WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 51–100 of 471 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Realtyna Organic IDX plugin + WPL Real Estate Plugin real-estate-listing-realtyna-wpl Cross-Site Scripting Reflected XSS via Location Selector Endpoint No login needed < 5.4.2 Fixed in 5.4.2 CVE-2026-91014 WPScan
3.7 Low LearnPress Plugin learnpress Information Disclosure Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint No login needed 4.4.3 – < 4.4.7 Fixed in 4.4.7 CVE-2026-86446 WPScan
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Other Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission No login needed < 1.5.95 Fixed in 1.5.95 CVE-2026-86475 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Internal Notes Disclosure via Service and Category REST Routes No login needed < 1.2.8 Fixed in 1.2.8 CVE-2026-87907 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Staff PII Disclosure via Agent REST Route No login needed < 1.2.8 Fixed in 1.2.8 CVE-2026-87896 WPScan
3.7 Low Eventin Plugin wp-event-solution Broken Access Control Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint No login needed 4.1.5 – < 4.1.24 Fixed in 4.1.24 CVE-2026-84907 WPScan
7.1 High MultiVendorX Plugin dc-woocommerce-multi-vendor Broken Access Control Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint 5.0.0 – < 5.0.16 Fixed in 5.0.16 CVE-2026-74926 WPScan
7.5 High Online Scheduling and Appointment Booking System Plugin bookly-responsive-appointment-booking-tool Broken Access Control Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter No login needed ≤ 28.1 CVE-2026-89063 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action No login needed ≤ 1.2.3 CVE-2026-14349 Wordfence
5.3 Medium Bookit Plugin bookit-for-cal-com Information Disclosure Unauthenticated Appointment PII Disclosure via Availability Check No login needed < 2.6.0.1 Fixed in 2.6.0.1 CVE-2026-88995 WPScan
6.4 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Cross-Site Scripting Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parameter ≤ 2.4.9 CVE-2026-10148 Wordfence
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Customer PII Disclosure via IDOR No login needed 1.0.9 – < 1.2.3 Fixed in 1.2.3 CVE-2026-87894 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Price Manipulation Unauthenticated Price Manipulation and Payment Method Restriction Bypass No login needed < 1.2.0 Fixed in 1.2.0 CVE-2026-87892 WPScan
6.5 Medium Rox Appointment Booking Plugin rox-appointment-booking Broken Access Control Unauthenticated Holiday Schedule Modification via REST API No login needed < 1.2.0 Fixed in 1.2.0 CVE-2026-87891 WPScan
8.8 High BE REST Endpoints Plugin Cross-Site Scripting Unauthenticated Stored XSS and Widget Manipulation No login needed ≤ 1.0.0 CVE-2026-81742 WPScan
5.3 Medium Booktics – Booking Calendar for Appointments and Service Businesses Plugin booktics Broken Access Control Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization No login needed ≤ 1.0.23 CVE-2026-11446 Wordfence
6.4 Medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program Plugin mycred Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute ≤ 3.2.4 CVE-2026-17149 Wordfence
8.1 High Next-Cart Store to WooCommerce Migration Plugin nextcart-woocommerce-migration Authentication Bypass Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint No login needed ≤ 3.9.8 CVE-2026-76009 Wordfence
5.4 Medium Eventin Plugin wp-event-solution Broken Access Control Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint ≤ 4.1.17 CVE-2026-11821 Wordfence
5.4 Medium Online Scheduling and Appointment Booking System – Bookly Plugin bookly-responsive-appointment-booking-tool Broken Access Control Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update ≤ 27.2 CVE-2026-2520 Wordfence
7.5 High Csomagpontok és szállítási címkék WooCommerce-hez Plugin hungarian-pickup-points-for-woocommerce Broken Access Control No login needed < 4.2.8 Fixed in 4.2.8 CVE-2026-81790 Patchstack
7.1 High Easy Appointments Plugin easy-appointments Cross-Site Scripting No login needed ≤ 4.0.2.1 CVE-2026-81798 Patchstack
5.4 Medium LearnDash LMS Plugin Broken Access Control Unauthenticated Arbitrary Course Enrollment via REST Endpoint 4.25.0 – 5.1.6 CVE-2026-12843 Wordfence
4.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Server-Side Request Forgery Contributor+ SSRF via get-csv-to-json REST Endpoint < 13.2.0 Fixed in 13.2.0 CVE-2026-83543 WPScan
9.3 Critical VikAppointments Services Booking Calendar Plugin vikappointments SQL Injection No login needed ≤ 1.2.20 Fixed in 1.2.21 CVE-2026-84768 Patchstack
8.2 High Auto x LINE Plugin Broken Access Control Unauthenticated REST API Endpoints Call No login needed ≤ 1.0.0 CVE-2025-15485 WPScan
3.8 Low Timetics Plugin timetics Broken Access Control Staff+ Cross-Staff Appointment Modification via IDOR ≤ 1.0.61 CVE-2026-14326 WPScan
8.8 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Request Forgery No login needed ≤ 1.6.12.23 Fixed in 1.6.12.24 CVE-2026-84764 Patchstack
4.3 Medium GamiPress Plugin gamipress Broken Access Control Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners < 7.9.9.6 Fixed in 7.9.9.6 CVE-2026-77764 WPScan
5.3 Medium MultiVendorX Plugin dc-woocommerce-multi-vendor Information Disclosure Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint No login needed 5.0.13 – < 5.0.15 Fixed in 5.0.15 CVE-2026-74927 WPScan
5.3 Medium Appointment Booking Lite Plugin Broken Access Control Unauthenticated Arbitrary Reservation Deletion No login needed < 2.4.8 Fixed in 2.4.8 CVE-2026-15232 WPScan
9.8 Critical Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Privilege Escalation Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' No login needed 8.0 – 9.6.2 CVE-2026-9055 Wordfence
9.8 Critical WPLP Cookie Consent Plugin gdpr-cookie-consent Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'upload-logo' REST Endpoint No login needed ≤ 4.4.1 CVE-2026-75865 Wordfence
2.7 Low Amelia Plugin Broken Access Control Amelia Customer+ Appointment Status Update and Self-Approval 1.2.32 – < 2.4.9 Fixed in 2.4.9 CVE-2026-77704 WPScan
7.2 High WP Rocket Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint No login needed ≤ 3.21.0.1 CVE-2026-5934 Wordfence
7.2 High Booking for Appointments and Events Calendar Plugin ameliabooking Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission No login needed ≤ 2.2 CVE-2026-6286 Wordfence
5.3 Medium Dokan Plugin Information Disclosure Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint No login needed < 5.0.14 Fixed in 5.0.14 CVE-2026-16575 WPScan
6.5 Medium WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting ≤ 6.3.2 Fixed in 6.4.0 CVE-2026-73402 Patchstack
9.3 Critical BookingPress Appointment Booking Pro Plugin bookingpress-appointment-booking-pro SQL Injection No login needed ≤ 6.0.2 CVE-2026-68566 Patchstack
5.3 Medium AI Agent by SiteGround Plugin sg-ai-studio Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint No login needed ≤ 1.2.7 CVE-2026-17153 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter No login needed ≤ 1.2.6 CVE-2026-18315 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Privilege Escalation No login needed ≤ 1.2.6 Fixed in 1.2.7 CVE-2026-73347 Patchstack
4.3 Medium KiviCare Plugin kivicare-clinic-management-system Broken Access Control Patient+ Cross-Patient Appointment Modification via IDOR No login needed < 4.5.4 Fixed in 4.5.4 CVE-2026-19416 WPScan
2.7 Low Easy Appointments Plugin easy-appointments Information Disclosure Contributor+ Sensitive Information Disclosure via REST Appointments Listing 3.12.28 – < 4.0.1 Fixed in 4.0.1 CVE-2026-19406 WPScan
5.3 Medium TrueBooker Appointment Booking Plugin Broken Access Control Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18779 WPScan
5.3 Medium TrueBooker Appointment Booking Plugin Information Disclosure Unauthenticated Customer PII Disclosure via Multiple AJAX Actions No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18778 WPScan
5.3 Medium TrueBooker Appointment Booking Plugin Broken Access Control Unauthenticated Arbitrary Appointment Status Change via update_appointment_status No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18777 WPScan
9.8 Critical TrueBooker Appointment Booking Plugin Privilege Escalation Unauthenticated Account Takeover via Multiple AJAX Actions No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18776 WPScan
8.8 High Booking calendar, Appointment Booking System Plugin Cross-Site Scripting Unauthenticated Stored XSS via SVG File Upload No login needed 3.2.18 – 3.2.36 CVE-2026-14334 WPScan
6.5 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.2.36 CVE-2026-73395 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only