WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,301–2,350 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 47 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium RepairBuddy Plugin computer-repair-shop Broken Access Control ≤ 4.1132 Fixed in 4.1133 CVE-2026-39584 Patchstack
9.8 Critical Datalogics Ecommerce Delivery Plugin datalogics Privilege Escalation No login needed ≤ 2.6.62 Fixed in 2.6.63 CVE-2026-39583 Patchstack
8.8 High B Blocks Plugin b-blocks Privilege Escalation ≤ 2.0.31 Fixed in 2.0.32 CVE-2026-39579 Patchstack
6.5 Medium Shipment Tracker for Woocommerce Plugin shipment-tracker-for-woocommerce Cross-Site Scripting ≤ 1.5.3.2 Fixed in 1.5.3.3 CVE-2026-39540 Patchstack
7.5 High WP Directory Kit Plugin wpdirectorykit Broken Access Control No login needed ≤ 1.5.0 Fixed in 1.5.1 CVE-2026-39534 Patchstack
7.5 High AWP Classifieds Plugin another-wordpress-classifieds-plugin Broken Access Control No login needed ≤ 4.4.4 Fixed in 4.4.5 CVE-2026-39533 Patchstack
8.8 High Events Calendar for GeoDirectory Plugin events-for-geodirectory PHP Object Injection ≤ 2.3.25 Fixed in 2.3.26 CVE-2026-39532 Patchstack
9.3 Critical SpeakOut! Email Petitions Plugin speakout SQL Injection No login needed ≤ 4.6.5 Fixed in 4.6.5.1 CVE-2026-39530 Patchstack
5.4 Medium WpStream Plugin wpstream Arbitrary File Upload < 4.11.2 Fixed in 4.11.2 CVE-2026-39527 Patchstack
6.5 Medium Booking Activities Plugin booking-activities Broken Access Control No login needed ≤ 1.16.48.1 Fixed in 1.17.0 CVE-2026-39525 Patchstack
7.5 High Masteriyo - LMS Plugin learning-management-system Price Manipulation LMS plugin <= 2.1.5 - Payment Bypass No login needed ≤ 2.1.5 Fixed in 2.1.6 CVE-2026-39524 Patchstack
9.3 Critical GeekyBot Plugin geeky-bot SQL Injection No login needed ≤ 1.2.0 Fixed in 1.2.1 CVE-2026-39519 Patchstack
7.1 High EventPrime Plugin eventprime-event-calendar-management Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.3.0.0 Fixed in 4.3.0.1 CVE-2026-39518 Patchstack
6.5 Medium Motors Plugin motors-car-dealership-classified-listings Broken Access Control < 1.4.107 Fixed in 1.4.107 CVE-2026-39515 Patchstack
7.1 High Paid Member Subscriptions Plugin paid-member-subscriptions Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.17.3 Fixed in 3.0.0 CVE-2026-39514 Patchstack
7.5 High Easy Appointments Plugin easy-appointments Broken Access Control No login needed ≤ 3.12.21 Fixed in 3.12.22 CVE-2026-39513 Patchstack
9.3 Critical GeoDirectory Plugin geodirectory SQL Injection No login needed ≤ 2.8.152 Fixed in 2.8.154 CVE-2026-39512 Patchstack
9.3 Critical WP Photo Album Plus Plugin wp-photo-album-plus SQL Injection No login needed ≤ 9.1.08.001 Fixed in 9.1.08.002 CVE-2026-39511 Patchstack
7.1 High Social Slider Feed Plugin instagram-slider-widget Cross-Site Scripting No login needed ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-39507 Patchstack
7.5 High Easy Digital Downloads Plugin easy-digital-downloads Broken Access Control No login needed ≤ 3.6.5 Fixed in 3.6.6 CVE-2026-39503 Patchstack
9.3 Critical Form Maker by 10Web Plugin form-maker SQL Injection No login needed ≤ 1.15.38 Fixed in 1.15.39 CVE-2026-39502 Patchstack
7.2 High Advanced Product Fields (Product Addons) for WooCommerce Plugin advanced-product-fields-for-woocommerce PHP Object Injection ≤ 1.6.19 Fixed in 1.6.20 CVE-2026-39499 Patchstack
7.2 High YayMail Plugin yaymail PHP Object Injection ≤ 4.3.3 Fixed in 4.3.4 CVE-2026-39498 Patchstack
9.3 Critical Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection No login needed ≤ 1.6.9.27 Fixed in 1.6.9.29 CVE-2026-39493 Patchstack
9.3 Critical WP Maps Plugin wp-google-map-plugin SQL Injection No login needed ≤ 4.9.1 Fixed in 4.9.2 CVE-2026-39492 Patchstack
6.5 Medium JupiterX Core Plugin jupiterx-core Cross-Site Scripting ≤ 4.14.1 Fixed in 4.14.2 CVE-2026-39491 Patchstack
4.4 Medium Download Monitor Plugin download-monitor Path Traversal Non-Arbitrary File Download ≤ 5.1.9 Fixed in 5.1.10 CVE-2026-39489 Patchstack
7.2 High Modula Image Gallery Plugin modula-best-grid-gallery PHP Object Injection ≤ 2.14.18 Fixed in 2.14.19 CVE-2026-39481 Patchstack
7.5 High Backup Migration Plugin backup-backup Information Disclosure Sensitive Data Exposure No login needed ≤ 2.1.1 Fixed in 2.1.2 CVE-2026-39480 Patchstack
8.8 High Anti-Malware Security and Brute-Force Firewall Plugin gotmls PHP Object Injection ≤ 4.23.87 Fixed in 4.23.88 CVE-2026-39478 Patchstack
8.8 High Post Duplicator Plugin post-duplicator PHP Object Injection ≤ 3.0.10 Fixed in 3.0.11 CVE-2026-39474 Patchstack
7.2 High WooCommerce PDF Invoices & Packing Slips Plugin woocommerce-pdf-invoices-packing-slips PHP Object Injection < 5.9.0 Fixed in 5.9.0 CVE-2026-39472 Patchstack
7.2 High ShortPixel Image Optimizer Plugin shortpixel-image-optimiser PHP Object Injection ≤ 6.4.3 Fixed in 6.4.4 CVE-2026-39471 Patchstack
7.2 High WooCommerce Cart Abandonment Recovery Plugin woo-cart-abandonment-recovery Privilege Escalation < 2.1.0 Fixed in 2.1.0 CVE-2026-39470 Patchstack
6.8 Medium Meta Box – WordPress Custom Fields Framework Plugin meta-box Arbitrary File Deletion WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion No login needed ≤ 5.11.1 Fixed in 5.11.2 CVE-2026-39468 Patchstack
9.1 Critical Responsive Slider by MetaSlider Plugin ml-slider Remote Code Execution ≤ 3.106.0 Fixed in 3.107.0 CVE-2026-39465 Patchstack
7.1 High ManageWP Worker Plugin worker Cross-Site Scripting No login needed ≤ 4.9.31 Fixed in 4.9.32 CVE-2026-39463 Patchstack
6.3 Medium WP Google Review Slider Plugin wp-google-places-review-slider Cross-Site Scripting No login needed ≤ 18.0 Fixed in 18.1 CVE-2026-39451 Patchstack
7.1 High FunnelKit Automations Plugin wp-marketing-automations Authentication Bypass Broken Authentication ≤ 3.7.3 Fixed in 3.8.0 CVE-2026-39450 Patchstack
7.1 High Contact Form to Any API Plugin contact-form-to-any-api Cross-Site Scripting No login needed ≤ 3.0.3 CVE-2026-39449 Patchstack
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting No login needed ≤ 1.6.10.6 Fixed in 1.6.11.0 CVE-2026-39447 Patchstack
9.3 Critical Feed KuantoKusta for WooCommerce – Free Plugin feed-kuantokusta-for-woocommerce SQL Injection Free plugin <= 5.3 - SQL Injection No login needed ≤ 5.3 Fixed in 5.3.1 CVE-2026-39441 Patchstack
7.1 High CformsII Plugin cforms2 Cross-Site Scripting No login needed ≤ 15.1.3 Fixed in 15.1.4 CVE-2026-39435 Patchstack
7.2 High CTX Feed Plugin webappick-product-feed-for-woocommerce PHP Object Injection ≤ 6.6.26 Fixed in 6.6.27 CVE-2026-39434 Patchstack
7.1 High WooCommerce Product Table Lite Plugin wc-product-table-lite Cross-Site Scripting No login needed ≤ 4.6.3 Fixed in 4.6.4 CVE-2026-34902 Patchstack
9.8 Critical iControlWP Plugin worpit-admin-dashboard-plugin Privilege Escalation No login needed ≤ 5.5.3 Fixed in 5.5.4 CVE-2026-34901 Patchstack
7.1 High GiveWP Plugin give Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 4.14.2 Fixed in 4.14.3 CVE-2026-34900 Patchstack
7.5 High Event Tickets Manager for WooCommerce Plugin event-tickets-manager-for-woocommerce Broken Access Control No login needed ≤ 1.5.3 Fixed in 1.5.4 CVE-2026-34898 Patchstack
6.5 Medium Rank Math SEO Plugin seo-by-rank-math Broken Access Control ≤ 1.0.271 Fixed in 1.0.271.1 CVE-2026-34892 Patchstack
7.5 High IDPay Payment Gateway for Woocommerce Plugin woo-idpay-gateway Information Disclosure Sensitive Data Exposure No login needed ≤ 2.2.5 CVE-2026-34891 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only