WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,001–1,050 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 21 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical EduAdmin Booking Plugin eduadmin-booking Authentication Bypass Broken Authentication No login needed ≤ 5.4.2 Fixed in 6.0.0 CVE-2026-62101 Patchstack
7.1 High Visitor Traffic Real Time Statistics Pro Plugin visitors-traffic-real-time-statistics-pro Cross-Site Scripting No login needed ≤ 11.21 Fixed in 11.22 CVE-2026-90986 Patchstack
5.3 Medium FluentAuth Plugin fluent-security Other Email Verification Bypass No login needed ≤ 2.1.2 Fixed in 3.0.0 CVE-2026-78296 Patchstack
4.3 Medium Checkout Field Manager Plugin Broken Access Control Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field 7.4.9 – < 7.9.7 Fixed in 7.9.7 CVE-2026-87831 WPScan
4.3 Medium Checkout Field Manager Plugin Broken Access Control Subscriber+ Arbitrary Attachment Deletion via Unvalidated Attachment ID Reparenting 7.8.6 – < 7.9.7 Fixed in 7.9.7 CVE-2026-87829 WPScan
3.7 Low Robokassa payment gateway for Woocommerce Plugin robokassa Price Manipulation Unauthenticated Payment Bypass via Forged JWT Callback No login needed < 1.8.9 Fixed in 1.8.9 CVE-2026-91017 WPScan
8.6 High Yo Plugin SQL Injection Unauthenticated SQL Injection via username Parameter No login needed 1.1 – 1.3.1 CVE-2026-87963 WPScan
8.8 High To Do List Member Plugin Cross-Site Scripting Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler No login needed 1.4 – 1.6 CVE-2026-86801 WPScan
4.9 Medium Event Booking Manager for WooCommerce Plugin mage-eventpress Information Disclosure Contributor+ Payment Gateway Credential Disclosure 5.3.6 – < 5.6.0 Fixed in 5.6.0 CVE-2026-91019 WPScan
5.3 Medium Motors Plugin motors-car-dealership-classified-listings Information Disclosure Unauthenticated Draft/Private Listing Disclosure No login needed < 1.4.121 Fixed in 1.4.121 CVE-2026-91016 WPScan
5.3 Medium Master Addons for Elementor Plugin master-addons Broken Access Control Unauthenticated Popup Deactivation via jltma_popup_disable_expired No login needed 3.0.0 – < 3.1.9 Fixed in 3.1.9 CVE-2026-91015 WPScan
7.1 High Realtyna Organic IDX plugin + WPL Real Estate Plugin real-estate-listing-realtyna-wpl Cross-Site Scripting Reflected XSS via Location Selector Endpoint No login needed < 5.4.2 Fixed in 5.4.2 CVE-2026-91014 WPScan
6.8 Medium EWWW Image Optimizer Plugin ewww-image-optimizer Cross-Site Scripting Author+ Stored XSS via Image Class Attribute Backreference Expansion < 8.7.7 Fixed in 8.7.7 CVE-2026-91011 WPScan
4.3 Medium Invisible Anti-Spam & CAPTCHA Plugin Broken Access Control Subscriber+ Arbitrary Form Submission Deletion 2.0.5 – < 5.1.1 Fixed in 5.1.1 CVE-2026-91010 WPScan
4.3 Medium Active Products Tables for WooCommerce Plugin Cross-Site Request Forgery Subscriber+ Arbitrary Post Title Modification via woot_update_attachment 2.1.2 – < 2.1.3 Fixed in 2.1.3 CVE-2026-91009 WPScan
3.7 Low Event Booking Manager for WooCommerce Plugin mage-eventpress Information Disclosure Unauthenticated Attendee PII Disclosure via Booking Confirmation Panel No login needed 5.3.6 – < 5.3.8 Fixed in 5.3.8 CVE-2026-91008 WPScan
6.5 Medium Autopay Plugin platnosci-online-blue-media Information Disclosure Unauthenticated Cross-Customer Order Payment Parameter Disclosure and Deletion No login needed < 5.0.1 Fixed in 5.0.1 CVE-2026-90923 WPScan
5.3 Medium Paid Member Subscriptions Plugin Price Manipulation Unauthenticated Membership Payment Bypass via PayPal Standard Amount and Currency Mismatch No login needed < 3.0.9 Fixed in 3.0.9 CVE-2026-90922 WPScan
8.8 High PuppyFW Plugin Privilege Escalation Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation ≤ 0.4.4 CVE-2026-88904 WPScan
9.0 Critical wpShopGermany IT-RECHT KANZLEI Plugin wpshopgermany-it-recht-kanzlei Remote Code Execution Unauthenticated RCE via Predictable API Token No login needed 1.6 – < 2.4 Fixed in 2.4 CVE-2026-88795 WPScan
8.8 High Dictionary Plugin Cross-Site Scripting Unauthenticated Stored XSS via Direct Dictionary Update No login needed ≤ 1.0 CVE-2026-88792 WPScan
2.7 Low Comments Import & Export Plugin comments-import-export-woocommerce Information Disclosure Author+ Comment PII Disclosure via Export 2.1.11 – < 2.5.4 Fixed in 2.5.4 CVE-2026-87836 WPScan
8.8 High Dewa Kirim Plugin Cross-Site Scripting Unauthenticated Stored XSS via Checkout Coordinates No login needed ≤ 1.0.0 CVE-2026-87786 WPScan
4.8 Medium Newsletter Plugin newsletter Information Disclosure Unauthenticated Subscriber PII Disclosure and Modification via Predictable Tracking Signature Key No login needed < 9.3.8 Fixed in 9.3.8 CVE-2026-86824 WPScan
6.8 Medium HT Mega Plugin Cross-Site Scripting Contributor+ Stored XSS via Section Headline Tag 3.2.0 – < 3.2.6 Fixed in 3.2.6 CVE-2026-86788 WPScan
9.8 Critical Login with QR Plugin Authentication Bypass Unauthenticated Authentication Bypass via 'autologin_code' Parameter No login needed ≤ 1.0.0 CVE-2026-86710 WPScan
9.8 Critical The Pressengine Plugin Authentication Bypass Unauthenticated Authentication Bypass No login needed ≤ 1.0 CVE-2026-86709 WPScan
9.8 Critical Private Feed Key Plugin Authentication Bypass Unauthenticated Authentication Bypass via 'feedkey' Parameter No login needed ≤ 0.1 CVE-2026-86707 WPScan
3.7 Low LearnPress Plugin learnpress Information Disclosure Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint No login needed 4.4.3 – < 4.4.7 Fixed in 4.4.7 CVE-2026-86446 WPScan
8.8 High WPLP Cookie Consent Plugin gdpr-cookie-consent Cross-Site Scripting Unauthenticated Stored XSS via Consent Logs No login needed < 4.4.4 Fixed in 4.4.4 CVE-2026-85130 WPScan
7.5 High Choose User Role at Registration for WooCommerce Plugin Privilege Escalation Unauthenticated Privilege Escalation via Registration Role Request No login needed < 1.3.3 Fixed in 1.3.3 CVE-2026-85128 WPScan
7.1 High Dictionary Plugin Cross-Site Scripting Reflected XSS via Multiple Parameters No login needed ≤ 1.0 CVE-2025-15697 WPScan
9.8 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Arbitrary File Upload Unauthenticated Arbitrary File Upload via Chunked File Upload No login needed ≤ 1.1.9 CVE-2026-87796 Wordfence
8.1 High Paid Downloads Plugin paid-downloads Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action No login needed ≤ 3.15 CVE-2026-87935 Wordfence
6.4 Medium Photo Gallery by 10Web – Mobile-Friendly Image Gallery Plugin photo-gallery Cross-Site Scripting Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.8.44 CVE-2026-86311 Wordfence
5.3 Medium All-in-One WP Migration and Backup Plugin all-in-one-wp-migration Other Unauthenticated Insufficient Credential Protection via Authorization Basic Header No login needed ≤ 7.110 CVE-2026-89064 Wordfence
5.4 Medium Blog2Social Plugin blog2social Broken Access Control Blog2Social WordPress Plugin < 9.1.0 Broken Access Control via b2s_calendar_move_post < 9.1.0 Fixed in 9.1.0 CVE-2026-89031 VulnCheck
4.3 Medium Blog2Social Plugin blog2social Information Disclosure Blog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user < 9.1.0 Fixed in 9.1.0 CVE-2026-89030 VulnCheck
4.3 Medium Blog2Social Plugin blog2social Broken Access Control Blog2Social WordPress Plugin < 9.1.0 User Enumeration via AJAX Handler < 9.1.0 Fixed in 9.1.0 CVE-2026-89029 VulnCheck
7.6 High WP Mega Menu Plugin wp-megamenu SQL Injection ≤ 1.4.2 CVE-2026-92465 Patchstack
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Other Unauthenticated Booking Capacity Bypass via Multi-Appointment Submission No login needed < 1.5.95 Fixed in 1.5.95 CVE-2026-86475 WPScan
5.3 Medium Eventin Plugin wp-event-solution Price Manipulation Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay No login needed < 4.1.24 Fixed in 4.1.24 CVE-2026-84906 WPScan
4.8 Medium Formidable Forms Plugin formidable Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token No login needed 6.34 – < 6.35 Fixed in 6.35 CVE-2026-19857 WPScan
6.1 Medium Royal Elementor Addons Plugin Content Injection Unauthenticated Stored HTML Injection in Form Notification Emails No login needed < 1.7.1067 Fixed in 1.7.1067 CVE-2026-13407 WPScan
3.8 Low FluentBoards Plugin fluent-boards Broken Access Control Board Member+ Board Membership and Public Access Modification < 2.0.15 Fixed in 2.0.15 CVE-2026-89328 WPScan
3.8 Low FluentBoards Plugin fluent-boards Authentication Bypass Board Member+ Comment Author Spoofing via 'comment_by' Parameter < 2.0.15 Fixed in 2.0.15 CVE-2026-89327 WPScan
5.3 Medium KBoard Plugin Broken Access Control Unauthenticated Board Media Deletion via IDOR No login needed < 6.7 Fixed in 6.7 CVE-2026-88910 WPScan
5.4 Medium WPBot Plugin chatbot Broken Access Control Subscriber+ Claude AI Settings Update 8.7.2 – < 8.7.6 Fixed in 8.7.6 CVE-2026-87959 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Internal Notes Disclosure via Service and Category REST Routes No login needed < 1.2.8 Fixed in 1.2.8 CVE-2026-87907 WPScan
5.3 Medium Rox Appointment Booking Plugin rox-appointment-booking Information Disclosure Unauthenticated Staff PII Disclosure via Agent REST Route No login needed < 1.2.8 Fixed in 1.2.8 CVE-2026-87896 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only