WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 51–100 of 146 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Forminator Forms Plugin forminator Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook ≤ 1.53.0 CVE-2026-6214 Wordfence
5.3 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Authentication Bypass Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter No login needed ≤ 5.103.0 CVE-2026-4664 Wordfence
4.3 Medium Advanced CF7 DB Plugin advanced-cf7-db Broken Access Control Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel Export ≤ 2.0.9 CVE-2026-0814 Wordfence
9.1 Critical Order Notification for WooCommerce Plugin Authentication Bypass Unauthenticated WooCommerce REST Permission Bypass No login needed < 3.6.3 Fixed in 3.6.3 CVE-2025-15484 WPScan
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control No login needed ≤ <= 6.0.7.6 Fixed in 6.0.7.7 CVE-2026-32498 Patchstack
8.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation Account Takeover No login needed ≤ 6.0.7.1 Fixed in 6.0.7.2 CVE-2026-24373 Patchstack
5.3 Medium RepairBuddy Plugin computer-repair-shop Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action No login needed ≤ 4.1132 CVE-2026-3567 Wordfence
5.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control ≤ 6.0.7.6 Fixed in 6.0.7.7 CVE-2026-32385 Patchstack
7.5 High Easy Post Submission Plugin easy-post-submission Broken Access Control No login needed ≤ 2.4.0 Fixed in 2.5.0 CVE-2026-22479 Patchstack
7.2 High Fluent Forms Pro Plugin fluentform Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Draft Form Submission No login needed ≤ 6.1.17 CVE-2026-2365 Wordfence
5.3 Medium RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment No login needed ≤ 6.0.6.9 CVE-2025-14444 Wordfence
6.1 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Open Redirect Unauthenticated Open Redirect via 'requested_page' Parameter No login needed 1.0.0 – 1.2.7 CVE-2026-1296 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Subscriber+ Form Creation < 6.0.7.2 Fixed in 6.0.7.2 CVE-2026-0929 WPScan
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Information Disclosure Subscriber+ Sensitive Data Disclosure < 6.0.7.2 Fixed in 6.0.7.2 CVE-2025-15520 WPScan
7.2 High Name Directory Plugin name-directory Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form No login needed ≤ 1.32.0 CVE-2026-1866 Wordfence
4.4 Medium WP Content Permission Plugin wp-content-permission Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter ≤ 1.2 CVE-2026-0743 Wordfence
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Missing Authorization to Unauthenticated Arbitrary Settings Modification No login needed ≤ 6.0.7.4 CVE-2026-1054 Wordfence
3.7 Low MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Plugin metform Information Disclosure Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value No login needed ≤ 4.1.0 CVE-2026-0633 Wordfence
5.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery No login needed ≤ 6.0.6.9 Fixed in 6.0.7.0 CVE-2026-24374 Patchstack
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Privilege Escalation Unauthenticated Privilege Escalation via admin_order No login needed ≤ 6.0.7.1 CVE-2025-15403 Wordfence
4.3 Medium AMP for WP – Accelerated Mobile Pages Plugin accelerated-mobile-pages Cross-Site Request Forgery Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission No login needed ≤ 1.1.9 CVE-2025-14468 Wordfence
5.3 Medium Ninja Forms Plugin ninja-forms Information Disclosure Unauthenticated Token Generation and Submission Disclosure No login needed < 3.13.3 Fixed in 3.13.3 CVE-2025-14072 WPScan
5.3 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Broken Access Control Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed ≤ 1.2.6 CVE-2025-14913 Wordfence
5.3 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Modification No login needed ≤ 1.2.5 CVE-2025-14080 Wordfence
6.4 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode ≤ 6.0.6.7 CVE-2025-13610 Wordfence
4.3 Medium Ultra Addons for Contact Form 7 Plugin ultimate-addons-for-contact-form-7 Broken Access Control Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF ≤ 3.5.33 CVE-2025-14356 Wordfence
5.3 Medium Fluent Forms Plugin fluentform Broken Access Control Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id No login needed ≤ 6.1.7 CVE-2025-13748 Wordfence
5.3 Medium Zigaform Plugin zigaform-calculator-cost-estimation-form-builder-lite Information Disclosure Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint No login needed ≤ 7.6.5 CVE-2025-13696 Wordfence
5.3 Medium Easy Post Submission Plugin easy-post-submission Information Disclosure Sensitive Data Exposure ≤ 1.7.0 Fixed in 2.0.0 CVE-2025-62062 Patchstack
9.8 Critical RegistrationMagic - Custom Registration Forms Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection Custom Registration Forms <= 3.7.9.2 - PHP Object Injection No login needed < 3.7.9.3 Fixed in 3.7.9.3 CVE-2017-20208 Wordfence
7.2 High RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager SQL Injection Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection ≤ 6.0.6.2 CVE-2025-11204 Wordfence
4.3 Medium WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Plugin wdesignkit Broken Access Control Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function ≤ 1.2.16 CVE-2025-9029 Wordfence
4.3 Medium CF7 Submissions Plugin cf7-submissions Broken Access Control ≤ 0.26 CVE-2025-58016 Patchstack
7.5 High Al Pack Plugin alpack Broken Access Control Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function No login needed ≤ 1.1.1 CVE-2025-7664 Wordfence
4.3 Medium WPeMatico RSS Feed Fetcher Plugin wpematico Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Deactivation via handle_feedback_submission Function No login needed ≤ 2.8.7 CVE-2025-8103 Wordfence
8.1 High Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) Plugin extensions-for-cf7 Arbitrary File Deletion Unauthenticated Arbitrary File Deletion Triggered via Admin Form Submission Deletion No login needed ≤ 3.2.8 CVE-2025-7645 Wordfence
7.5 High SureForms – Drag and Drop Form Builder Plugin sureforms PHP Object Injection Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion No login needed 0.0 – 0.0.13, 1.0 – 1.0.6, 1.1 – 1.1.1, … CVE-2025-6742 Wordfence
8.1 High SureForms – Drag and Drop Form Builder Plugin sureforms Arbitrary File Deletion Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion No login needed 0.0 – 0.0.13, 1.0 – 1.0.6, 1.1 – 1.1.1, … CVE-2025-6691 Wordfence
7.5 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator PHP Object Injection Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion No login needed ≤ 1.44.2 CVE-2025-6464 Wordfence
8.8 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Arbitrary File Deletion Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion No login needed ≤ 1.44.2 CVE-2025-6463 Wordfence
8.8 High Offsprout Page Builder Plugin offsprout-page-builder Privilege Escalation Authenticated (Contributor+) Privilege Escalation via permission_callback Function 2.2.1 – 2.15.2 CVE-2025-4672 Wordfence
4.8 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Stored XSS < 6.0.2.1 Fixed in 6.0.2.1 CVE-2024-9390 WPScan
5.9 Medium Submission DOM tracking for Contact Form 7 Plugin cf7-submission-dom-tracking Cross-Site Scripting ≤ 2.1 Fixed in 2.2 CVE-2025-47626 Patchstack
6.1 Medium Coupon Affiliates – Affiliate Plugin for WooCommerce Plugin woo-coupon-usage Cross-Site Scripting Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter No login needed ≤ 6.3.0 CVE-2025-3598 Wordfence
7.1 High Spark GF Failed Submissions Plugin spark-gf-failed-submissions Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.5 Fixed in 1.3.6 CVE-2025-32670 Patchstack
6.4 Medium RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 6.0.4.3 CVE-2025-2836 Wordfence
7.1 High Frontend Post Submission Plugin frontend-post-submission Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.0 CVE-2025-23638 Patchstack
4.3 Medium Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics Plugin cookiebot Broken Access Control Cookiebot CMP by Usercentrics <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission ≤ 4.4.1 CVE-2025-1666 Wordfence
7.1 High ePermissions Plugin epermissions Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2 CVE-2025-23635 Patchstack
4.3 Medium NextMove Lite – Thank You Page for WooCommerce Plugin woo-thank-you-page-nextmove-lite Broken Access Control Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission ≤ 2.19.0 CVE-2024-10860 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only