WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,451–1,500 of 8,931 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 30 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium FluentForm Plugin fluentform Broken Access Control ≤ 6.1.14 Fixed in 6.1.15 CVE-2026-25313 Patchstack
5.4 Medium Autoshare for Twitter Plugin autoshare-for-twitter Broken Access Control ≤ 2.3.1 Fixed in 2.3.2 CVE-2026-25311 Patchstack
4.9 Medium Extend Link Plugin extend-link Server-Side Request Forgery ≤ 2.0.0 Fixed in 2.0.1 CVE-2026-25310 Patchstack
4.3 Medium Simple Membership Plugin simple-membership Broken Access Control ≤ 4.6.9 Fixed in 4.7.0 CVE-2026-25308 Patchstack
6.5 Medium XStore Core Plugin et-core-plugin Cross-Site Scripting ≤ 5.7 Fixed in 5.7 CVE-2026-25307 Patchstack
6.5 Medium XStore Theme xstore Cross-Site Scripting ≤ 9.6.4 Fixed in 9.6.5 CVE-2026-25305 Patchstack
4.3 Medium Ninja Tables Plugin ninja-tables Information Disclosure Sensitive Data Exposure ≤ 5.2.5 Fixed in 5.2.6 CVE-2026-25008 Patchstack
5.3 Medium XStore Theme xstore Arbitrary Shortcode Execution No login needed ≤ 9.6.4 Fixed in 9.6.5 CVE-2026-25006 Patchstack
5.3 Medium Frontend File Manager Plugin nmedia-user-file-uploader Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 23.5 Fixed in 23.6 CVE-2026-25005 Patchstack
5.9 Medium CM Business Directory Plugin cm-business-directory Cross-Site Scripting ≤ 1.5.3 Fixed in 1.5.4 CVE-2026-25004 Patchstack
4.3 Medium Client Portal Plugin client-portal Broken Access Control ≤ 1.2.1 Fixed in 1.2.2 CVE-2026-25003 Patchstack
5.3 Medium Wheel of Life Plugin wheel-of-life Broken Access Control No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2026-25000 Patchstack
5.3 Medium Alma Plugin alma-gateway-for-woocommerce Broken Access Control No login needed ≤ 5.16.1 Fixed in 5.16.2 CVE-2026-24999 Patchstack
5.9 Medium HurryTimer Plugin hurrytimer Cross-Site Scripting ≤ 2.14.2 Fixed in 2.14.3 CVE-2026-24392 Patchstack
5.3 Medium Ultimate Gift Cards For WooCommerce Plugin woo-gift-cards-lite Broken Access Control No login needed ≤ 3.2.4 Fixed in 3.2.5 CVE-2026-24375 Patchstack
5.4 Medium Better Business Reviews Plugin better-business-reviews Broken Access Control ≤ 0.1.1 Fixed in 0.1.2 CVE-2026-23804 Patchstack
5.3 Medium DirectoryPress Plugin directorypress Broken Access Control No login needed ≤ 3.6.25 Fixed in 3.6.26 CVE-2026-23548 Patchstack
6.5 Medium Aruba HiSpeed Cache Plugin aruba-hispeed-cache Broken Access Control No login needed ≤ 3.0.4 Fixed in 3.0.5 CVE-2026-23545 Patchstack
5.3 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Broken Access Control No login needed ≤ 6.5.5 Fixed in 6.5.6 CVE-2026-23543 Patchstack
5.3 Medium Everest Forms Plugin everest-forms Arbitrary Shortcode Execution No login needed ≤ 3.4.1 Fixed in 3.4.2 CVE-2026-22422 Patchstack
4.3 Medium iThemes Sync Plugin ithemes-sync Broken Access Control ≤ 3.2.8 Fixed in 3.2.9 CVE-2026-27056 Patchstack
6.4 Medium YaMaps Plugin yamaps Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters ≤ 0.6.40 CVE-2025-14851 Wordfence
5.3 Medium Breeze – WordPress Cache Plugin breeze Broken Access Control WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion No login needed ≤ 2.2.21 CVE-2025-13864 Wordfence
6.4 Medium Official StatCounter Plugin official-statcounter-plugin-for-wordpress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Nickname ≤ 2.1.0 CVE-2025-13048 Wordfence
6.5 Medium WP Import – Ultimate CSV XML Importer Plugin wp-ultimate-csv-importer SQL Injection Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name ≤ 7.37 CVE-2026-1317 Wordfence
4.9 Medium Bookster – WordPress Appointment Booking Plugin bookster SQL Injection WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw' ≤ 2.1.1 CVE-2025-8781 Wordfence
6.4 Medium InteractiveCalculator Plugin interactivecalculator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute ≤ 1.0.3 CVE-2026-1807 Wordfence
4.3 Medium Tickera – WordPress Event Ticketing Plugin tickera-event-ticketing-system Broken Access Control WordPress Event Ticketing <= 3.5.6.4 - Missing Authorization to Authenticated (Subscriber+) Event/Post Status Update ≤ 3.5.6.4 CVE-2025-12356 Wordfence
6.4 Medium Popup Box – Easily Create WordPress Popups Plugin popup-box Cross-Site Scripting Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.12 CVE-2025-12122 Wordfence
6.5 Medium SP Project & Document Manager Plugin sp-client-document-manager Broken Access Control Broken Access Control to XSS ≤ 4.70 CVE-2024-31118 Patchstack
6.5 Medium Custom Content by Country (by Shield Security) Plugin custom-content-by-country Broken Access Control No login needed ≤ 3.1.2 CVE-2022-41650 Patchstack
6.4 Medium Chatbot for WordPress by Collect.chat ⚡️ Plugin collectchat Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field ≤ 2.4.8 CVE-2026-0736 Wordfence
6.4 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Cross-Site Scripting for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode ≤ 3.7.11 CVE-2026-0559 Wordfence
6.5 Medium Activity Log Plugin winterlock Broken Access Control Missing Authorization to Sensitive Information Exposure via Log File ≤ 1.2.8 CVE-2026-1671 Wordfence
6.4 Medium Yoast SEO Plugin wordpress-seo Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute ≤ 26.8 CVE-2026-1293 Wordfence
6.4 Medium Orange Confort+ accessibility toolbar Plugin orange-confort-plus Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.7 CVE-2026-1808 Wordfence
5.3 Medium ELEX WordPress HelpDesk & Customer Ticketing System Plugin elex-helpdesk-customer-support-ticket-system Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Update No login needed ≤ 3.3.5 CVE-2025-14079 Wordfence
6.5 Medium Passster Plugin content-protector Broken Access Control ≤ 4.2.25 Fixed in 4.2.26 CVE-2026-25036 Patchstack
5.4 Medium ElementInvader Addons for Elementor Plugin elementinvader-addons-for-elementor Broken Access Control ≤ 1.4.1 Fixed in 1.4.2 CVE-2026-25028 Patchstack
5.4 Medium ThirstyAffiliates Plugin thirstyaffiliates Cross-Site Request Forgery No login needed ≤ 3.11.9 Fixed in 3.11.10 CVE-2026-25024 Patchstack
5.3 Medium Run Contests, Raffles, and Giveaways with ContestsWP Plugin contest-code-checker Information Disclosure Sensitive Data Exposure No login needed ≤ 2.0.7 Fixed in 2.1.1 CVE-2026-25023 Patchstack
5.4 Medium Mizan Demo Importer Plugin mizan-demo-importer Broken Access Control ≤ 0.1.3 Fixed in 0.1.4 CVE-2026-25021 Patchstack
4.3 Medium WP Sync for Notion Plugin wp-sync-for-notion Broken Access Control ≤ 1.7.0 Fixed in 1.7.1 CVE-2026-25020 Patchstack
5.3 Medium Atarim Plugin atarim-visual-collaboration Broken Access Control No login needed ≤ 4.3.1 Fixed in 4.3.2 CVE-2026-25019 Patchstack
4.3 Medium Nelio Popups Plugin nelio-popups Broken Access Control ≤ 1.3.5 Fixed in 1.3.6 CVE-2026-25016 Patchstack
4.3 Medium UsersWP Plugin userswp Cross-Site Request Forgery No login needed ≤ 1.2.53 Fixed in 1.2.54 CVE-2026-25015 Patchstack
4.3 Medium Enter Addons Plugin enteraddons Cross-Site Request Forgery No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-25014 Patchstack
5.3 Medium WP Bannerize Pro Plugin wp-bannerize-pro Broken Access Control No login needed ≤ 1.11.0 Fixed in 1.11.1 CVE-2026-25012 Patchstack
4.3 Medium WP Custom Admin Interface Plugin wp-custom-admin-interface Broken Access Control ≤ 7.41 Fixed in 7.42 CVE-2026-25011 Patchstack
5.3 Medium Share This Image Plugin share-this-image Broken Access Control No login needed ≤ 2.09 Fixed in 2.10 CVE-2026-25010 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only