WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 51–100 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.10.3.1 CVE-2026-18021 Wordfence
6.5 Medium Email Subscribers & Newsletters Plugin email-subscribers Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field No login needed ≤ 5.9.27 CVE-2026-12757 Wordfence
4.8 Medium Ninja Forms Plugin ninja-forms Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags No login needed 3.14.10 – < 3.15.2 Fixed in 3.15.2 CVE-2026-80437 WPScan
4.8 Medium Redirection for Contact Form 7 Plugin wpcf7-redirect Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags No login needed 2.2.7 – < 3.2.11 Fixed in 3.2.11 CVE-2026-80439 WPScan
6.5 Medium JetFormBuilder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19859 WPScan
6.4 Medium Pods Plugin pods Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute ≤ 3.3.9.1 CVE-2026-76573 Wordfence
6.4 Medium Gallery : FooGallery Plugin foogallery Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute ≤ 3.3.2 CVE-2026-85414 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter ≤ 4.27.6 CVE-2026-3853 Wordfence
6.8 Medium Joli Table Of Contents Plugin joli-table-of-contents Cross-Site Scripting Author+ Stored XSS via joli-toc Shortcode Theme Attribute < 3.0.3 Fixed in 3.0.3 CVE-2026-84931 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Multiple Shortcode Element Attributes < 5.9.8 Fixed in 5.9.8 CVE-2026-84022 WPScan
5.3 Medium WPFunnels Plugin wpfunnels Broken Access Control Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission No login needed 3.1.0 – < 3.13.0 Fixed in 3.13.0 CVE-2026-79632 WPScan
6.8 Medium Pods Plugin pods Path Traversal Author+ Arbitrary File Read via Shortcode Display Callback 3.1.0 – < 3.3.9.2 Fixed in 3.3.9.2 CVE-2026-74853 WPScan
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter ≤ 4.27.6 CVE-2026-3852 Wordfence
5.9 Medium LiveJournal Shortcode Plugin Cross-Site Scripting Contributor+ Stored XSS via Shortcode ≤ 1.1.1 CVE-2024-3773 WPScan
4.8 Medium Brave Popup Builder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via UTM Parameter No login needed < 0.8.8 Fixed in 0.8.8 CVE-2026-81571 WPScan
6.4 Medium Easy Waveform Player Plugin easy-waveform-player Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function ≤ 1.2.2 CVE-2025-7963 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter ≤ 4.27.5 CVE-2026-3850 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode ≤ 4.27.6 CVE-2026-3851 Wordfence
6.4 Medium WP Recipe Maker Premium Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode ≤ 10.5.0 CVE-2026-7877 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode ≤ 2.1.19 CVE-2026-16788 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode ≤ 2.1.19 CVE-2026-16786 Wordfence
4.8 Medium MW WP Form Plugin mw-wp-form Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Completion Message Merge Tags No login needed < 5.1.5 Fixed in 5.1.5 CVE-2026-78363 WPScan
6.5 Medium Charitable Plugin charitable SQL Injection Authenticated (Contributor+) SQL Injection via 'order' Shortcode Attribute ≤ 1.8.12.1 CVE-2026-77189 Wordfence
6.4 Medium Frontend Admin by DynamiApps Plugin acf-frontend-form-element Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute ≤ 3.29.11 CVE-2026-12747 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode ≤ 2.1.19 CVE-2026-16787 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute ≤ 2.1.19 CVE-2026-13203 Wordfence
6.4 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute ≤ 4.0.0 CVE-2026-75965 Wordfence
6.8 Medium Profile Builder Plugin Cross-Site Scripting Contributor+ Stored XSS via Format Date Shortcode 3.3.4 – < 4.0.1 Fixed in 4.0.1 CVE-2026-76546 WPScan
6.4 Medium GiveWP Plugin give Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.14.4 CVE-2026-5510 Wordfence
6.4 Medium Avada (Fusion) Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute ≤ 3.15.6 CVE-2026-16654 Wordfence
6.4 Medium Reviews and Rating – Google Reviews Plugin g-business-reviews-rating Cross-Site Scripting Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes ≤ 5.10 CVE-2026-2388 Wordfence
6.4 Medium Betheme Theme betheme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode ≤ 28.4 CVE-2026-6178 Wordfence
6.4 Medium eCommerce Product Catalog Plugin ecommerce-product-catalog Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute ≤ 3.5.10 CVE-2026-76128 Wordfence
6.4 Medium Image Photo Gallery Final Tiles Grid Plugin final-tiles-grid-gallery-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute ≤ 3.6.12 CVE-2026-4559 Wordfence
5.3 Medium kk Star Ratings Plugin kk-star-ratings Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter No login needed ≤ 5.4.10.3 CVE-2026-3424 Wordfence
6.5 Medium ProfilePress Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Display Name No login needed < 4.17.1 Fixed in 4.17.1 CVE-2026-19848 WPScan
5.3 Medium Shortcodes and extra features for Phlox Plugin auxin-elements Information Disclosure Sensitive Data Exposure No login needed ≤ 2.17.24 CVE-2026-74008 Patchstack
6.5 Medium Wufoo Shortcode Plugin wufoo-shortcode Cross-Site Scripting ≤ 1.55 CVE-2026-66643 Patchstack
6.4 Medium Smash Balloon Social Post Feed Plugin custom-facebook-feed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute ≤ 4.9.0 CVE-2026-16775 Wordfence
6.4 Medium Snippet Shortcodes Plugin shortcode-variables Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 5.2.0 CVE-2026-16758 Wordfence
6.4 Medium SureDash Plugin suredash Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute ≤ 1.10.3 CVE-2026-18402 Wordfence
6.4 Medium Video Gallery Plugin youtube-showcase Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Attachment 'post_title' via emd_mb_meta Shortcode ≤ 4.0.4 CVE-2026-15790 Wordfence
6.4 Medium Serious Slider Plugin cryout-serious-slider Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute ≤ 1.4.0 CVE-2026-15726 Wordfence
5.4 Medium Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content Plugin wp-user-avatar Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field ≤ 4.16.19 CVE-2026-18385 Wordfence
6.8 Medium Embed Google Photos Album Easily Plugin Cross-Site Scripting Contributor+ Stored XSS via link Shortcode Attribute ≤ 2.2.1 CVE-2026-14290 WPScan
6.4 Medium PPWP – Password Protect Pages Plugin password-protect-page Cross-Site Scripting Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.9.21 CVE-2026-3639 Wordfence
6.5 Medium Kirki Plugin kirki Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Form Email Actions No login needed < 6.2.1 Fixed in 6.2.1 CVE-2026-16747 WPScan
6.4 Medium Kirki - Freeform Page Builder, Website Builder & Customizer Plugin Cross-Site Scripting Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_meta Shortcode ≤ 6.2.0 CVE-2026-16974 Wordfence
6.8 Medium s2Member Plugin s2member Cross-Site Scripting Contributor+ Stored XSS via Shortcode < 260805 Fixed in 260805 CVE-2026-15047 WPScan
5.4 Medium BNE Testimonials Plugin bne-testimonials Cross-Site Scripting Contributor+ Stored XSS via Slider Shortcode < 2.0.8.2 Fixed in 2.0.8.2 CVE-2026-15245 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only