WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 1,051–1,100 of 30,513 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 8.8 High | LifterLMS | PHP Object Injection Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data |
≤ 10.2.1 Fixed in 10.3.0 |
CVE-2026-104723 |
Wordfence | |
| 6.4 Medium | GiveWP | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes |
≤ 4.17.0 |
CVE-2026-97643 |
Wordfence | |
| 6.4 Medium | Kadence Blocks | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute |
≤ 3.7.12 Fixed in 3.7.12.1 |
CVE-2026-104762 |
Wordfence | |
| 7.2 High | Presto Player | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag No login needed |
≤ 4.5.1 Fixed in 4.5.2 |
CVE-2026-96682 |
Wordfence | |
| 8.1 High | Groundhogg | Privilege Escalation Unauthenticated Privilege Escalation to Support User Identity Confusion No login needed |
≤ 4.8.3 |
CVE-2026-92975 |
Wordfence | |
| 8.1 High | GeoDirectory | Local File Inclusion Unauthenticated Local File Inclusion via 'design_type' Parameter No login needed |
≤ 2.8.187 Fixed in 2.8.188 |
CVE-2026-104899 |
Wordfence | |
| 6.4 Medium | Embed Any Document | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode |
≤ 2.7.13 |
CVE-2026-18558 |
Wordfence | |
| 6.4 Medium | Church Admin | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter |
≤ 5.1.2 |
CVE-2026-94421 |
Wordfence | |
| 6.4 Medium | Getwid | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points' |
≤ 3.0.1 |
CVE-2026-91862 |
Wordfence | |
| 8.8 High | FooSales | Privilege Escalation Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint |
≤ 1.43.0 Fixed in 1.43.1 |
CVE-2026-77183 |
Wordfence | |
| 7.2 High | Real Estate Manager | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter No login needed |
≤ 7.3 |
CVE-2026-96667 |
Wordfence | |
| 5.3 Medium | Order Export & Order Import for WooCommerce | Information Disclosure Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path() No login needed |
≤ 2.7.8 Fixed in 2.7.9 |
CVE-2026-94375 |
Wordfence | |
| 4.9 Medium | Post Export Import with Media | Path Traversal Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_path' Parameter in media_metadata.json |
≤ 1.17.1 Fixed in 1.17.2 |
CVE-2026-104763 |
Wordfence | |
| 8.8 High | Groundhogg | Privilege Escalation Authenticated (Custom+) Privilege Escalation to 'user' Parameter |
≤ 4.9 Fixed in 4.9.1 |
CVE-2026-104725 |
Wordfence | |
| 6.4 Medium | HivePress | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format |
≤ 1.7.31 |
CVE-2026-103520 |
Wordfence | |
| 8.8 High | FV Player 8 | Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter |
≤ 8.1.7 |
CVE-2026-83526 |
Wordfence | |
| 6.4 Medium | MP3 Audio Player | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 5.14.2 Fixed in 5.15 |
CVE-2026-16776 |
Wordfence | |
| 6.4 Medium | GamiPress | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter |
≤ 7.9.4 Fixed in 7.9.9 |
CVE-2026-14379 |
Wordfence | |
| 8.8 High | Appointment Booking | Privilege Escalation Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter |
≤ 5.7.3 Fixed in 5.7.4 |
CVE-2026-104766 |
Wordfence | |
| 3.1 Low | AI Puffer | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action |
≤ 2.4.89 Fixed in 2.4.90 |
CVE-2026-104742 |
Wordfence | |
| 3.1 Low | AI Puffer | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint |
≤ 2.4.89 Fixed in 2.4.90 |
CVE-2026-104741 |
Wordfence | |
| 4.9 Medium | Smart Popup by Supsystic | SQL Injection Authenticated (Administrator+) SQL Injection via 'sidx' Parameter |
≤ 1.13.2 Fixed in 1.13.3 |
CVE-2026-104023 |
Wordfence | |
| 6.4 Medium | Table Field Add-on for ACF and SCF | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content |
≤ 1.3.35 Fixed in 1.4.0 |
CVE-2026-78068 |
Wordfence | |
| 4.3 Medium | Appointment Booking | Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter |
≤ 5.7.2 |
CVE-2026-91050 |
Wordfence | |
| 5.3 Medium | Booking Calendar | Information Disclosure Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action No login needed |
≤ 11.4.3 Fixed in 11.5 |
CVE-2026-18496 |
Wordfence | |
| 7.5 High | rtMedia for WordPress, BuddyPress and bbPress | Broken Access Control Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter No login needed |
≤ 4.7.13 |
CVE-2026-89301 |
Wordfence | |
| 7.2 High | Fastcache by Host.it | Remote Code Execution Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting |
≤ 1.7.4 Fixed in 1.7.5 |
CVE-2026-104021 |
Wordfence | |
| 9.1 Critical | Avada (Fusion) Builder | Broken Access Control Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field No login needed |
≤ 7.16.1 |
CVE-2026-97670 |
Wordfence | |
| 5.3 Medium | FireBox | SQL Injection Authenticated (Author+) SQL Injection via FireBox Form Display Condition |
≤ 3.1.13 Fixed in 3.1.14 |
CVE-2026-104724 |
Wordfence | |
| 6.1 Medium | Form Maker by 10Web | Cross-Site Scripting Reflected Cross-Site Scripting via 'inputs' Parameter Array Key No login needed |
≤ 1.15.48 Fixed in 1.15.49 |
CVE-2026-103998 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode |
≤ 3.3.58 |
CVE-2026-9696 |
Wordfence | |
| 5.4 Medium | Anti-Spam by CleanTalk | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex No login needed |
≤ 6.88 |
CVE-2026-103424 |
Wordfence | |
| 5.3 Medium | Appointment Booking Calendar | Broken Access Control Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token No login needed |
≤ 1.6.11.11 Fixed in 1.6.12.0 |
CVE-2026-6723 |
Wordfence | |
| 6.4 Medium | RSS Aggregator by Feedzy | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title> |
≤ 5.2.10 |
CVE-2026-104735 |
Wordfence | |
| 4.3 Medium | Download Manager | Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email |
≤ 3.3.71 Fixed in 3.3.72 |
CVE-2026-103964 |
Wordfence | |
| 6.1 Medium | Filter Everything — WordPress & WooCommerce Filters | Cross-Site Scripting Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL No login needed |
≤ 1.9.6 Fixed in 1.9.7 |
CVE-2026-87869 |
Wordfence | |
| 6.4 Medium | Download Manager | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute |
≤ 3.3.71 Fixed in 3.3.72 |
CVE-2026-102401 |
Wordfence | |
| 6.4 Medium | FV Flowplayer Video Player | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute |
≤ 7.5.54.7212 |
CVE-2026-97630 |
Wordfence | |
| 5.4 Medium | Hello Plus | Broken Access Control Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site |
≤ 1.7.7 Fixed in 1.7.8 |
CVE-2026-5727 |
Wordfence | |
| 9.8 Critical | 3D Product configurator for WooCommerce | Remote Code Execution Unauthenticated Remote Code Execution via 'xpv_image' Parameter No login needed |
≤ 2.16.2 Fixed in 2.16.3 |
CVE-2026-103889 |
Wordfence | |
| 4.7 Medium | Fluent Forms | Cross-Site Scripting Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter No login needed |
≤ 6.2.14 Fixed in 6.2.15 |
CVE-2026-101324 |
Wordfence | |
| 6.4 Medium | GeoDirectory | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field |
≤ 2.8.188 Fixed in 2.8.189 |
CVE-2026-104993 |
Wordfence | |
| 6.4 Medium | Data Tables Generator by Supsystic | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action |
≤ 1.15.1 Fixed in 1.15.3 |
CVE-2026-96648 |
Wordfence | |
| 9.8 Critical | Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) | Arbitrary File Upload Unauthenticated Arbitrary File Upload via Signature Field File Upload No login needed |
≤ 3.4.5 Fixed in 3.4.6 |
CVE-2026-94589 |
Wordfence | |
| 9.8 Critical | Advanced IP Blocker | Authentication Bypass Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler No login needed |
≤ 8.13.13 Fixed in 8.13.14 |
CVE-2026-104732 |
Wordfence | |
| 5.3 Medium | Online Scheduling and Appointment Booking System | Information Disclosure Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details No login needed |
≤ 28.4 Fixed in 28.5 |
CVE-2026-103365 |
Wordfence | |
| 9.1 Critical | Blocksy Companion | Privilege Escalation Unauthenticated Privilege Escalation to 'role' Parameter No login needed |
≤ 2.1.58 Fixed in 2.1.59 |
CVE-2026-107645 |
Wordfence | |
| 8.1 High | Advanced Form Integration | Authentication Bypass Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action No login needed |
≤ 2.9.0 Fixed in 2.10.0 |
CVE-2026-104797 |
Wordfence | |
| 6.4 Medium | Table Field Add-on for ACF and SCF | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value |
≤ 1.4.1-RC2 |
CVE-2026-96743 |
Wordfence | |
| 6.8 Medium | Online Scheduling and Appointment Booking System | Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body |
≤ 28.4 Fixed in 28.5 |
CVE-2026-104898 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.