WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.
Showing 2,301–2,350 of 30,563 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 4.2 Medium | NextGEN Gallery | Broken Access Control Authenticated Arbitrary Gallery Image Deletion via IDOR |
< 4.5.0 Fixed in 4.5.0 |
CVE-2026-81653 |
WPScan | |
| 2.7 Low | NextGEN Gallery | Information Disclosure Contributor+ Image Metadata Disclosure via IDOR |
3.59.5 – < 4.5.0 Fixed in 4.5.0 |
CVE-2026-81652 |
WPScan | |
| 3.1 Low | NextGEN Gallery | Broken Access Control Authenticated Cross-Gallery Settings Modification via IDOR |
< 4.5.0 Fixed in 4.5.0 |
CVE-2026-81651 |
WPScan | |
| 7.2 High | NextGEN Gallery | Arbitrary File Upload Authenticated Arbitrary File Upload via ZIP Import |
< 4.5.0 Fixed in 4.5.0 |
CVE-2026-81650 |
WPScan | |
| 4.1 Medium | Import and export users and customers | Server-Side Request Forgery Admin+ SSRF via bp_avatar |
< 2.4.5 Fixed in 2.4.5 |
CVE-2026-16542 |
WPScan | |
| 6.8 Medium | Master Slider | Cross-Site Scripting Contributor+ Stored XSS via ms_slider Shortcode Attributes |
≤ 3.11.2 |
CVE-2026-14844 |
WPScan | |
| 4.3 Medium | Partial Shipment for Woocommerce | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX Actions |
≤ 3.4 Fixed in 3.5 |
CVE-2026-9858 |
Wordfence | |
| 4.7 Medium | LiteSpeed Cache | Cross-Site Scripting Reflected Cross-Site Scripting via ESI 'esi' Parameter No login needed |
≤ 7.9 Fixed in 7.9.1 |
CVE-2026-76579 |
Wordfence | |
| 4.3 Medium | Datalogics Ecommerce Delivery | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping) |
≤ 2.6.65 Fixed in 2.6.66 |
CVE-2026-9613 |
Wordfence | |
| 6.4 Medium | YS LeadGen – Popups, Opt-ins & Lead Capture | Broken Access Control Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input |
≤ 2.1.4 |
CVE-2026-1256 |
Wordfence | |
| 4.3 Medium | Empik for Woocommerce | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action |
≤ 1.5.1 Fixed in 1.5.2 |
CVE-2026-9766 |
Wordfence | |
| 5.3 Medium | WordLift | Information Disclosure Unauthenticated Sensitive Information Exposure in JSON-LD REST API Endpoints No login needed |
≤ 3.54.10 Fixed in 3.54.11 |
CVE-2026-9289 |
Wordfence | |
| 7.5 High | YS LeadGen – Popups, Opt-ins & Lead Capture | Information Disclosure Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action No login needed |
≤ 2.1.4 |
CVE-2026-1255 |
Wordfence | |
| 5.3 Medium | TikTok | Broken Access Control Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter No login needed |
≤ 1.4.1 Fixed in 1.4.2 |
CVE-2026-18346 |
Wordfence | |
| 6.4 Medium | Gum Addon for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting |
≤ 1.3.15 Fixed in 1.3.16 |
CVE-2026-8354 |
Wordfence | |
| 6.4 Medium | Redux Framework | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input |
≤ 4.5.13 Fixed in 4.5.14 |
CVE-2026-5410 |
Wordfence | |
| 6.4 Medium | Real 3D Flipbook | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute |
≤ 5.1.1 Fixed in 5.1.2 |
CVE-2026-15098 |
Wordfence | |
| 6.1 Medium | MC4WP: Mailchimp | Cross-Site Scripting Reflected Cross-Site Scripting via 'data' Dynamic Content Tag No login needed |
≤ 4.14.0 Fixed in 4.14.1 |
CVE-2026-87917 |
Wordfence | |
| 6.5 Medium | Custom Field Template | SQL Injection Authenticated (Contributor+) SQL Injection via 'post_ID' Parameter |
≤ 2.7.8 Fixed in 2.8 |
CVE-2026-9855 |
Wordfence | |
| 5.3 Medium | Ibtana – Ecommerce Product Addons | Broken Access Control Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action |
≤ 0.4.7.7 Fixed in 0.4.7.8 |
CVE-2026-1984 |
Wordfence | |
| 8.1 High | Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket) |
≤ 4.17.2 Fixed in 4.17.3 |
CVE-2026-85658 |
Wordfence | |
| 4.7 Medium | WP Ghost (Hide My WP Ghost) | Open Redirect Unauthenticated Open Redirect via 'redirect_to' Parameter No login needed |
≤ 7.0.02 |
CVE-2026-7527 |
Wordfence | |
| 6.4 Medium | Redux Framework | Cross-Site Scripting Authenticated (Subscriber+) Cross-Site Scripting via User Input |
≤ 4.5.13 Fixed in 4.5.14 |
CVE-2026-5400 |
Wordfence | |
| 4.9 Medium | GoPay for WooCommerce | SQL Injection Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parameter |
≤ 1.0.36 |
CVE-2026-75959 |
Wordfence | |
| 6.5 Medium | Create | SQL Injection Authenticated (Author+) SQL Injection via 'order' Parameter |
≤ 2.5.3 Fixed in 2.5.4 |
CVE-2026-13200 |
Wordfence | |
| 4.4 Medium | OTP Login & Register Woocommerce | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting |
≤ 2.7.3 Fixed in 2.7.4 |
CVE-2026-12402 |
Wordfence | |
| 8.8 High | The Welcomizer | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter |
≤ 2.8.1 |
CVE-2026-4327 |
Wordfence | |
| 6.4 Medium | WP Composer | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode |
≤ 1.0.5 |
CVE-2026-2422 |
Wordfence | |
| 6.5 Medium | Wow Elements Addons for Elementor | Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Setting |
≤ 1.11.2 Fixed in 1.11.3 |
CVE-2026-1641 |
Wordfence | |
| 6.1 Medium | SSL Zen | Cross-Site Scripting Reflected Cross-Site Scripting via 'uri' and 'host' Parameters No login needed |
≤ 4.7.42 Fixed in 4.7.43 |
CVE-2026-15463 |
Wordfence | |
| 6.5 Medium | Easy Appointments | Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action |
≤ 3.12.27 |
CVE-2026-9232 |
Wordfence | |
| 4.3 Medium | Search Atlas SEO | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function |
≤ 2.6.23 |
CVE-2026-15946 |
Wordfence | |
| 6.5 Medium | Create | SQL Injection Authenticated (Author+) SQL Injection via 'order_by' Parameter |
≤ 2.5.3 Fixed in 2.5.4 |
CVE-2026-13191 |
Wordfence | |
| 4.9 Medium | WP Optimizer | SQL Injection Authenticated (Administrator+) SQL Injection via 's' Parameter |
≤ 2.5.0 |
CVE-2026-6295 |
Wordfence | |
| 6.4 Medium | AppMySite | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler |
≤ 3.15.3 Fixed in 3.15.4 |
CVE-2026-13770 |
Wordfence | |
| 5.3 Medium | Payment Gateway of Stripe for WooCommerce | Other Unauthenticated Improper Verification of Cryptographic Signature via woocommerce_api_wt_stripe Webhook Endpoint No login needed |
≤ 5.0.8 Fixed in 5.0.9 |
CVE-2026-9832 |
Wordfence | |
| 4.3 Medium | BlockSpare - Gutenberg Site Builder Blocks & Starter Sites | Broken Access Control Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation |
≤ 4.2.6 |
CVE-2026-1242 |
Wordfence | |
| 4.3 Medium | Search Atlas SEO | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter |
≤ 2.6.23 |
CVE-2026-15947 |
Wordfence | |
| 5.3 Medium | Bread | Broken Access Control Missing Authorization to Unauthenticated Information Exposure No login needed |
≤ 2.9.12 |
CVE-2026-4792 |
Wordfence | |
| 4.3 Medium | VW Writer Blog | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset |
≤ 1.3.8 |
CVE-2026-2278 |
Wordfence | |
| 7.2 High | Quill Forms | Conversational Multi Step Forms, Surveys & quizzes | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value No login needed |
≤ 5.7.1 Fixed in 5.7.2 |
CVE-2026-15664 |
Wordfence | |
| 4.3 Medium | PDF Builder for WooCommerce. Create invoices,packing slips and more | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler |
≤ 2.0.11 |
CVE-2026-11899 |
Wordfence | |
| 6.1 Medium | WP Customer Reviews | Cross-Site Scripting Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter No login needed |
≤ 3.7.8 Fixed in 3.8.0 |
CVE-2026-11608 |
Wordfence | |
| 4.3 Medium | Flex Import | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions |
≤ 3.0 Fixed in 3.1 |
CVE-2026-9615 |
Wordfence | |
| 5.3 Medium | Mailchimp for WooCommerce | Broken Access Control Unauthenticated Broken Access Control in REST API No login needed |
< 6.1.1 Fixed in 6.1.1 |
CVE-2026-92435 |
WPScan | |
| 5.3 Medium | Rede Itaú for WooCommerce | Broken Access Control Unauthenticated Order Status Manipulation via PIX Webhook No login needed |
3.6.1 – < 5.4.7 Fixed in 5.4.7 |
CVE-2026-92430 |
WPScan | |
| 5.5 Medium | Hydra Booking | Broken Access Control Hydra Host+ Cross-Host Account Modification and Deletion via IDOR |
< 1.2.4 Fixed in 1.2.4 |
CVE-2026-92425 |
WPScan | |
| 4.7 Medium | Hydra Booking 1.1.0 | Broken Access Control < 1.2.3 - Hydra Host+ Host Profile Takeover via IDOR |
1.1.0 – < 1.2.3 Fixed in 1.2.3 |
CVE-2026-92421 |
WPScan | |
| 3.8 Low | Hydra Booking | Broken Access Control Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR |
< 1.2.2 Fixed in 1.2.2 |
CVE-2026-92420 |
WPScan | |
| 7.5 High | MgoSync | Information Disclosure Unauthenticated WooCommerce API Credential Disclosure No login needed |
2.1.5 – < 2.1.7 Fixed in 2.1.7 |
CVE-2026-92404 |
WPScan |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.