WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,151–1,200 of 6,499 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 24 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.2 High	AutomatorWP Plugin `automatorwp`	Cross-Site Scripting No login needed	`≤ 5.6.7` Fixed in `5.6.8`	Jun 15, 2026	`CVE-2026-42650`	Patchstack
7.1 High	Favicon Rotator Plugin `favicon-rotator`	Cross-Site Scripting No login needed	`≤ 1.2.11` Fixed in `1.2.12`	Jun 15, 2026	`CVE-2026-42649`	Patchstack
8.1 High	CloudSecure WP Security Plugin `cloudsecure-wp-security`	Authentication Bypass Broken Authentication No login needed	`≤ 1.4.7` Fixed in `1.4.8`	Jun 15, 2026	`CVE-2026-42411`	Patchstack
7.5 High	Simply Schedule Appointments Plugin `simply-schedule-appointments`	Information Disclosure Sensitive Data Exposure No login needed	`< 1.6.11.2` Fixed in `1.6.11.2`	Jun 15, 2026	`CVE-2026-42384`	Patchstack
7.1 High	WP Time Slots Booking Form Plugin `wp-time-slots-booking-form`	Cross-Site Scripting No login needed	`≤ 1.2.46` Fixed in `1.2.47`	Jun 15, 2026	`CVE-2026-40791`	Patchstack
7.5 High	Amelia Plugin `ameliabooking`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.2` Fixed in `2.2.1`	Jun 15, 2026	`CVE-2026-40789`	Patchstack
7.1 High	ChatBot Plugin `chatbot`	Broken Access Control	`≤ 7.9.7` Fixed in `7.9.9`	Jun 15, 2026	`CVE-2026-40788`	Patchstack
7.1 High	Quiz And Survey Master Plugin `quiz-master-next`	Cross-Site Scripting No login needed	`≤ 11.0.0` Fixed in `11.1.0`	Jun 15, 2026	`CVE-2026-40787`	Patchstack
7.1 High	AutomatorWP Plugin `automatorwp`	Authentication Bypass Broken Authentication	`≤ 5.6.7` Fixed in `5.6.8`	Jun 15, 2026	`CVE-2026-40785`	Patchstack
7.5 High	ReviewX Plugin `reviewx`	Authentication Bypass Broken Authentication No login needed	`≤ 2.3.6` Fixed in `2.3.7`	Jun 15, 2026	`CVE-2026-40781`	Patchstack
7.7 High	Link Library Plugin `link-library`	Arbitrary File Deletion	`≤ 7.8.8` Fixed in `7.8.9`	Jun 15, 2026	`CVE-2026-40779`	Patchstack
7.5 High	WP Event SOlution Plugin `wp-event-solution`	Broken Access Control No login needed	`≤ 4.1.8` Fixed in `4.1.9`	Jun 15, 2026	`CVE-2026-40776`	Patchstack
7.3 High	Royal MCP Plugin `royal-mcp`	Broken Access Control No login needed	`≤ 1.4.2` Fixed in `1.4.3`	Jun 15, 2026	`CVE-2026-40775`	Patchstack
7.5 High	Booking Package Plugin `booking-package`	Broken Access Control No login needed	`≤ 1.7.06` Fixed in `1.7.07`	Jun 15, 2026	`CVE-2026-40774`	Patchstack
7.1 High	Coupon Affiliates Plugin `woo-coupon-usage`	Cross-Site Scripting No login needed	`≤ 7.5.3` Fixed in `7.6.0`	Jun 15, 2026	`CVE-2026-40770`	Patchstack
8.6 High	Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field Plugin `contact-form-extender-for-divi-builder`	Arbitrary File Upload Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion No login needed	`≤ 1.0.6` Fixed in `1.0.7`	Jun 15, 2026	`CVE-2026-40769`	Patchstack
7.5 High	wpForo Forum Plugin `wpforo`	Broken Access Control No login needed	`< 3.0.2` Fixed in `3.0.2`	Jun 15, 2026	`CVE-2026-40767`	Patchstack
8.5 High	MasterStudy LMS Plugin `masterstudy-lms-learning-management-system`	SQL Injection	`≤ 3.7.25` Fixed in `3.7.26`	Jun 15, 2026	`CVE-2026-40766`	Patchstack
7.5 High	WPGraphQL Plugin `wp-graphql`	SQL Injection No login needed	`< 2.11.1` Fixed in `2.11.1`	Jun 15, 2026	`CVE-2026-40762`	Patchstack
7.5 High	Redsys for WooCommerce Light Plugin `woo-redsys-gateway-light`	Broken Access Control No login needed	`≤ 7.0.0` Fixed in `7.0.1`	Jun 15, 2026	`CVE-2026-40741`	Patchstack
7.1 High	Notification for Telegram Plugin `notification-for-telegram`	Cross-Site Scripting No login needed	`≤ 3.5` Fixed in `3.5.1`	Jun 15, 2026	`CVE-2026-40732`	Patchstack
7.7 High	Groundhogg Plugin `groundhogg`	Arbitrary File Deletion	`≤ 4.4` Fixed in `4.4.1`	Jun 15, 2026	`CVE-2026-40727`	Patchstack
8.1 High	WP BASE Booking Plugin `wp-base-booking-of-appointments-services-and-events`	Privilege Escalation No login needed	`≤ 5.9.0` Fixed in `6.0.0`	Jun 15, 2026	`CVE-2026-39587`	Patchstack
8.8 High	B Blocks Plugin `b-blocks`	Privilege Escalation	`≤ 2.0.31` Fixed in `2.0.32`	Jun 15, 2026	`CVE-2026-39579`	Patchstack
7.5 High	WP Directory Kit Plugin `wpdirectorykit`	Broken Access Control No login needed	`≤ 1.5.0` Fixed in `1.5.1`	Jun 15, 2026	`CVE-2026-39534`	Patchstack
7.5 High	AWP Classifieds Plugin `another-wordpress-classifieds-plugin`	Broken Access Control No login needed	`≤ 4.4.4` Fixed in `4.4.5`	Jun 15, 2026	`CVE-2026-39533`	Patchstack
8.8 High	Events Calendar for GeoDirectory Plugin `events-for-geodirectory`	PHP Object Injection	`≤ 2.3.25` Fixed in `2.3.26`	Jun 15, 2026	`CVE-2026-39532`	Patchstack
7.5 High	Masteriyo - LMS Plugin `learning-management-system`	Price Manipulation LMS plugin <= 2.1.5 - Payment Bypass No login needed	`≤ 2.1.5` Fixed in `2.1.6`	Jun 15, 2026	`CVE-2026-39524`	Patchstack
7.1 High	EventPrime Plugin `eventprime-event-calendar-management`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 4.3.0.0` Fixed in `4.3.0.1`	Jun 15, 2026	`CVE-2026-39518`	Patchstack
7.1 High	Paid Member Subscriptions Plugin `paid-member-subscriptions`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.17.3` Fixed in `3.0.0`	Jun 15, 2026	`CVE-2026-39514`	Patchstack
7.5 High	Easy Appointments Plugin `easy-appointments`	Broken Access Control No login needed	`≤ 3.12.21` Fixed in `3.12.22`	Jun 15, 2026	`CVE-2026-39513`	Patchstack
7.1 High	Social Slider Feed Plugin `instagram-slider-widget`	Cross-Site Scripting No login needed	`≤ 2.3.2` Fixed in `2.3.3`	Jun 15, 2026	`CVE-2026-39507`	Patchstack
7.5 High	Easy Digital Downloads Plugin `easy-digital-downloads`	Broken Access Control No login needed	`≤ 3.6.5` Fixed in `3.6.6`	Jun 15, 2026	`CVE-2026-39503`	Patchstack
7.2 High	Advanced Product Fields (Product Addons) for WooCommerce Plugin `advanced-product-fields-for-woocommerce`	PHP Object Injection	`≤ 1.6.19` Fixed in `1.6.20`	Jun 15, 2026	`CVE-2026-39499`	Patchstack
7.2 High	YayMail Plugin `yaymail`	PHP Object Injection	`≤ 4.3.3` Fixed in `4.3.4`	Jun 15, 2026	`CVE-2026-39498`	Patchstack
7.2 High	Modula Image Gallery Plugin `modula-best-grid-gallery`	PHP Object Injection	`≤ 2.14.18` Fixed in `2.14.19`	Jun 15, 2026	`CVE-2026-39481`	Patchstack
7.5 High	Backup Migration Plugin `backup-backup`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.1.1` Fixed in `2.1.2`	Jun 15, 2026	`CVE-2026-39480`	Patchstack
8.8 High	Anti-Malware Security and Brute-Force Firewall Plugin `gotmls`	PHP Object Injection	`≤ 4.23.87` Fixed in `4.23.88`	Jun 15, 2026	`CVE-2026-39478`	Patchstack
8.8 High	Post Duplicator Plugin `post-duplicator`	PHP Object Injection	`≤ 3.0.10` Fixed in `3.0.11`	Jun 15, 2026	`CVE-2026-39474`	Patchstack
7.2 High	WooCommerce PDF Invoices & Packing Slips Plugin `woocommerce-pdf-invoices-packing-slips`	PHP Object Injection	`< 5.9.0` Fixed in `5.9.0`	Jun 15, 2026	`CVE-2026-39472`	Patchstack
7.2 High	ShortPixel Image Optimizer Plugin `shortpixel-image-optimiser`	PHP Object Injection	`≤ 6.4.3` Fixed in `6.4.4`	Jun 15, 2026	`CVE-2026-39471`	Patchstack
7.2 High	WooCommerce Cart Abandonment Recovery Plugin `woo-cart-abandonment-recovery`	Privilege Escalation	`< 2.1.0` Fixed in `2.1.0`	Jun 15, 2026	`CVE-2026-39470`	Patchstack
7.1 High	ManageWP Worker Plugin `worker`	Cross-Site Scripting No login needed	`≤ 4.9.31` Fixed in `4.9.32`	Jun 15, 2026	`CVE-2026-39463`	Patchstack
7.1 High	FunnelKit Automations Plugin `wp-marketing-automations`	Authentication Bypass Broken Authentication	`≤ 3.7.3` Fixed in `3.8.0`	Jun 15, 2026	`CVE-2026-39450`	Patchstack
7.1 High	Contact Form to Any API Plugin `contact-form-to-any-api`	Cross-Site Scripting No login needed	`≤ 3.0.3`	Jun 15, 2026	`CVE-2026-39449`	Patchstack
7.1 High	Simply Schedule Appointments Plugin `simply-schedule-appointments`	Cross-Site Scripting No login needed	`≤ 1.6.10.6` Fixed in `1.6.11.0`	Jun 15, 2026	`CVE-2026-39447`	Patchstack
7.1 High	CformsII Plugin `cforms2`	Cross-Site Scripting No login needed	`≤ 15.1.3` Fixed in `15.1.4`	Jun 15, 2026	`CVE-2026-39435`	Patchstack
7.2 High	CTX Feed Plugin `webappick-product-feed-for-woocommerce`	PHP Object Injection	`≤ 6.6.26` Fixed in `6.6.27`	Jun 15, 2026	`CVE-2026-39434`	Patchstack
7.1 High	WooCommerce Product Table Lite Plugin `wc-product-table-lite`	Cross-Site Scripting No login needed	`≤ 4.6.3` Fixed in `4.6.4`	Jun 15, 2026	`CVE-2026-34902`	Patchstack
7.1 High	GiveWP Plugin `give`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 4.14.2` Fixed in `4.14.3`	Jun 15, 2026	`CVE-2026-34900`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.