WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 51–100 of 1,456 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter ≤ 5.9.6 CVE-2026-5920 Wordfence
6.4 Medium Bridge - Creative Multipurpose Theme Cross-Site Scripting Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute ≤ 30.8.9.1 CVE-2026-15609 Wordfence
2.7 Low WP Directory Kit Plugin wpdirectorykit Information Disclosure Contributor+ Non-Public Listing Field Disclosure via Shortcodes ≤ 1.5.7 CVE-2026-16592 WPScan
4.9 Medium Product XML Feed Manager for WooCommerce Plugin product-xml-feeds-for-woocommerce Broken Access Control Contributor+ Arbitrary Product Deletion via Shortcode < 3.1.1 Fixed in 3.1.1 CVE-2026-87919 WPScan
6.8 Medium WP Highlight Box Plugin Cross-Site Scripting Contributor+ Stored XSS via highlight-box Shortcode ≤ 1.0 CVE-2026-86790 WPScan
6.8 Medium Custom Menu Wizard Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcode Attributes ≤ 3.3.1 CVE-2026-83532 WPScan
6.5 Medium Simple CAPTCHA with Cloudflare Turnstile Plugin simple-cloudflare-turnstile Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Contact Form 7 Field Repopulation No login needed 1.2.2 – < 1.42.3 Fixed in 1.42.3 CVE-2026-85116 WPScan
6.4 Medium Media Library Assistant Plugin media-library-assistant Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter ≤ 3.35 CVE-2026-6641 Wordfence
6.4 Medium Bold Timeline Lite Plugin bold-timeline-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.2.8 CVE-2026-7438 Wordfence
6.4 Medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program Plugin mycred Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute ≤ 3.2.4 CVE-2026-17149 Wordfence
6.5 Medium Contact Form 7 Captcha Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation No login needed 0.1.7 – < 0.1.9 Fixed in 0.1.9 CVE-2026-85117 WPScan
4.8 Medium Hustle Plugin wordpress-popup Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders No login needed 7.0.0.1 – < 7.8.14.2 Fixed in 7.8.14.2 CVE-2026-80440 WPScan
6.5 Medium Spam protection, Honeypot, Anti-Spam by CleanTalk Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Comment Text No login needed < 6.87 Fixed in 6.87 CVE-2026-19855 WPScan
4.3 Medium WP Recipe Maker Plugin wp-recipe-maker Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode ≤ 10.8.0 CVE-2026-75905 Wordfence
6.4 Medium My Calendar Plugin my-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes ≤ 3.8.3 CVE-2026-77187 Wordfence
6.4 Medium My Calendar Plugin my-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute ≤ 3.8.3 CVE-2026-77186 Wordfence
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.10.3.1 CVE-2026-18021 Wordfence
8.8 High Live Composer Plugin live-composer-page-builder PHP Object Injection Authenticated (Contributor+) PHP Object Injection via Shortcode ≤ 2.1.18 CVE-2026-16502 Wordfence
6.5 Medium Email Subscribers & Newsletters Plugin email-subscribers Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field No login needed ≤ 5.9.27 CVE-2026-12757 Wordfence
4.8 Medium Ninja Forms Plugin ninja-forms Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags No login needed 3.14.10 – < 3.15.2 Fixed in 3.15.2 CVE-2026-80437 WPScan
4.8 Medium Redirection for Contact Form 7 Plugin wpcf7-redirect Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags No login needed 2.2.7 – < 3.2.11 Fixed in 3.2.11 CVE-2026-80439 WPScan
6.5 Medium JetFormBuilder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19859 WPScan
6.4 Medium Pods Plugin pods Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute ≤ 3.3.9.1 CVE-2026-76573 Wordfence
6.4 Medium Gallery : FooGallery Plugin foogallery Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute ≤ 3.3.2 CVE-2026-85414 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter ≤ 4.27.6 CVE-2026-3853 Wordfence
6.8 Medium Joli Table Of Contents Plugin joli-table-of-contents Cross-Site Scripting Author+ Stored XSS via joli-toc Shortcode Theme Attribute < 3.0.3 Fixed in 3.0.3 CVE-2026-84931 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Multiple Shortcode Element Attributes < 5.9.8 Fixed in 5.9.8 CVE-2026-84022 WPScan
5.3 Medium WPFunnels Plugin wpfunnels Broken Access Control Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission No login needed 3.1.0 – < 3.13.0 Fixed in 3.13.0 CVE-2026-79632 WPScan
6.8 Medium Pods Plugin pods Path Traversal Author+ Arbitrary File Read via Shortcode Display Callback 3.1.0 – < 3.3.9.2 Fixed in 3.3.9.2 CVE-2026-74853 WPScan
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter ≤ 4.27.6 CVE-2026-3852 Wordfence
5.9 Medium LiveJournal Shortcode Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcode ≤ 1.1.1 CVE-2024-3773 WPScan
4.8 Medium Brave Popup Builder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via UTM Parameter No login needed < 0.8.8 Fixed in 0.8.8 CVE-2026-81571 WPScan
6.4 Medium Easy Waveform Player Plugin easy-waveform-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function ≤ 1.2.2 CVE-2025-7963 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter ≤ 4.27.5 CVE-2026-3850 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode ≤ 4.27.6 CVE-2026-3851 Wordfence
6.4 Medium WP Recipe Maker Premium Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode ≤ 10.5.0 CVE-2026-7877 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode ≤ 2.1.19 CVE-2026-16788 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode ≤ 2.1.19 CVE-2026-16786 Wordfence
4.8 Medium MW WP Form Plugin mw-wp-form Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags No login needed < 5.1.5 Fixed in 5.1.5 CVE-2026-78363 WPScan
6.5 Medium Charitable Plugin charitable SQL Injection Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute ≤ 1.8.12.1 CVE-2026-77189 Wordfence
7.2 High Affiliate Super Assistent Plugin amazonsimpleadmin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function No login needed ≤ 1.10.2 CVE-2026-19573 Wordfence
6.4 Medium Frontend Admin by DynamiApps Plugin acf-frontend-form-element Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute ≤ 3.29.11 CVE-2026-12747 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode ≤ 2.1.19 CVE-2026-16787 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute ≤ 2.1.19 CVE-2026-13203 Wordfence
6.4 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute ≤ 4.0.0 CVE-2026-75965 Wordfence
6.8 Medium Profile Builder Plugin Cross-Site Scripting Contributor+ Stored XSS via Format Date Shortcode 3.3.4 – < 4.0.1 Fixed in 4.0.1 CVE-2026-76546 WPScan
6.4 Medium GiveWP Plugin give Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.14.4 CVE-2026-5510 Wordfence
6.4 Medium Avada (Fusion) Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute ≤ 3.15.6 CVE-2026-16654 Wordfence
6.4 Medium Reviews and Rating – Google Reviews Plugin g-business-reviews-rating Cross-Site Scripting Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 5.10 CVE-2026-2388 Wordfence
6.4 Medium Betheme Theme betheme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode ≤ 28.4 CVE-2026-6178 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only