WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,901–1,950 of 9,010 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 39 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High WP Travel Engine Plugin wp-travel-engine Other Other Vulnerability Type No login needed ≤ 6.7.10 Fixed in 6.7.11 CVE-2026-49078 Patchstack
7.5 High Knit Pay Plugin knit-pay Broken Access Control No login needed ≤ 9.4.0.0 Fixed in 9.4.0.1 CVE-2026-49070 Patchstack
7.5 High Coupon Affiliates Plugin woo-coupon-usage Information Disclosure Sensitive Data Exposure No login needed ≤ 7.8.1 Fixed in 7.8.2 CVE-2026-49068 Patchstack
7.5 High Conekta Payment Gateway Plugin conekta-payment-gateway Information Disclosure Sensitive Data Exposure No login needed ≤ 6.0.0 Fixed in 6.0.1 CVE-2026-49066 Patchstack
8.2 High Hippoo Mobile App for WooCommerce Plugin hippoo Broken Access Control No login needed ≤ 1.9.5 Fixed in 1.9.6 CVE-2026-49065 Patchstack
7.3 High Listdom Plugin listdom Privilege Escalation No login needed ≤ 5.5.0 Fixed in 5.6.0 CVE-2026-49063 Patchstack
7.5 High WPC Product Options for WooCommerce Plugin wpc-product-options Path Traversal Arbitrary File Download No login needed ≤ 3.2.1 Fixed in 3.2.2 CVE-2026-49061 Patchstack
7.5 High WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin print-invoices-packing-slip-labels-for-woocommerce Information Disclosure Sensitive Data Exposure No login needed ≤ 4.9.4 Fixed in 4.9.5 CVE-2026-49056 Patchstack
7.1 High Drag and Drop Multiple File Upload – Contact Form 7 Plugin drag-and-drop-multiple-file-upload-contact-form-7 Arbitrary File Upload Contact Form 7 plugin <= 1.3.9.7 - Cross Site Scripting (XSS) No login needed ≤ 1.3.9.7 Fixed in 1.3.9.8 CVE-2026-49055 Patchstack
8.1 High Really Simple SSL Plugin really-simple-ssl Authentication Bypass Broken Authentication No login needed ≤ 9.5.10 Fixed in 9.5.10.1 CVE-2026-48970 Patchstack
7.1 High Funnel Builder by FunnelKit Plugin funnel-builder Cross-Site Scripting No login needed ≤ 3.15.0.2 Fixed in 3.15.0.3 CVE-2026-48966 Patchstack
8.5 High ELEX WordPress HelpDesk & Customer Ticketing System Plugin elex-helpdesk-customer-support-ticket-system SQL Injection ≤ 3.3.6 Fixed in 3.3.7 CVE-2026-48964 Patchstack
8.8 High Amelia Plugin ameliabooking Privilege Escalation ≤ 2.3 Fixed in 2.4 CVE-2026-48889 Patchstack
7.1 High HollerBox Plugin holler-box Cross-Site Scripting No login needed ≤ 2.3.10.1 Fixed in 2.3.11 CVE-2026-48885 Patchstack
7.5 High WPC Product Bundles for WooCommerce Plugin woo-product-bundle Broken Access Control No login needed ≤ 8.5.3 Fixed in 8.5.4 CVE-2026-48883 Patchstack
8.5 High WP Time Slots Booking Form Plugin wp-time-slots-booking-form SQL Injection ≤ 1.2.50 Fixed in 1.2.51 CVE-2026-48882 Patchstack
7.1 High Stop Spammers Plugin stop-spammer-registrations-plugin Cross-Site Scripting No login needed ≤ 2026.3 Fixed in 2026.4 CVE-2026-48876 Patchstack
8.5 High GamiPress Plugin gamipress SQL Injection ≤ 7.8.7 Fixed in 7.8.8 CVE-2026-48874 Patchstack
7.5 High Montonio for WooCommerce Plugin montonio-for-woocommerce Broken Access Control No login needed ≤ 10.1.2 Fixed in 10.1.3 CVE-2026-48873 Patchstack
7.5 High EmbedPress Plugin embedpress Information Disclosure Sensitive Data Exposure No login needed ≤ 4.5.2 Fixed in 4.5.3 CVE-2026-48872 Patchstack
7.1 High MW WP Form Plugin mw-wp-form Cross-Site Scripting No login needed ≤ 5.1.3 Fixed in 5.1.4 CVE-2026-48871 Patchstack
7.5 High Simple Shopping Cart Plugin wordpress-simple-paypal-shopping-cart Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 5.2.9 Fixed in 5.3.0 CVE-2026-48868 Patchstack
7.1 High Quiz And Survey Master Plugin quiz-master-next Cross-Site Scripting No login needed ≤ 11.1.2 Fixed in 11.1.3 CVE-2026-48867 Patchstack
7.1 High Post SMTP Plugin post-smtp Cross-Site Scripting No login needed ≤ 3.6.2 Fixed in 3.6.3 CVE-2026-48838 Patchstack
7.5 High Contact Form by WPForms Plugin wpforms-lite Broken Access Control No login needed ≤ 1.10.0.4 Fixed in 1.10.0.5 CVE-2026-48835 Patchstack
7.5 High WpEvently Plugin mage-eventpress Other Other Vulnerability Type No login needed ≤ 5.3.3 Fixed in 5.3.4 CVE-2026-45441 Patchstack
7.1 High Product Filter Widget for Elementor Plugin product-filter-widget-for-elementor Cross-Site Scripting No login needed ≤ 1.0.6 CVE-2026-45437 Patchstack
7.1 High AutomatorWP Plugin automatorwp Cross-Site Scripting No login needed ≤ 5.7.2 Fixed in 5.7.3 CVE-2026-42775 Patchstack
8.1 High EventPrime Plugin eventprime-event-calendar-management PHP Object Injection No login needed ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42687 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting ≤ 4.3.2.1 Fixed in 4.3.2.2 CVE-2026-42686 Patchstack
7.5 High Email Marketing for WooCommerce by Omnisend Plugin omnisend-connect Authentication Bypass Broken Authentication No login needed ≤ 1.18.0 Fixed in 1.18.1 CVE-2026-42668 Patchstack
7.5 High Bookly Plugin bookly-responsive-appointment-booking-tool Information Disclosure Sensitive Data Exposure No login needed ≤ 27.4 Fixed in 27.5 CVE-2026-42667 Patchstack
7.5 High Salon booking system Plugin salon-booking-system Broken Access Control No login needed ≤ 10.30.25 Fixed in 10.30.26 CVE-2026-42666 Patchstack
8.2 High AI Product Search for WooCommerce – Motive Commerce Search Plugin motive-commerce-search Broken Access Control Motive Commerce Search plugin <= 1.38.2 - Broken Access Control No login needed ≤ 1.38.2 Fixed in 1.38.3 CVE-2026-42664 Patchstack
8.8 High WP Customer Area Plugin customer-area Path Traversal ≤ 8.3.4 Fixed in 8.3.5 CVE-2026-42661 Patchstack
7.1 High Classified Listing Plugin classified-listing Cross-Site Scripting No login needed ≤ 5.3.8 Fixed in 5.3.9 CVE-2026-42658 Patchstack
7.5 High Best Payments Plugin for WP Plugin wp-payment-form Price Manipulation Payment Bypass No login needed ≤ 4.6.19 Fixed in 4.6.20 CVE-2026-42655 Patchstack
7.2 High AutomatorWP Plugin automatorwp Cross-Site Scripting No login needed ≤ 5.6.7 Fixed in 5.6.8 CVE-2026-42650 Patchstack
7.1 High Favicon Rotator Plugin favicon-rotator Cross-Site Scripting No login needed ≤ 1.2.11 Fixed in 1.2.12 CVE-2026-42649 Patchstack
8.1 High CloudSecure WP Security Plugin cloudsecure-wp-security Authentication Bypass Broken Authentication No login needed ≤ 1.4.7 Fixed in 1.4.8 CVE-2026-42411 Patchstack
7.5 High Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Sensitive Data Exposure No login needed < 1.6.11.2 Fixed in 1.6.11.2 CVE-2026-42384 Patchstack
7.1 High WP Time Slots Booking Form Plugin wp-time-slots-booking-form Cross-Site Scripting No login needed ≤ 1.2.46 Fixed in 1.2.47 CVE-2026-40791 Patchstack
7.5 High Amelia Plugin ameliabooking Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2 Fixed in 2.2.1 CVE-2026-40789 Patchstack
7.1 High ChatBot Plugin chatbot Broken Access Control ≤ 7.9.7 Fixed in 7.9.9 CVE-2026-40788 Patchstack
7.1 High Quiz And Survey Master Plugin quiz-master-next Cross-Site Scripting No login needed ≤ 11.0.0 Fixed in 11.1.0 CVE-2026-40787 Patchstack
7.1 High AutomatorWP Plugin automatorwp Authentication Bypass Broken Authentication ≤ 5.6.7 Fixed in 5.6.8 CVE-2026-40785 Patchstack
7.5 High ReviewX Plugin reviewx Authentication Bypass Broken Authentication No login needed ≤ 2.3.6 Fixed in 2.3.7 CVE-2026-40781 Patchstack
7.7 High Link Library Plugin link-library Arbitrary File Deletion ≤ 7.8.8 Fixed in 7.8.9 CVE-2026-40779 Patchstack
7.5 High WP Event SOlution Plugin wp-event-solution Broken Access Control No login needed ≤ 4.1.8 Fixed in 4.1.9 CVE-2026-40776 Patchstack
7.3 High Royal MCP Plugin royal-mcp Broken Access Control No login needed ≤ 1.4.2 Fixed in 1.4.3 CVE-2026-40775 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only