WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 51–100 of 136 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.1 High WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Plugin wc-frontend-manager Broken Access Control Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.25 - Authenticated (Vendor+) Insecure Direct Object Reference to Arbitrary User Deletion ≤ 6.7.25 CVE-2026-2554 Wordfence
4.3 Medium ProfilePress Plugin wp-user-avatar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription ≤ 4.16.12 CVE-2026-4949 Wordfence
7.5 High Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Authentication Bypass Bypass Vulnerability No login needed ≤ 1.8.10 Fixed in 1.9.0 CVE-2026-24372 Patchstack
8.6 High WPSubscription Plugin subscription Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 1.8.10 Fixed in 1.8.11 CVE-2025-69347 Patchstack
7.1 High tagDiv Opt-In Builder Plugin td-subscription Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.7.3 Fixed in 1.7.4 CVE-2025-53222 Patchstack
5.3 Medium Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Broken Access Control Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation No login needed ≤ 1.9.2 CVE-2026-1926 Wordfence
6.5 Medium wpDiscuz Plugin wpdiscuz Other No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass No login needed < 7.6.47 Fixed in 7.6.47 CVE-2026-22216 VulnCheck
8.1 High wpDiscuz Plugin wpdiscuz SQL Injection SQL Injection in getAllSubscriptions() No login needed < 7.6.47 Fixed in 7.6.47 CVE-2026-22193 VulnCheck
8.1 High ProfilePress Plugin wp-user-avatar Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Subscription Cancellation/Expiration ≤ 4.16.11 CVE-2026-3453 Wordfence
6.5 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Broken Access Control Missing Authorization to Unauthenticated Arbitrary Subscription Deletion No login needed ≤ 4.11.1 CVE-2026-1781 Wordfence
6.5 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Broken Access Control Insecure Direct Object References (IDOR) ≤ 2.16.8 Fixed in 2.16.9 CVE-2025-68514 Patchstack
4.3 Medium Newsletter – Send awesome emails from Plugin newsletter Cross-Site Request Forgery Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription No login needed ≤ 9.1.0 CVE-2026-1051 Wordfence
7.2 High Brevo for WooCommerce Plugin woocommerce-sendinblue-newsletter-subscription Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 4.0.49 CVE-2025-14436 Wordfence
5.3 Medium Sendinblue for WooCommerce Plugin woocommerce-sendinblue-newsletter-subscription Broken Access Control No login needed ≤ 4.0.49 Fixed in 4.0.50 CVE-2025-66128 Patchstack
6.4 Medium User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Plugin user-registration Cross-Site Scripting Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 4.4.6 CVE-2025-13367 Wordfence
6.4 Medium Mailgun Subscriptions Plugin mailgun-subscriptions Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.3.1 CVE-2025-11876 Wordfence
5.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Other Unauthenticated Fake Payment Creation No login needed ≤ 1.1.7 CVE-2025-12752 Wordfence
5.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Broken Access Control No login needed ≤ 1.1.7 Fixed in 1.1.8 CVE-2025-66107 Patchstack
7.2 High Easy Email Subscription Plugin email-subscription-with-secure-captcha Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.3 CVE-2025-11994 Wordfence
4.3 Medium Asgaros Forum Plugin asgaros-forum Cross-Site Request Forgery Cross-Site Request Forgery to Subscription Settings Update No login needed ≤ 3.2.1 CVE-2025-12901 Wordfence
4.3 Medium Easy Email Subscription Plugin email-subscription-with-secure-captcha Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Subscriber Deletion No login needed ≤ 1.3 CVE-2025-10691 Wordfence
4.9 Medium Easy Email Subscription Plugin email-subscription-with-secure-captcha SQL Injection Authenticated (Admin+) SQL Injection via uid ≤ 1.3 CVE-2025-10683 Wordfence
5.3 Medium Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction Plugin paid-member-subscriptions Broken Access Control Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal No login needed ≤ 2.16.4 CVE-2025-11835 Wordfence
5.9 Medium Email Subscription Popup Plugin email-subscribe Cross-Site Scripting ≤ 1.2.26 Fixed in 1.2.27 CVE-2025-49912 Patchstack
4.3 Medium WP Subscription Forms PRO Plugin wp-subscription-forms-pro Broken Access Control Arbitrary Content Deletion ≤ 2.0.5 CVE-2025-60166 Patchstack
6.5 Medium Zoho Billing Plugin zoho-subscriptions Cross-Site Scripting ≤ 4.1 CVE-2025-57963 Patchstack
5.3 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Broken Access Control No login needed ≤ 2.15.9 Fixed in 2.16.0 CVE-2025-58600 Patchstack
7.1 High Newsletter subscription optin module Plugin newsletter-subscription-widget-for-sendblaster Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Stored XSS No login needed ≤ 1.2.9 CVE-2025-48308 Patchstack
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions Local File Inclusion No login needed ≤ 2.15.4 Fixed in 2.15.5 CVE-2025-54017 Patchstack
6.5 Medium WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible Plugin wc-frontend-manager Broken Access Control Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification No login needed ≤ 6.7.16 CVE-2025-3780 Wordfence
7.5 High Paid Member Subscriptions Plugin paid-member-subscriptions SQL Injection No login needed ≤ 2.15.1 Fixed in 2.15.2 CVE-2025-49870 Patchstack
4.3 Medium MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet Plugin paid-membership Cross-Site Request Forgery Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset No login needed ≤ 3.2.0 CVE-2025-5937 Wordfence
7.1 High Icegram Collect Plugin icegram-rainmaker Broken Access Control Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control ≤ 1.3.18 Fixed in 1.3.19 CVE-2025-47527 Patchstack
4.3 Medium Subscription Renewal Reminders for WooCommerce Plugin subscriptions-renewal-reminders Cross-Site Request Forgery No login needed ≤ 1.4.1 Fixed in 1.4.2 CVE-2025-28984 Patchstack
4.8 Medium Newsletter Plugin newsletter Cross-Site Scripting Admin+ Stored XSS via Subscription < 8.8.2 Fixed in 8.8.2 CVE-2025-3584 WPScan
6.1 Medium MemberSpace – Membership Plugin and Paid Subscriptions Plugin Cross-Site Scripting Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS No login needed < 2.1.14 Fixed in 2.1.14 CVE-2024-13727 WPScan
6.5 Medium tagDiv Opt-In Builder Plugin SQL Injection Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter ≤ 1.7 CVE-2025-2890 Wordfence
5.4 Medium WP Subscription Forms Plugin wp-subscription-forms Broken Access Control ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-39591 Patchstack
7.5 High WP Subscription Forms Plugin wp-subscription-forms Local File Inclusion ≤ 1.2.4 Fixed in 1.2.5 CVE-2025-32692 Patchstack
5.9 Medium ActiveCampaign Plugin activecampaign-subscription-forms Cross-Site Scripting ≤ 8.1.16 Fixed in 8.1.17 CVE-2025-32136 Patchstack
6.5 Medium Subscription Form for Feedblitz Plugin feedblitz-email-subscription Cross-Site Scripting ≤ 1.0.9 CVE-2025-31745 Patchstack
6.5 Medium Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Scripting ≤ 2.14.3 Fixed in 2.14.4 CVE-2025-31088 Patchstack
6.5 Medium Zoho Billing – Embed Payment Form Plugin zoho-subscriptions Cross-Site Scripting Embed Payment Form plugin <= 4.0 - Stored Cross Site Scripting (XSS) ≤ 4.0 Fixed in 4.1 CVE-2025-30900 Patchstack
8.5 High WP Subscription Forms Plugin wp-subscription-forms SQL Injection ≤ 1.2.3 Fixed in 1.2.4 CVE-2025-30784 Patchstack
5.3 Medium Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Plugin easy-digital-downloads Information Disclosure eCommerce Payments and Subscriptions made easy <= 3.3.6.1 - Unauthenticated Private Post Title Disclosure No login needed ≤ 3.3.6.1 CVE-2025-2252 Wordfence
7.6 High Super Simple Subscriptions Plugin super-simple-subscriptions SQL Injection ≤ 1.1.0 CVE-2025-30523 Patchstack
6.1 Medium Razorpay Subscription Button Elementor Plugin razorpay-subscription-button-elementor Cross-Site Scripting Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions No login needed ≤ 1.0.3 CVE-2024-13827 Wordfence
4.3 Medium Subscriptions & Memberships for PayPal Plugin subscriptions-memberships-for-paypal Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Post Deletion No login needed ≤ 1.1.6 CVE-2024-13560 Wordfence
6.5 Medium Autoship Cloud for WooCommerce Subscription Products Plugin autoship-cloud Cross-Site Scripting ≤ 2.8.0.1 Fixed in 2.8.1 CVE-2025-26878 Patchstack
6.4 Medium Autoship Cloud for WooCommerce Subscription Products Plugin autoship-cloud Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.0 CVE-2024-13461 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only