendors Plugin wc-vendors Cross-Site Request Forgery Order Shipment Status Change via CSRF No login needed < 2.7.2.1 Fixed in 2.7.2.1 CVE-2026-81426 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Statistics Disclosure via student/stats REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81199 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Unpublished Course Title Disclosure via course-list REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81197 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Enrollment Disclosure via student-courses REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81195 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter < 3.7.46 Fixed in 3.7.46 CVE-2026-81194 WPScan
4.3 Medium CatalogX Plugin woocommerce-catalog-enquiry Content Injection Unauthenticated Email Content Injection via Shared Transient No login needed < 6.1.3 Fixed in 6.1.3 CVE-2026-79621 WPScan
5.3 Medium FormLayer Plugin formlayer Information Disclosure Unauthenticated Form Configuration Disclosure via Form Submission Response No login needed < 1.0.9 Fixed in 1.0.9 CVE-2026-78151 WPScan
4.9 Medium Rank Math SEO Plugin seo-by-rank-math Broken Access Control Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas 1.0.48 – < 1.0.277 Fixed in 1.0.277 CVE-2026-77788 WPScan
5.3 Medium Rank Math SEO Plugin seo-by-rank-math Information Disclosure Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt No login needed < 1.0.277.1 Fixed in 1.0.277.1 CVE-2026-77782 WPScan
4.3 Medium GamiPress Plugin gamipress Broken Access Control Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners < 7.9.9.6 Fixed in 7.9.9.6 CVE-2026-77764 WPScan
5.3 Medium MultiVendorX Plugin dc-woocommerce-multi-vendor Information Disclosure Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint No login needed 5.0.13 – < 5.0.15 Fixed in 5.0.15 CVE-2026-74927 WPScan
6.8 Medium Social Media Share Buttons & Social Sharing Icons Plugin ultimate-social-media-icons Cross-Site Scripting Contributor+ Stored XSS via Post Title < 3.0.1 Fixed in 3.0.1 CVE-2026-19719 WPScan
5.3 Medium Comments – wpDiscuz Plugin wpdiscuz Information Disclosure wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi No login needed < 7.6.66 Fixed in 7.6.66 CVE-2026-19704 WPScan
5.3 Medium Ultimate Member Plugin ultimate-member Information Disclosure Unauthenticated Unapproved Comment Disclosure via Profile Activity No login needed < 2.13.0 Fixed in 2.13.0 CVE-2026-19251 WPScan
4.3 Medium Gutentor Plugin gutentor Information Disclosure Subscriber+ Password Protected Post Password Disclosure via REST API < 4.0.6 Fixed in 4.0.6 CVE-2026-16983 WPScan
5.3 Medium Solace Extra Plugin solace-extra Information Disclosure Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content No login needed < 1.7.0 Fixed in 1.7.0 CVE-2026-16966 WPScan
5.3 Medium Appointment Booking Lite Plugin Broken Access Control Unauthenticated Arbitrary Reservation Deletion No login needed < 2.4.8 Fixed in 2.4.8 CVE-2026-15232 WPScan
6.5 Medium Amelia Plugin Broken Access Control Unauthenticated Post-Booking Action Trigger No login needed < 2.4.9 Fixed in 2.4.9 CVE-2026-14215 WPScan
6.8 Medium BEAF Plugin Cross-Site Scripting Author+ Stored XSS via Before Label < 4.7.19 Fixed in 4.7.19 CVE-2025-15664 WPScan
6.8 Medium BEAF Plugin Cross-Site Scripting Author+ Stored XSS via After Label < 4.7.19 Fixed in 4.7.19 CVE-2025-15663 WPScan
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode ≤ 4.27.6 CVE-2026-3851 Wordfence
6.4 Medium WP Recipe Maker Premium Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode ≤ 10.5.0 CVE-2026-7877 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Authentication Bypass Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding No login needed ≤ 4.8.1 CVE-2026-77194 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode ≤ 2.1.19 CVE-2026-16788 Wordfence
6.4 Medium WPBakery Page Builder Plugin js_composer Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter ≤ 8.7.4 CVE-2026-15101 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode ≤ 2.1.19 CVE-2026-16786 Wordfence
5.3 Medium KiviCare – Clinic & Patient Management System (EHR) Plugin kivicare-clinic-management-system Information Disclosure Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure No login needed < 4.5.5 Fixed in 4.5.5 CVE-2026-13611 WPScan
4.8 Medium MW WP Form Plugin mw-wp-form Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags No login needed < 5.1.5 Fixed in 5.1.5 CVE-2026-78363 WPScan
6.5 Medium WP Fastest Cache Plugin wp-fastest-cache Other Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters No login needed 0.8.7.7 – < 1.5.1 Fixed in 1.5.1 CVE-2026-74916 WPScan
6.4 Medium Blocksy Companion Plugin blocksy-companion Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) ≤ 2.1.51 CVE-2026-18488 Wordfence
6.4 Medium BetterDocs Plugin betterdocs Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content ≤ 4.8.1 CVE-2026-75980 Wordfence
6.1 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'email' Parameter No login needed ≤ 4.0.0 CVE-2026-75964 Wordfence
6.5 Medium Charitable Plugin charitable SQL Injection Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute ≤ 1.8.12.1 CVE-2026-77189 Wordfence
5.3 Medium Cozy Blocks Plugin cozy-addons Broken Access Control Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter No login needed ≤ 2.2.17 CVE-2026-19948 Wordfence
4.9 Medium LearnPress Plugin learnpress SQL Injection Authenticated (Administrator+) SQL Injection via 'orderby' Parameter ≤ 4.4.4 CVE-2026-77823 Wordfence
6.4 Medium Frontend Admin by DynamiApps Plugin acf-frontend-form-element Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute ≤ 3.29.11 CVE-2026-12747 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode ≤ 2.1.19 CVE-2026-16787 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute ≤ 2.1.19 CVE-2026-13203 Wordfence
4.9 Medium Photo Gallery by Ays Plugin gallery-photo-gallery SQL Injection Authenticated (Administrator+) SQL Injection via 's' Parameter ≤ 6.8.2 CVE-2026-76006 Wordfence
6.4 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute ≤ 4.0.0 CVE-2026-75965 Wordfence
6.5 Medium Persistent Login Plugin wp-persistent-login SQL Injection Authenticated (Subscriber+) SQL Injection via 'wppl_device_id' Cookie ≤ 3.1.0 CVE-2026-18752 Wordfence
4.9 Medium Shopping Cart & eCommerce Store Plugin wp-easycart SQL Injection Authenticated (Administrator+) SQL Injection via 'product_order' Parameter ≤ 5.9.2 CVE-2026-17589 Wordfence
5.4 Medium Post SMTP Plugin post-smtp Broken Access Control Settings Change 4.0.0 – beta.1 Fixed in 4.0.1 CVE-2026-81278 Patchstack
6.5 Medium Kalles Addons Plugin kalles-addons Cross-Site Scripting ≤ 1.0.6 CVE-2026-81778 Patchstack
6.5 Medium Booking and Rental Manager Plugin booking-and-rental-manager-for-woocommerce Broken Access Control ≤ 2.7.6 Fixed in 2.7.7 CVE-2026-81762 Patchstack
6.3 Medium OwnerRez API Plugin ownerrez Broken Access Control ≤ 1.2.6 Fixed in 1.3.0 CVE-2026-81758 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only