WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 51–100 of 313 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Masteriyo - LMS Plugin learning-management-system Arbitrary File Upload LMS plugin <= 2.3.2 - Arbitrary File Upload No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-73996 Patchstack
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-73404 Patchstack
6.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Privilege Escalation ≤ 3.7.41 Fixed in 3.7.42 CVE-2026-68568 Patchstack
6.1 Medium Masteriyo LMS Plugin learning-management-system Cross-Site Scripting Instructor+ Stored XSS via Quiz Description No login needed < 2.3.3 Fixed in 2.3.3 CVE-2026-19712 WPScan
4.3 Medium Tutor LMS Plugin tutor Information Disclosure Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass < 3.9.14 Fixed in 3.9.14 CVE-2026-14306 WPScan
6.5 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint < 3.8.3 Fixed in 3.8.3 CVE-2026-16563 WPScan
5.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control No login needed ≤ 3.7.39 Fixed in 3.7.40 CVE-2026-28145 Patchstack
4.3 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint ≤ 3.8.2 CVE-2026-12376 WPScan
5.4 Medium Tutor LMS Plugin tutor Information Disclosure Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection < 4.0.0 Fixed in 4.0.0 CVE-2026-14310 WPScan
4.3 Medium LifterLMS Plugin lifterlms Information Disclosure Subscriber+ Sensitive Information Disclosure via select2_query_posts < 10.0.10 Fixed in 10.0.10 CVE-2026-14231 WPScan
6.1 Medium LifterLMS Plugin lifterlms Cross-Site Scripting Instructor+ Stored XSS via Featured Pricing Information No login needed 9.2.3 – < 10.0.10 Fixed in 10.0.10 CVE-2026-14207 WPScan
6.5 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Broken Access Control for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion ≤ 3.7.23 CVE-2026-5060 Wordfence
4.9 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter ≤ 4.0.1 CVE-2026-15444 Wordfence
9.1 Critical Masteriyo LMS Plugin learning-management-system Denial of Service Unauthenticated Arbitrary User Session Termination (Denial of Service) No login needed < 2.3.1 Fixed in 2.3.1 CVE-2026-13332 WPScan
5.4 Medium Masteriyo - LMS Plugin learning-management-system Broken Access Control LMS plugin <= 2.3.1 - Insecure Direct Object References (IDOR) ≤ 2.3.1 Fixed in 2.3.2 CVE-2026-65463 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Cross-Site Scripting LMS plugin <= 2.3.0 - Cross Site Scripting (XSS) ≤ 2.3.0 Fixed in 2.3.1 CVE-2026-59513 Patchstack
4.3 Medium Tutor LMS Elementor Addons Plugin tutor-lms-elementor-addons Broken Access Control Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation ≤ 4.0.0 CVE-2026-1372 Wordfence
5.4 Medium Academy LMS Plugin academy Broken Access Control Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR < 3.8.1 Fixed in 3.8.1 CVE-2026-14184 WPScan
6.5 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array ≤ 4.0.0 CVE-2026-15022 Wordfence
4.3 Medium Academy LMS Plugin academy Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference via 'user_id' Parameter ≤ 3.8.0 CVE-2026-9341 Wordfence
6.5 Medium Tutor LMS Plugin tutor Broken Access Control Insecure Direct Object References (IDOR) ≤ 3.9.13 Fixed in 3.9.14 CVE-2026-57694 Patchstack
7.1 High Tutor LMS Plugin tutor Broken Access Control Subscriber+ Unauthorized Course Enrollment and Private Course Content Disclosure via Droip/Kirki Integration < 3.9.13 Fixed in 3.9.13 CVE-2026-12275 WPScan
6.5 Medium Tutor LMS Plugin tutor Broken Access Control Instructor+ Arbitrary Post Overwrite via IDOR < 3.9.13 Fixed in 3.9.13 CVE-2026-12274 WPScan
4.3 Medium Tutor LMS Plugin tutor Broken Access Control Subscriber+ Arbitrary Auto-Approved Comment Creation < 3.9.13 Fixed in 3.9.13 CVE-2026-12273 WPScan
5.4 Medium Tutor LMS Plugin tutor Broken Access Control Subscriber+ Arbitrary Quiz Attempt Modification via IDOR < 3.9.13 Fixed in 3.9.13 CVE-2026-12271 WPScan
7.1 High LMS Theme lms Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 9.7 CVE-2026-27404 Patchstack
5.3 Medium Academy LMS Plugin academy Broken Access Control Unauthenticated Insecure Direct Object Reference to Private Topic Disclosure No login needed ≤ 3.8.1 CVE-2026-5348 Wordfence
6.4 Medium Tutor LMS Plugin tutor Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title ≤ 3.9.13 CVE-2026-13443 Wordfence
6.5 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Cross-Site Scripting ≤ 3.7.27 Fixed in 3.7.28 CVE-2026-57330 Patchstack
4.3 Medium Masteriyo LMS Plugin learning-management-system Broken Access Control Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification ≤ 2.2.1 CVE-2026-11773 Wordfence
4.3 Medium MasterStudy LMS Plugin masterstudy-lms-learning-management-system Broken Access Control ≤ 3.7.30 Fixed in 3.7.31 CVE-2026-57640 Patchstack
6.5 Medium Masteriyo LMS Plugin learning-management-system Information Disclosure Unauthenticated Course Progress Disclosure and Deletion No login needed < 2.2.1 Fixed in 2.2.1 CVE-2026-10824 WPScan
4.9 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Administrator+) SQL Injection via 'data' Parameter ≤ 3.9.11 CVE-2026-10736 Wordfence
9.3 Critical Tutor LMS Pro Plugin tutor-pro SQL Injection No login needed ≤ 3.9.6 Fixed in 3.9.7 CVE-2026-22332 Patchstack
8.0 High Academy LMS Pro Plugin academy-pro Arbitrary File Upload < 3.5.2 Fixed in 3.5.2 CVE-2026-39598 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Authentication Bypass LMS plugin <= 2.1.8 - Broken Authentication No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2026-42743 Patchstack
8.5 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection ≤ 3.7.25 Fixed in 3.7.26 CVE-2026-40766 Patchstack
6.5 Medium Tutor LMS Plugin tutor Broken Access Control No login needed ≤ 3.9.7 Fixed in 3.9.8 CVE-2026-40743 Patchstack
7.5 High Masteriyo - LMS Plugin learning-management-system Price Manipulation LMS plugin <= 2.1.5 - Payment Bypass No login needed ≤ 2.1.5 Fixed in 2.1.6 CVE-2026-39524 Patchstack
6.5 Medium MasterStudy LMS Pro Plugin masterstudy-lms-learning-management-system-pro Broken Access Control No login needed < 4.7.16 Fixed in 4.7.16 CVE-2025-64215 Patchstack
8.8 High Masteriyo - LMS Plugin learning-management-system Privilege Escalation LMS plugin <= 2.2.0 - Privilege Escalation ≤ 2.2.0 Fixed in 2.2.1 CVE-2026-49111 Patchstack
6.5 Medium MasterStudy LMS Pro Plus Plugin SQL Injection Authenticated (Instructor+) SQL Injection via 'columns' Parameter ≤ 4.8.20 CVE-2026-8653 Wordfence
9.8 Critical Masteriyo LMS PRO Plugin learning-management-system-pro Privilege Escalation No login needed ≤ 2.20.0 Fixed in 2.20.1 CVE-2025-53209 Patchstack
8.5 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection ≤ 3.7.29 Fixed in 3.7.30 CVE-2026-42730 Patchstack
4.3 Medium LearnPress – WordPress LMS Plugin for Create and Sell Online Courses Plugin learnpress Price Manipulation WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter ≤ 4.3.5 CVE-2026-7648 Wordfence
5.3 Medium Tutor LMS Plugin tutor Broken Access Control Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter No login needed ≤ 3.9.9 CVE-2026-6965 Wordfence
4.4 Medium Website LLMs.txt Plugin website-llms-txt Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 8.2.6 CVE-2026-6712 Wordfence
6.1 Medium Website LLMs.txt Plugin website-llms-txt Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 8.2.6 CVE-2026-6711 Wordfence
5.3 Medium Tutor LMS Plugin tutor Broken Access Control Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order No login needed ≤ 3.9.8 CVE-2026-5502 Wordfence
6.5 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Admin+) SQL Injection via 'date' Parameter ≤ 3.9.8 CVE-2026-6080 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only