WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1,951–2,000 of 9,010 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 40 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Booking Package Plugin booking-package Broken Access Control No login needed ≤ 1.7.06 Fixed in 1.7.07 CVE-2026-40774 Patchstack
7.1 High Coupon Affiliates Plugin woo-coupon-usage Cross-Site Scripting No login needed ≤ 7.5.3 Fixed in 7.6.0 CVE-2026-40770 Patchstack
8.6 High Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field Plugin contact-form-extender-for-divi-builder Arbitrary File Upload Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion No login needed ≤ 1.0.6 Fixed in 1.0.7 CVE-2026-40769 Patchstack
7.5 High wpForo Forum Plugin wpforo Broken Access Control No login needed < 3.0.2 Fixed in 3.0.2 CVE-2026-40767 Patchstack
8.5 High MasterStudy LMS Plugin masterstudy-lms-learning-management-system SQL Injection ≤ 3.7.25 Fixed in 3.7.26 CVE-2026-40766 Patchstack
7.5 High WPGraphQL Plugin wp-graphql SQL Injection No login needed < 2.11.1 Fixed in 2.11.1 CVE-2026-40762 Patchstack
7.5 High Redsys for WooCommerce Light Plugin woo-redsys-gateway-light Broken Access Control No login needed ≤ 7.0.0 Fixed in 7.0.1 CVE-2026-40741 Patchstack
7.1 High Notification for Telegram Plugin notification-for-telegram Cross-Site Scripting No login needed ≤ 3.5 Fixed in 3.5.1 CVE-2026-40732 Patchstack
7.7 High Groundhogg Plugin groundhogg Arbitrary File Deletion ≤ 4.4 Fixed in 4.4.1 CVE-2026-40727 Patchstack
8.1 High WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Privilege Escalation No login needed ≤ 5.9.0 Fixed in 6.0.0 CVE-2026-39587 Patchstack
8.8 High B Blocks Plugin b-blocks Privilege Escalation ≤ 2.0.31 Fixed in 2.0.32 CVE-2026-39579 Patchstack
7.5 High WP Directory Kit Plugin wpdirectorykit Broken Access Control No login needed ≤ 1.5.0 Fixed in 1.5.1 CVE-2026-39534 Patchstack
7.5 High AWP Classifieds Plugin another-wordpress-classifieds-plugin Broken Access Control No login needed ≤ 4.4.4 Fixed in 4.4.5 CVE-2026-39533 Patchstack
8.8 High Events Calendar for GeoDirectory Plugin events-for-geodirectory PHP Object Injection ≤ 2.3.25 Fixed in 2.3.26 CVE-2026-39532 Patchstack
7.5 High Masteriyo - LMS Plugin learning-management-system Price Manipulation LMS plugin <= 2.1.5 - Payment Bypass No login needed ≤ 2.1.5 Fixed in 2.1.6 CVE-2026-39524 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.3.0.0 Fixed in 4.3.0.1 CVE-2026-39518 Patchstack
7.1 High Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.17.3 Fixed in 3.0.0 CVE-2026-39514 Patchstack
7.5 High Easy Appointments Plugin easy-appointments Broken Access Control No login needed ≤ 3.12.21 Fixed in 3.12.22 CVE-2026-39513 Patchstack
7.1 High Social Slider Feed Plugin instagram-slider-widget Cross-Site Scripting No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-39507 Patchstack
7.5 High Easy Digital Downloads Plugin easy-digital-downloads Broken Access Control No login needed ≤ 3.6.5 Fixed in 3.6.6 CVE-2026-39503 Patchstack
7.2 High Advanced Product Fields (Product Addons) for WooCommerce Plugin advanced-product-fields-for-woocommerce PHP Object Injection ≤ 1.6.19 Fixed in 1.6.20 CVE-2026-39499 Patchstack
7.2 High YayMail Plugin yaymail PHP Object Injection ≤ 4.3.3 Fixed in 4.3.4 CVE-2026-39498 Patchstack
7.2 High Modula Image Gallery Plugin modula-best-grid-gallery PHP Object Injection ≤ 2.14.18 Fixed in 2.14.19 CVE-2026-39481 Patchstack
7.5 High Backup Migration Plugin backup-backup Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.1 Fixed in 2.1.2 CVE-2026-39480 Patchstack
8.8 High Anti-Malware Security and Brute-Force Firewall Plugin gotmls PHP Object Injection ≤ 4.23.87 Fixed in 4.23.88 CVE-2026-39478 Patchstack
8.8 High Post Duplicator Plugin post-duplicator PHP Object Injection ≤ 3.0.10 Fixed in 3.0.11 CVE-2026-39474 Patchstack
7.2 High WooCommerce PDF Invoices & Packing Slips Plugin woocommerce-pdf-invoices-packing-slips PHP Object Injection < 5.9.0 Fixed in 5.9.0 CVE-2026-39472 Patchstack
7.2 High ShortPixel Image Optimizer Plugin shortpixel-image-optimiser PHP Object Injection ≤ 6.4.3 Fixed in 6.4.4 CVE-2026-39471 Patchstack
7.2 High WooCommerce Cart Abandonment Recovery Plugin woo-cart-abandonment-recovery Privilege Escalation < 2.1.0 Fixed in 2.1.0 CVE-2026-39470 Patchstack
7.1 High ManageWP Worker Plugin worker Cross-Site Scripting No login needed ≤ 4.9.31 Fixed in 4.9.32 CVE-2026-39463 Patchstack
7.1 High FunnelKit Automations Plugin wp-marketing-automations Authentication Bypass Broken Authentication ≤ 3.7.3 Fixed in 3.8.0 CVE-2026-39450 Patchstack
7.1 High Contact Form to Any API Plugin contact-form-to-any-api Cross-Site Scripting No login needed ≤ 3.0.3 CVE-2026-39449 Patchstack
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting No login needed ≤ 1.6.10.6 Fixed in 1.6.11.0 CVE-2026-39447 Patchstack
7.1 High CformsII Plugin cforms2 Cross-Site Scripting No login needed ≤ 15.1.3 Fixed in 15.1.4 CVE-2026-39435 Patchstack
7.2 High CTX Feed Plugin webappick-product-feed-for-woocommerce PHP Object Injection ≤ 6.6.26 Fixed in 6.6.27 CVE-2026-39434 Patchstack
7.1 High WooCommerce Product Table Lite Plugin wc-product-table-lite Cross-Site Scripting No login needed ≤ 4.6.3 Fixed in 4.6.4 CVE-2026-34902 Patchstack
7.1 High GiveWP Plugin give Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.14.2 Fixed in 4.14.3 CVE-2026-34900 Patchstack
7.5 High Event Tickets Manager for WooCommerce Plugin event-tickets-manager-for-woocommerce Broken Access Control No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2026-34898 Patchstack
7.5 High IDPay Payment Gateway for Woocommerce Plugin woo-idpay-gateway Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2.5 CVE-2026-34891 Patchstack
7.5 High Simple Membership Plugin simple-membership Broken Access Control No login needed ≤ 4.7.1 Fixed in 4.7.2 CVE-2026-34886 Patchstack
7.2 High AI Engine Plugin ai-engine Privilege Escalation ≤ 3.4.9 Fixed in 3.5.0 CVE-2026-27407 Patchstack
8.1 High Paid Videochat Turnkey Site Plugin ppv-live-webcams PHP Object Injection Deserialization of untrusted data No login needed ≤ 7.3.23 Fixed in 7.3.24 CVE-2026-27333 Patchstack
7.5 High WpTravelly Plugin tour-booking-manager Authentication Bypass Bypass Vulnerability No login needed ≤ 2.1.7 Fixed in 2.1.8 CVE-2026-27089 Patchstack
7.5 High User Registration Plugin user-registration Broken Access Control No login needed ≤ 5.1.2 Fixed in 5.1.3 CVE-2026-25425 Patchstack
8.5 High PowerPress Podcasting Plugin powerpress SQL Injection ≤ 11.15.10 Fixed in 11.15.11 CVE-2026-24637 Patchstack
7.1 High Redirection for Contact Form 7 Plugin wpcf7-redirect Cross-Site Scripting No login needed ≤ 3.2.8 Fixed in 3.2.9 CVE-2026-23970 Patchstack
7.1 High Eli's WordCents adSense Widget with Analytics Plugin wordcents Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.03.27 CVE-2025-68872 Patchstack
7.1 High Okay Toolkit Plugin okay-toolkit Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.3 CVE-2025-68851 Patchstack
7.1 High iRobots.txt SEO Plugin irobotstxt-seo Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.1.2 CVE-2025-68840 Patchstack
7.5 High Projectopia Plugin projectopia-core Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 5.1.25.2 CVE-2025-59133 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only