WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,251–2,300 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 46 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.5 Medium	Advanced Form Integration Plugin `advanced-form-integration`	Broken Access Control	`≤ 1.126.12` Fixed in `1.127.0`	Jun 15, 2026	`CVE-2026-42659`	Patchstack
7.1 High	Classified Listing Plugin `classified-listing`	Cross-Site Scripting No login needed	`≤ 5.3.8` Fixed in `5.3.9`	Jun 15, 2026	`CVE-2026-42658`	Patchstack
6.5 Medium	Contest Gallery Plugin `contest-gallery`	Other Other Vulnerability Type No login needed	`≤ 28.1.7` Fixed in `29.0.0`	Jun 15, 2026	`CVE-2026-42657`	Patchstack
6.5 Medium	Contest Gallery Plugin `contest-gallery`	Cross-Site Scripting	`≤ 28.1.6` Fixed in `29.0.0`	Jun 15, 2026	`CVE-2026-42656`	Patchstack
7.5 High	Best Payments Plugin for WP Plugin `wp-payment-form`	Price Manipulation Payment Bypass No login needed	`≤ 4.6.19` Fixed in `4.6.20`	Jun 15, 2026	`CVE-2026-42655`	Patchstack
6.3 Medium	Classified Listing Plugin `classified-listing`	Broken Access Control	`≤ 5.3.9` Fixed in `5.3.10`	Jun 15, 2026	`CVE-2026-42651`	Patchstack
7.2 High	AutomatorWP Plugin `automatorwp`	Cross-Site Scripting No login needed	`≤ 5.6.7` Fixed in `5.6.8`	Jun 15, 2026	`CVE-2026-42650`	Patchstack
7.1 High	Favicon Rotator Plugin `favicon-rotator`	Cross-Site Scripting No login needed	`≤ 1.2.11` Fixed in `1.2.12`	Jun 15, 2026	`CVE-2026-42649`	Patchstack
6.5 Medium	Classified Listing Plugin `classified-listing`	Broken Access Control No login needed	`≤ 5.3.8` Fixed in `5.3.9`	Jun 15, 2026	`CVE-2026-42640`	Patchstack
9.3 Critical	GD Rating System Plugin `gd-rating-system`	SQL Injection No login needed	`≤ 3.6.2` Fixed in `3.7`	Jun 15, 2026	`CVE-2026-42639`	Patchstack
8.1 High	CloudSecure WP Security Plugin `cloudsecure-wp-security`	Authentication Bypass Broken Authentication No login needed	`≤ 1.4.7` Fixed in `1.4.8`	Jun 15, 2026	`CVE-2026-42411`	Patchstack
9.3 Critical	Order Delivery Date for WooCommerce Plugin `order-delivery-date-for-woocommerce`	SQL Injection No login needed	`≤ 4.5.1` Fixed in `4.5.2`	Jun 15, 2026	`CVE-2026-42386`	Patchstack
7.5 High	Simply Schedule Appointments Plugin `simply-schedule-appointments`	Information Disclosure Sensitive Data Exposure No login needed	`< 1.6.11.2` Fixed in `1.6.11.2`	Jun 15, 2026	`CVE-2026-42384`	Patchstack
9.3 Critical	Funnel Builder by FunnelKit Plugin `funnel-builder`	SQL Injection No login needed	`≤ 3.15.0.1` Fixed in `3.15.0.2`	Jun 15, 2026	`CVE-2026-42381`	Patchstack
6.5 Medium	WP Full Stripe Free Plugin `wp-full-stripe-free`	Authentication Bypass Broken Authentication	`≤ 8.4.1` Fixed in `8.4.2`	Jun 15, 2026	`CVE-2026-42378`	Patchstack
6.5 Medium	ProfilePress Plugin `wp-user-avatar`	Cross-Site Scripting	`≤ 4.16.13` Fixed in `4.16.14`	Jun 15, 2026	`CVE-2026-41556`	Patchstack
5.8 Medium	Simple Cloudflare Turnstile Plugin `simple-cloudflare-turnstile`	Authentication Bypass Broken Authentication No login needed	`≤ 1.38.0` Fixed in `1.38.1`	Jun 15, 2026	`CVE-2026-40799`	Patchstack
9.3 Critical	wpForo Forum Plugin `wpforo`	SQL Injection No login needed	`≤ 3.0.4` Fixed in `3.0.5`	Jun 15, 2026	`CVE-2026-40798`	Patchstack
6.5 Medium	WPPizza Plugin `wppizza`	Information Disclosure Sensitive Data Exposure	`≤ 3.19.9` Fixed in `3.20`	Jun 15, 2026	`CVE-2026-40796`	Patchstack
6.5 Medium	Amelia Plugin `ameliabooking`	Broken Access Control	`≤ 2.2` Fixed in `2.2.1`	Jun 15, 2026	`CVE-2026-40795`	Patchstack
6.5 Medium	myCred Plugin `mycred`	Broken Access Control	`≤ 3.0.3` Fixed in `3.0.4`	Jun 15, 2026	`CVE-2026-40794`	Patchstack
6.5 Medium	Groundhogg Plugin `groundhogg`	Broken Access Control	`< 4.4.1` Fixed in `4.4.1`	Jun 15, 2026	`CVE-2026-40793`	Patchstack
6.3 Medium	KiviCare Plugin `kivicare-clinic-management-system`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 4.2.1` Fixed in `4.3.0`	Jun 15, 2026	`CVE-2026-40792`	Patchstack
7.1 High	WP Time Slots Booking Form Plugin `wp-time-slots-booking-form`	Cross-Site Scripting No login needed	`≤ 1.2.46` Fixed in `1.2.47`	Jun 15, 2026	`CVE-2026-40791`	Patchstack
6.5 Medium	WP SMS Plugin `wp-sms`	Information Disclosure Sensitive Data Exposure	`≤ 7.2.1` Fixed in `7.2.2`	Jun 15, 2026	`CVE-2026-40790`	Patchstack
7.5 High	Amelia Plugin `ameliabooking`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.2` Fixed in `2.2.1`	Jun 15, 2026	`CVE-2026-40789`	Patchstack
7.1 High	ChatBot Plugin `chatbot`	Broken Access Control	`≤ 7.9.7` Fixed in `7.9.9`	Jun 15, 2026	`CVE-2026-40788`	Patchstack
7.1 High	Quiz And Survey Master Plugin `quiz-master-next`	Cross-Site Scripting No login needed	`≤ 11.0.0` Fixed in `11.1.0`	Jun 15, 2026	`CVE-2026-40787`	Patchstack
7.1 High	AutomatorWP Plugin `automatorwp`	Authentication Bypass Broken Authentication	`≤ 5.6.7` Fixed in `5.6.8`	Jun 15, 2026	`CVE-2026-40785`	Patchstack
6.5 Medium	WPAdverts Plugin `wpadverts`	Broken Access Control No login needed	`≤ 2.3.0` Fixed in `2.3.1`	Jun 15, 2026	`CVE-2026-40782`	Patchstack
7.5 High	ReviewX Plugin `reviewx`	Authentication Bypass Broken Authentication No login needed	`≤ 2.3.6` Fixed in `2.3.7`	Jun 15, 2026	`CVE-2026-40781`	Patchstack
7.7 High	Link Library Plugin `link-library`	Arbitrary File Deletion	`≤ 7.8.8` Fixed in `7.8.9`	Jun 15, 2026	`CVE-2026-40779`	Patchstack
7.5 High	WP Event SOlution Plugin `wp-event-solution`	Broken Access Control No login needed	`≤ 4.1.8` Fixed in `4.1.9`	Jun 15, 2026	`CVE-2026-40776`	Patchstack
7.3 High	Royal MCP Plugin `royal-mcp`	Broken Access Control No login needed	`≤ 1.4.2` Fixed in `1.4.3`	Jun 15, 2026	`CVE-2026-40775`	Patchstack
7.5 High	Booking Package Plugin `booking-package`	Broken Access Control No login needed	`≤ 1.7.06` Fixed in `1.7.07`	Jun 15, 2026	`CVE-2026-40774`	Patchstack
6.5 Medium	rtMedia for WordPress, BuddyPress and bbPress Plugin `buddypress-media`	Broken Access Control	`≤ 4.7.9` Fixed in `4.7.10`	Jun 15, 2026	`CVE-2026-40773`	Patchstack
10.0 Critical	GeekyBot Plugin `geeky-bot`	Arbitrary File Upload No login needed	`≤ 1.2.2` Fixed in `1.2.3`	Jun 15, 2026	`CVE-2026-40772`	Patchstack
9.3 Critical	Contest Gallery Plugin `contest-gallery`	SQL Injection No login needed	`≤ 28.1.6` Fixed in `28.1.7`	Jun 15, 2026	`CVE-2026-40771`	Patchstack
7.1 High	Coupon Affiliates Plugin `woo-coupon-usage`	Cross-Site Scripting No login needed	`≤ 7.5.3` Fixed in `7.6.0`	Jun 15, 2026	`CVE-2026-40770`	Patchstack
8.6 High	Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field Plugin `contact-form-extender-for-divi-builder`	Arbitrary File Upload Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion No login needed	`≤ 1.0.6` Fixed in `1.0.7`	Jun 15, 2026	`CVE-2026-40769`	Patchstack
7.5 High	wpForo Forum Plugin `wpforo`	Broken Access Control No login needed	`< 3.0.2` Fixed in `3.0.2`	Jun 15, 2026	`CVE-2026-40767`	Patchstack
8.5 High	MasterStudy LMS Plugin `masterstudy-lms-learning-management-system`	SQL Injection	`≤ 3.7.25` Fixed in `3.7.26`	Jun 15, 2026	`CVE-2026-40766`	Patchstack
7.5 High	WPGraphQL Plugin `wp-graphql`	SQL Injection No login needed	`< 2.11.1` Fixed in `2.11.1`	Jun 15, 2026	`CVE-2026-40762`	Patchstack
6.5 Medium	Tutor LMS Plugin `tutor`	Broken Access Control No login needed	`≤ 3.9.7` Fixed in `3.9.8`	Jun 15, 2026	`CVE-2026-40743`	Patchstack
7.5 High	Redsys for WooCommerce Light Plugin `woo-redsys-gateway-light`	Broken Access Control No login needed	`≤ 7.0.0` Fixed in `7.0.1`	Jun 15, 2026	`CVE-2026-40741`	Patchstack
7.1 High	Notification for Telegram Plugin `notification-for-telegram`	Cross-Site Scripting No login needed	`≤ 3.5` Fixed in `3.5.1`	Jun 15, 2026	`CVE-2026-40732`	Patchstack
7.7 High	Groundhogg Plugin `groundhogg`	Arbitrary File Deletion	`≤ 4.4` Fixed in `4.4.1`	Jun 15, 2026	`CVE-2026-40727`	Patchstack
6.4 Medium	Ultra Addons for WPForms Plugin `ultra-addons-for-wpforms`	Broken Access Control	`≤ 1.0.11` Fixed in `1.0.12`	Jun 15, 2026	`CVE-2026-39594`	Patchstack
9.9 Critical	WP-BusinessDirectory Plugin `wp-businessdirectory`	Arbitrary File Upload	`≤ 4.0.0` Fixed in `4.0.1`	Jun 15, 2026	`CVE-2026-39591`	Patchstack
8.1 High	WP BASE Booking Plugin `wp-base-booking-of-appointments-services-and-events`	Privilege Escalation No login needed	`≤ 5.9.0` Fixed in `6.0.0`	Jun 15, 2026	`CVE-2026-39587`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.