WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,801–1,850 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 37 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	Ditty Plugin `ditty-news-ticker`	Broken Access Control No login needed	`≤ 3.1.66`	Jul 23, 2026	`CVE-2026-27355`	Patchstack
5.3 Medium	WP Go Maps Plugin `wp-google-maps`	Broken Access Control No login needed	`≤ 10.1.04`	Jul 23, 2026	`CVE-2026-25466`	Patchstack
5.4 Medium	eRoom Plugin `eroom-zoom-meetings-webinar`	Broken Access Control	`≤ 1.7.1`	Jul 23, 2026	`CVE-2026-25427`	Patchstack
4.3 Medium	Mediavine Control Panel Plugin `mediavine-control-panel`	Broken Access Control	`≤ 2.10.10`	Jul 23, 2026	`CVE-2026-25424`	Patchstack
4.4 Medium	Photo Block Plugin `photo-block`	Server-Side Request Forgery	`≤ 1.7.1`	Jul 23, 2026	`CVE-2026-24639`	Patchstack
5.9 Medium	Photo Gallery by Supsystic Plugin `gallery-by-supsystic`	Cross-Site Scripting	`≤ 1.16.3`	Jul 23, 2026	`CVE-2026-24628`	Patchstack
4.3 Medium	WP Accessibility Helper (WAH) Plugin `wp-accessibility-helper`	Cross-Site Request Forgery No login needed	`≤ 0.6.6`	Jul 23, 2026	`CVE-2026-24537`	Patchstack
5.9 Medium	WP-Polls Plugin `wp-polls`	Cross-Site Scripting	`≤ 2.77.3`	Jul 23, 2026	`CVE-2025-68081`	Patchstack
6.5 Medium	Tickera Plugin `tickera-event-ticketing-system`	SQL Injection Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter	`≤ 3.6.0.1`	Jul 23, 2026	`CVE-2026-15448`	Wordfence
6.4 Medium	Header Footer Script Adder Plugin `header-and-footer-script-adder`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta	`≤ 2.1`	Jul 23, 2026	`CVE-2026-15394`	Wordfence
4.4 Medium	WP Encryption Plugin `wp-letsencrypt-ssl`	Path Traversal Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter	`≤ 7.8.6.6`	Jul 23, 2026	`CVE-2026-15786`	Wordfence
6.5 Medium	Registrations for the Events Calendar Plugin `registrations-for-the-events-calendar`	SQL Injection Authenticated (Contributor+) SQL Injection via 'standard' Parameter	`≤ 3.2`	Jul 23, 2026	`CVE-2026-13119`	Wordfence
6.5 Medium	AI Copilot Plugin `ai-copilot-content-generator`	SQL Injection Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter	`≤ 1.5.4`	Jul 23, 2026	`CVE-2026-13009`	Wordfence
6.3 Medium	Premium Packages Plugin `wpdm-premium-packages`	Authentication Bypass Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter	`≤ 7.0.4`	Jul 23, 2026	`CVE-2026-15348`	Wordfence
6.4 Medium	Grid/List View for WooCommerce Plugin `gridlist-view-for-woocommerce`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute	`≤ 3.0.9`	Jul 23, 2026	`CVE-2026-15794`	Wordfence
6.4 Medium	Equalize Digital Accessibility Checker Plugin `accessibility-checker`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter	`≤ 1.46.0`	Jul 23, 2026	`CVE-2026-14481`	Wordfence
6.5 Medium	Premium Packages Plugin `wpdm-premium-packages`	SQL Injection Authenticated (Admin+) SQL Injection via 'orderby' Parameter	`≤ 7.0.4`	Jul 23, 2026	`CVE-2026-15906`	Wordfence
4.4 Medium	Brands for WooCommerce Plugin `brands-for-woocommerce`	Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field	`≤ 3.8.8`	Jul 23, 2026	`CVE-2026-15647`	Wordfence
6.4 Medium	Brands for WooCommerce Plugin `brands-for-woocommerce`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute	`≤ 3.8.8`	Jul 23, 2026	`CVE-2026-15646`	Wordfence
5.3 Medium	GutenKit Plugin `gutenkit-blocks-addon`	Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints No login needed	`≤ 2.4.12`	Jul 23, 2026	`CVE-2026-15827`	Wordfence
6.5 Medium	Tickera Plugin `tickera-event-ticketing-system`	SQL Injection Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter	`≤ 3.6.0.1`	Jul 23, 2026	`CVE-2026-15761`	Wordfence
6.5 Medium	WCPOS Plugin `woocommerce-pos`	Path Traversal Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter	`≤ 1.9.8`	Jul 23, 2026	`CVE-2026-16078`	Wordfence
6.4 Medium	Bulk Page Generator Plugin `lpagery`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title	`≤ 2.5.7`	Jul 23, 2026	`CVE-2026-15404`	Wordfence
6.4 Medium	WP Shortcode by MyThemeShop Plugin `wp-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 1.4.17`	Jul 23, 2026	`CVE-2026-9635`	Wordfence
6.4 Medium	Web Push Notifications Plugin `webpushr-web-push-notifications`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter	`≤ 4.39.0`	Jul 23, 2026	`CVE-2026-9729`	Wordfence
4.8 Medium	Post Status Notifier Lite Plugin `post-status-notifier-lite`	Cross-Site Scripting Reflected XSS via mod Parameter	`< 1.13.0` Fixed in `1.13.0`	Jul 23, 2026	`CVE-2026-9577`	WPScan
6.1 Medium	WP Compress Plugin `wp-compress-image-optimizer`	Cross-Site Scripting Reflected XSS via test_zone No login needed	`< 7.10.04` Fixed in `7.10.04`	Jul 23, 2026	`CVE-2026-9066`	WPScan
6.5 Medium	Contact Form 7 – Dynamic Text Extension Plugin `contact-form-7-dynamic-text-extension`	Arbitrary Shortcode Execution Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution No login needed	`≤ 5.0.7`	Jul 22, 2026	`CVE-2025-13146`	Wordfence
6.4 Medium	Ultimate Addons for Elementor Plugin `header-footer-elementor`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes	`≤ 2.9.1`	Jul 22, 2026	`CVE-2026-15787`	Wordfence
5.3 Medium	Timetics Plugin `timetics`	Broken Access Control Unauthenticated Booking Auto-Approval via Arbitrary payment_method No login needed	`< 1.0.57` Fixed in `1.0.57`	Jul 22, 2026	`CVE-2026-14322`	WPScan
6.5 Medium	Ninja Forms Plugin `ninja-forms`	Other Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler No login needed	`< 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65051`	VulnCheck
6.5 Medium	Ninja Forms Plugin `ninja-forms`	Broken Access Control Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors	`< 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65050`	VulnCheck
6.4 Medium	Essential Addons for Elementor Plugin `essential-addons-for-elementor-lite`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget	`≤ 6.6.11`	Jul 21, 2026	`CVE-2026-15145`	Wordfence
4.3 Medium	Tutor LMS Elementor Addons Plugin `tutor-lms-elementor-addons`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation	`≤ 4.0.0`	Jul 21, 2026	`CVE-2026-1372`	Wordfence
4.3 Medium	WPBot AI ChatBot Plugin	Broken Access Control Subscriber+ RAG Settings Update	`< 8.2.0` Fixed in `8.2.0`	Jul 21, 2026	`CVE-2026-14185`	WPScan
5.4 Medium	Academy LMS Plugin `academy`	Broken Access Control Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR	`< 3.8.1` Fixed in `3.8.1`	Jul 21, 2026	`CVE-2026-14184`	WPScan
4.3 Medium	Classified Listing Plugin `classified-listing`	Information Disclosure Subscriber+ Payment Receipt Disclosure via IDOR	`< 5.3.9` Fixed in `5.3.9`	Jul 21, 2026	`CVE-2026-14183`	WPScan
6.5 Medium	Bit Form Plugin `bit-form`	Authentication Bypass Unauthenticated Workflow Trigger via Authentication Bypass No login needed	`< 3.1.0` Fixed in `3.1.0`	Jul 21, 2026	`CVE-2026-13694`	WPScan
5.9 Medium	Bit Form Plugin `bit-form`	Path Traversal Unauthenticated Arbitrary File Read via Path Traversal No login needed	`< 3.1.0` Fixed in `3.1.0`	Jul 21, 2026	`CVE-2026-13693`	WPScan
4.9 Medium	WPForms Plugin `wpforms-lite`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content	`≤ 2.0.0.1`	Jul 21, 2026	`CVE-2026-15782`	Wordfence
6.4 Medium	Essential Addons for Elementor Plugin `essential-addons-for-elementor-lite`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings	`≤ 6.6.11`	Jul 21, 2026	`CVE-2026-15156`	Wordfence
6.4 Medium	Spectra Gutenberg Blocks Plugin `ultimate-addons-for-gutenberg`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block	`≤ 2.19.28`	Jul 20, 2026	`CVE-2026-12900`	Wordfence
5.4 Medium	ThumbPress Plugin `image-sizes`	Broken Access Control Subscriber+ Plugin Deactivation	`< 6.2.2` Fixed in `6.2.2`	Jul 20, 2026	`CVE-2026-13432`	WPScan
4.9 Medium	Elementor Plugin	Information Disclosure Contributor+ Sensitive Information Disclosure via REST API	`< 4.1.4` Fixed in `4.1.4`	Jul 20, 2026	`CVE-2026-8825`	WPScan
5.4 Medium	MailerSend - Official SMTP Integration Plugin	Cross-Site Request Forgery Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF No login needed	`< 1.0.8` Fixed in `1.0.8`	Jul 20, 2026	`CVE-2026-13156`	WPScan
6.5 Medium	PayPlus Payment Gateway Plugin `payplus-payment-gateway`	Information Disclosure Unauthenticated Order Key Disclosure and Order Status Modification No login needed	`< 8.2.2` Fixed in `8.2.2`	Jul 20, 2026	`CVE-2026-12973`	WPScan
5.3 Medium	PayPlus Payment Gateway Plugin `payplus-payment-gateway`	Broken Access Control Unauthenticated Order Payment Metadata Tampering No login needed	`< 8.2.2` Fixed in `8.2.2`	Jul 20, 2026	`CVE-2026-12972`	WPScan
6.5 Medium	All-in-One WP Migration and Backup Plugin `all-in-one-wp-migration`	Path Traversal Unauthenticated Arbitrary-Location Log File Write via Path Traversal No login needed	`7.87 – < 7.106` Fixed in `7.106`	Jul 20, 2026	`CVE-2026-12898`	WPScan
4.3 Medium	Kirki Plugin `kirki`	Content Injection Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password No login needed	`< 6.0.12` Fixed in `6.0.12`	Jul 20, 2026	`CVE-2026-12724`	WPScan
5.3 Medium	Kirki Plugin `kirki`	Broken Access Control Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library No login needed	`< 6.0.12` Fixed in `6.0.12`	Jul 20, 2026	`CVE-2026-12723`	WPScan

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.