WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 151–200 of 2,543 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Gmail SMTP Plugin `gmail-smtp`	Cross-Site Request Forgery No login needed	`≤ 1.2.3.19` Fixed in `1.2.3.20`	Jun 26, 2026	`CVE-2026-57657`	Patchstack
8.2 High	Child Theme Wizard Plugin `child-theme-wizard`	Cross-Site Request Forgery No login needed	`≤ 1.4` Fixed in `1.5`	Jun 26, 2026	`CVE-2026-57655`	Patchstack
6.5 Medium	Real Estate 7 Theme `realestate-7`	Cross-Site Request Forgery No login needed	`≤ 3.5.9` Fixed in `3.6.0`	Jun 26, 2026	`CVE-2026-57641`	Patchstack
4.3 Medium	Abandoned Cart Lite for WooCommerce Plugin `woocommerce-abandoned-cart`	Cross-Site Request Forgery No login needed	`≤ 6.8.0` Fixed in `6.8.1`	Jun 26, 2026	`CVE-2026-57637`	Patchstack
6.5 Medium	FunnelKit Payment Gateway for Stripe WooCommerce Plugin `funnelkit-stripe-woo-payment-gateway`	Cross-Site Request Forgery No login needed	`≤ 1.14.0.3` Fixed in `1.14.0.4`	Jun 26, 2026	`CVE-2026-57635`	Patchstack
4.9 Medium	Kirki Plugin `kirki`	Server-Side Request Forgery	`≤ 6.0.11` Fixed in `6.0.12`	Jun 26, 2026	`CVE-2026-57627`	Patchstack
8.5 High	Tourfic Plugin `tourfic`	SQL Injection	`≤ 2.22.5` Fixed in `2.22.6`	Jun 26, 2026	`CVE-2026-56064`	Patchstack
7.1 High	perfmatters Plugin `perfmatters`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.6.3` Fixed in `2.6.4`	Jun 26, 2026	`CVE-2026-56047`	Patchstack
6.4 Medium	utm.codes Plugin `utm-dot-codes`	Server-Side Request Forgery	`≤ 1.9.0` Fixed in `1.9.1`	Jun 26, 2026	`CVE-2026-56026`	Patchstack
8.8 High	Eagle Booking Plugin `eagle-booking`	Cross-Site Request Forgery No login needed	`≤ 1.3.4.3`	Jun 26, 2026	`CVE-2025-68052`	Patchstack
7.5 High	Tourfic Plugin `tourfic`	SQL Injection Unauthenticated SQL Injection via 'post_id' Parameter No login needed	`≤ 2.22.7`	Jun 25, 2026	`CVE-2026-12937`	Wordfence
7.2 High	ARForms Plugin	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'value' Parameter No login needed	`≤ 7.1.3`	Jun 24, 2026	`CVE-2026-3652`	Wordfence
6.5 Medium	WP EasyPay Plugin `wp-easy-pay`	Cross-Site Request Forgery No login needed	`≤ 4.5.0`	Jun 18, 2026	`CVE-2026-56024`	Patchstack
4.3 Medium	Emergency Password Reset Plugin `emergency-password-reset`	Cross-Site Request Forgery No login needed	`≤ 8.0` Fixed in `9.0`	Jun 17, 2026	`CVE-2024-35648`	Patchstack
4.3 Medium	Skyline WP Theme `skyline-wp`	Cross-Site Request Forgery No login needed	`≤ 1.0.10` Fixed in `1.0.11`	Jun 17, 2026	`CVE-2024-34810`	Patchstack
8.8 High	Dating Theme `da10`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Account Takeover No login needed	`≤ 11.2.0`	Jun 17, 2026	`CVE-2026-22342`	Patchstack
4.7 Medium	WP Migrate Lite Plugin `wp-migrate-db`	Cross-Site Request Forgery No login needed	`≤ 2.7.8` Fixed in `2.7.9`	Jun 15, 2026	`CVE-2026-49043`	Patchstack
4.4 Medium	PopAd Plugin `popad`	Server-Side Request Forgery	`≤ 1.0.4`	Jun 15, 2026	`CVE-2025-60175`	Patchstack
4.3 Medium	WooCommerce Conversion Tracking Plugin `woocommerce-conversion-tracking`	Cross-Site Request Forgery No login needed	`≤ 2.0.10` Fixed in `2.0.11`	Jun 11, 2026	`CVE-2022-47150`	Patchstack
5.4 Medium	Advanced AJAX Product Filters Plugin `woocommerce-ajax-filters`	Broken Access Control Broken Access Control + CSRF	`≤ 1.6.3.3` Fixed in `1.6.3.4`	Jun 11, 2026	`CVE-2022-45813`	Patchstack
4.6 Medium	YITH WooCommerce Product Slider Carousel Plugin `yith-woocommerce-product-slider-carousel`	Cross-Site Request Forgery	`≤ 1.16.0` Fixed in `1.16.1`	Jun 11, 2026	`CVE-2022-44630`	Patchstack
4.3 Medium	WpEvently Plugin `mage-eventpress`	Cross-Site Request Forgery No login needed	`≤ 4.1.2` Fixed in `4.1.3`	Jun 11, 2026	`CVE-2024-32110`	Patchstack
6.1 Medium	Product Filter Widget for Elementor Plugin `product-filter-widget-for-elementor`	Cross-Site Scripting Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter No login needed	`≤ 1.0.6`	Jun 9, 2026	`CVE-2026-11603`	Wordfence
6.4 Medium	ePaperFlip Publisher Plugin `epaperflip-publisher`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'publicationid' Shortcode Attribute	`≤ 1`	Jun 9, 2026	`CVE-2026-7662`	Wordfence
4.0 Medium	Contact Form Maker Plugin `contact-form-maker`	Cross-Site Request Forgery Contact Form by WD 1.13.1 CSRF to Local File Inclusion No login needed	`1.13.1`	Jun 4, 2026	`CVE-2019-25734`	VulnCheck
4.3 Medium	DearFlip Plugin `3d-flipbook-dflip-lite`	Broken Access Control	`≤ 2.4.27`	May 27, 2026	`CVE-2026-49047`	Patchstack
7.1 High	CformsII Plugin `cforms2`	Cross-Site Request Forgery No login needed	`≤ 15.1.3` Fixed in `15.1.4`	May 25, 2026	`CVE-2026-39436`	Patchstack
4.3 Medium	WPSubscription Plugin `subscription`	Cross-Site Request Forgery No login needed	`≤ 1.9.1` Fixed in `1.9.2`	May 25, 2026	`CVE-2026-24554`	Patchstack
6.5 Medium	Export WP Page to Static HTML/CSS Plugin `export-wp-page-to-static-html`	Cross-Site Request Forgery No login needed	`≤ 6.0.0` Fixed in `6.0.1`	May 25, 2026	`CVE-2026-24574`	Patchstack
4.3 Medium	Organization chart Plugin `organization-chart`	Cross-Site Request Forgery No login needed	`≤ 1.7.5` Fixed in `1.7.6`	May 25, 2026	`CVE-2026-24597`	Patchstack
4.3 Medium	BEAR Plugin `woo-bulk-editor`	Cross-Site Request Forgery No login needed	`≤ 1.1.5` Fixed in `1.1.6`	May 7, 2026	`CVE-2026-27415`	Patchstack
5.4 Medium	WPGraphQL Plugin `wp-graphql`	Cross-Site Request Forgery No login needed	`≤ 2.5.3` Fixed in `2.5.4`	May 7, 2026	`CVE-2025-68604`	Patchstack
4.3 Medium	Barcode Scanner with Inventory & Order Manager Plugin `barcode-scanner-lite-pos-to-manage-products-inventory-and-orders`	Cross-Site Request Forgery No login needed	`≤ 1.11.0` Fixed in `1.12.0`	Apr 29, 2026	`CVE-2026-42645`	Patchstack
5.4 Medium	Share This Image Plugin `share-this-image`	Server-Side Request Forgery No login needed	`≤ 2.14` Fixed in `2.15`	Apr 29, 2026	`CVE-2026-42641`	Patchstack
4.3 Medium	Avada Theme `avada`	Cross-Site Request Forgery No login needed	`< 7.13.2` Fixed in `7.13.2`	Apr 22, 2026	`CVE-2025-58922`	Patchstack
4.3 Medium	Smart Online Order for Clover Plugin `clover-online-orders`	Cross-Site Request Forgery No login needed	`≤ 1.6.0`	Apr 15, 2026	`CVE-2025-15635`	Patchstack
4.3 Medium	Userpro Plugin `userpro`	Cross-Site Request Forgery No login needed	`≤ 5.1.11` Fixed in `5.1.11`	Apr 15, 2026	`CVE-2025-53444`	Patchstack
8.1 High	Contact Form by WPForms Plugin `wpforms-lite`	Cross-Site Request Forgery No login needed	`≤ 1.10.0.2` Fixed in `1.10.0.3`	Apr 15, 2026	`CVE-2026-40764`	Patchstack
8.1 High	Perfmatters Plugin	Path Traversal Authenticated (Subscriber+) Arbitrary File Overwrite via 'snippets' Parameter	`≤ 2.5.9`	Apr 10, 2026	`CVE-2026-4351`	Wordfence
5.4 Medium	RT-Theme 18 \| Extensions Plugin `rt18-extensions`	Cross-Site Request Forgery No login needed	`≤ 2.5`	Apr 8, 2026	`CVE-2026-39710`	Patchstack
5.4 Medium	Podigee Plugin `podigee`	Server-Side Request Forgery No login needed	`≤ 1.4.0`	Apr 8, 2026	`CVE-2026-39695`	Patchstack
7.1 High	Extra Fees Plugin for WooCommerce Plugin `woo-conditional-product-fees-for-checkout`	Cross-Site Request Forgery No login needed	`≤ 4.3.3`	Apr 8, 2026	`CVE-2026-39671`	Patchstack
6.0 Medium	Visual Link Preview Plugin `visual-link-preview`	Server-Side Request Forgery	`≤ 2.3.0`	Apr 8, 2026	`CVE-2026-39670`	Patchstack
5.4 Medium	MP3 Audio Player for Music, Radio & Podcast by Sonaar Plugin `mp3-music-player-by-sonaar`	Server-Side Request Forgery No login needed	`≤ 5.11`	Apr 8, 2026	`CVE-2026-39647`	Patchstack
5.4 Medium	GlobalPayments WooCommerce Plugin `global-payments-woocommerce`	Server-Side Request Forgery No login needed	`≤ 1.18.0`	Apr 8, 2026	`CVE-2026-39645`	Patchstack
6.5 Medium	Blackfyre Theme `blackfyre`	Cross-Site Request Forgery No login needed	`≤ 2.5.4`	Apr 8, 2026	`CVE-2026-39641`	Patchstack
9.6 Critical	Theme Editor Plugin `theme-editor`	Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Remote Code Execution No login needed	`≤ 3.2`	Apr 8, 2026	`CVE-2026-39640`	Patchstack
5.4 Medium	Grand Magazine Theme `grandmagazine`	Cross-Site Request Forgery No login needed	`≤ 3.5.5`	Apr 8, 2026	`CVE-2026-39635`	Patchstack
5.4 Medium	Grand Portfolio Theme `grandportfolio`	Cross-Site Request Forgery No login needed	`≤ 3.3`	Apr 8, 2026	`CVE-2026-39634`	Patchstack
6.5 Medium	Grand Car Rental Plugin `grandcarrental`	Cross-Site Request Forgery No login needed	`≤ 3.6.9`	Apr 8, 2026	`CVE-2026-39633`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.