WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 51–100 of 284 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member SQL Injection User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection No login needed ≤ 2.10.1 CVE-2026-15290 Wordfence
5.3 Medium ARMember Plugin armember-membership Path Traversal Directory Traversal via X-FILENAME No login needed ≤ 4.0.27 CVE-2026-15302 Wordfence
5.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter No login needed ≤ 4.3.7 CVE-2026-12418 Wordfence
4.3 Medium Memberships and User Profiles for WooCommerce Plugin ecommerce-user-profiles-by-profilegrid Broken Access Control Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation ≤ 3.4 CVE-2026-11359 Wordfence
5.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Broken Access Control Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite No login needed ≤ 4.3.1 CVE-2026-5459 Wordfence
8.1 High WCFM - WooCommerce Multivendor Membership Plugin wc-multivendor-membership Broken Access Control WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite ≤ 2.11.10 CVE-2026-3688 Wordfence
8.8 High Simple Membership Plugin simple-membership Cross-Site Scripting Unauthenticated Stored XSS via Stripe Webhook API Version No login needed < 4.7.5 Fixed in 4.7.5 CVE-2026-11855 WPScan
6.5 Medium User Registration & Membership Plugin user-registration Authentication Bypass Unauthenticated Paid Membership Bypass No login needed < 5.2.0 Fixed in 5.2.0 CVE-2026-11965 WPScan
4.4 Medium Team Members Plugin team-showcase-supreme Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter ≤ 8.7 CVE-2026-12114 Wordfence
8.8 High Paid Memberships Pro - Add Member From Admin Plugin pmpro-add-member-admin Cross-Site Request Forgery Add Member From Admin plugin <= 0.7.2 - Cross Site Request Forgery (CSRF) No login needed ≤ 0.7.2 Fixed in 0.7.3 CVE-2026-57659 Patchstack
6.5 Medium User Registration & Membership Plugin user-registration Broken Access Control Missing Authorization to Unauthenticated Payment Bypass No login needed ≤ 5.2.0 CVE-2026-1869 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Broken Access Control Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook No login needed ≤ 4.7.5 CVE-2026-12093 Wordfence
6.5 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.7.2 Fixed in 4.7.3 CVE-2026-42663 Patchstack
7.5 High Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2026-34886 Patchstack
4.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation ≤ 4.3.2 CVE-2026-4058 Wordfence
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Media Deletion via 'profile-pic-url' Parameter No login needed ≤ 5.1.5 CVE-2026-7651 Wordfence
7.3 High WCFM Membership Plugin wc-multivendor-membership Broken Access Control No login needed ≤ 2.11.10 Fixed in 2.11.11 CVE-2026-42753 Patchstack
8.2 High Membership Plugin membership-for-woocommerce SQL Injection WordPress Plugin Supsystic Membership 1.4.7 SQL Injection via sidx No login needed 1.4.7 CVE-2020-37244 VulnCheck
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter No login needed ≤ 5.1.5 CVE-2026-6145 Wordfence
8.8 High User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend PHP Object Injection Authenticated (Subscriber+) PHP Object Injection ≤ 4.3.1 CVE-2026-5127 Wordfence
4.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification ≤ 5.1.4 CVE-2026-3601 Wordfence
7.1 High Paid Memberships Pro Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption ≤ 3.6.5 CVE-2026-4100 Wordfence
7.5 High ARMember Plugin armember-membership SQL Injection Unauthenticated SQL Injection via 'orderby' Parameter No login needed ≤ 4.0.60 CVE-2026-7649 Wordfence
4.3 Medium ProfilePress Plugin wp-user-avatar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription ≤ 4.16.12 CVE-2026-4949 Wordfence
6.1 Medium User Registration & Membership Plugin user-registration Open Redirect Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter No login needed ≤ 5.1.4 CVE-2026-6203 Wordfence
8.8 High Advanced Members for ACF Plugin advanced-members Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal ≤ 1.2.5 CVE-2026-3243 Wordfence
6.5 Medium User Registration & Membership Plugin user-registration SQL Injection Authenticated (Subscriber+) SQL Injection via membership_ids[] ≤ 5.1.2 CVE-2026-1865 Wordfence
6.5 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Arbitrary Shortcode Execution ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields No login needed ≤ 4.16.11 CVE-2026-3309 Wordfence
7.1 High Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress Plugin wp-user-avatar Broken Access Control ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass ≤ 4.16.11 CVE-2026-3445 Wordfence
7.1 High Vayvo Theme vayvo-progression Cross-Site Scripting Media Streaming & Membership WordPress Theme theme < 6.8 - Reflected Cross Site Scripting (XSS) No login needed ≤ 6.8 Fixed in 6.8 CVE-2026-25373 Patchstack
8.1 High Ultimate Membership Pro Plugin indeed-membership-pro Privilege Escalation Account Takeover No login needed ≤ 13.7 Fixed in 13.7.1 CVE-2026-25357 Patchstack
5.4 Medium User Registration & Membership Plugin user-registration Broken Access Control Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation ≤ 5.1.4 CVE-2026-4056 Wordfence
4.3 Medium Membership Plugin – Restrict Content Plugin restrict-content Authentication Bypass Restrict Content <= 3.2.24 - Unvalidated Redirect in Password Reset Flow via rcp_redirect No login needed ≤ 3.2.24 CVE-2026-4136 Wordfence
5.3 Medium User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parameter No login needed ≤ 4.2.8 CVE-2026-2233 Wordfence
4.3 Medium ProfileGrid Plugin profilegrid-user-profiles-groups-and-communities Cross-Site Request Forgery Cross-Site Request Forgery to Group Membership Request Approval/Denial No login needed ≤ 5.9.8.2 CVE-2026-2494 Wordfence
8.1 High Membership Plugin – Restrict Content Plugin restrict-content Privilege Escalation Restrict Content <= 3.2.20 - Unauthenticated Privilege Escalation via 'rcp_level' No login needed ≤ 3.2.20 CVE-2026-1321 Wordfence
6.5 Medium WP-Members Membership Plugin wp-members SQL Injection Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute ≤ 3.5.5.1 CVE-2026-2363 Wordfence
9.8 Critical User Registration & Membership Plugin user-registration Privilege Escalation Unauthenticated Privilege Escalation via Membership Registration No login needed ≤ 5.1.2 CVE-2026-1492 Wordfence
8.8 High User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration Plugin wp-user-frontend Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload ≤ 4.2.8 CVE-2026-1565 Wordfence
8.1 High User Registration & Membership Plugin user-registration Authentication Bypass No login needed ≤ 5.1.2 CVE-2026-1779 Wordfence
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Insecure Direct Object Reference to Unauthenticated Limited User Deletion No login needed ≤ 5.1.2 CVE-2026-2356 Wordfence
6.5 Medium Simple Membership Plugin simple-membership Broken Access Control Unauthenticated Improper Handling of Missing Values No login needed ≤ 4.7.0 CVE-2026-1461 Wordfence
4.3 Medium Simple Membership Plugin simple-membership Broken Access Control ≤ 4.6.9 Fixed in 4.7.0 CVE-2026-25308 Patchstack
4.4 Medium Membership Plugin – Restrict Content Plugin restrict-content Cross-Site Scripting Restrict Content <= 3.2.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Invoice Settings ≤ 3.2.18 CVE-2026-1304 Wordfence
4.3 Medium WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Plugin wc-multivendor-membership Broken Access Control WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment ≤ 2.11.8 CVE-2025-15147 Wordfence
5.4 Medium Simple Membership WP user Import Plugin simple-membership-wp-user-import Cross-Site Request Forgery No login needed ≤ 1.9.1 Fixed in 1.9.2 CVE-2026-24986 Patchstack
8.8 High WP Membership Plugin wp-membership Privilege Escalation ≤ 1.6.4 CVE-2025-69292 Patchstack
7.3 High WP Membership Plugin wp-membership Broken Access Control No login needed ≤ 1.6.4 CVE-2025-69193 Patchstack
8.2 High Membership Plugin – Restrict Content Plugin restrict-content Broken Access Control Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure No login needed ≤ 3.2.16 CVE-2025-14844 Wordfence
5.4 Medium WP-Members Membership Plugin wp-members Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields ≤ 3.5.4.3 CVE-2025-14448 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only