WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 151–200 of 6,408 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.3 High	Taxi Booking Manager for WooCommerce Plugin `ecab-taxi-booking-manager`	Authentication Bypass Broken Authentication No login needed	`< 2.0.8` Fixed in `2.0.8`	Sep 22, 2026	`CVE-2026-93928`	Patchstack
7.1 High	WordPress Core	Cross-Site Scripting Unauth. Cross Site Scripting (XSS) No login needed	`7.1 – < 7.1.1, 7.0 – 7.0.4, 6.9 – 6.9.7, …` Fixed in `7.1.1`	Sep 18, 2026	`CVE-2026-93485`	Patchstack
7.1 High	WP Inventory Manager Plugin `wp-inventory-manager`	Cross-Site Scripting No login needed	`≤ 2.5.4`	Sep 17, 2026	`CVE-2026-90887`	Patchstack
8.8 High	Xagio SEO Plugin `xagio-seo`	Cross-Site Request Forgery No login needed	`≤ 7.1.0.43` Fixed in `7.1.0.44`	Sep 17, 2026	`CVE-2026-78295`	Patchstack
7.6 High	MC Woocommerce Wishlist Plugin `smart-wishlist-for-more-convert`	SQL Injection	`≤ 1.9.21` Fixed in `2.0.0`	Sep 17, 2026	`CVE-2026-66631`	Patchstack
7.6 High	PublishPress Series Plugin `organize-series`	SQL Injection	`≤ 3.1.3` Fixed in `3.1.4`	Sep 17, 2026	`CVE-2026-66630`	Patchstack
7.6 High	WP-Lister Lite for eBay Plugin `wp-lister-for-ebay`	SQL Injection	`≤ 3.8.11` Fixed in `3.8.12`	Sep 17, 2026	`CVE-2026-66628`	Patchstack
7.6 High	SKT Addons for Elementor Plugin `skt-addons-for-elementor`	SQL Injection	`≤ 4.0` Fixed in `4.1`	Sep 17, 2026	`CVE-2026-66626`	Patchstack
7.6 High	WC Vendors Marketplace Plugin `wc-vendors`	SQL Injection	`≤ 2.7.2.1` Fixed in `2.7.2.2`	Sep 17, 2026	`CVE-2026-66625`	Patchstack
7.6 High	WPMasterToolKit Plugin `wpmastertoolkit`	SQL Injection	`≤ 2.22.0` Fixed in `2.23.1`	Sep 17, 2026	`CVE-2026-66624`	Patchstack
7.6 High	Newsletters Plugin `newsletters-lite`	SQL Injection	`≤ 4.18` Fixed in `4.18.1`	Sep 17, 2026	`CVE-2026-66619`	Patchstack
7.6 High	WP Maps Plugin `wp-google-map-plugin`	SQL Injection	`≤ 4.9.9` Fixed in `5.0.0`	Sep 17, 2026	`CVE-2026-66618`	Patchstack
8.5 High	Product Feed Manager Plugin `best-woocommerce-feed`	SQL Injection	`≤ 7.12.0` Fixed in `7.12.1`	Sep 17, 2026	`CVE-2026-66580`	Patchstack
7.1 High	Asset CleanUp: Page Speed Booster Plugin `wp-asset-clean-up`	Cross-Site Request Forgery No login needed	`≤ 1.4.0.5` Fixed in `1.4.0.6`	Sep 17, 2026	`CVE-2026-66571`	Patchstack
7.1 High	Visitor Traffic Real Time Statistics Pro Plugin `visitors-traffic-real-time-statistics-pro`	Cross-Site Scripting No login needed	`≤ 11.21` Fixed in `11.22`	Sep 17, 2026	`CVE-2026-90986`	Patchstack
7.6 High	WP Mega Menu Plugin `wp-megamenu`	SQL Injection	`≤ 1.4.2`	Sep 16, 2026	`CVE-2026-92465`	Patchstack
8.7 High	design-scuole-wordpress-theme Theme	Broken Access Control Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme No login needed	`1.0 – 2.17.3`	Sep 15, 2026	`CVE-2026-87792`	ENISA
8.7 High	design-scuole-wordpress-theme Theme	Path Traversal Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme No login needed	`2.6.0 – 2.18.1`	Sep 15, 2026	`CVE-2026-87791`	ENISA
8.8 High	Consulting - Business, Finance Theme	Privilege Escalation Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX	`≤ 6.7.16`	Sep 15, 2026	`CVE-2026-14805`	Wordfence
7.5 High	rtMedia for WordPress, BuddyPress and bbPress Plugin `buddypress-media`	SQL Injection Unauthenticated SQL Injection via 'compare' Parameter No login needed	`≤ 4.7.11`	Sep 12, 2026	`CVE-2026-16482`	Wordfence
7.2 High	Amelia Plugin	Privilege Escalation Amelia Manager+ WordPress Account Takeover	`< 2.4.10` Fixed in `2.4.10`	Sep 12, 2026	`CVE-2026-77705`	WPScan
7.1 High	Master Addons for Elementor Plugin `master-addons`	Broken Access Control	`≤ 3.2.2` Fixed in `3.2.3`	Sep 11, 2026	`CVE-2026-62089`	Patchstack
7.6 High	Amelia Plugin `ameliabooking`	SQL Injection	`≤ 2.4.9` Fixed in `2.4.10`	Sep 11, 2026	`CVE-2026-62112`	Patchstack
7.6 High	Sky Addons for Elementor Plugin `sky-elementor-addons`	SQL Injection	`≤ 3.8.4` Fixed in `3.8.5`	Sep 11, 2026	`CVE-2026-62109`	Patchstack
8.8 High	Masteriyo - LMS Plugin `learning-management-system`	PHP Object Injection LMS plugin <= 3.4.0 - PHP Object Injection	`≤ 3.4.0` Fixed in `3.4.1`	Sep 11, 2026	`CVE-2026-62107`	Patchstack
8.8 High	SMS Alert Order Notifications Plugin `sms-alert`	Privilege Escalation	`≤ 3.9.9` Fixed in `4.0.0`	Sep 11, 2026	`CVE-2026-62106`	Patchstack
8.8 High	Gato GraphQL Plugin `gatographql`	Privilege Escalation	`≤ 19.2.3` Fixed in `19.2.4`	Sep 11, 2026	`CVE-2026-62102`	Patchstack
7.5 High	AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution Plugin `acymailing`	Path Traversal An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter No login needed	`≤ 11.0.4`	Sep 10, 2026	`CVE-2026-77807`	Wordfence
7.5 High	WP Fast Total Search Plugin `fulltext-search`	Broken Access Control No login needed	`≤ 1.82.284` Fixed in `1.83.286`	Sep 10, 2026	`CVE-2026-84821`	Patchstack
7.1 High	WPAdverts Plugin `wpadverts`	Cross-Site Scripting No login needed	`≤ 2.3.3` Fixed in `2.3.4`	Sep 10, 2026	`CVE-2026-84819`	Patchstack
7.1 High	WPCS Plugin `currency-switcher`	Cross-Site Scripting No login needed	`≤ 1.3.2` Fixed in `1.3.3`	Sep 10, 2026	`CVE-2026-84816`	Patchstack
8.1 High	SiteSkite Plugin `siteskite`	Privilege Escalation No login needed	`≤ 2.1.5` Fixed in `2.1.6`	Sep 10, 2026	`CVE-2026-81805`	Patchstack
7.5 High	ZHBackup – Backup, Restore & Migration Plugin `zhbackup`	Information Disclosure Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure No login needed	`≤ 2.4.2` Fixed in `2.4.3`	Sep 10, 2026	`CVE-2026-81804`	Patchstack
7.5 High	RepairBuddy Plugin `computer-repair-shop`	Remote Code Execution	`≤ 4.1224` Fixed in `4.1225`	Sep 10, 2026	`CVE-2026-81803`	Patchstack
8.1 High	WP-Stateless Plugin `wp-stateless`	Broken Access Control Settings Change	`≤ 4.4.1` Fixed in `4.4.2`	Sep 10, 2026	`CVE-2026-81801`	Patchstack
7.5 High	Return Refund and Exchange For WooCommerce Plugin `woo-refund-and-exchange-lite`	Broken Access Control No login needed	`≤ 4.6.4`	Sep 10, 2026	`CVE-2026-81799`	Patchstack
7.3 High	WP Travel Plugin `wp-travel`	Authentication Bypass Broken Authentication No login needed	`≤ 12.0.3` Fixed in `12.0.4`	Sep 10, 2026	`CVE-2026-81796`	Patchstack
7.1 High	Page Visits Counter – Lite Plugin `page-visits-counter-lite`	Cross-Site Scripting Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) No login needed	`≤ 1.2.3`	Sep 10, 2026	`CVE-2026-81795`	Patchstack
7.5 High	Shirt Product Designer for WooCommerce Plugin `woo-shirt-product-designer`	Broken Access Control No login needed	`1.0.4`	Sep 10, 2026	`CVE-2026-81794`	Patchstack
8.6 High	Advanced Product Fields Extended for WooCommerce Plugin `advanced-product-fields-for-woocommerce-extended`	Arbitrary File Deletion No login needed	`≤ 3.1.6` Fixed in `3.1.7`	Sep 10, 2026	`CVE-2026-81789`	Patchstack
7.5 High	Thank You Page Customizer for WooCommerce Plugin `woo-thank-you-page-customizer`	Broken Access Control No login needed	`≤ 1.2.2`	Sep 10, 2026	`CVE-2026-81786`	Patchstack
8.1 High	Wise Chat Plugin `wise-chat`	PHP Object Injection No login needed	`≤ 3.4`	Sep 10, 2026	`CVE-2026-81784`	Patchstack
7.1 High	MailMunch – Grow your Email List Plugin `mailmunch`	Authentication Bypass Grow your Email List plugin <= 3.2.5 - Broken Authentication	`≤ 3.2.5`	Sep 10, 2026	`CVE-2026-81783`	Patchstack
7.2 High	Hide My WP Ghost Plugin `hide-my-wp`	Server-Side Request Forgery No login needed	`≤ 7.0.09` Fixed in `7.0.10`	Sep 8, 2026	`CVE-2026-81806`	Patchstack
7.5 High	WooCommerce Plugin `woocommerce`	Denial of Service Denial of Service Attack No login needed	`< 11.1.0` Fixed in `11.1.0`	Sep 8, 2026	`CVE-2026-48888`	Patchstack
7.1 High	Unbounce Landing Pages Plugin `unbounce`	Broken Access Control	`≤ 1.1.4`	Sep 8, 2026	`CVE-2026-81781`	Patchstack
7.5 High	Csomagpontok és szállítási címkék WooCommerce-hez Plugin `hungarian-pickup-points-for-woocommerce`	Broken Access Control No login needed	`< 4.2.8` Fixed in `4.2.8`	Sep 8, 2026	`CVE-2026-81790`	Patchstack
7.1 High	Easy Appointments Plugin `easy-appointments`	Cross-Site Scripting No login needed	`≤ 4.0.2.1`	Sep 8, 2026	`CVE-2026-81798`	Patchstack
7.1 High	Open User Map Plugin `open-user-map`	Cross-Site Scripting No login needed	`≤ 1.4.50` Fixed in `1.4.51`	Sep 8, 2026	`CVE-2026-84818`	Patchstack
7.1 High	JetFormBuilder Plugin `jetformbuilder`	Cross-Site Scripting No login needed	`≤ 3.6.5.1` Fixed in `3.6.5.2`	Sep 8, 2026	`CVE-2026-84817`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.