WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 1,001–1,050 of 30,513 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.1 High | Grocery Shopping Store | Authentication Bypass Broken Authentication |
≤ 1.3.3 |
CVE-2026-93949 |
Patchstack | |
| 9.8 Critical | Travesia | PHP Object Injection No login needed |
≤ 1.1.16 |
CVE-2026-93929 |
Patchstack | |
| 9.8 Critical | Veto | PHP Object Injection No login needed |
≤ 1.6.0 |
CVE-2026-93927 |
Patchstack | |
| 7.2 High | YITH WooCommerce Affiliates | PHP Object Injection |
≤ 3.31.0 Fixed in 3.31.1 |
CVE-2026-106606 |
Patchstack | |
| 6.4 Medium | Simple Membership | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field |
≤ 4.8.4 |
CVE-2026-103427 |
Wordfence | |
| 7.2 High | WP Meteor Website Speed Optimization Addon | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Author Name No login needed |
≤ 3.4.18 Fixed in 3.4.19 |
CVE-2026-96572 |
Wordfence | |
| 7.2 High | 10Web Booster | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Author Name No login needed |
≤ 2.34.8 Fixed in 2.34.10 |
CVE-2026-107742 |
Wordfence | |
| 3.7 Low | SpeedyCache | Information Disclosure Unauthenticated Sensitive Information Exposure via Insecure Cache Configuration via Cache Write Gate Missing comment_author_* Cookie Check No login needed |
≤ 1.4.2 Fixed in 1.4.3 |
CVE-2026-104006 |
Wordfence | |
| 5.3 Medium | CV Builder – Professional Resume Builder SaaS | Broken Access Control Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload No login needed |
≤ 1.3.1 Fixed in 1.3.2 |
CVE-2026-3717 |
Wordfence | |
| 6.4 Medium | Team | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode |
≤ 6.0.2 |
CVE-2026-102402 |
Wordfence | |
| 7.2 High | LazyLoad | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content No login needed |
≤ 2.4.0 Fixed in 2.4.1 |
CVE-2026-100196 |
Wordfence | |
| 6.5 Medium | WP Booking System | SQL Injection Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter |
≤ 2.1.0.1 Fixed in 2.1.0.2 |
CVE-2026-107712 |
Wordfence | |
| 6.4 Medium | Frontend Admin by DynamiApps | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content |
≤ 3.28.36 |
CVE-2026-6243 |
Wordfence | |
| 6.1 Medium | Favicon Rotator | Cross-Site Scripting Reflected Cross-Site Scripting via 'fvrt_' prefix No login needed |
≤ 1.2.11 |
CVE-2026-5725 |
Wordfence | |
| 7.2 High | Photo Reviews for WooCommerce | Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter No login needed |
≤ 1.2.30 |
CVE-2026-100161 |
Wordfence | |
| 8.1 High | WP File Download | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions |
≤ 6.3.9 |
CVE-2026-94538 |
Wordfence | |
| 9.1 Critical | PPOM | Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter No login needed |
≤ 34.0.10 Fixed in 34.0.11 |
CVE-2026-104801 |
Wordfence | |
| 4.4 Medium | Responsive Lightbox & Gallery | Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute |
≤ 2.7.9 Fixed in 2.7.10 |
CVE-2026-103897 |
Wordfence | |
| 6.1 Medium | Payment Plugins for Stripe WooCommerce | Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment No login needed |
≤ 4.0.17 Fixed in 4.0.18 |
CVE-2026-89100 |
Wordfence | |
| 6.5 Medium | SiteOrigin Widgets Bundle | Path Traversal Authenticated (Contributor+) Arbitrary File Read via LESS Injection via [siteorigin_widget] Shortcode 'value' JSON Instance (design.colors LESS Variable) |
≤ 1.74.3 Fixed in 1.75.0 |
CVE-2026-97348 |
Wordfence | |
| 7.2 High | Online Scheduling and Appointment Booking System | PHP Object Injection Authenticated (Custom+) PHP Object Injection via 'value' Parameter |
≤ 28.2 Fixed in 28.3 |
CVE-2026-12626 |
Wordfence | |
| 7.2 High | Post Grid Gutenberg Blocks | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via display_name User Field No login needed |
≤ 5.1.0 |
CVE-2026-96840 |
Wordfence | |
| 6.4 Medium | User Frontend | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter |
≤ 4.3.12 Fixed in 4.3.13 |
CVE-2026-96574 |
Wordfence | |
| 7.2 High | VikBooking Hotel Booking Engine & PMS | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter No login needed |
≤ 1.8.15 Fixed in 1.8.16 |
CVE-2026-95684 |
Wordfence | |
| 7.2 High | Quiz and Survey Master (QSM) | Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter No login needed |
≤ 11.2.6 Fixed in 11.2.7 |
CVE-2026-96558 |
Wordfence | |
| 5.4 Medium | Fluent Forms | Broken Access Control Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification |
≤ 6.2.5 Fixed in 6.2.6 |
CVE-2026-15178 |
Wordfence | |
| 8.1 High | SMS Alert | Privilege Escalation Unauthenticated Privilege Escalation via Arbitrary Password Reset No login needed |
3.9.6 – < 4.0.1 Fixed in 4.0.1 |
CVE-2026-94257 |
WPScan | |
| 8.1 High | SMS Alert | Authentication Bypass Unauthenticated Authentication Bypass via Login with OTP No login needed |
4.0.0 – < 4.0.1 Fixed in 4.0.1 |
CVE-2026-94256 |
WPScan | |
| 6.8 Medium | Gallery PhotoBlocks | Cross-Site Scripting Contributor+ Stored XSS |
1.3.5 – < 1.3.6 Fixed in 1.3.6 |
CVE-2026-107323 |
WPScan | |
| 5.4 Medium | W3 Total Cache | Path Traversal Author+ Path Traversal via CDN Media Library Import |
< 2.10.6 Fixed in 2.10.6 |
CVE-2026-107321 |
WPScan | |
| 5.3 Medium | Contest Gallery | Authentication Bypass Unauthenticated Email Verification Bypass via Brute-Forceable Registration PIN No login needed |
< 33.0.1 Fixed in 33.0.1 |
CVE-2026-107120 |
WPScan | |
| 8.6 High | LTL Freight Quotes – Old Dominion Edition | SQL Injection Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter No login needed |
4.2.11 – < 4.2.19 Fixed in 4.2.19 |
CVE-2026-87781 |
WPScan | |
| 8.8 High | LTL Freight Quotes – Old Dominion Edition | Cross-Site Scripting Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules No login needed |
< 4.2.19 Fixed in 4.2.19 |
CVE-2026-87780 |
WPScan | |
| 6.5 Medium | Tutor LMS | Broken Access Control Instructor+ Arbitrary Post Reparenting via IDOR |
4.0.5 – < 4.1.1 Fixed in 4.1.1 |
CVE-2026-85571 |
WPScan | |
| 5.3 Medium | Booking Package | Information Disclosure Unauthenticated Booking Customer PII Disclosure No login needed |
< 1.7.30 Fixed in 1.7.30 |
CVE-2026-105995 |
WPScan | |
| 5.3 Medium | Accept PayPal Payments Using Contact Form 7 | Information Disclosure Unauthenticated PII Disclosure via CSV Export No login needed |
< 4.0.7 Fixed in 4.0.7 |
CVE-2026-105990 |
WPScan | |
| 5.3 Medium | Accept PayPal Payments using Contact Form 7 | Broken Access Control Unauthenticated Transaction Status Forgery No login needed |
< 4.0.7 Fixed in 4.0.7 |
CVE-2026-105989 |
WPScan | |
| 2.2 Low | Portfolio Filter Gallery | Broken Access Control Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail |
2.0.2 – < 2.2.1 Fixed in 2.2.1 |
CVE-2026-105977 |
WPScan | |
| 4.7 Medium | Portfolio Filter Gallery | Broken Access Control Contributor+ Missing Authorization via Multiple AJAX Actions |
< 2.2.1 Fixed in 2.2.1 |
CVE-2026-105976 |
WPScan | |
| 3.5 Low | Rank Math SEO | Cross-Site Scripting Admin+ Stored XSS via Redirection Source URL |
< 1.0.280 Fixed in 1.0.280 |
CVE-2026-104754 |
WPScan | |
| 4.1 Medium | Rank Math SEO | SQL Injection Admin+ SQLi via 'per_page' Parameter |
< 1.0.280 Fixed in 1.0.280 |
CVE-2026-104753 |
WPScan | |
| 7.2 High | Rank Math SEO | Arbitrary File Upload Admin+ Arbitrary File Upload to RCE via Settings Import |
< 1.0.280 Fixed in 1.0.280 |
CVE-2026-104752 |
WPScan | |
| 6.4 Medium | Graphene | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields |
≤ 2.9.4 Fixed in 2.9.6 |
CVE-2026-17025 |
Wordfence | |
| 7.2 High | Easy Digital Downloads | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters No login needed |
≤ 3.6.9 Fixed in 3.6.9.1 |
CVE-2026-14335 |
Wordfence | |
| 6.1 Medium | Download Manager | Cross-Site Scripting Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter No login needed |
≤ 3.3.57 Fixed in 3.3.58 |
CVE-2026-12054 |
Wordfence | |
| 4.7 Medium | JetFormBuilder | Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer No login needed |
≤ 3.6.6 Fixed in 3.6.6.1 |
CVE-2026-103912 |
Wordfence | |
| 6.4 Medium | Brizy | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta |
≤ 2.8.18 Fixed in 2.8.19 |
CVE-2026-14882 |
Wordfence | |
| 5.4 Medium | Simple Newsletter | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot No login needed |
≤ 4.3.10 |
CVE-2026-103482 |
Wordfence | |
| 7.2 High | Podlove Podcast Publisher | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook No login needed |
≤ 4.5.6 Fixed in 4.5.7 |
CVE-2026-93775 |
Wordfence | |
| 6.4 Medium | Data Tables Generator by Supsystic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute |
≤ 1.12.03 Fixed in 1.12.04 |
CVE-2026-14877 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.