WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.
Showing 101–150 of 276 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.3 Medium | Easy Appointments | Broken Access Control Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation |
≤ 3.12.27 |
CVE-2026-11992 |
Wordfence | |
| 4.3 Medium | FlowForms | Broken Access Control Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoints |
≤ 1.1.1 |
CVE-2026-12400 |
Wordfence | |
| 5.9 Medium | Booking calendar, Appointment Booking System | SQL Injection Unauthenticated Time-Based SQL Injection via 'wpdevart_id' No login needed |
≤ 3.2.17 |
CVE-2026-15289 |
Wordfence | |
| 5.3 Medium | CorvusPay WooCommerce Payment Gateway | Price Manipulation Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint No login needed |
≤ 2.7.4 |
CVE-2026-9027 |
Wordfence | |
| 5.3 Medium | Fediverse Embeds | Server-Side Request Forgery Unauthenticated SSRF via Site Info Endpoint No login needed |
< 1.5.8 Fixed in 1.5.8 |
CVE-2026-12517 |
WPScan | |
| 6.5 Medium | Everest Forms | Broken Access Control Unauthenticated Missing Authorization via Site Assistant REST Endpoints No login needed |
3.4.2 – < 3.5.0 Fixed in 3.5.0 |
CVE-2026-12270 |
WPScan | |
| 5.3 Medium | LatePoint | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step No login needed |
≤ 5.6.1 |
CVE-2026-11398 |
Wordfence | |
| 5.3 Medium | MotoPress Appointment Booking | Broken Access Control Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter No login needed |
≤ 2.4.4 |
CVE-2026-9180 |
Wordfence | |
| 5.3 Medium | Ninja Forms - File Uploads | Arbitrary File Upload File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints No login needed |
≤ 3.3.29 |
CVE-2026-12557 |
Wordfence | |
| 5.3 Medium | LatePoint | Broken Access Control Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter No login needed |
≤ 5.6.2 |
CVE-2026-12657 |
Wordfence | |
| 5.3 Medium | Appointment Bookings for Zoom GoogleMeet and more – Wappointment | Broken Access Control Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter No login needed |
≤ 2.7.6 |
CVE-2026-9188 |
Wordfence | |
| 6.5 Medium | MotoPress Appointment Booking | SQL Injection Authenticated (Staff+) SQL Injection via 's' Parameter |
≤ 2.4.5 |
CVE-2026-13454 |
Wordfence | |
| 4.3 Medium | Appointment Booking Calendar | Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure |
≤ 1.4.02 |
CVE-2026-12113 |
Wordfence | |
| 6.4 Medium | CodePeople Post Map for Google Maps | Cross-Site Scripting Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta |
≤ 1.2.6 |
CVE-2026-13335 |
Wordfence | |
| 5.3 Medium | Devs Accounting | Broken Access Control Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint No login needed |
≤ 1.2.0 |
CVE-2026-9172 |
Wordfence | |
| 5.3 Medium | STRABL | Broken Access Control Unauthenticated Arbitrary Webhook Creation via REST API Endpoint No login needed |
≤ 4.5 |
CVE-2026-3640 |
Wordfence | |
| 5.3 Medium | WP DSGVO Tools (GDPR) | Broken Access Control Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters) No login needed |
≤ 3.1.39 |
CVE-2026-10034 |
Wordfence | |
| 6.4 Medium | Appointment Booking Calendar | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label |
≤ 1.4.4 |
CVE-2026-1856 |
Wordfence | |
| 4.3 Medium | Appointment Booking Calendar | Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter |
≤ 1.4.01 |
CVE-2026-12111 |
Wordfence | |
| 5.3 Medium | Event Koi Lite | Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints No login needed |
≤ 1.3.13.1 |
CVE-2026-10029 |
Wordfence | |
| 6.4 Medium | myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program | Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute |
≤ 3.1 |
CVE-2026-8607 |
Wordfence | |
| 5.3 Medium | MapPress Maps | Broken Access Control Unauthenticated Insecure Direct Object Reference via REST API Endpoints No login needed |
≤ 2.96.6 |
CVE-2026-8839 |
Wordfence | |
| 5.3 Medium | WPForms | Other Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint No login needed |
≤ 1.10.0.4 |
CVE-2026-7792 |
Wordfence | |
| 4.3 Medium | LatePoint | Cross-Site Request Forgery Cross-Site Request Forgery via invoices__change_status Action No login needed |
≤ 5.6.0 |
CVE-2026-9719 |
Wordfence | |
| 5.3 Medium | Appointment Booking Calendar | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint No login needed |
≤ 1.6.11.8 |
CVE-2026-6937 |
Wordfence | |
| 4.3 Medium | 3D Viewer | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint |
≤ 2.0.1 |
CVE-2026-8682 |
Wordfence | |
| 5.3 Medium | Appointment Booking Calendar — Simply Schedule Appointments Booking | Denial of Service Unauthenticated Denial of Service No login needed |
≤ 1.6.11.5 |
CVE-2026-7493 |
Wordfence | |
| 4.3 Medium | Slider by Soliloquy | Information Disclosure Authenticated (Subscriber+) Information Disclosure via REST API Endpoint |
≤ 2.8.1 |
CVE-2026-7636 |
Wordfence | |
| 4.3 Medium | LatePoint | Cross-Site Request Forgery Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route No login needed |
≤ 5.3.2 |
CVE-2026-5365 |
Wordfence | |
| 5.3 Medium | Smart Appointment & Booking | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Booking Cancellation No login needed |
≤ 1.0.8 |
CVE-2026-5693 |
Wordfence | |
| 5.3 Medium | LatePoint | Privilege Escalation Unauthenticated Account Takeover via Weak Password Recovery Mechanism No login needed |
≤ 5.5.0 |
CVE-2026-7652 |
Wordfence | |
| 6.5 Medium | Appointment Booking Calendar | Broken Access Control Unauthenticated Arbitrary Appointment View, Modification and Deletion No login needed |
≤ 1.6.10.6 |
CVE-2026-4807 |
Wordfence | |
| 6.4 Medium | LatePoint | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update |
≤ 5.5.0 |
CVE-2026-7457 |
Wordfence | |
| 5.3 Medium | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | Information Disclosure Unauthenticated Information Disclosure in Store Reviews REST API Endpoint No login needed |
≤ 4.3.1 |
CVE-2026-3504 |
Wordfence | |
| 5.3 Medium | Booking for Appointments and Events Calendar – Amelia | Broken Access Control Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint No login needed |
≤ 2.1.2 |
CVE-2026-6449 |
Wordfence | |
| 6.5 Medium | Widgets for Social Photo Feed | Broken Access Control Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints No login needed |
≤ 1.8 |
CVE-2025-14726 |
Wordfence | |
| 5.3 Medium | Complianz – GDPR/CCPA Cookie Consent | Broken Access Control GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint No login needed |
≤ 7.4.5 |
CVE-2026-4019 |
Wordfence | |
| 5.3 Medium | Liaison Site Prober | Broken Access Control Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint No login needed |
≤ 1.2.1 |
CVE-2026-3569 |
Wordfence | |
| 5.3 Medium | LatePoint | Broken Access Control Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID No login needed |
≤ 5.3.2 |
CVE-2026-5234 |
Wordfence | |
| 5.3 Medium | Online Scheduling and Appointment Booking System – Bookly | Price Manipulation Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips' No login needed |
≤ 27.0 |
CVE-2026-2519 |
Wordfence | |
| 5.3 Medium | Simply Schedule Appointments | Broken Access Control No login needed |
≤ 1.6.10.2 |
CVE-2026-39694 |
Patchstack | |
| 5.3 Medium | Pinpoint Booking System | Broken Access Control No login needed |
≤ 2.9.9.7.2 |
CVE-2026-39678 |
Patchstack | |
| 5.3 Medium | TrueBooker | Broken Access Control No login needed |
≤ 1.1.5 |
CVE-2026-39663 |
Patchstack | |
| 5.3 Medium | Masteriyo LMS | Broken Access Control Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint No login needed |
≤ 2.1.7 |
CVE-2026-5167 |
Wordfence | |
| 5.3 Medium | Riaxe Product Customizer | Information Disclosure Unauthenticated Sensitive Information Disclosure via '/orders' REST API Endpoint No login needed |
≤ 2.4 |
CVE-2026-3594 |
Wordfence | |
| 6.4 Medium | LatePoint | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 5.3.0 |
CVE-2026-4785 |
Wordfence | |
| 5.3 Medium | Truebooker - Appointment Booking and Scheduler | Information Disclosure Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files No login needed |
≤ 1.1.4 |
CVE-2026-1797 |
Wordfence | |
| 6.5 Medium | LatePoint | Broken Access Control Insecure Direct Object References (IDOR) No login needed |
≤ <= 5.2.6 Fixed in 5.2.7 |
CVE-2026-32533 |
Patchstack | |
| 5.3 Medium | Appmax | Broken Access Control Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint No login needed |
≤ 1.0.3 |
CVE-2026-3641 |
Wordfence | |
| 4.3 Medium | Appointment Booking Calendar | Broken Access Control Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure |
≤ 1.6.9.29 |
CVE-2026-1704 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.