WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,151–1,200 of 9,010 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 24 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
8.1 High	Ultimate Member Plugin `ultimate-member`	Privilege Escalation Unauthenticated Privilege Escalation via Role Selection Field No login needed	`< 2.12.1` Fixed in `2.12.1`	Jul 31, 2026	`CVE-2026-12251`	WPScan
8.1 High	Product Feed Manager for WooCommerce Plugin `webappick-product-feed-for-woocommerce`	SQL Injection Contributor+ SQL Injection via Feed Filter	`< 7.6.1` Fixed in `7.6.1`	Jul 31, 2026	`CVE-2026-15258`	WPScan
7.5 High	GeekyBot Plugin	Information Disclosure Unauthenticated Sensitive Information Exposure via Chat History No login needed	`< 1.2.8` Fixed in `1.2.8`	Jul 31, 2026	`CVE-2026-15048`	WPScan
7.5 High	JS Help Desk Plugin `js-support-ticket`	Broken Access Control Unauthenticated Arbitrary Ticket File Attachment Upload No login needed	`< 3.1.4` Fixed in `3.1.4`	Jul 31, 2026	`CVE-2026-14930`	WPScan
7.5 High	FlxWoo Plugin `flx-woo`	Price Manipulation Unauthenticated Payment Bypass No login needed	`< 3.1.1` Fixed in `3.1.1`	Jul 31, 2026	`CVE-2026-14830`	WPScan
7.5 High	Demi - One Click Demo Import, Backup & Site Migration Plugin	Information Disclosure One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory No login needed	`< 0.0.7` Fixed in `0.0.7`	Jul 31, 2026	`CVE-2026-14333`	WPScan
7.5 High	GiveWP Plugin `give`	Information Disclosure Unauthenticated Recurring Donor Information Disclosure No login needed	`< 4.16.3` Fixed in `4.16.3`	Jul 31, 2026	`CVE-2026-14319`	WPScan
8.8 High	Realtyna Organic IDX plugin + WPL Real Estate Plugin `real-estate-listing-realtyna-wpl`	Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload	`≤ 5.3.0`	Jul 31, 2026	`CVE-2026-16236`	Wordfence
7.2 High	Subscriptions for WooCommerce Plugin `subscriptions-for-woocommerce`	Broken Access Control Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action	`≤ 2.0.0`	Jul 30, 2026	`CVE-2026-15397`	Wordfence
7.1 High	Tourmaster Plugin	Cross-Site Scripting Stored XSS via CSRF No login needed	`< 5.4.8` Fixed in `5.4.8`	Jul 30, 2026	`CVE-2026-14239`	WPScan
8.6 High	Bookly Plugin	SQL Injection Unauthenticated SQL Injection via staff_id No login needed	`< 27.8` Fixed in `27.8`	Jul 30, 2026	`CVE-2026-13395`	WPScan
7.5 High	Eventin Plugin `wp-event-solution`	Price Manipulation Unauthenticated Payment Bypass via Order Status Manipulation No login needed	`< 4.1.16` Fixed in `4.1.16`	Jul 30, 2026	`CVE-2026-13178`	WPScan
7.5 High	WP Travel Engine Plugin `wp-travel-engine`	Broken Access Control Unauthenticated Trip Difficulty Level Option Update No login needed	`< 6.8.2` Fixed in `6.8.2`	Jul 30, 2026	`CVE-2026-12500`	WPScan
7.5 High	Customer Switching for WooCommerce Plugin	Privilege Escalation Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution	`< 2.1.3` Fixed in `2.1.3`	Jul 30, 2026	`CVE-2026-15240`	WPScan
7.5 High	ProfileGrid Plugin `profilegrid-user-profiles-groups-and-communities`	Privilege Escalation Unauthenticated Privilege Escalation via Unrestricted Group ID No login needed	`< 5.9.9.8` Fixed in `5.9.9.8`	Jul 30, 2026	`CVE-2026-12687`	WPScan
7.5 High	BuddyPress Plugin `buddypress`	PHP Object Injection Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data	`≤ 14.5.0`	Jul 30, 2026	`CVE-2026-1360`	Wordfence
8.8 High	FleekDash V2 Plugin `fleekdash`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint	`≤ 2.6.2.2`	Jul 30, 2026	`CVE-2026-14356`	Wordfence
8.8 High	Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) Plugin	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings	`≤ 2.3.2`	Jul 29, 2026	`CVE-2026-14270`	Wordfence
7.2 High	Fluent Forms Plugin `fluentform`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member No login needed	`≤ 6.2.7`	Jul 29, 2026	`CVE-2026-16655`	Wordfence
7.2 High	GTM4WP Plugin `duracelltomi-google-tag-manager`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields No login needed	`≤ 1.22.3`	Jul 29, 2026	`CVE-2026-16597`	Wordfence
7.2 High	Database for CF7 Plugin `database-for-cf7`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Array Form Field Values No login needed	`≤ 1.2.6`	Jul 29, 2026	`CVE-2026-13425`	Wordfence
8.1 High	miniOrange Social Login and Register Plugin	Privilege Escalation Unauthenticated Account Takeover No login needed	`< 7.8.0` Fixed in `7.8.0`	Jul 29, 2026	`CVE-2026-14300`	WPScan
7.1 High	WOLF - WordPress Posts Bulk Editor and Manager Plugin	Cross-Site Scripting WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF No login needed	`< 1.1.0` Fixed in `1.1.0`	Jul 29, 2026	`CVE-2026-14234`	WPScan
7.4 High	UsersWP Plugin `userswp`	Authentication Bypass Two-Factor Authentication Bypass No login needed	`< 1.2.67` Fixed in `1.2.67`	Jul 29, 2026	`CVE-2026-13690`	WPScan
8.6 High	Media folder Addon Plugin	Path Traversal Unauthenticated Arbitrary File Download No login needed	`< 4.1.7` Fixed in `4.1.7`	Jul 29, 2026	`CVE-2026-11974`	WPScan
7.2 High	Easy Digital Downloads Plugin `easy-digital-downloads`	Arbitrary File Upload Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter	`≤ 3.6.9`	Jul 29, 2026	`CVE-2026-12476`	Wordfence
8.8 High	Wholesale for WooCommerce Plugin `woo-wholesale-pricing`	Privilege Escalation Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter	`≤ 2.0.5`	Jul 29, 2026	`CVE-2026-12144`	Wordfence
8.8 High	WP Password Policy Plugin `password-requirements`	Privilege Escalation Authenticated (Subscriber+) Privilege Escalation	`≤ 3.7.1`	Jul 28, 2026	`CVE-2026-15992`	Wordfence
7.2 High	StoreGrowth: Smart Sales Booster for WooCommerce \| BOGO, Upsells, Direct Checkout, Quick View, Side Cart Plugin `storegrowth-sales-booster`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter No login needed	`≤ 2.1.0`	Jul 28, 2026	`CVE-2026-13440`	Wordfence
7.5 High	Uncanny Automator Plugin `uncanny-automator`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints No login needed	`≤ 7.3.2`	Jul 28, 2026	`CVE-2026-15025`	Wordfence
7.5 High	Web Directory Free Plugin `web-directory-free`	SQL Injection Unauthenticated SQL Injection No login needed	`≤ 1.7.13`	Jul 28, 2026	`CVE-2026-14785`	Wordfence
8.8 High	Eazy Plugin Manager Plugin `plugins-on-steroids`	Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint	`≤ 4.4.1`	Jul 28, 2026	`CVE-2026-14328`	Wordfence
7.5 High	PickPlugins Question Answer Plugin `question-answer`	SQL Injection Unauthenticated SQL Injection via 'id' Parameter No login needed	`≤ 1.2.73`	Jul 28, 2026	`CVE-2026-10207`	Wordfence
7.5 High	TrueBooker Plugin `truebooker-appointment-booking`	SQL Injection Unauthenticated SQL Injection No login needed	`≤ 1.2.2`	Jul 28, 2026	`CVE-2026-13161`	Wordfence
7.5 High	Premium Packages Plugin `wpdm-premium-packages`	SQL Injection Unauthenticated SQL Injection No login needed	`≤ 6.2.0`	Jul 28, 2026	`CVE-2026-12800`	Wordfence
7.5 High	Online Scheduling and Appointment Booking System Plugin `bookly-responsive-appointment-booking-tool`	SQL Injection Unauthenticated SQL Injection No login needed	`≤ 27.5`	Jul 28, 2026	`CVE-2026-14516`	Wordfence
7.5 High	WP Fast Total Search Plugin `fulltext-search`	SQL Injection Unauthenticated SQL Injection No login needed	`≤ 1.80.280`	Jul 28, 2026	`CVE-2026-12741`	Wordfence
7.5 High	Tablesome Plugin	Broken Access Control Unauthenticated Post Creation and Modification No login needed	`< 1.1.31` Fixed in `1.1.31`	Jul 28, 2026	`CVE-2026-14924`	WPScan
7.1 High	Database for Contact Form 7, WPforms, Elementor forms Plugin `contact-form-entries`	Cross-Site Scripting Reflected XSS via form_id No login needed	`< 1.5.3` Fixed in `1.5.3`	Jul 28, 2026	`CVE-2026-14870`	WPScan
7.2 High	Better Messages Plugin `bp-better-messages`	Arbitrary File Deletion Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter	`≤ 2.15.19`	Jul 28, 2026	`CVE-2026-16585`	Wordfence
7.5 High	Demi Plugin `demi-backup-migration`	Arbitrary File Deletion Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action No login needed	`≤ 0.0.7`	Jul 28, 2026	`CVE-2026-14490`	Wordfence
7.1 High	Contest Gallery Plugin `contest-gallery`	Cross-Site Scripting No login needed	`≤ 30.0.6` Fixed in `30.0.7`	Jul 27, 2026	`CVE-2026-65447`	Patchstack
7.1 High	Kali Forms Plugin `kali-forms`	Cross-Site Scripting No login needed	`≤ 2.4.18` Fixed in `2.4.19`	Jul 27, 2026	`CVE-2026-65446`	Patchstack
7.1 High	BackWPup Plugin `backwpup`	Cross-Site Scripting No login needed	`≤ 5.7.4` Fixed in `5.7.5`	Jul 27, 2026	`CVE-2026-65443`	Patchstack
7.2 High	FormCraft Plugin `formcraft`	Server-Side Request Forgery No login needed	`≤ 3.9.15` Fixed in `3.9.16`	Jul 27, 2026	`CVE-2026-65442`	Patchstack
7.1 High	GiveWP Plugin `give`	Cross-Site Scripting No login needed	`≤ 4.16.3` Fixed in `4.16.4`	Jul 27, 2026	`CVE-2026-65441`	Patchstack
7.1 High	GetGenie Plugin `getgenie`	Cross-Site Scripting No login needed	`≤ 4.4.3` Fixed in `4.5.0`	Jul 27, 2026	`CVE-2026-65440`	Patchstack
7.1 High	Ultimate Addons for Contact Form 7 Plugin `ultimate-addons-for-contact-form-7`	Cross-Site Scripting No login needed	`≤ 3.5.45` Fixed in `3.5.46`	Jul 27, 2026	`CVE-2026-65439`	Patchstack
7.1 High	Message Filter for Contact Form 7 Plugin `cf7-message-filter`	Cross-Site Scripting No login needed	`≤ 1.6.3.9` Fixed in `1.6.4.0`	Jul 27, 2026	`CVE-2026-65438`	Patchstack
7.1 High	Spam protection, AntiSpam, FireWall by CleanTalk Plugin `cleantalk-spam-protect`	Cross-Site Scripting No login needed	`≤ 6.82` Fixed in `6.83`	Jul 27, 2026	`CVE-2026-65437`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.