WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 51–100 of 378 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.4 Medium Lockme OAuth2 calendars integration Plugin lockme-calendars-integration Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'App ID' Setting ≤ 2.11.0 CVE-2026-3367 Wordfence
6.1 Medium ICS Calendar Plugin ics-calendar Cross-Site Scripting Reflected Cross-Site Scripting via 'htmltagtitle' Parameter No login needed ≤ 12.0.9 CVE-2026-9838 Wordfence
5.9 Medium Booking calendar, Appointment Booking System Plugin booking-calendar SQL Injection Unauthenticated Time-Based SQL Injection via 'wpdevart_id' No login needed ≤ 3.2.17 CVE-2026-15289 Wordfence
7.2 High EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter No login needed ≤ 4.3.4.2 CVE-2026-13441 Wordfence
6.4 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup ≤ 6.6.2 CVE-2026-6459 Wordfence
7.5 High LatePoint - Calendar Booking Plugin for Appointments and Events Plugin latepoint Broken Access Control Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass No login needed ≤ 5.4.0 CVE-2026-5356 Wordfence
7.5 High My Calendar Plugin my-calendar SQL Injection Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters No login needed ≤ 3.7.8 CVE-2026-6854 Wordfence
5.3 Medium My Calendar Plugin my-calendar Broken Access Control Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'vcal' Parameter No login needed ≤ 3.7.14 CVE-2026-11896 Wordfence
4.3 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure ≤ 1.4.02 CVE-2026-12113 Wordfence
9.8 Critical EventON - WordPress Virtual Event Calendar Plugin SQL Injection WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter No login needed ≤ 5.0.11 CVE-2026-9711 Wordfence
4.9 Medium Fluent Booking Plugin fluent-booking Information Disclosure Calendar Manager+ Sensitive Information Disclosure via Attendee Export < 2.1.2 Fixed in 2.1.2 CVE-2026-9576 WPScan
8.8 High EventPrime Plugin eventprime-event-calendar-management PHP Object Injection ≤ 4.3.4.1 Fixed in 4.3.4.2 CVE-2026-56053 Patchstack
4.3 Medium Book a Room Event Calendar Plugin book-a-room-event-calendar Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.9 CVE-2026-9721 Wordfence
6.4 Medium Appointment Booking Calendar Plugin creavi-booking-service Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label ≤ 1.4.4 CVE-2026-1856 Wordfence
4.3 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter ≤ 1.4.01 CVE-2026-12111 Wordfence
8.5 High Events Schedule - WordPress Events Calendar Plugin weekly-class SQL Injection WordPress Events Calendar Plugin plugin <= 2.7.2 - SQL Injection ≤ 2.7.2 CVE-2025-69135 Patchstack
9.3 Critical The Events Calendar Plugin the-events-calendar SQL Injection No login needed 6.15.12 – 6.16.2 Fixed in 6.16.3 CVE-2026-49772 Patchstack
8.1 High EventPrime Plugin eventprime-event-calendar-management PHP Object Injection No login needed ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42687 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42686 Patchstack
8.8 High Events Calendar for GeoDirectory Plugin events-for-geodirectory PHP Object Injection ≤ 2.3.25 Fixed in 2.3.26 CVE-2026-39532 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.3.0.0 Fixed in 4.3.0.1 CVE-2026-39518 Patchstack
8.8 High Events Calendar for GeoDirectory Plugin events-for-geodirectory Privilege Escalation Authenticated (Subscriber+) Privilege Escalation ≤ 2.3.28 CVE-2026-11616 Wordfence
7.5 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control No login needed ≤ 4.3.2.0 Fixed in 4.3.2.1 CVE-2026-42669 Patchstack
5.3 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint No login needed ≤ 1.6.11.8 CVE-2026-6937 Wordfence
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'append_where_sql' Parameter No login needed ≤ 1.6.11.8 CVE-2026-7797 Wordfence
7.2 High Booking Calendar – Event Calendar Plugin Cross-Site Scripting Event Calendar <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters No login needed ≤ 2.1.6 CVE-2026-8143 Wordfence
5.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Denial of Service Unauthenticated Denial of Service No login needed ≤ 1.6.11.5 CVE-2026-7493 Wordfence
4.3 Medium My Calendar Plugin my-calendar Broken Access Control Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter ≤ 3.7.9 CVE-2026-7525 Wordfence
6.5 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Unauthenticated Arbitrary Appointment View, Modification and Deletion No login needed ≤ 1.6.10.6 CVE-2026-4807 Wordfence
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Broken Access Control Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint No login needed ≤ 2.1.2 CVE-2026-6449 Wordfence
5.3 Medium Booking Calendar Contact Form Plugin booking-calendar-contact-form Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Calendar Takeover No login needed ≤ 1.2.63 CVE-2026-6810 Wordfence
8.8 High my-calendar Plugin Information Disclosure My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog No login needed < 3.7.7 CVE-2026-40308 GitHub_M
4.4 Medium List View Google Calendar Plugin list-view-google-calendar Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description ≤ 7.4.3 CVE-2026-2396 Wordfence
4.3 Medium Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) Plugin Broken Access Control Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure ≤ 4.1.8 CVE-2026-4109 Wordfence
6.5 Medium CP Multi View Event Calendar Plugin cp-multi-view-calendar Cross-Site Scripting ≤ 1.4.36 CVE-2026-25465 Patchstack
7.1 High Booking calendar, Appointment Booking System Plugin booking-calendar Cross-Site Scripting No login needed ≤ 3.2.36 CVE-2026-25435 Patchstack
9.8 Critical EventPrime Plugin eventprime-event-calendar-management PHP Object Injection No login needed ≤ 4.2.8.0 Fixed in 4.2.8.1 CVE-2026-24378 Patchstack
7.5 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control No login needed ≤ 4.2.6.0 Fixed in 4.2.7.0 CVE-2025-69358 Patchstack
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'fields' Parameter No login needed ≤ 1.6.10.0 CVE-2026-3658 Wordfence
7.5 High EventPrime Plugin eventprime-event-calendar-management Price Manipulation Payment Bypass No login needed ≤ 4.2.8.3 Fixed in 4.2.8.4 CVE-2026-25312 Patchstack
5.3 Medium Modern Events Calendar Plugin modern-events-calendar Broken Access Control No login needed ≤ 7.29.0 CVE-2026-32583 Patchstack
6.5 Medium Editorial Calendar Plugin editorial-calendar Cross-Site Scripting ≤ 3.9.0 Fixed in 3.9.1 CVE-2026-32361 Patchstack
7.6 High Booking Calendar Plugin booking SQL Injection ≤ 10.14.15 Fixed in 10.14.16 CVE-2026-32358 Patchstack
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint No login needed ≤ 1.6.9.29 CVE-2026-3045 Wordfence
4.3 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure ≤ 1.6.9.29 CVE-2026-1704 Wordfence
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'append_where_sql' Parameter No login needed ≤ 1.6.9.27 CVE-2026-1708 Wordfence
6.1 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Request Forgery Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting No login needed ≤ 5.2.7 CVE-2026-2324 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar Path Traversal Authenticated (Author+) Arbitrary File Read via ajax_create_import No login needed ≤ 6.15.17 CVE-2026-3585 Wordfence
6.4 Medium Hammas Calendar Plugin hammas-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute ≤ 1.5.11 CVE-2026-1902 Wordfence
6.4 Medium My Calendar – Accessible Event Manager Plugin my-calendar Cross-Site Scripting Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.7.3 CVE-2026-2355 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only