WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 51–100 of 276 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Appointment Booking Lite Plugin Broken Access Control Unauthenticated Arbitrary Reservation Deletion No login needed < 2.4.8 Fixed in 2.4.8 CVE-2026-15232 WPScan
5.3 Medium Dokan Plugin Information Disclosure Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint No login needed < 5.0.14 Fixed in 5.0.14 CVE-2026-16575 WPScan
6.5 Medium WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting ≤ 6.3.2 Fixed in 6.4.0 CVE-2026-73402 Patchstack
5.3 Medium AI Agent by SiteGround Plugin sg-ai-studio Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint No login needed ≤ 1.2.7 CVE-2026-17153 Wordfence
4.3 Medium KiviCare Plugin kivicare-clinic-management-system Broken Access Control Patient+ Cross-Patient Appointment Modification via IDOR No login needed < 4.5.4 Fixed in 4.5.4 CVE-2026-19416 WPScan
5.3 Medium TrueBooker Appointment Booking Plugin Broken Access Control Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18779 WPScan
5.3 Medium TrueBooker Appointment Booking Plugin Information Disclosure Unauthenticated Customer PII Disclosure via Multiple AJAX Actions No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18778 WPScan
5.3 Medium TrueBooker Appointment Booking Plugin Broken Access Control Unauthenticated Arbitrary Appointment Status Change via update_appointment_status No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18777 WPScan
6.5 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.2.36 CVE-2026-73395 Patchstack
6.5 Medium Appointment Hour Booking Plugin appointment-hour-booking Broken Access Control No login needed ≤ 1.5.91 CVE-2026-66679 Patchstack
4.3 Medium Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI Plugin everest-forms Broken Access Control Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints ≤ 3.5.2 CVE-2026-13167 Wordfence
6.5 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure ≤ 1.6.12.10 CVE-2026-13358 Wordfence
4.3 Medium Online Scheduling and Appointment Booking System – Bookly Plugin bookly-responsive-appointment-booking-tool Broken Access Control Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter ≤ 27.7 CVE-2026-12905 Wordfence
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Team Member+ User Email Disclosure via Users and Customers REST Endpoints < 1.6.12.17 Fixed in 1.6.12.17 CVE-2026-16541 WPScan
5.3 Medium Pinpoint Booking System Plugin booking-system Price Manipulation Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter No login needed ≤ 2.9.9.6.8 CVE-2026-12128 Wordfence
5.3 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action No login needed ≤ 3.2.36 CVE-2026-8840 Wordfence
4.3 Medium KiviCare Plugin kivicare-clinic-management-system Information Disclosure Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR < 4.5.2 Fixed in 4.5.2 CVE-2026-13612 WPScan
5.3 Medium Pinpoint Booking System Plugin Price Manipulation Unauthenticated Arbitrary Booking Price Manipulation No login needed ≤ 2.9.9.7.1 CVE-2026-15229 WPScan
5.3 Medium Hotel Booking Lite Plugin Broken Access Control Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint No login needed < 6.2.3 Fixed in 6.2.3 CVE-2026-15237 WPScan
5.4 Medium Dokan Plugin Broken Access Control Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint < 5.0.11 Fixed in 5.0.11 CVE-2026-16574 WPScan
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Price Manipulation Unauthenticated Booking Price Manipulation via tcost Parameter No login needed < 1.5.88 Fixed in 1.5.88 CVE-2026-16282 WPScan
6.4 Medium LatePoint Plugin latepoint Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 5.3.2 CVE-2026-5391 Wordfence
6.5 Medium Bit Assist Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via Response Endpoint No login needed < 1.8.2 Fixed in 1.8.2 CVE-2026-16548 WPScan
5.9 Medium REST API Log Plugin wp-rest-api-log Information Disclosure Unauthenticated Sensitive Log Data Disclosure via Download Endpoint No login needed < 1.7.1 Fixed in 1.7.1 CVE-2026-16547 WPScan
6.8 Medium Brizy - Page Builder Plugin Cross-Site Scripting Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point < 2.8.19 Fixed in 2.8.19 CVE-2026-16069 WPScan
4.3 Medium Dokan Plugin Broken Access Control Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint < 5.0.9 Fixed in 5.0.9 CVE-2026-16564 WPScan
6.5 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint < 3.8.3 Fixed in 3.8.3 CVE-2026-16563 WPScan
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Contributor+ Sensitive Data Disclosure via Admin Shortcode < 1.6.12.11 Fixed in 1.6.12.11 CVE-2026-15254 WPScan
6.5 Medium Advanced Views Plugin acf-views Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints ≤ 3.9.1 CVE-2026-17580 Wordfence
5.3 Medium PixelYourSite Plugin pixelyoursite Information Disclosure Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation No login needed ≤ 11.2.1, < 12.6.1 Fixed in 12.6.1 CVE-2026-18059 Wordfence
4.9 Medium Pinpoint Booking System Plugin booking-system SQL Injection Authenticated (Administrator+) SQL Injection via 'field' Parameter ≤ 2.9.9.6.9 CVE-2026-15403 Wordfence
5.3 Medium MailerPress Plugin mailerpress Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint No login needed ≤ 1.5.0 CVE-2026-18436 Wordfence
4.3 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint ≤ 3.8.2 CVE-2026-12376 WPScan
5.9 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR No login needed < 2.10.1 Fixed in 2.10.1 CVE-2026-11782 WPScan
5.3 Medium LatePoint Plugin Broken Access Control Unauthenticated Booking Object Mass Assignment via Public Booking Funnel No login needed < 5.6.8 Fixed in 5.6.8 CVE-2026-15250 WPScan
4.3 Medium Easy Appointments Plugin easy-appointments Information Disclosure Subscriber+ Sensitive Information Disclosure via REST Appointments Listing < 3.12.28 Fixed in 3.12.28 CVE-2026-14226 WPScan
4.3 Medium Easy Appointments Plugin easy-appointments Information Disclosure Subscriber+ Customer PII Disclosure via IDOR < 3.12.28 Fixed in 3.12.28 CVE-2026-14223 WPScan
5.4 Medium Easy Appointments Plugin easy-appointments Broken Access Control Subscriber+ Cross-User Appointment Data Modification via IDOR < 3.12.28 Fixed in 3.12.28 CVE-2026-14224 WPScan
6.1 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting Unauthenticated Stored XSS via Booking Customer Information No login needed < 1.6.12.4 Fixed in 1.6.12.4 CVE-2026-13400 WPScan
6.5 Medium Appointment Hour Booking Plugin appointment-hour-booking Cross-Site Scripting ≤ 1.5.86 Fixed in 1.5.87 CVE-2026-65514 Patchstack
6.5 Medium Easy Appointments Plugin easy-appointments Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.12.27 Fixed in 3.12.28 CVE-2026-61946 Patchstack
6.7 Medium QuickCal - Appointment Booking Calendar Plugin quickcal Broken Access Control Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control ≤ 1.0.16 CVE-2026-27377 Patchstack
5.3 Medium GutenKit Plugin gutenkit-blocks-addon Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints No login needed ≤ 2.4.12 CVE-2026-15827 Wordfence
4.9 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking SQL Injection Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import ≤ 2.4.3 CVE-2026-14782 Wordfence
5.4 Medium LatePoint Plugin Cross-Site Request Forgery Multiple Privileged Actions via CSRF No login needed < 5.6.3 Fixed in 5.6.3 CVE-2026-11866 WPScan
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.11.11 Fixed in 1.6.12.0 CVE-2026-59523 Patchstack
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Broken Access Control No login needed ≤ 1.6.12.4 Fixed in 1.6.12.6 CVE-2026-57812 Patchstack
5.3 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control No login needed ≤ 3.2.36 CVE-2026-57778 Patchstack
4.3 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions ≤ 2.10.1 CVE-2026-10628 Wordfence
5.3 Medium KiviCare Plugin kivicare-clinic-management-system Broken Access Control Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint No login needed ≤ 4.4.0 CVE-2026-11990 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only