WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,601–1,650 of 9,010 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 33 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.1 High	WoodMart Theme `woodmart`	Cross-Site Scripting No login needed	`≤ 8.5.3` Fixed in `8.5.4`	Jun 26, 2026	`CVE-2026-56072`	Patchstack
7.5 High	Toolset Forms Plugin `cred-frontend-editor`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 2.6.24` Fixed in `2.6.25`	Jun 26, 2026	`CVE-2026-56069`	Patchstack
8.5 High	Tourfic Plugin `tourfic`	SQL Injection	`≤ 2.22.5` Fixed in `2.22.6`	Jun 26, 2026	`CVE-2026-56064`	Patchstack
8.3 High	MailChimp Block Plugin `block-for-mailchimp`	Broken Access Control No login needed	`≤ 1.1.15` Fixed in `1.1.16`	Jun 26, 2026	`CVE-2026-56063`	Patchstack
7.5 High	Subscriptions for WooCommerce Plugin `subscriptions-for-woocommerce`	Broken Access Control No login needed	`≤ 1.9.5` Fixed in `1.9.6`	Jun 26, 2026	`CVE-2026-56061`	Patchstack
7.5 High	Print Invoice & Delivery Notes for WooCommerce Plugin `woocommerce-delivery-notes`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 7.1.1` Fixed in `7.1.2`	Jun 26, 2026	`CVE-2026-56060`	Patchstack
8.8 High	RealHomes Theme `realhomes`	PHP Object Injection	`≤ 4.5.3` Fixed in `4.5.4`	Jun 26, 2026	`CVE-2026-56055`	Patchstack
7.1 High	perfmatters Plugin `perfmatters`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.6.3` Fixed in `2.6.4`	Jun 26, 2026	`CVE-2026-56047`	Patchstack
7.1 High	Automatic Plugin `wp-automatic`	Cross-Site Scripting No login needed	`< 3.135.1` Fixed in `3.135.1`	Jun 26, 2026	`CVE-2026-56045`	Patchstack
7.1 High	Blog2Social Plugin `blog2social`	Cross-Site Scripting No login needed	`≤ 8.9.2` Fixed in `8.9.3`	Jun 26, 2026	`CVE-2026-56044`	Patchstack
7.1 High	Customer Reviews for WooCommerce Plugin `customer-reviews-woocommerce`	Cross-Site Scripting No login needed	`≤ 5.110.1` Fixed in `5.111.0`	Jun 26, 2026	`CVE-2026-56043`	Patchstack
7.1 High	Responsive Lightbox Plugin `responsive-lightbox`	Cross-Site Scripting No login needed	`≤ 2.7.6` Fixed in `2.7.7`	Jun 26, 2026	`CVE-2026-56041`	Patchstack
7.1 High	Gutenverse Form Plugin `gutenverse-form`	Cross-Site Scripting No login needed	`≤ 2.4.7` Fixed in `2.5.0`	Jun 26, 2026	`CVE-2026-56040`	Patchstack
7.1 High	Quick Interest Slider Plugin `quick-interest-slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.6` Fixed in `3.1.7`	Jun 26, 2026	`CVE-2026-56039`	Patchstack
8.8 High	Frisbii Pay Plugin `reepay-checkout-gateway`	Privilege Escalation	`≤ 1.8.2` Fixed in `1.8.2.1`	Jun 26, 2026	`CVE-2026-56038`	Patchstack
8.6 High	BitFire Security Plugin `bitfire`	Other Multiple Vulnerabilities No login needed	`≤ 5.0.3` Fixed in `5.0.4`	Jun 26, 2026	`CVE-2026-56035`	Patchstack
8.1 High	Uncanny Automator Plugin `uncanny-automator`	PHP Object Injection No login needed	`≤ 7.3.1.2` Fixed in `7.3.1.3`	Jun 26, 2026	`CVE-2026-56031`	Patchstack
7.5 High	CorvusPay WooCommerce Payment Gateway Plugin `corvuspay-woocommerce-integration`	Authentication Bypass Broken Authentication No login needed	`≤ 2.7.4` Fixed in `2.7.5`	Jun 26, 2026	`CVE-2026-56029`	Patchstack
7.5 High	Paymob for WooCommerce Plugin `paymob-for-woocommerce`	Broken Access Control No login needed	`≤ 4.1.2`	Jun 26, 2026	`CVE-2026-56025`	Patchstack
7.1 High	MapPress Maps Plugin `mappress-google-maps-for-wordpress`	Cross-Site Scripting No login needed	`≤ 2.97.3` Fixed in `2.97.4`	Jun 26, 2026	`CVE-2026-56011`	Patchstack
8.8 High	Abandoned Cart Pro for WooCommerce Plugin `woocommerce-abandon-cart-pro`	Privilege Escalation	`≤ 10.4.0` Fixed in `10.4.1`	Jun 26, 2026	`CVE-2026-56010`	Patchstack
8.8 High	Fusion Builder Plugin `fusion-builder`	Privilege Escalation	`≤ 3.15.4` Fixed in `3.15.5`	Jun 26, 2026	`CVE-2026-56008`	Patchstack
7.5 High	Stylish Cost Calculator Plugin `stylish-cost-calculator`	Broken Access Control No login needed	`≤ 8.3.9` Fixed in `8.3.10`	Jun 26, 2026	`CVE-2026-54847`	Patchstack
7.5 High	Syncee Premium Dropshipping & Wholesale Plugin `syncee-global-dropshipping`	Broken Access Control No login needed	`≤ 1.0.27` Fixed in `1.0.28`	Jun 26, 2026	`CVE-2026-54846`	Patchstack
7.3 High	Newsletters Plugin `newsletters-lite`	Broken Access Control No login needed	`≤ 4.13` Fixed in `4.14`	Jun 26, 2026	`CVE-2026-54840`	Patchstack
7.5 High	Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups Plugin `trinity-backup`	Information Disclosure Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure No login needed	`≤ 2.0.9` Fixed in `2.0.10`	Jun 26, 2026	`CVE-2026-54839`	Patchstack
7.5 High	Intranet & Private Site – All-In-One Intranet Plugin `all-in-one-intranet`	Broken Access Control All-In-One Intranet plugin <= 1.8.1 - Broken Access Control No login needed	`≤ 1.8.1` Fixed in `1.9.0`	Jun 26, 2026	`CVE-2026-54837`	Patchstack
7.5 High	Five Star Restaurant Menu Plugin `food-and-drink-menu`	Broken Access Control No login needed	`≤ 2.5.2` Fixed in `2.5.3`	Jun 26, 2026	`CVE-2026-54835`	Patchstack
7.5 High	Object Cache 4 everyone Plugin `object-cache-4-everyone`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.3.2` Fixed in `2.3.3`	Jun 26, 2026	`CVE-2026-54834`	Patchstack
7.4 High	Enable CORS Plugin `enable-cors`	Other Backdoor No login needed	`≤ 2.0.3` Fixed in `2.0.4`	Jun 26, 2026	`CVE-2026-54833`	Patchstack
7.5 High	Gutenverse Companion Plugin `gutenverse-companion`	Broken Access Control No login needed	`≤ 2.5.0` Fixed in `2.5.1`	Jun 26, 2026	`CVE-2026-54832`	Patchstack
7.6 High	SupportCandy Plugin `supportcandy`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 3.4.6` Fixed in `3.4.7`	Jun 26, 2026	`CVE-2026-54826`	Patchstack
7.5 High	Ads by WPQuads Plugin `quick-adsense-reloaded`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 3.0.3` Fixed in `3.0.4`	Jun 26, 2026	`CVE-2026-54824`	Patchstack
7.5 High	Goya Core Plugin `goya-core`	Local File Inclusion	`< 1.0.9.4` Fixed in `1.0.9.4`	Jun 26, 2026	`CVE-2025-68064`	Patchstack
7.5 High	Splash - Sport Club WordPress Theme for Basketball, Football, Hockey Theme `splash`	Local File Inclusion Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion	`≤ 4.4.3` Fixed in `4.4.4`	Jun 26, 2026	`CVE-2025-68063`	Patchstack
8.8 High	Eagle Booking Plugin `eagle-booking`	Cross-Site Request Forgery No login needed	`≤ 1.3.4.3`	Jun 26, 2026	`CVE-2025-68052`	Patchstack
7.7 High	SALESmanago & Leadoo Plugin	SQL Injection Subscriber+ SQL Injection	`< 3.11.3` Fixed in `3.11.3`	Jun 26, 2026	`CVE-2026-10835`	WPScan
7.5 High	YMC Smart Filter Plugin	Information Disclosure Unauthenticated Private/Draft Post Disclosure No login needed	`< 3.11.3` Fixed in `3.11.3`	Jun 26, 2026	`CVE-2026-10823`	WPScan
8.3 High	APIExperts Square for WooCommerce Plugin `woosquare`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 4.7.3` Fixed in `4.7.4`	Jun 25, 2026	`CVE-2026-54848`	Patchstack
7.5 High	WP Photo Album Plus Plugin `wp-photo-album-plus`	SQL Injection No login needed	`≤ 9.1.13.005` Fixed in `9.2.01.001`	Jun 25, 2026	`CVE-2026-54829`	Patchstack
8.1 High	Royal MCP Plugin `royal-mcp`	Broken Access Control	`≤ 1.4.25` Fixed in `1.4.26`	Jun 25, 2026	`CVE-2026-54842`	Patchstack
7.1 High	Forminator Plugin `forminator`	Cross-Site Scripting No login needed	`≤ 1.53.1` Fixed in `1.53.2`	Jun 25, 2026	`CVE-2026-56071`	Patchstack
7.7 High	JS Help Desk Plugin `js-support-ticket`	Arbitrary File Deletion	`≤ 3.1.1` Fixed in `3.1.2`	Jun 25, 2026	`CVE-2026-56054`	Patchstack
8.8 High	EventPrime Plugin `eventprime-event-calendar-management`	PHP Object Injection	`≤ 4.3.4.1` Fixed in `4.3.4.2`	Jun 25, 2026	`CVE-2026-56053`	Patchstack
7.1 High	TablePress Plugin `tablepress`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.3.1` Fixed in `3.3.2`	Jun 25, 2026	`CVE-2026-56051`	Patchstack
8.5 High	Post Snippets Plugin `post-snippets`	Remote Code Execution	`≤ 4.0.19` Fixed in `4.1.0`	Jun 25, 2026	`CVE-2026-56049`	Patchstack
7.1 High	Advanced Order Export For WooCommerce Plugin `woo-order-export-lite`	Cross-Site Scripting No login needed	`≤ 4.0.9` Fixed in `4.0.10`	Jun 25, 2026	`CVE-2026-56042`	Patchstack
7.1 High	Master Slider Plugin `master-slider`	Cross-Site Scripting No login needed	`≤ 3.11.3`	Jun 25, 2026	`CVE-2026-56014`	Patchstack
7.1 High	H5P Plugin `h5p`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.17.6` Fixed in `1.17.7`	Jun 25, 2026	`CVE-2026-56006`	Patchstack
7.1 High	WP Activity Log Plugin `wp-security-audit-log`	Cross-Site Scripting No login needed	`≤ 5.6.3.1` Fixed in `5.6.4`	Jun 25, 2026	`CVE-2026-56005`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.