WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,851–1,900 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 38 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium WP Travel Plugin wp-travel Broken Access Control Unauthenticated Arbitrary Booking Cancellation No login needed < 11.7.1 Fixed in 11.7.1 CVE-2026-11868 WPScan
4.8 Medium Reviews Feed Plugin reviews-feed Arbitrary Shortcode Execution Unauthenticated Stored Arbitrary Shortcode Execution via Google Reviews No login needed < 2.6.5 Fixed in 2.6.5 CVE-2026-10724 WPScan
4.3 Medium Flow Payment Plugin Cross-Site Scripting Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter No login needed ≤ 3.0.8 Fixed in 3.0.9 CVE-2026-57857 VulnCheck
4.3 Medium W3SC Elementor to Zoho CRM Plugin w3sc-elementor-to-zoho Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 2.2.0 CVE-2026-9734 Wordfence
5.9 Medium WordPress Core SQL Injection Facilitated SQL Injection via author__not_in in WP_Query No login needed 6.8.0 – < 6.8.6, 6.9.0 – < 6.9.5, 7.0.0 – < 7.0.2 Fixed in 6.8.6 CVE-2026-60137 WPScan
4.3 Medium HubSpot All-In-One Marketing Plugin leadin Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via Block Editor Localized Script ≤ 11.3.62 CVE-2026-9656 Wordfence
5.3 Medium Royal Elementor Addons Plugin Information Disclosure Unauthenticated Private Mega Menu Template Disclosure No login needed < 1.7.1063 Fixed in 1.7.1063 CVE-2026-13402 WPScan
5.4 Medium WPS Bookings for WooCommerce Plugin mwb-bookings-for-woocommerce Broken Access Control Subscriber+ Arbitrary Booking Order Cancellation via IDOR < 3.11.7 Fixed in 3.11.7 CVE-2026-12393 WPScan
5.3 Medium User Registration & Membership Plugin user-registration Broken Access Control Unauthenticated Limited User Deletion via Stripe Subscription Handler No login needed 4.2.3 – < 5.2.3 Fixed in 5.2.3 CVE-2026-11966 WPScan
6.1 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder Cross-Site Scripting Unauthenticated Stored XSS via Form Submission No login needed < 9.2.3 Fixed in 9.2.3 CVE-2026-10525 WPScan
6.1 Medium WP Hotel Booking Plugin wp-hotel-booking Cross-Site Scripting Reflected Cross-Site Scripting via 'check_in_date' Parameter No login needed ≤ 2.3.2 CVE-2026-15094 Wordfence
6.4 Medium ChatHelp Plugin chat-help Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'number' and 'group' Shortcode Attributes ≤ 3.5.1 CVE-2026-15759 Wordfence
6.4 Medium Ninja Forms - Excel Export Plugin ninja-forms-excel-export Cross-Site Scripting Excel Export <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'filter' Parameter ≤ 3.3.6 CVE-2026-15161 Wordfence
4.3 Medium ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce Plugin erp Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJAX Handler ≤ 1.17.6 CVE-2026-15349 Wordfence
6.5 Medium pCloud WP Backup Plugin pcloud-wp-backup Broken Access Control Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read ≤ 2.0.3 CVE-2026-14503 Wordfence
4.9 Medium Kirki Plugin kirki Path Traversal Authenticated (Editor+) Path Traversal to Arbitrary Directory Deletion via 'family' Parameter ≤ 6.0.13 CVE-2026-15457 Wordfence
4.3 Medium Ninja Forms - Excel Export Plugin ninja-forms-excel-export Broken Access Control Excel Export <= 3.3.6 - Missing Authorization to Authenticated (Subscriber+) XLS Write via Path Traversal ≤ 3.3.6 CVE-2026-15160 Wordfence
4.3 Medium Ninja Forms - Excel Export Plugin ninja-forms-excel-export Broken Access Control Excel Export <= 3.3.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Data Disclosure via 'spreadsheet_export_form_id' Parameter ≤ 3.3.6 CVE-2026-15159 Wordfence
6.1 Medium WooCommerce Placetopay Gateway Plugin Cross-Site Scripting Reflected Cross-Site Scripting via 'redirect-url' No login needed ≤ 3.2.2 CVE-2026-11324 Wordfence
5.3 Medium Fense Proxy & VPN Blocker Plugin fense-block-vpn-proxy Broken Access Control Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action No login needed ≤ 3.0.1 CVE-2026-8616 Wordfence
6.4 Medium Smart Custom Fields Plugin smart-custom-fields Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title ≤ 5.0.7 CVE-2026-2594 Wordfence
4.9 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking SQL Injection Amelia <= 2.4.3 - Authenticated (Custom+) SQL Injection via Customer Import ≤ 2.4.3 CVE-2026-14782 Wordfence
4.4 Medium SysBasics Customize My Account for WooCommerce Plugin customize-my-account-for-woocommerce Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter ≤ 4.4.14 CVE-2026-15324 Wordfence
4.9 Medium WP Bulk Delete Plugin wp-bulk-delete SQL Injection Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter ≤ 1.4.2 CVE-2026-15727 Wordfence
6.4 Medium wpForo Forum Plugin wpforo Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field ≤ 3.1.1 CVE-2026-15021 Wordfence
6.4 Medium Tickera Plugin tickera-event-ticketing-system Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute ≤ 3.6.0.0 CVE-2026-13755 Wordfence
4.3 Medium WPBot Plugin chatbot Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function ≤ 8.5.6 CVE-2026-15610 Wordfence
5.3 Medium WPBot Plugin chatbot Broken Access Control Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter No login needed ≤ 8.5.6 CVE-2026-15106 Wordfence
4.9 Medium WP TripAdvisor Review Slider Plugin wp-tripadvisor-review-slider SQL Injection Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter ≤ 14.6 CVE-2026-15651 Wordfence
4.3 Medium Themify Builder Plugin themify-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action ≤ 7.7.7 CVE-2026-15407 Wordfence
6.5 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array ≤ 4.0.0 CVE-2026-15022 Wordfence
6.5 Medium Tickera Plugin tickera-event-ticketing-system SQL Injection Authenticated (Staff+) SQL Injection via 's' Parameter ≤ 3.6.0.0 CVE-2026-13754 Wordfence
4.3 Medium The Cache Purger Plugin the-cache-purger Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter ≤ 2.3.20 CVE-2026-15350 Wordfence
6.5 Medium Quiz and Survey Master (QSM) Plugin quiz-master-next SQL Injection Authenticated (Custom+) SQL Injection via 'pages' Parameter ≤ 11.2.0 CVE-2026-13767 Wordfence
6.4 Medium WP Delicious Plugin delicious-recipes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute ≤ 1.10.2 CVE-2026-15099 Wordfence
5.5 Medium FunnelKit Plugin funnel-builder Arbitrary File Deletion Admin+ Arbitrary File Deletion via Path Traversal in Template Importer < 3.15.0.6 Fixed in 3.15.0.6 CVE-2026-12979 WPScan
6.1 Medium Header Footer Builder for Elementor Plugin header-footer-builder-for-elementor Cross-Site Scripting Contributor+ Stored XSS via Template Import No login needed < 1.2.1 Fixed in 1.2.1 CVE-2026-12869 WPScan
6.5 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Arbitrary File Upload Unauthenticated Arbitrary Media Upload via cr_upload_media No login needed < 5.113.0 Fixed in 5.113.0 CVE-2026-12684 WPScan
5.9 Medium AI Engine Plugin ai-engine Information Disclosure Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR < 3.5.5 Fixed in 3.5.5 CVE-2026-12510 WPScan
6.5 Medium WP Job Portal Plugin wp-job-portal SQL Injection Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter < 2.5.5 Fixed in 2.5.5 CVE-2026-12395 WPScan
5.4 Medium LatePoint Plugin Cross-Site Request Forgery Multiple Privileged Actions via CSRF No login needed < 5.6.3 Fixed in 5.6.3 CVE-2026-11866 WPScan
6.1 Medium BetterDocs Plugin betterdocs Cross-Site Scripting Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection No login needed 4.0.0 – < 4.5.5 Fixed in 4.5.5 CVE-2026-11371 WPScan
4.9 Medium SEO Booster Plugin seo-booster SQL Injection Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter ≤ 7.3.1 CVE-2026-15458 Wordfence
4.9 Medium SEO Booster Plugin seo-booster SQL Injection Authenticated (Administrator+) SQL Injection via 'orderby' Parameter ≤ 7.3.1 CVE-2026-15445 Wordfence
6.1 Medium Product Feed Manager For WooCommerce Plugin best-woocommerce-feed Cross-Site Scripting Reflected Cross-Site Scripting via 's' Search Parameter No login needed ≤ 7.6.1 CVE-2026-15306 Wordfence
6.4 Medium Easy Accordion Plugin easy-accordion-free Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute ≤ 3.1.6 CVE-2026-15652 Wordfence
6.4 Medium GiveWP Plugin give Cross-Site Scripting Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting ≤ 4.16.3 CVE-2026-14987 Wordfence
6.5 Medium MultiVendorX Plugin dc-woocommerce-multi-vendor SQL Injection Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter ≤ 5.0.9 CVE-2026-12941 Wordfence
4.3 Medium Landing Page Builder Plugin page-builder-add Cross-Site Request Forgery Cross-Site Request Forgery to ulpb_admin_data AJAX Action No login needed ≤ 1.5.3.6 CVE-2026-12409 Wordfence
4.3 Medium Catch Themes Demo Import Plugin catch-themes-demo-import Broken Access Control Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter ≤ 3.3 CVE-2026-15336 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only