WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 151–200 of 1,401 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
9.8 Critical	Kadence WooCommerce Email Designer Plugin `kadence-woocommerce-email-designer`	Privilege Escalation No login needed	`≤ 1.5.19` Fixed in `1.5.19.1`	Aug 6, 2026	`CVE-2026-28005`	Patchstack
9.8 Critical	Insert or Embed Articulate Content into Plugin	Arbitrary File Upload Editor+ Arbitrary File Upload No login needed	`≤ 4.3000000027`	Aug 3, 2026	`CVE-2026-16060`	WPScan
9.3 Critical	AWP Classifieds Plugin `another-wordpress-classifieds-plugin`	SQL Injection No login needed	`≤ 4.4.7` Fixed in `4.4.8`	Jul 27, 2026	`CVE-2026-59550`	Patchstack
9.3 Critical	rtMedia for WordPress, BuddyPress and bbPress Plugin `buddypress-media`	SQL Injection No login needed	`≤ 4.7.10` Fixed in `4.7.11`	Jul 27, 2026	`CVE-2026-59549`	Patchstack
9.3 Critical	GamiPress Plugin `gamipress`	SQL Injection No login needed	`≤ 7.9.7` Fixed in `7.9.8`	Jul 27, 2026	`CVE-2026-59538`	Patchstack
9.3 Critical	Relevanssi Light Plugin `relevanssi-light`	SQL Injection No login needed	`≤ 1.2.2` Fixed in `1.2.3`	Jul 27, 2026	`CVE-2026-59533`	Patchstack
9.3 Critical	MapSVG Plugin `mapsvg-lite-interactive-vector-maps`	SQL Injection No login needed	`≤ 8.14.0` Fixed in `8.14.1`	Jul 27, 2026	`CVE-2026-59527`	Patchstack
9.6 Critical	Avada Core Plugin `fusion-core`	Cross-Site Request Forgery No login needed	`≤ 5.15.6` Fixed in `5.15.7`	Jul 23, 2026	`CVE-2026-65471`	Patchstack
9.1 Critical	Really Simple CSV Importer Plugin `really-simple-csv-importer`	Arbitrary File Upload	`≤ 1.3` Fixed in `1.3.1`	Jul 23, 2026	`CVE-2026-65461`	Patchstack
9.1 Critical	MapSVG Plugin `mapsvg-lite-interactive-vector-maps`	Arbitrary File Upload	`≤ 8.14.0` Fixed in `8.14.1`	Jul 23, 2026	`CVE-2026-65455`	Patchstack
9.8 Critical	TrueBooker Plugin `truebooker-appointment-booking`	Privilege Escalation No login needed	`≤ 1.2.3` Fixed in `1.2.4`	Jul 23, 2026	`CVE-2026-61951`	Patchstack
9.3 Critical	TrueBooker Plugin `truebooker-appointment-booking`	SQL Injection No login needed	`≤ 1.2.3` Fixed in `1.2.4`	Jul 23, 2026	`CVE-2026-61950`	Patchstack
9.3 Critical	Bookly Plugin `bookly-responsive-appointment-booking-tool`	SQL Injection No login needed	`≤ 27.7` Fixed in `27.8`	Jul 23, 2026	`CVE-2026-61949`	Patchstack
9.3 Critical	WPDM – Premium Packages Plugin `wpdm-premium-packages`	SQL Injection Premium Packages plugin <= 6.2.0 - SQL Injection No login needed	`≤ 6.2.0` Fixed in `7.0.0`	Jul 23, 2026	`CVE-2026-61948`	Patchstack
10.0 Critical	Participants Database Plugin `participants-database`	Arbitrary File Deletion No login needed	`≤ 2.7.8.3` Fixed in `2.7.8.4`	Jul 23, 2026	`CVE-2026-59555`	Patchstack
9.8 Critical	Thrive Quiz Builder Plugin `thrive-quiz-builder`	PHP Object Injection No login needed	`≤ 10.9.3.0` Fixed in `10.9.3.1`	Jul 23, 2026	`CVE-2026-59544`	Patchstack
9.9 Critical	Advanced Views Plugin `acf-views`	Remote Code Execution	`≤ 3.8.11` Fixed in `3.9.0`	Jul 23, 2026	`CVE-2026-59543`	Patchstack
9.8 Critical	SMS Alert Order Notifications Plugin `sms-alert`	Privilege Escalation No login needed	`≤ 3.9.6` Fixed in `3.9.7`	Jul 23, 2026	`CVE-2026-59540`	Patchstack
9.3 Critical	MapSVG Plugin `mapsvg`	SQL Injection No login needed	`≤ 8.14.0` Fixed in `8.14.1`	Jul 23, 2026	`CVE-2026-59526`	Patchstack
9.3 Critical	Participants Database Plugin `participants-database`	SQL Injection No login needed	`≤ 2.7.8.3` Fixed in `2.7.8.4`	Jul 23, 2026	`CVE-2026-59525`	Patchstack
9.3 Critical	Buddyboss Platform Plugin `buddyboss-platform`	SQL Injection No login needed	`≤ 3.0.5` Fixed in `3.1.0`	Jul 23, 2026	`CVE-2026-59514`	Patchstack
9.6 Critical	Ninja Forms File Uploads Extension Plugin `ninja-forms-uploads`	Arbitrary File Upload Cross Site Request Forgery (CSRF) No login needed	`≤ 3.3.26`	Jul 23, 2026	`CVE-2026-57784`	Patchstack
9.1 Critical	Mailster Plugin `mailster`	Arbitrary File Upload	`≤ 4.1.17` Fixed in `4.1.18`	Jul 23, 2026	`CVE-2026-27064`	Patchstack
9.8 Critical	MountDev AI MCP Connector Plugin `mountdev-ai-mcp-connector`	Privilege Escalation Unauthenticated Privilege Escalation via OAuth Authorization Endpoint No login needed	`≤ 1.6.1`	Jul 23, 2026	`CVE-2026-15015`	Wordfence
9.3 Critical	Ninja Forms Plugin `ninja-forms`	Broken Access Control Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action No login needed	`< 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65049`	VulnCheck
9.8 Critical	WordPress Core	SQL Injection REST API batch-route confusion and SQL injection issue leading to Remote Code Execution No login needed	`6.9.0 – < 6.9.5, 7.0.0 – < 7.0.2` Fixed in `6.9.5`	Jul 17, 2026	`CVE-2026-63030`	WPScan
9.8 Critical	Podlove Podcast Publisher Plugin `podlove-podcasting-plugin-for-wordpress`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter No login needed	`≤ 4.5.1`	Jul 14, 2026	`CVE-2026-13001`	Wordfence
9.8 Critical	Directorist Plugin `directorist`	PHP Object Injection No login needed	`≤ 8.8.2` Fixed in `8.8.3`	Jul 13, 2026	`CVE-2026-59518`	Patchstack
9.3 Critical	AIWU Plugin `ai-copilot-content-generator`	SQL Injection No login needed	`≤ 1.5.4` Fixed in `1.5.5`	Jul 13, 2026	`CVE-2026-59515`	Patchstack
9.8 Critical	MailOptin Plugin `mailoptin`	Privilege Escalation No login needed	`≤ 1.2.77.3` Fixed in `1.2.78.0`	Jul 13, 2026	`CVE-2026-57813`	Patchstack
10.0 Critical	Realtyna Organic IDX Plugin `real-estate-listing-realtyna-wpl`	Remote Code Execution No login needed	`≤ 5.2.0` Fixed in `5.3.0`	Jul 13, 2026	`CVE-2026-57811`	Patchstack
9.8 Critical	Grand Photography Theme `grandphotography`	PHP Object Injection No login needed	`≤ 5.7.8`	Jul 13, 2026	`CVE-2026-57770`	Patchstack
9.8 Critical	RT-Theme 18 \| Extensions Plugin `rt18-extensions`	PHP Object Injection No login needed	`≤ 2.5`	Jul 13, 2026	`CVE-2026-57744`	Patchstack
9.3 Critical	AcyMailing SMTP Newsletter Plugin `acymailing`	SQL Injection No login needed	`≤ 10.11.0` Fixed in `10.11.1`	Jul 13, 2026	`CVE-2026-57739`	Patchstack
9.8 Critical	777 Theme `triple-seven`	PHP Object Injection No login needed	`≤ 1.13.0`	Jul 13, 2026	`CVE-2026-57738`	Patchstack
9.3 Critical	Kirki Plugin `kirki`	SQL Injection No login needed	`≤ 6.0.12` Fixed in `6.0.13`	Jul 13, 2026	`CVE-2026-57726`	Patchstack
9.8 Critical	Kirki Plugin `kirki`	PHP Object Injection No login needed	`≤ 6.0.12` Fixed in `6.0.13`	Jul 13, 2026	`CVE-2026-57724`	Patchstack
10.0 Critical	Aimogen Pro Plugin `aimogen-pro`	Arbitrary File Upload No login needed	`≤ 2.8.3` Fixed in `2.8.3.1`	Jul 13, 2026	`CVE-2026-57719`	Patchstack
9.3 Critical	LatePoint Plugin `latepoint`	SQL Injection No login needed	`≤ 5.6.3` Fixed in `5.6.4`	Jul 13, 2026	`CVE-2026-57714`	Patchstack
9.9 Critical	WoowBot Pro Max Plugin `woowbot-pro-max`	Arbitrary File Upload	`≤ 14.1.7` Fixed in `14.1.8`	Jul 13, 2026	`CVE-2026-57710`	Patchstack
9.3 Critical	Simple Business Directory Pro Plugin `simple-business-directory-pro`	SQL Injection No login needed	`≤ 15.9.4` Fixed in `15.9.5`	Jul 13, 2026	`CVE-2026-57707`	Patchstack
9.3 Critical	Amelia Plugin `ameliabooking`	SQL Injection No login needed	`≤ 2.4.2` Fixed in `2.4.3`	Jul 13, 2026	`CVE-2026-57702`	Patchstack
9.9 Critical	SureDash Plugin `suredash`	Arbitrary File Deletion	`≤ 1.8.0` Fixed in `1.8.1`	Jul 13, 2026	`CVE-2026-57401`	Patchstack
9.8 Critical	OAuth Single Sign On - SSO (OAuth Client) Plugin `miniorange-oauth-oidc-single-sign-on`	Authentication Bypass SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication No login needed	`≤ 38.5.8` Fixed in `38.5.8.1`	Jul 10, 2026	`CVE-2026-57807`	Patchstack
9.3 Critical	WP Fast Total Search Plugin `fulltext-search`	SQL Injection No login needed	`≤ 1.80.280` Fixed in `1.81.282`	Jul 2, 2026	`CVE-2026-57683`	Patchstack
9.3 Critical	GeekyBot Plugin `geeky-bot`	SQL Injection No login needed	`≤ 1.2.5` Fixed in `1.2.6`	Jul 2, 2026	`CVE-2026-57679`	Patchstack
9.8 Critical	Novalnet Payment Gateway for WooCommerce Plugin `woocommerce-novalnet-gateway`	PHP Object Injection No login needed	`≤ 12.10.3` Fixed in `12.10.4`	Jul 2, 2026	`CVE-2026-57677`	Patchstack
9.6 Critical	Admin and Site Enhancements (ASE) Pro Plugin `admin-site-enhancements-pro`	Cross-Site Scripting No login needed	`≤ 8.8.5` Fixed in `8.8.6`	Jul 2, 2026	`CVE-2026-57625`	Patchstack
10.0 Critical	Blocksy Companion Pro Plugin `blocksy-companion-pro`	Remote Code Execution No login needed	`≤ 2.1.46` Fixed in `2.1.47`	Jul 2, 2026	`CVE-2026-57624`	Patchstack
9.0 Critical	W3 Total Cache Plugin `w3-total-cache`	Remote Code Execution Arbitrary Code Execution No login needed	`≤ 2.9.4` Fixed in `2.10.0`	Jul 2, 2026	`CVE-2026-57623`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.