WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 151–200 of 2,150 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 4 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.9 Critical Smart Cleaning Theme smart-cleaning Arbitrary File Upload ≤ 4.8.6 CVE-2026-74016 Patchstack
9.9 Critical IT Residence Theme it-residence Arbitrary File Upload ≤ 3.2.1 CVE-2026-74014 Patchstack
9.8 Critical User Registration & Membership Pro Plugin user-registration-pro Privilege Escalation Account Takeover No login needed ≤ 5.4.5 Fixed in 5.4.6 CVE-2026-74001 Patchstack
9.8 Critical FundEngine Plugin wp-fundraising-donation PHP Object Injection No login needed ≤ 1.7.9 Fixed in 1.8.0 CVE-2026-73993 Patchstack
9.9 Critical Query Wrangler Plugin query-wrangler Remote Code Execution ≤ 1.5.57 Fixed in 1.5.58 CVE-2026-73992 Patchstack
9.3 Critical BookingPress Appointment Booking Pro Plugin bookingpress-appointment-booking-pro SQL Injection No login needed ≤ 6.0.2 CVE-2026-68566 Patchstack
9.8 Critical Abandoned Cart Pro for WooCommerce Plugin woocommerce-abandon-cart-pro Privilege Escalation No login needed ≤ 10.4.0 CVE-2026-66682 Patchstack
9.3 Critical Locatoraid Store Locator Plugin locatoraid SQL Injection No login needed ≤ 3.9.72 CVE-2026-66680 Patchstack
9.8 Critical Flatastic Theme flatastic PHP Object Injection No login needed ≤ 2.0 CVE-2026-66672 Patchstack
9.3 Critical Directory Pro Plugin directory-pro SQL Injection No login needed ≤ 2.5.8 CVE-2026-66649 Patchstack
9.3 Critical TheGem (Elementor) Theme thegem-elementor SQL Injection No login needed ≤ 5.12.3 Fixed in 5.12.3.1 CVE-2026-66609 Patchstack
9.1 Critical Media LIbrary Assistant Plugin media-library-assistant Arbitrary File Upload ≤ 3.39 Fixed in 3.40 CVE-2026-66600 Patchstack
9.3 Critical Security & Malware scan by CleanTalk Plugin security-malware-firewall SQL Injection No login needed ≤ 2.184 Fixed in 2.185 CVE-2026-66593 Patchstack
9.3 Critical rtMedia for WordPress, BuddyPress and bbPress Plugin buddypress-media SQL Injection No login needed ≤ 4.7.11 Fixed in 4.7.12 CVE-2026-66592 Patchstack
9.8 Critical Forminator Plugin forminator PHP Object Injection No login needed ≤ 1.57.0 Fixed in 1.57.1 CVE-2026-66583 Patchstack
9.8 Critical Capella Theme capella Privilege Escalation No login needed ≤ 2.5.5 CVE-2025-15689 Patchstack
9.3 Critical Capella Theme capella SQL Injection No login needed ≤ 2.5.5 CVE-2025-15688 Patchstack
9.8 Critical JSON Options Plugin Privilege Escalation Unauthenticated Arbitrary Options Update No login needed ≤ 0.0.4 CVE-2026-75860 WPScan
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Unauthenticated Authorization Bypass Through User-Controlled Key to Account Takeover to 'truebooker_wp_user_id' Parameter No login needed ≤ 1.2.6 CVE-2026-18315 Wordfence
9.0 Critical Elementor Pro Plugin elementor-pro Arbitrary File Upload No login needed ≤ 4.2.1 Fixed in 4.2.2 CVE-2026-32475 Patchstack
9.3 Critical Total Donations Plugin totaldonations SQL Injection No login needed ≤ 2.0.5 CVE-2026-73391 Patchstack
9.8 Critical Total Donations Plugin totaldonations Privilege Escalation No login needed ≤ 2.0.5 CVE-2026-73390 Patchstack
9.8 Critical Kalles Addons Plugin kalles-addons PHP Object Injection No login needed ≤ 1.0.6 CVE-2026-73389 Patchstack
9.3 Critical Nikstore Core Plugin nikstore-core SQL Injection No login needed ≤ 1.5 CVE-2026-73388 Patchstack
9.8 Critical Flexible Subscriptions Plugin flexible-subscriptions PHP Object Injection No login needed ≤ 1.8.1 Fixed in 1.8.2 CVE-2026-73364 Patchstack
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Privilege Escalation No login needed ≤ 1.2.6 Fixed in 1.2.7 CVE-2026-73347 Patchstack
9.3 Critical NGG Smart Image Search Plugin ngg-smart-image-search SQL Injection No login needed < 4.0.0 Fixed in 4.0.0 CVE-2026-73185 Patchstack
9.3 Critical Maps Marker Pro Plugin maps-marker-pro SQL Injection No login needed ≤ 4.32 Fixed in 4.32.1 CVE-2026-73183 Patchstack
9.8 Critical JetEngine Plugin jet-engine Remote Code Execution No login needed ≤ 3.8.14 Fixed in 3.8.14.1 CVE-2026-66613 Patchstack
9.0 Critical Broken Link Checker Plugin broken-link-checker Remote Code Execution Unauthenticated RCE via Query Variable Injection No login needed < 2.4.12 Fixed in 2.4.12 CVE-2026-18937 WPScan
9.8 Critical TrueBooker Appointment Booking Plugin Privilege Escalation Unauthenticated Account Takeover via Multiple AJAX Actions No login needed < 1.2.7 Fixed in 1.2.7 CVE-2026-18776 WPScan
10.0 Critical W3 Total Cache Plugin w3-total-cache Path Traversal Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key No login needed < 2.10.5 Fixed in 2.10.5 CVE-2026-18051 WPScan
9.8 Critical TabaPay Gateway Plugin Privilege Escalation Unauthenticated Account Takeover via Payment Callback No login needed ≤ 1.4.0 CVE-2026-18031 WPScan
9.3 Critical Readabler Plugin readabler SQL Injection No login needed < 2.0.18 Fixed in 2.0.18 CVE-2026-74015 Patchstack
9.8 Critical Masteriyo - LMS Plugin learning-management-system Arbitrary File Upload LMS plugin <= 2.3.2 - Arbitrary File Upload No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-73996 Patchstack
9.8 Critical Youzify Plugin youzify PHP Object Injection Deserialization of untrusted data No login needed ≤ 1.3.7 CVE-2026-73397 Patchstack
9.1 Critical Popup by Supsystic Plugin popup-by-supsystic Authentication Bypass Broken Authentication No login needed ≤ 1.13.0 Fixed in 1.13.1 CVE-2026-73381 Patchstack
9.8 Critical Popup by Supsystic Plugin popup-by-supsystic PHP Object Injection No login needed ≤ 1.13.0 Fixed in 1.13.1 CVE-2026-73380 Patchstack
9.8 Critical Ultimate Maps by Supsystic Plugin ultimate-maps-by-supsystic PHP Object Injection No login needed < 1.5.0 Fixed in 1.5.0 CVE-2026-73376 Patchstack
9.8 Critical Easy Google Maps Plugin google-maps-easy PHP Object Injection No login needed ≤ 1.13.0 Fixed in 1.14.0 CVE-2026-73366 Patchstack
9.3 Critical JetAppointment Plugin jet-appointments-booking SQL Injection No login needed ≤ 2.5.2 Fixed in 2.5.2.1 CVE-2026-73365 Patchstack
9.3 Critical Affiliates Manager Plugin affiliates-manager SQL Injection No login needed ≤ 2.9.53 Fixed in 2.9.54 CVE-2026-73355 Patchstack
10.0 Critical WP Compress Plugin wp-compress-image-optimizer Remote Code Execution No login needed < 7.20.01 Fixed in 7.20.01 CVE-2026-73343 Patchstack
9.8 Critical RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection No login needed ≤ 6.0.9.7 Fixed in 6.0.9.8 CVE-2026-73341 Patchstack
9.3 Critical Modern Events Calendar Plugin modern-events-calendar SQL Injection No login needed < 7.35.0 Fixed in 7.35.0 CVE-2026-73339 Patchstack
9.3 Critical Sticky Chat Widget Plugin sticky-chat-widget SQL Injection No login needed ≤ 1.4.2 Fixed in 1.4.3 CVE-2026-73187 Patchstack
9.9 Critical GP Premium Plugin gp-premium Arbitrary File Upload ≤ 2.5.5 Fixed in 2.5.6 CVE-2026-66627 Patchstack
9.9 Critical Templatiq Plugin templatiq Arbitrary File Upload ≤ 0.2.5 CVE-2026-32474 Patchstack
9.8 Critical FundEngine Plugin wp-fundraising-donation PHP Object Injection No login needed ≤ 1.7.9 Fixed in 1.8.0 CVE-2026-32470 Patchstack
9.9 Critical Sync Post With Other Site Plugin sync-post-with-other-site Arbitrary File Upload ≤ 1.9.3 CVE-2026-32463 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only