WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 101–150 of 355 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium WP Event Aggregator Plugin wp-event-aggregator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.8.7 CVE-2026-1941 Wordfence
4.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Event Modification via 'event_id' Parameter ≤ 4.2.8.4 CVE-2026-1655 Wordfence
4.3 Medium Tickera – WordPress Event Ticketing Plugin tickera-event-ticketing-system Broken Access Control WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update ≤ 3.5.6.4 CVE-2025-12356 Wordfence
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint No login needed ≤ 4.2.8.4 CVE-2026-1657 Wordfence
5.4 Medium Scheduler Widget Plugin scheduler-widget Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification ≤ 0.1.6 CVE-2026-1987 Wordfence
4.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Request Forgery Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery No login needed ≤ 5.2.5 CVE-2025-14873 Wordfence
4.3 Medium SEATT: Simple Event Attendance Plugin simple-event-attendance Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Event Deletion No login needed ≤ 1.5.0 CVE-2026-1983 Wordfence
5.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Broken Access Control Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure No login needed ≤ 5.2.6 CVE-2026-1537 Wordfence
6.4 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.1.2 CVE-2026-1922 Wordfence
6.4 Medium Events Listing Widget Plugin events-listing-widget Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field ≤ 1.3.4 CVE-2026-1252 Wordfence
6.5 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting ≤ 3.1.1 Fixed in 3.1.2 CVE-2026-24988 Patchstack
4.3 Medium WpEvently Plugin mage-eventpress Cross-Site Request Forgery No login needed ≤ 5.1.1 Fixed in 5.1.2 CVE-2026-24942 Patchstack
6.1 Medium Timeline Event History Plugin timeline-event-history Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.2 CVE-2026-1127 Wordfence
4.3 Medium Fraud Prevention For Woocommerce Plugin woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers Information Disclosure Sensitive Data Exposure ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-24553 Patchstack
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control No login needed ≤ 4.2.8.0 Fixed in 4.2.8.1 CVE-2026-24380 Patchstack
6.5 Medium Event Espresso 4 Decaf Plugin event-espresso-decaf Broken Access Control Settings Change No login needed ≤ 5.0.37.decaf Fixed in 5.0.53.decaf CVE-2025-68007 Patchstack
6.5 Medium Tickera Plugin tickera-event-ticketing-system Broken Access Control ≤ 3.5.6.2 Fixed in 3.5.6.3 CVE-2025-67939 Patchstack
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Data Migration Control ≤ 6.15.13 CVE-2025-15043 Wordfence
5.3 Medium Community Events Plugin community-events Broken Access Control Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter No login needed ≤ 1.5.6 CVE-2025-14029 Wordfence
5.3 Medium EventPrime - Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Information Disclosure Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API No login needed ≤ 4.2.7.0 CVE-2025-14507 Wordfence
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Broken Access Control Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions No login needed ≤ 1.2.38 CVE-2025-14720 Wordfence
4.3 Medium Tickera Plugin tickera-event-ticketing-system Broken Access Control ≤ 3.5.6.4 Fixed in 3.5.6.5 CVE-2025-69355 Patchstack
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control ≤ 6.15.12.2 Fixed in 6.15.13 CVE-2025-69352 Patchstack
4.3 Medium The Events Calendar Countdown Addon Plugin countdown-for-the-events-calendar Broken Access Control ≤ 1.4.15 Fixed in 1.4.16 CVE-2025-69348 Patchstack
4.3 Medium Event Organiser Plugin event-organiser Broken Access Control ≤ 3.12.8 CVE-2025-69012 Patchstack
5.9 Medium AM Events Plugin am-events Cross-Site Scripting ≤ 1.13.1 CVE-2025-69006 Patchstack
5.3 Medium Google Calendar Events Plugin google-calendar-events Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.5.9 Fixed in 3.6.0 CVE-2025-68979 Patchstack
6.4 Medium Calendar Plugin calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc' ≤ 1.3.16 CVE-2025-14548 Wordfence
6.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode ≤ 7.2.2.1 CVE-2025-12976 Wordfence
4.3 Medium Events Manager – Calendar, Bookings, Tickets, and more! Plugin events-manager Cross-Site Request Forgery Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion No login needed ≤ 7.2.2.2 CVE-2025-12407 Wordfence
5.3 Medium Events Manager Plugin events-manager Information Disclosure Unauthenticated Information Exposure No login needed ≤ 7.2.2.2 CVE-2025-12408 Wordfence
6.5 Medium EventON Plugin eventon Cross-Site Scripting ≤ 4.9.12 CVE-2025-63064 Patchstack
5.3 Medium WP Google Analytics Events Plugin wp-google-analytics-events Information Disclosure Sensitive Data Exposure No login needed ≤ 2.8.2 CVE-2025-63009 Patchstack
4.3 Medium EventPrime Plugin eventprime-event-calendar-management Information Disclosure Sensitive Data Exposure ≤ 4.2.4.1 Fixed in 4.2.5.0 CVE-2025-63007 Patchstack
4.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control ≤ 4.2.4.1 Fixed in 4.2.5.0 CVE-2025-63006 Patchstack
4.3 Medium Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution Plugin fluent-booking Broken Access Control The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management ≤ 1.9.11 CVE-2025-13756 Wordfence
5.3 Medium WpEvently Plugin mage-eventpress Broken Access Control No login needed ≤ 5.0.4 Fixed in 5.0.5 CVE-2025-66083 Patchstack
5.3 Medium WpEvently Plugin mage-eventpress Broken Access Control No login needed ≤ 5.0.4 Fixed in 5.0.5 CVE-2025-66082 Patchstack
6.4 Medium Eventbee Ticketing Widget Plugin eventbee-ticketing-widget Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0 CVE-2025-11856 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Broken Access Control Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation ≤ 4.2.0.0 CVE-2025-12498 Wordfence
6.5 Medium Ovatheme Events Manager Plugin Broken Access Control Missing Authorization No login needed ≤ 1.8.6 CVE-2025-7663 Wordfence
5.3 Medium imEvent Plugin imevent Broken Access Control No login needed ≤ 3.4.0 CVE-2025-58243 Patchstack
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure No login needed ≤ 6.15.9 CVE-2025-12192 Wordfence
4.3 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure ≤ 6.15.9 CVE-2025-12175 Wordfence
6.5 Medium Events Maker by dFactory Plugin events-maker Cross-Site Scripting ≤ 1.6.14 CVE-2025-62941 Patchstack
6.5 Medium Event post Plugin event-post Cross-Site Scripting ≤ 5.10.3 Fixed in 5.10.4 CVE-2025-62042 Patchstack
5.4 Medium Event Tickets Plugin event-tickets Broken Access Control ≤ 5.26.3 Fixed in 5.26.4 CVE-2025-62027 Patchstack
6.4 Medium Event Tickets, RSVPs, Calendar Plugin ticket-spot Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.2 CVE-2025-9875 Wordfence
5.3 Medium WooEvents Plugin woo-events Broken Access Control No login needed ≤ 4.1.7 Fixed in 4.1.8 CVE-2025-60121 Patchstack
4.3 Medium Event Rocket Plugin event-rocket Broken Access Control ≤ 3.3 CVE-2025-53452 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only