WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1,951–2,000 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 40 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.4 Medium Fluent Support Pro Plugin fluent-support-pro Broken Access Control ≤ 2.3.1 Fixed in 2.3.2 CVE-2026-78272 Patchstack
7.6 High FluentCRM Pro Plugin fluentcampaign-pro SQL Injection ≤ 3.1.12 Fixed in 3.1.13 CVE-2026-78270 Patchstack
6.4 Medium Shared Files Plugin shared-files Server-Side Request Forgery ≤ 1.7.69 Fixed in 1.7.70 CVE-2026-78269 Patchstack
5.3 Medium Booking and Rental Manager Plugin booking-and-rental-manager-for-woocommerce Broken Access Control No login needed ≤ 2.7.5 Fixed in 2.7.6 CVE-2026-78258 Patchstack
7.1 High Social Media & Share Icons Plugin ultimate-social-media-icons Cross-Site Scripting No login needed ≤ 2.9.9 Fixed in 3.0.0 CVE-2026-66623 Patchstack
7.1 High WPComplete Plugin wpcomplete Cross-Site Scripting No login needed ≤ 2.9.5.6 Fixed in 2.9.5.7 CVE-2026-66599 Patchstack
7.1 High 12 Step Meeting List Plugin 12-step-meeting-list Cross-Site Scripting No login needed ≤ 3.19.16 Fixed in 3.19.17 CVE-2026-66584 Patchstack
5.3 Medium RepairBuddy Plugin computer-repair-shop Broken Access Control No login needed ≤ 4.1223 Fixed in 4.1224 CVE-2026-78291 Patchstack
2.7 Low Content Mask Plugin content-mask Privilege Escalation Contributor Publish Capability Bypass via create_new_content_mask 1.8.0 – < 1.8.5.5 Fixed in 1.8.5.5 CVE-2026-77003 WPScan
4.3 Medium WooCommerce Bookings Plugin Broken Access Control Subscriber+ Draft Bookable Product Creation via Missing Authorization < 3.9.0 Fixed in 3.9.0 CVE-2026-14853 WPScan
9.8 Critical RestrictMate Plugin restrictmate Privilege Escalation Unauthenticated Privilege Escalation to Administrator No login needed < 1.3.0 Fixed in 1.3.0 CVE-2026-13598 WPScan
6.5 Medium WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels Plugin print-invoices-packing-slip-labels-for-woocommerce Path Traversal Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter ≤ 4.9.8 CVE-2026-18027 Wordfence
8.8 High PPWP – Password Protect Pages Plugin password-protect-page PHP Object Injection Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles ≤ 1.9.18 CVE-2026-0551 Wordfence
8.8 High Security Hardener Plugin security-hardener Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite ≤ 2.4.4 CVE-2026-16149 Wordfence
9.8 Critical WS Form LITE Plugin ws-form PHP Object Injection Unauthenticated PHP Object Injection via Form Submission No login needed ≤ 1.10.80 CVE-2026-4703 Wordfence
6.4 Medium Image Photo Gallery Final Tiles Grid Plugin final-tiles-grid-gallery-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute ≤ 3.6.12 CVE-2026-4559 Wordfence
4.3 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Broken Access Control Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' ≤ 12.8.9 CVE-2026-5093 Wordfence
6.4 Medium MC4WP: Mailchimp Plugin mailchimp-for-wp Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages ≤ 4.12.0 CVE-2026-4561 Wordfence
7.5 High Advanced Product Fields (Product Addons) for WooCommerce Plugin advanced-product-fields-for-woocommerce Other Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request No login needed ≤ 1.6.21 CVE-2026-2996 Wordfence
4.3 Medium Post Duplicator Plugin post-duplicator Broken Access Control Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution ≤ 3.0.11 CVE-2026-4244 Wordfence
4.3 Medium Post Duplicator Plugin post-duplicator Broken Access Control Authorization Bypass to Authenticated (Contributor+) Post Duplication ≤ 3.0.11 CVE-2026-4245 Wordfence
5.3 Medium kk Star Ratings Plugin kk-star-ratings Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'payload' Parameter No login needed ≤ 5.4.10.3 CVE-2026-3424 Wordfence
9.8 Critical Mailgun Plugin mailgun Server-Side Request Forgery Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys No login needed ≤ 2.2.0 CVE-2026-78003 Wordfence
9.8 Critical SmilePass Selfie Login Plugin Authentication Bypass Unauthenticated Authentication Bypass No login needed ≤ 1.0.2 CVE-2026-77002 WPScan
9.8 Critical Social Login & Sharing buttons with Analytics By SoClever Plugin Authentication Bypass Unauthenticated Authentication Bypass No login needed ≤ 1.2.0 CVE-2026-77001 WPScan
9.8 Critical WP Social Media Login Plugin Privilege Escalation Unauthenticated Account Takeover via Twitter Login Flow No login needed ≤ 1.0.6 CVE-2026-77000 WPScan
8.1 High Firebase Authentication Plugin firebase-authentication Privilege Escalation Unauthenticated Account Takeover via Firebase Email Claim No login needed < 1.7.1 Fixed in 1.7.1 CVE-2026-76793 WPScan
8.8 High Slider Hero Plugin Cross-Site Scripting Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers No login needed < 9.1.3 Fixed in 9.1.3 CVE-2026-76789 WPScan
6.6 Medium Forminator Forms Plugin forminator Privilege Escalation Authenticated Privilege Escalation via Registration Form Role Bypass < 1.57.0.7 Fixed in 1.57.0.7 CVE-2026-19222 WPScan
7.2 High Forminator Forms Plugin forminator Remote Code Execution Admin+ Network-Wide RCE via Hub Connector API Key on Multisite 1.40.0 – < 1.57.0.5 Fixed in 1.57.0.5 CVE-2026-19221 WPScan
6.8 Medium Tutor LMS Plugin tutor Path Traversal Instructor+ Arbitrary File Read via Video Path < 4.0.6 Fixed in 4.0.6 CVE-2026-19093 WPScan
8.1 High ManageWP Worker Plugin worker Authentication Bypass Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters No login needed < 4.9.37 Fixed in 4.9.37 CVE-2026-18052 WPScan
5.3 Medium Conekta Payment Gateway Plugin conekta-payment-gateway Broken Access Control Unauthenticated Order Payment Completion via Webhook Forgery No login needed < 6.2.2 Fixed in 6.2.2 CVE-2026-16738 WPScan
5.3 Medium FiboSearch Plugin ajax-search-for-woocommerce Information Disclosure Unauthenticated Password-Protected Product Information Disclosure No login needed < 1.34.1 Fixed in 1.34.1 CVE-2026-16612 WPScan
6.8 Medium Post Grid, Slider & Carousel Ultimate Plugin Cross-Site Scripting Contributor+ Stored XSS via Header Title Field < 1.8.1 Fixed in 1.8.1 CVE-2026-16260 WPScan
2.7 Low Tutor LMS Plugin tutor Information Disclosure Instructor+ Cross-Instructor Private Course Disclosure via IDOR < 4.0.6 Fixed in 4.0.6 CVE-2026-14187 WPScan
4.3 Medium AutomatorWP Plugin automatorwp Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action ≤ 5.8.4 CVE-2026-76074 Wordfence
4.3 Medium AutomatorWP Plugin automatorwp Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action ≤ 5.8.4 CVE-2026-76057 Wordfence
5.3 Medium Themify Builder Plugin themify-builder Broken Access Control Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action No login needed ≤ 7.8.0 CVE-2026-75027 Wordfence
8.8 High WPeMatico RSS Feed Fetcher Plugin wpematico Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action ≤ 2.8.24 CVE-2026-19883 Wordfence
6.5 Medium ProfilePress Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Display Name No login needed < 4.17.1 Fixed in 4.17.1 CVE-2026-19848 WPScan
3.7 Low Limit Login Attempts Reloaded Plugin Other Username Denylist Bypass via Case Variant and Account Email No login needed < 3.3.5 Fixed in 3.3.5 CVE-2026-18356 WPScan
5.3 Medium Content Protector (Passster) Plugin Information Disclosure Unauthenticated Protected Content Disclosure via REST Path Allowlist Bypass No login needed 4.3.3 – < 4.3.9 Fixed in 4.3.9 CVE-2026-17559 WPScan
5.3 Medium Charitable Plugin charitable Other Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass No login needed < 1.8.12 Fixed in 1.8.12 CVE-2026-16650 WPScan
5.3 Medium myCred Plugin Price Manipulation Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification in buyCRED No login needed < 3.2.5 Fixed in 3.2.5 CVE-2026-15150 WPScan
4.2 Medium LitExtension: Store to WooCommerce Migration Plugin Cross-Site Request Forgery Connector Token Takeover via CSRF No login needed ≤ 1.2.5 CVE-2026-15046 WPScan
2.7 Low Eventin Plugin wp-event-solution Server-Side Request Forgery Contributor+ Server-Side Request Forgery < 4.1.21 Fixed in 4.1.21 CVE-2026-13176 WPScan
9.8 Critical Automation Web Platform Plugin automation-web-platform Authentication Bypass Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure No login needed ≤ 4.8.6 CVE-2026-77264 Wordfence
7.2 High AI Engine Plugin ai-engine Privilege Escalation Admin+ Multisite Network Administrator Account Takeover via MCP User Tools 2.8.0 – < 3.6.1 Fixed in 3.6.1 CVE-2026-75796 WPScan
2.7 Low Copy & Delete Posts Plugin Information Disclosure Authenticated Arbitrary Post Content and Password Disclosure < 1.5.6 Fixed in 1.5.6 CVE-2026-19435 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only