WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 101–150 of 471 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.3 Critical JetAppointment Plugin jet-appointments-booking SQL Injection No login needed ≤ 2.5.2 Fixed in 2.5.2.1 CVE-2026-73365 Patchstack
6.5 Medium Appointment Hour Booking Plugin appointment-hour-booking Broken Access Control No login needed ≤ 1.5.91 CVE-2026-66679 Patchstack
7.5 High WPAdverts Plugin wpadverts Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint No login needed ≤ 2.3.2 CVE-2026-11801 Wordfence
7.2 High Online Scheduling and Appointment Booking System Plugin bookly-responsive-appointment-booking-tool Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action No login needed ≤ 27.7 CVE-2026-13424 Wordfence
7.2 High Infility Global Plugin infility-global Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint No login needed ≤ 2.15.21 CVE-2026-10734 Wordfence
4.3 Medium Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI Plugin everest-forms Broken Access Control Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX Endpoints ≤ 3.5.2 CVE-2026-13167 Wordfence
6.5 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure ≤ 1.6.12.10 CVE-2026-13358 Wordfence
4.3 Medium Online Scheduling and Appointment Booking System – Bookly Plugin bookly-responsive-appointment-booking-tool Broken Access Control Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter ≤ 27.7 CVE-2026-12905 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Privilege Escalation Unauthenticated Account Takeover via Insecure Direct Object Reference in 'truebooker_wp_user_id' Parameter No login needed ≤ 1.2.6 CVE-2026-16142 Wordfence
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Team Member+ User Email Disclosure via Users and Customers REST Endpoints < 1.6.12.17 Fixed in 1.6.12.17 CVE-2026-16541 WPScan
5.3 Medium Pinpoint Booking System Plugin booking-system Price Manipulation Unauthenticated Improper Input Validation to Price Manipulation via 'cart_data' Parameter No login needed ≤ 2.9.9.6.8 CVE-2026-12128 Wordfence
5.3 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action No login needed ≤ 3.2.36 CVE-2026-8840 Wordfence
7.5 High WooCommerce Appointments Plugin woocommerce-appointments Information Disclosure Sensitive Data Exposure No login needed ≤ 5.3.8 CVE-2026-66462 Patchstack
10.0 Critical WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Remote Code Execution Arbitrary Code Execution No login needed ≤ 6.3.0 Fixed in 6.3.1 CVE-2026-61962 Patchstack
3.7 Low Amelia Plugin Information Disclosure Provider+ Cross-Customer Appointment Data Disclosure via IDOR No login needed < 2.4.6 Fixed in 2.4.6 CVE-2026-14213 WPScan
8.8 High KiviCare Plugin kivicare-clinic-management-system SQL Injection Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint < 4.5.2 Fixed in 4.5.2 CVE-2026-13613 WPScan
4.3 Medium KiviCare Plugin kivicare-clinic-management-system Information Disclosure Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR < 4.5.2 Fixed in 4.5.2 CVE-2026-13612 WPScan
8.2 High Eventin Plugin wp-event-solution Broken Access Control Unauthenticated Account Creation via Waiting List Endpoint No login needed < 4.1.20 Fixed in 4.1.20 CVE-2026-13171 WPScan
5.3 Medium Pinpoint Booking System Plugin Price Manipulation Unauthenticated Arbitrary Booking Price Manipulation No login needed ≤ 2.9.9.7.1 CVE-2026-15229 WPScan
5.3 Medium Hotel Booking Lite Plugin Broken Access Control Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint No login needed < 6.2.3 Fixed in 6.2.3 CVE-2026-15237 WPScan
7.5 High GeoDirectory Plugin geodirectory Information Disclosure Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint No login needed < 2.8.169 Fixed in 2.8.169 CVE-2026-16988 WPScan
5.4 Medium Dokan Plugin Broken Access Control Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint < 5.0.11 Fixed in 5.0.11 CVE-2026-16574 WPScan
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Price Manipulation Unauthenticated Booking Price Manipulation via tcost Parameter No login needed < 1.5.88 Fixed in 1.5.88 CVE-2026-16282 WPScan
9.8 Critical Ajax Search Lite Plugin ajax-search-lite PHP Object Injection Unauthenticated PHP Object Injection via Search Statistics REST Endpoint No login needed < 4.14.5 Fixed in 4.14.5 CVE-2026-16258 WPScan
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' No login needed ≤ 1.2.3 CVE-2026-14364 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' No login needed ≤ 1.2.3 CVE-2026-14365 Wordfence
2.7 Low Easy Appointments Plugin easy-appointments Other Contributor+ Shortcode Allowlist Bypass < 3.12.28 Fixed in 3.12.28 CVE-2026-14225 WPScan
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting No login needed ≤ 1.6.12.10 Fixed in 1.6.12.11 CVE-2026-65513 Patchstack
9.3 Critical Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection No login needed ≤ 1.6.12.10 Fixed in 1.6.12.11 CVE-2026-65508 Patchstack
6.4 Medium LatePoint Plugin latepoint Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 5.3.2 CVE-2026-5391 Wordfence
7.5 High Essential Blocks Plugin Information Disclosure Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint No login needed < 6.4.0 Fixed in 6.4.0 CVE-2026-13154 WPScan
7.5 High Essential Blocks Plugin Information Disclosure Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint No login needed < 6.4.0 Fixed in 6.4.0 CVE-2026-13153 WPScan
8.1 High WPMU DEV Dashboard Plugin Authentication Bypass Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint No login needed ≤ 5.0.0 CVE-2026-15459 Wordfence
2.7 Low MultiVendorX Plugin dc-woocommerce-multi-vendor Information Disclosure Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint < 5.0.11 Fixed in 5.0.11 CVE-2026-16746 WPScan
7.5 High Content Protector (Passster) Plugin Information Disclosure Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint No login needed < 4.3.6 Fixed in 4.3.6 CVE-2026-16602 WPScan
7.5 High VikAppointments – Services Booking Calendar Plugin vikappointments SQL Injection Services Booking Calendar <= 1.2.19 - Unauthenticated SQL Injection No login needed ≤ 1.2.19 CVE-2026-15918 Wordfence
6.5 Medium Bit Assist Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via Response Endpoint No login needed < 1.8.2 Fixed in 1.8.2 CVE-2026-16548 WPScan
5.9 Medium REST API Log Plugin wp-rest-api-log Information Disclosure Unauthenticated Sensitive Log Data Disclosure via Download Endpoint No login needed < 1.7.1 Fixed in 1.7.1 CVE-2026-16547 WPScan
6.8 Medium Brizy - Page Builder Plugin Cross-Site Scripting Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point < 2.8.19 Fixed in 2.8.19 CVE-2026-16069 WPScan
4.3 Medium Dokan Plugin Broken Access Control Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint < 5.0.9 Fixed in 5.0.9 CVE-2026-16564 WPScan
6.5 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint < 3.8.3 Fixed in 3.8.3 CVE-2026-16563 WPScan
6.5 Medium Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Contributor+ Sensitive Data Disclosure via Admin Shortcode < 1.6.12.11 Fixed in 1.6.12.11 CVE-2026-15254 WPScan
7.5 High Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint No login needed < 1.6.12.6 Fixed in 1.6.12.6 CVE-2026-16540 WPScan
6.5 Medium Advanced Views Plugin acf-views Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints ≤ 3.9.1 CVE-2026-17580 Wordfence
5.3 Medium PixelYourSite Plugin pixelyoursite Information Disclosure Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation No login needed ≤ 11.2.1, < 12.6.1 Fixed in 12.6.1 CVE-2026-18059 Wordfence
4.9 Medium Pinpoint Booking System Plugin booking-system SQL Injection Authenticated (Administrator+) SQL Injection via 'field' Parameter ≤ 2.9.9.6.9 CVE-2026-15403 Wordfence
5.3 Medium MailerPress Plugin mailerpress Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint No login needed ≤ 1.5.0 CVE-2026-18436 Wordfence
4.3 Medium Academy LMS Plugin academy Information Disclosure Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint ≤ 3.8.2 CVE-2026-12376 WPScan
5.9 Medium Points and Rewards for WooCommerce Plugin points-and-rewards-for-woocommerce Broken Access Control Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR No login needed < 2.10.1 Fixed in 2.10.1 CVE-2026-11782 WPScan
5.3 Medium LatePoint Plugin Broken Access Control Unauthenticated Booking Object Mass Assignment via Public Booking Funnel No login needed < 5.6.8 Fixed in 5.6.8 CVE-2026-15250 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only