WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 101–150 of 476 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Fluent Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute |
≤ 6.2.1 Fixed in 6.2.2 |
CVE-2026-6828 |
Wordfence | |
| 4.3 Medium | Forms Rb | Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter |
≤ 1.1.9 |
CVE-2026-7050 |
Wordfence | |
| 6.1 Medium | Contact Form Builder | Cross-Site Scripting WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php No login needed |
1.6.1 |
CVE-2022-50959 |
VulnCheck | |
| 6.5 Medium | Forminator Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook |
≤ 1.53.0 Fixed in 1.53.0.1 |
CVE-2026-6214 |
Wordfence | |
| 5.3 Medium | Forminator Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter |
≤ 1.51.1 Fixed in 1.52 |
CVE-2026-6222 |
Wordfence | |
| 4.9 Medium | Fluent Forms | Path Traversal Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment |
≤ 6.2.1 Fixed in 6.2.2 |
CVE-2026-6344 |
Wordfence | |
| 4.3 Medium | HubSpot All-In-One Marketing - Forms, Popups, Live Chat | Broken Access Control Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure |
≤ 11.3.32 Fixed in 11.3.33 |
CVE-2025-11762 |
Wordfence | |
| 5.3 Medium | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | Broken Access Control Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification No login needed |
6.1.21 Fixed in 6.2.0 |
CVE-2026-4160 |
Wordfence | |
| 5.3 Medium | Mailercloud – Integrate webforms and synchronize website contacts | Broken Access Control Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control No login needed |
≤ 1.0.7 |
CVE-2026-39713 |
Patchstack | |
| 5.3 Medium | leadlovers forms | Broken Access Control No login needed |
≤ 1.0.2 |
CVE-2026-39657 |
Patchstack | |
| 6.4 Medium | Magic Conversation For Gravity Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 3.0.97 |
CVE-2026-1396 |
Wordfence | |
| 6.1 Medium | Gravity Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field No login needed |
≤ 2.9.30 |
CVE-2026-4394 |
Wordfence | |
| 4.7 Medium | Gravity Forms | Cross-Site Scripting Reflected Cross-Site Scripting via 'form_ids' Parameter No login needed |
≤ 2.9.30 |
CVE-2026-4406 |
Wordfence | |
| 4.3 Medium | Database for Contact Form 7, WPforms, Elementor forms | Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode |
≤ 1.4.9 |
CVE-2026-3831 |
Wordfence | |
| 4.3 Medium | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Broken Access Control Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field |
≤ 3.15.5 Fixed in 3.15.6 |
CVE-2026-3139 |
Wordfence | |
| 6.5 Medium | Ninja Forms | Information Disclosure Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token |
≤ 3.14.1 Fixed in 3.14.2 |
CVE-2026-1307 |
Wordfence | |
| 5.3 Medium | FormLift for Infusionsoft Web Forms | Broken Access Control Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow No login needed |
≤ 7.5.21 Fixed in 7.5.22 |
CVE-2026-4281 |
Wordfence | |
| 6.5 Medium | WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms | Broken Access Control |
≤ <= 1.1.5 Fixed in 1.1.6 |
CVE-2026-32527 |
Patchstack | |
| 6.5 Medium | Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms | Broken Access Control |
≤ 1.2.2 Fixed in 1.2.3 |
CVE-2026-25430 |
Patchstack | |
| 6.5 Medium | Contact Form by WPForms | Information Disclosure Sensitive Data Exposure No login needed |
≤ 1.9.8.7 Fixed in 1.9.9.2 |
CVE-2026-25339 |
Patchstack | |
| 6.4 Medium | Integration with Hubspot Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.2.2 |
CVE-2026-1908 |
Wordfence | |
| 5.6 Medium | Contact Form, Survey, Quiz & Popup Form Builder – ARForms | Arbitrary Shortcode Execution ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution No login needed |
≤ 1.7.2 |
CVE-2024-13785 |
Wordfence | |
| 4.3 Medium | NEX-Forms – Ultimate Forms | Broken Access Control Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license |
≤ 9.1.9 Fixed in 9.1.10 |
CVE-2026-1948 |
Wordfence | |
| 4.3 Medium | Contact Form by WPForms | Broken Access Control |
≤ 1.9.9.3 Fixed in 1.9.9.4 |
CVE-2026-32446 |
Patchstack | |
| 5.3 Medium | Formidable Forms | Price Manipulation Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter No login needed |
≤ 6.28 Fixed in 6.29 |
CVE-2026-2888 |
Wordfence | |
| 6.4 Medium | Gravity Forms | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title |
≤ 2.9.28 |
CVE-2026-3492 |
Wordfence | |
| 6.8 Medium | Gutena Forms | Broken Access Control Contributor+ Arbitrary Limited Options Update |
< 1.6.1 Fixed in 1.6.1 |
CVE-2026-1753 |
WPScan | |
| 6.4 Medium | weForms | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API |
≤ 1.6.27 Fixed in 1.6.28 |
CVE-2026-2707 |
Wordfence | |
| 6.5 Medium | Fluent Forms Pro Add On Pack | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed |
≤ 6.1.17 |
CVE-2026-2899 |
Wordfence | |
| 6.5 Medium | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder | Broken Access Control Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema() |
≤ 1.6.0 Fixed in 1.6.1 |
CVE-2026-1674 |
Wordfence | |
| 6.5 Medium | PDF for Elementor Forms + Drag And Drop Template Builder | Broken Access Control |
≤ 6.3.1 Fixed in 6.5.0 |
CVE-2026-22350 |
Patchstack | |
| 6.5 Medium | PDF for WPForms | Broken Access Control |
≤ 6.3.0 Fixed in 6.3.1 |
CVE-2025-68534 |
Patchstack | |
| 4.3 Medium | MailerLite | Broken Access Control |
≤ 1.7.18 Fixed in 1.7.19 |
CVE-2026-25420 |
Patchstack | |
| 5.3 Medium | hCaptcha for WP | Broken Access Control No login needed |
≤ 4.21.1 Fixed in 4.22.0 |
CVE-2026-25315 |
Patchstack | |
| 5.3 Medium | Everest Forms | Arbitrary Shortcode Execution No login needed |
≤ 3.4.1 Fixed in 3.4.2 |
CVE-2026-22422 |
Patchstack | |
| 5.3 Medium | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | Price Manipulation Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment No login needed |
≤ 6.0.6.9 |
CVE-2025-14444 |
Wordfence | |
| 4.3 Medium | Kali Forms | Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure |
≤ 2.4.8 Fixed in 2.4.9 |
CVE-2026-1860 |
Wordfence | |
| 4.4 Medium | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting |
≤ 1.50.2 |
CVE-2026-2002 |
Wordfence | |
| 4.3 Medium | Smart Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure |
≤ 2.6.99 |
CVE-2026-2022 |
Wordfence | |
| 6.4 Medium | Fluent Forms | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module |
≤ 6.1.14 Fixed in 6.1.15 |
CVE-2026-0996 |
Wordfence | |
| 5.4 Medium | Fluent Forms Pro Add On Pack | Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' |
≤ 6.1.12 |
CVE-2026-0632 |
Wordfence | |
| 4.3 Medium | WP Forms Signature Contract Add-On | Broken Access Control Broken Access Control to Notice Dismissal |
≤ 1.8.2 Fixed in 1.8.3 |
CVE-2026-24985 |
Patchstack | |
| 5.3 Medium | NEX-Forms – Ultimate Forms | Broken Access Control Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed |
≤ 9.1.8 |
CVE-2025-15510 |
Wordfence | |
| 5.3 Medium | Database for Contact Form 7, WPforms, Elementor forms | Broken Access Control Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export No login needed |
≤ 1.4.5 Fixed in 1.4.6 |
CVE-2026-0825 |
Wordfence | |
| 6.4 Medium | Forms Bridge | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
≤ 4.2.5 Fixed in 4.3.0 |
CVE-2026-1244 |
Wordfence | |
| 4.3 Medium | SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity | Cross-Site Request Forgery Cross-Site Request Forgery to Survey Cloning No login needed |
≤ 2.5.2 |
CVE-2025-13205 |
Wordfence | |
| 4.3 Medium | SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity | Cross-Site Request Forgery Cross-Site Request Forgery to Survey Renaming No login needed |
≤ 2.5.2 |
CVE-2025-13194 |
Wordfence | |
| 5.4 Medium | Zoho CRM Lead Magnet | Broken Access Control |
≤ 1.8.1.9 |
CVE-2026-24595 |
Patchstack | |
| 6.4 Medium | SpiceForms Form Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2025-12178 |
Wordfence | |
| 6.1 Medium | WPForms | Cross-Site Scripting No login needed |
≤ 1.7.8 |
CVE-2020-36919 |
VulnCheck |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.