WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 51–100 of 133 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Ninja Forms Plugin ninja-forms Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint No login needed ≤ 3.14.1 CVE-2026-1239 Wordfence
7.5 High BookingPress Appointment Booking Pro Plugin bookingpress-appointment-booking-pro SQL Injection Unauthenticated SQL Injection via 'store_service_date' Parameter No login needed ≤ 5.7.1 CVE-2026-11823 Wordfence
7.5 High Visualizer Plugin visualizer Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint No login needed ≤ 4.0.3 CVE-2026-13468 Wordfence
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting No login needed ≤ 1.6.12.2 Fixed in 1.6.12.4 CVE-2026-57317 Patchstack
7.5 High WP Forms Connector Plugin wp-forms-connector Broken Access Control Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint No login needed ≤ 1.8 CVE-2026-9178 Wordfence
7.5 High JetEngine Plugin jet-engine SQL Injection Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint No login needed ≤ 3.8.10.1 CVE-2026-12360 Wordfence
7.5 High LatePoint Plugin latepoint Privilege Escalation Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset ≤ 5.5.1 CVE-2026-8176 Wordfence
7.5 High LatePoint Plugin latepoint Privilege Escalation ≤ 5.5.1 Fixed in 5.5.2 CVE-2026-49083 Patchstack
7.5 High Bookly Plugin bookly-responsive-appointment-booking-tool Information Disclosure Sensitive Data Exposure No login needed ≤ 27.4 Fixed in 27.5 CVE-2026-42667 Patchstack
7.5 High Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Sensitive Data Exposure No login needed < 1.6.11.2 Fixed in 1.6.11.2 CVE-2026-42384 Patchstack
8.1 High WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Privilege Escalation No login needed ≤ 5.9.0 Fixed in 6.0.0 CVE-2026-39587 Patchstack
7.5 High Easy Appointments Plugin easy-appointments Broken Access Control No login needed ≤ 3.12.21 Fixed in 3.12.22 CVE-2026-39513 Patchstack
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting No login needed ≤ 1.6.10.6 Fixed in 1.6.11.0 CVE-2026-39447 Patchstack
7.2 High Online Scheduling and Appointment Booking System – Bookly Plugin bookly-responsive-appointment-booking-tool Cross-Site Scripting Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie No login needed ≤ 27.2 CVE-2026-5513 Wordfence
7.5 High Simple History – Track, Log, and Audit WordPress Changes Plugin simple-history Privilege Escalation Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint ≤ 5.26.0 CVE-2026-7459 Wordfence
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'append_where_sql' Parameter No login needed ≤ 1.6.11.8 CVE-2026-7797 Wordfence
7.2 High LiteSpeed Cache Plugin litespeed-cache Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints No login needed ≤ 7.7 CVE-2026-3375 Wordfence
7.2 High LatePoint Plugin latepoint Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter No login needed ≤ 5.5.0 CVE-2026-7332 Wordfence
7.5 High easy-paypal-events-tickets Plugin easy-paypal-events-tickets Information Disclosure Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint No login needed < 1.4.0 Fixed in 1.4.0 CVE-2026-41471 VulnCheck
8.8 High LatePoint Plugin latepoint Privilege Escalation Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability ≤ 5.4.1 CVE-2026-6741 Wordfence
7.5 High Easy Appointments Plugin easy-appointments Information Disclosure Unauthenticated Sensitive Information Exposure via REST API No login needed ≤ 3.12.21 CVE-2026-2262 Wordfence
8.5 High Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection ≤ 1.6.9.27 Fixed in 1.6.9.29 CVE-2026-39495 Patchstack
7.1 High Bookly Plugin bookly-responsive-appointment-booking-tool Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ <= 26.7 Fixed in 26.8 CVE-2026-32540 Patchstack
7.1 High Booking calendar, Appointment Booking System Plugin booking-calendar Cross-Site Scripting No login needed ≤ 3.2.36 CVE-2026-25435 Patchstack
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'fields' Parameter No login needed ≤ 1.6.10.0 CVE-2026-3658 Wordfence
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via Settings REST API Endpoint No login needed ≤ 1.6.9.29 CVE-2026-3045 Wordfence
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'append_where_sql' Parameter No login needed ≤ 1.6.9.27 CVE-2026-1708 Wordfence
7.2 High PostX Plugin ultimate-post Server-Side Request Forgery Authenticated (Administrator+) Server-Side Request Forgery via REST API Endpoints No login needed ≤ 5.0.8 CVE-2026-1273 Wordfence
8.8 High LatePoint Plugin Privilege Escalation Authenticated (Agent+) Privilege Escalation ≤ 5.2.7 CVE-2026-1566 Wordfence
7.2 High All In One Image Viewer Block Plugin image-viewer Server-Side Request Forgery Unauthenticated Server-Side Request Forgery via image-proxy Endpoint No login needed ≤ 1.0.2 CVE-2026-1294 Wordfence
8.2 High Popup builder with Gamification Plugin popup-builder-block SQL Injection Unauthenticated SQL Injection via Multiple REST API Endpoints No login needed ≤ 2.2.0 CVE-2025-13192 Wordfence
7.2 High LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Scripting Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 5.2.5 CVE-2026-0617 Wordfence
7.2 High AI Engine Plugin ai-engine Arbitrary File Upload Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint ≤ 3.3.2 CVE-2026-1400 Wordfence
7.5 High Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters No login needed ≤ 1.6.9.9 CVE-2025-12166 Wordfence
7.6 High Appointify Plugin appointify SQL Injection ≤ 1.0.8 CVE-2025-59129 Patchstack
8.8 High Vitepos – Point of Sale (POS) for WooCommerce Plugin vitepos-lite Arbitrary File Upload Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution ≤ 3.3.0 CVE-2025-13156 Wordfence
7.5 High Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking SQL Injection Amelia <= 1.2.35 - Unauthenticated SQL Injection via search No login needed ≤ 1.2.35 CVE-2025-12482 Wordfence
7.5 High Booking Calendar | Appointment Booking | Bookit Plugin bookit Broken Access Control Missing Authorization to Unauthenticated Stripe Connection No login needed ≤ 2.5.0 CVE-2025-12633 Wordfence
7.1 High gAppointments Plugin gappointments Cross-Site Scripting No login needed ≤ 1.14.1 CVE-2025-49951 Patchstack
8.8 High LatePoint Plugin latepoint Cross-Site Request Forgery Cross-Site Request Forgery to Account Takeover via change_password() Function No login needed ≤ 5.1.94 CVE-2025-7052 Wordfence
8.2 High LatePoint Plugin latepoint Authentication Bypass Unauthenticated Authentication Bypass via load_step Function No login needed ≤ 5.1.94 CVE-2025-7038 Wordfence
8.5 High WooCommerce Point Of Sale (POS) Plugin woo-point-of-salepos SQL Injection ≤ 1.4 CVE-2025-52820 Patchstack
7.1 High FastBook Plugin fastbook-responsive-appointment-booking-and-scheduling-system Cross-Site Scripting No login needed ≤ 1.1 CVE-2025-25173 Patchstack
8.3 High SUMO Reward Points Plugin rewardsystem Local File Inclusion No login needed ≤ 30.7.0 CVE-2025-32925 Patchstack
8.8 High QuickCal - Appointment Booking Calendar Plugin quickcal Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-32310 Patchstack
8.2 High Appointment Booking Calendar Plugin appointment-booking-calendar Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 1.3.92 Fixed in 1.3.93 CVE-2025-46241 Patchstack
7.6 High BMA Lite Plugin bma-lite-appointment-booking-and-scheduling SQL Injection ≤ 1.4.2 Fixed in 1.4.3 CVE-2025-39518 Patchstack
7.6 High BookingPress Plugin bookingpress-appointment-booking SQL Injection ≤ 1.1.28 Fixed in 1.1.38 CVE-2025-31910 Patchstack
7.3 High Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.6.8.5 CVE-2025-1119 Wordfence
7.5 High Doctor Appointment Booking Plugin doctor-appointment-booking Local File Inclusion ≤ 1.0.0 CVE-2025-27264 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only