WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 101–150 of 2,122 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 3 of 1
Severity Component Vulnerability Affected versions Published CVE Source
2.7 Low Comments Import & Export Plugin comments-import-export-woocommerce Information Disclosure Author+ Comment PII Disclosure via Export 2.1.11 – < 2.5.4 Fixed in 2.5.4 CVE-2026-87836 WPScan
7.5 High Choose User Role at Registration for WooCommerce Plugin Privilege Escalation Unauthenticated Privilege Escalation via Registration Role Request No login needed < 1.3.3 Fixed in 1.3.3 CVE-2026-85128 WPScan
4.3 Medium Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Cross-Site Request Forgery Subscription Cancellation via CSRF No login needed < 2.0.3 Fixed in 2.0.3 CVE-2026-87860 WPScan
5.3 Medium Subscriptions for WooCommerce Plugin subscriptions-for-woocommerce Information Disclosure Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass No login needed < 2.0.3 Fixed in 2.0.3 CVE-2026-87854 WPScan
5.3 Medium Ni WooCommerce Sales Report Plugin ni-woocommerce-sales-report Information Disclosure Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter No login needed < 4.2.0 Fixed in 4.2.0 CVE-2026-78474 WPScan
8.6 High Ni WooCommerce Sales Report Plugin ni-woocommerce-sales-report SQL Injection Unauthenticated SQLi via 'sort' Parameter No login needed < 4.2.0 Fixed in 4.2.0 CVE-2026-78472 WPScan
7.1 High MultiVendorX Plugin dc-woocommerce-multi-vendor Broken Access Control Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint 5.0.0 – < 5.0.16 Fixed in 5.0.16 CVE-2026-74926 WPScan
7.5 High Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Plugin wp-event-solution Privilege Escalation Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter ≤ 4.1.23 CVE-2026-75983 Wordfence
6.4 Medium ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets Plugin shopengine Cross-Site Scripting All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter ≤ 4.9.5 CVE-2026-85575 Wordfence
4.9 Medium Product XML Feed Manager for WooCommerce Plugin product-xml-feeds-for-woocommerce Broken Access Control Contributor+ Arbitrary Product Deletion via Shortcode < 3.1.1 Fixed in 3.1.1 CVE-2026-87919 WPScan
2.2 Low BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Information Disclosure Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR < 1.2.2 Fixed in 1.2.2 CVE-2026-84025 WPScan
4.3 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84024 WPScan
6.5 Medium BEAR - Bulk Editor and Products Manager Professional for WooCommerce Plugin Cross-Site Request Forgery Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRF No login needed < 1.2.2 Fixed in 1.2.2 CVE-2026-84023 WPScan
5.3 Medium Flexible Quantity – Measurement Price Calculator for WooCommerce Plugin flexible-quantity-measurement-price-calculator-for-woocommerce Broken Access Control Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control No login needed ≤ 2.3.21 Fixed in 2.3.22 CVE-2026-62136 Patchstack
5.3 Medium Deposits and Partial Payments for WooCommerce Plugin advanced-partial-payment-or-deposit-for-woocommerce Broken Access Control No login needed ≤ 3.1.0 Fixed in 4.0.1 CVE-2026-27378 Patchstack
5.3 Medium YITH WooCommerce Wishlist Plugin yith-woocommerce-wishlist Broken Access Control Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title No login needed < 4.18.1 Fixed in 4.18.1 CVE-2026-82305 WPScan
7.2 High MultiVendorX Plugin dc-woocommerce-multi-vendor Privilege Escalation Store Owner+ Privilege Escalation to Administrator 5.0.0 – < 5.0.16 Fixed in 5.0.16 CVE-2026-74925 WPScan
4.3 Medium Advanced Customized Prompts Plugin Broken Access Control Subscriber+ WooCommerce Order Item Metadata Tampering ≤ 1.0.1 CVE-2026-14566 WPScan
6.1 Medium Themify – WooCommerce Product Filter Plugin themify-wc-product-filter Cross-Site Scripting WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting No login needed ≤ 1.5.5 CVE-2026-78172 Wordfence
6.1 Medium HUSKY Plugin woocommerce-products-filter Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.4.3 CVE-2026-18562 Wordfence
9.8 Critical MIPL Grouped Checkout Fields for WooCommerce Plugin mipl-wc-checkout-fields Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.2.2 CVE-2026-8778 Wordfence
5.3 Medium OTP Login & Register Woocommerce Plugin mobile-login-woocommerce Authentication Bypass Unauthenticated Authentication Bypass via Brute Force No login needed ≤ 2.7.2 CVE-2026-12215 Wordfence
7.5 High Return Refund and Exchange For WooCommerce Plugin woo-refund-and-exchange-lite Broken Access Control No login needed ≤ 4.6.4 CVE-2026-81799 Patchstack
7.5 High Shirt Product Designer for WooCommerce Plugin woo-shirt-product-designer Broken Access Control No login needed 1.0.4 CVE-2026-81794 Patchstack
8.6 High Advanced Product Fields Extended for WooCommerce Plugin advanced-product-fields-for-woocommerce-extended Arbitrary File Deletion No login needed ≤ 3.1.6 Fixed in 3.1.7 CVE-2026-81789 Patchstack
7.5 High Thank You Page Customizer for WooCommerce Plugin woo-thank-you-page-customizer Broken Access Control No login needed ≤ 1.2.2 CVE-2026-81786 Patchstack
6.5 Medium Robokassa payment gateway for Woocommerce Plugin robokassa Broken Access Control No login needed ≤ 1.8.9 CVE-2026-78536 Patchstack
7.2 High Registration Form for WooCommerce Plugin registration-form-for-woocommerce Privilege Escalation Contributor+ Privilege Escalation via Unvalidated tgwcfb_id 1.1.0 – < 1.1.3 Fixed in 1.1.3 CVE-2026-81431 WPScan
9.1 Critical zipMoney(Zip Co) Payments Plugin for WooCommerce Plugin zipmoney-payments-woocommerce Broken Access Control Unauthenticated Arbitrary Option Deletion No login needed < 2.4.0 Fixed in 2.4.0 CVE-2026-78361 WPScan
7.5 High Ultimate Gift Cards for WooCommerce Plugin woo-gift-cards-lite Information Disclosure Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details No login needed 3.0.3 – < 3.2.10 Fixed in 3.2.10 CVE-2026-19439 WPScan
7.5 High Ultimate Gift Cards For WooCommerce Plugin woo-gift-cards-lite Broken Access Control Unauthenticated Gift Card Value Inflation via Discounted Purchase No login needed < 3.2.10 Fixed in 3.2.10 CVE-2026-19436 WPScan
7.5 High Direct Download for WooCommerce Plugin direct-download-for-woocommerce Path Traversal Unauthenticated Arbitrary File Read via 'file_id' Path Segment No login needed ≤ 1.19 CVE-2026-15019 Wordfence
8.8 High YITH WooCommerce Waitlist Premium Plugin Privilege Escalation Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user ≤ 3.35.0 CVE-2026-14359 Wordfence
6.5 Medium WPMR Google Feed Manager for WooCommerce Plugin wp-product-feed-manager SQL Injection Authenticated (Administrator+) SQL Injection via 'feed' Parameter ≤ 2.23.7 CVE-2026-19778 Wordfence
4.3 Medium Checkout Custom Fields Builder for WooCommerce Plugin checkout-custom-fields-builder-for-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter ≤ 1.1.5 CVE-2026-19802 Wordfence
5.9 Medium Payment Plugins for PayPal WooCommerce Plugin pymntpl-paypal-woocommerce Broken Access Control Subscriber+ Stored Payment Method Assignment via IDOR 1.1.0 – < 2.0.26 Fixed in 2.0.26 CVE-2026-80341 WPScan
5.3 Medium Payment Plugins for PayPal WooCommerce Plugin pymntpl-paypal-woocommerce Information Disclosure Unauthenticated Customer PII Disclosure via order-pay No login needed 1.0.0 – < 2.0.26 Fixed in 2.0.26 CVE-2026-80340 WPScan
5.3 Medium Payment Plugins for Stripe WooCommerce Plugin woo-stripe-payment Information Disclosure Unauthenticated Customer PII Disclosure via order-pay No login needed 4.0.0 – < 4.0.12 Fixed in 4.0.12 CVE-2026-80339 WPScan
6.5 Medium Ultimate Gift Cards for WooCommerce Plugin woo-gift-cards-lite Broken Access Control Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption < 3.2.10 Fixed in 3.2.10 CVE-2026-75861 WPScan
8.6 High ELEX WooCommerce Request a Quote Plugin elex-request-a-quote SQL Injection Unauthenticated SQLi via variation_id No login needed < 2.4.1 Fixed in 2.4.1 CVE-2026-14962 WPScan
4.3 Medium ilGhera Reviso Exporter for WooCommerce Plugin wc-exporter-for-reviso Broken Access Control Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function ≤ 1.2.3 CVE-2026-8615 Wordfence
8.1 High Next-Cart Store to WooCommerce Migration Plugin nextcart-woocommerce-migration Authentication Bypass Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint No login needed ≤ 3.9.8 CVE-2026-76009 Wordfence
6.1 Medium Product Filter for WooCommerce by WBW Plugin woo-product-filter Cross-Site Scripting Reflected Cross-Site Scripting via 'wpf_fid' Parameter No login needed ≤ 3.4.2 CVE-2026-7804 Wordfence
7.5 High WooCommerce Plugin woocommerce Denial of Service Denial of Service Attack No login needed < 11.1.0 Fixed in 11.1.0 CVE-2026-48888 Patchstack
7.5 High Csomagpontok és szállítási címkék WooCommerce-hez Plugin hungarian-pickup-points-for-woocommerce Broken Access Control No login needed < 4.2.8 Fixed in 4.2.8 CVE-2026-81790 Patchstack
6.5 Medium Product Catalog Enquiry for WooCommerce by MultiVendorX Plugin woocommerce-catalog-enquiry Privilege Escalation No login needed ≤ 6.1.5 CVE-2026-81792 Patchstack
8.8 High Abandoned Cart Pro for WooCommerce Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Privilege Escalation ≤ 10.7.1 CVE-2026-81543 Wordfence
5.3 Medium E-cab Taxi Booking Manager for Woocommerce Plugin ecab-taxi-booking-manager Price Manipulation Unauthenticated Price Manipulation via mptbm_add_to_cart No login needed 2.0.1 – < 2.0.5 Fixed in 2.0.5 CVE-2026-84045 WPScan
5.3 Medium ePayco Payment Gateway for WooCommerce Plugin Other Unauthenticated Payment Confirmation Bypass No login needed < 8.4.7 Fixed in 8.4.7 CVE-2026-84043 WPScan
7.6 High WooCommerce Plugin woocommerce SQL Injection < 11.0 Fixed in 11.0 CVE-2026-57777 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only