WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,601–1,650 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 33 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High FAQ Builder AYS Plugin faq-builder-ays Cross-Site Scripting Unauthenticated Stored XSS via ays_get_user_information No login needed 1.6.3 – < 1.8.5 Fixed in 1.8.5 CVE-2026-81737 WPScan
5.4 Medium Theme My Login Plugin theme-my-login Broken Access Control Subscriber+ Unauthorised Multisite Site Creation and Privilege Escalation 7.0 – < 7.2.0 Fixed in 7.2.0 CVE-2026-81583 WPScan
4.3 Medium JetStyleManager Plugin jet-style-manager Cross-Site Request Forgery Skin Deletion and Modification via CSRF No login needed < 1.3.9 Fixed in 1.3.9 CVE-2026-81432 WPScan
6.5 Medium WC Vendors Plugin wc-vendors Broken Access Control Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR < 2.7.2.1 Fixed in 2.7.2.1 CVE-2026-81428 WPScan
4.3 Medium WC Vendors Plugin wc-vendors Broken Access Control Vendor+ Cross-Vendor Order Shipment Status Change < 2.7.2.1 Fixed in 2.7.2.1 CVE-2026-81427 WPScan
4.3 Medium WC Vendors Plugin wc-vendors Cross-Site Request Forgery Order Shipment Status Change via CSRF No login needed < 2.7.2.1 Fixed in 2.7.2.1 CVE-2026-81426 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Statistics Disclosure via student/stats REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81199 WPScan
3.8 Low MasterStudy LMS Plugin Broken Access Control Instructor+ Cross-Course Curriculum Deletion and Tampering via IDOR < 3.7.46 Fixed in 3.7.46 CVE-2026-81198 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Unpublished Course Title Disclosure via course-list REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81197 WPScan
2.7 Low MasterStudy LMS Plugin Information Disclosure Instructor+ Quiz Answer Disclosure via IDOR < 3.7.46 Fixed in 3.7.46 CVE-2026-81196 WPScan
5.3 Medium MasterStudy LMS Plugin Information Disclosure Unauthenticated Student Enrollment Disclosure via student-courses REST Route No login needed < 3.7.46 Fixed in 3.7.46 CVE-2026-81195 WPScan
4.3 Medium MasterStudy LMS Plugin Information Disclosure Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter < 3.7.46 Fixed in 3.7.46 CVE-2026-81194 WPScan
8.1 High Advanced Custom Fields: Extended Plugin acf-extended Privilege Escalation Unauthenticated Privilege Escalation via Front-End User Insert Action No login needed 0.9.2.2 – < 0.9.2.7 Fixed in 0.9.2.7 CVE-2026-80467 WPScan
4.3 Medium CatalogX Plugin woocommerce-catalog-enquiry Content Injection Unauthenticated Email Content Injection via Shared Transient No login needed < 6.1.3 Fixed in 6.1.3 CVE-2026-79621 WPScan
5.3 Medium FormLayer Plugin formlayer Information Disclosure Unauthenticated Form Configuration Disclosure via Form Submission Response No login needed < 1.0.9 Fixed in 1.0.9 CVE-2026-78151 WPScan
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Unauthenticated Stored XSS via Rating Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77792 WPScan
4.9 Medium Rank Math SEO Plugin seo-by-rank-math Broken Access Control Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas 1.0.48 – < 1.0.277 Fixed in 1.0.277 CVE-2026-77788 WPScan
2.7 Low Rank Math SEO Plugin seo-by-rank-math Broken Access Control Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk 1.0.255 – < 1.0.277 Fixed in 1.0.277 CVE-2026-77787 WPScan
2.7 Low Rank Math SEO Plugin seo-by-rank-math Information Disclosure Author+ Non-Public Post Content Disclosure via Abilities API 1.0.272 – < 1.0.277 Fixed in 1.0.277 CVE-2026-77785 WPScan
2.7 Low Rank Math SEO Plugin seo-by-rank-math Broken Access Control Author+ Robots and Pillar Content Meta Update on Non-Owned Objects via mark_page_as < 1.0.277 Fixed in 1.0.277 CVE-2026-77784 WPScan
3.7 Low Rank Math SEO Plugin seo-by-rank-math Information Disclosure Unauthenticated Non-Public Post Schema and Content Disclosure No login needed 1.0.48 – < 1.0.277 Fixed in 1.0.277 CVE-2026-77783 WPScan
5.3 Medium Rank Math SEO Plugin seo-by-rank-math Information Disclosure Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt No login needed < 1.0.277.1 Fixed in 1.0.277.1 CVE-2026-77782 WPScan
4.3 Medium GamiPress Plugin gamipress Broken Access Control Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners < 7.9.9.6 Fixed in 7.9.9.6 CVE-2026-77764 WPScan
5.3 Medium MultiVendorX Plugin dc-woocommerce-multi-vendor Information Disclosure Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint No login needed 5.0.13 – < 5.0.15 Fixed in 5.0.15 CVE-2026-74927 WPScan
7.1 High Social Media Share Buttons & Social Sharing Icons Plugin ultimate-social-media-icons Cross-Site Scripting Reflected XSS via Pin It Share Handler No login needed < 3.0.1 Fixed in 3.0.1 CVE-2026-19723 WPScan
6.8 Medium Social Media Share Buttons & Social Sharing Icons Plugin ultimate-social-media-icons Cross-Site Scripting Contributor+ Stored XSS via Post Title < 3.0.1 Fixed in 3.0.1 CVE-2026-19719 WPScan
5.3 Medium Comments – wpDiscuz Plugin wpdiscuz Information Disclosure wpDiscuz < 7.6.66 - Unauthenticated Comment Disclosure via SQLi No login needed < 7.6.66 Fixed in 7.6.66 CVE-2026-19704 WPScan
7.1 High JetBackup Plugin backup Privilege Escalation Subscriber+ Privilege Escalation via Restore Admin User Selection 3.1.7.9 – < 3.1.23.5 Fixed in 3.1.23.5 CVE-2026-19453 WPScan
5.3 Medium Ultimate Member Plugin ultimate-member Information Disclosure Unauthenticated Unapproved Comment Disclosure via Profile Activity No login needed < 2.13.0 Fixed in 2.13.0 CVE-2026-19251 WPScan
8.8 High WP User Frontend Plugin PHP Object Injection Subscriber+ PHP Object Injection via Frontend Post Edit Form < 4.3.11 Fixed in 4.3.11 CVE-2026-19116 WPScan
4.3 Medium Gutentor Plugin gutentor Information Disclosure Subscriber+ Password Protected Post Password Disclosure via REST API < 4.0.6 Fixed in 4.0.6 CVE-2026-16983 WPScan
5.3 Medium Solace Extra Plugin solace-extra Information Disclosure Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content No login needed < 1.7.0 Fixed in 1.7.0 CVE-2026-16966 WPScan
5.3 Medium Appointment Booking Lite Plugin Broken Access Control Unauthenticated Arbitrary Reservation Deletion No login needed < 2.4.8 Fixed in 2.4.8 CVE-2026-15232 WPScan
6.5 Medium Amelia Plugin Broken Access Control Unauthenticated Post-Booking Action Trigger No login needed < 2.4.9 Fixed in 2.4.9 CVE-2026-14215 WPScan
7.1 High Photo Gallery by 10Web Plugin photo-gallery Cross-Site Scripting Reflected XSS via title and paged Parameters No login needed < 1.8.44 Fixed in 1.8.44 CVE-2026-12865 WPScan
8.1 High Advanced Custom Fields: Extended Plugin acf-extended Privilege Escalation Unauthenticated Administrator Account Takeover via Front-End User Update Action No login needed < 0.9.2.7 Fixed in 0.9.2.7 CVE-2026-12526 WPScan
6.8 Medium BEAF Plugin Cross-Site Scripting Author+ Stored XSS via Before Label < 4.7.19 Fixed in 4.7.19 CVE-2025-15664 WPScan
6.8 Medium BEAF Plugin Cross-Site Scripting Author+ Stored XSS via After Label < 4.7.19 Fixed in 4.7.19 CVE-2025-15663 WPScan
9.8 Critical SigmaForms Pro Plugin Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field No login needed ≤ 1.4.11 CVE-2026-78657 Wordfence
8.8 High DevKit Pro Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter ≤ 2.3.0 CVE-2026-14357 Wordfence
9.8 Critical Booking for Appointments and Events Calendar – Amelia (Premium) Plugin Privilege Escalation Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' No login needed 8.0 – 9.6.2 CVE-2026-9055 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode ≤ 4.27.6 CVE-2026-3851 Wordfence
8.1 High WP File Download Plugin Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter ≤ 6.3.4 CVE-2026-14982 Wordfence
8.8 High FS Poster Plugin Remote Code Execution Authenticated (Subscriber+) Remote Code Execution via FFmpeg Path Setting ≤ 8.0.1 CVE-2026-10195 Wordfence
8.1 High Gravity Forms Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion No login needed ≤ 3.0.2 CVE-2026-19513 Wordfence
6.4 Medium WP Recipe Maker Premium Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode ≤ 10.5.0 CVE-2026-7877 Wordfence
5.3 Medium Simple Membership Plugin simple-membership Authentication Bypass Unauthenticated Authentication Bypass to Administrator Account Takeover via Multisite Identity Binding No login needed ≤ 4.8.1 CVE-2026-77194 Wordfence
9.8 Critical Nokri - Job Board Theme Privilege Escalation Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter No login needed ≤ 1.6.6 CVE-2026-18550 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode ≤ 2.1.19 CVE-2026-16788 Wordfence
6.4 Medium WPBakery Page Builder Plugin js_composer Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter ≤ 8.7.4 CVE-2026-15101 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only