WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,563 vulnerabilities, 2,041 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 27, 2026.
Showing 2,351–2,400 of 30,563 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 3.7 Low | Secure Custom Fields | Broken Access Control Unauthenticated Post Modification via Front-End Form ID Substitution No login needed |
< 6.9.4 Fixed in 6.9.4 |
CVE-2026-92403 |
WPScan | |
| 6.5 Medium | WPGraphQL Smart Cache | Broken Access Control Unauthenticated Persisted Query Registration and Alias Squatting No login needed |
< 2.3.2 Fixed in 2.3.2 |
CVE-2026-92099 |
WPScan | |
| 4.8 Medium | Bookly | Information Disclosure Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR No login needed |
28.1 – < 28.2 Fixed in 28.2 |
CVE-2026-91847 |
WPScan | |
| 8.6 High | VikRentItems Flexible Rental Management System | SQL Injection Unauthenticated SQLi No login needed |
< 1.2.4 Fixed in 1.2.4 |
CVE-2026-88926 |
WPScan | |
| 8.8 High | Master Blocks | Cross-Site Scripting Unauthenticated Stored XSS via White Label Settings No login needed |
1.4.1 – < 1.5.0 Fixed in 1.5.0 |
CVE-2026-88824 |
WPScan | |
| 8.1 High | UsersWP - Social Login | Privilege Escalation Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email No login needed |
< 1.5.10 Fixed in 1.5.10 |
CVE-2026-86814 |
WPScan | |
| 9.8 Critical | Botiga Pro | Privilege Escalation Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route No login needed |
< 1.6.5 Fixed in 1.6.5 |
CVE-2026-86591 |
WPScan | |
| 8.8 High | Ultimate Member | Cross-Site Scripting Unauthenticated Stored XSS via Profile Page Title No login needed |
< 2.13.1 Fixed in 2.13.1 |
CVE-2026-85680 |
WPScan | |
| 8.0 High | Unbounce Landing Pages | Broken Access Control Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains |
1.1.1 – < 1.1.5 Fixed in 1.1.5 |
CVE-2026-85574 |
WPScan | |
| 6.5 Medium | Ultimate Addons for Contact Form 7 | Arbitrary File Upload Unauthenticated Arbitrary File Upload via Signature Field No login needed |
3.2.4 – < 3.5.51 Fixed in 3.5.51 |
CVE-2026-84750 |
WPScan | |
| 7.1 High | Estatik | Cross-Site Scripting Reflected XSS via get_listings hash Parameter No login needed |
4.0.1 – < 4.3.5 Fixed in 4.3.5 |
CVE-2026-76790 |
WPScan | |
| 7.2 High | WP Import Export Lite | Privilege Escalation Authenticated Privilege Escalation via User Import |
< 3.9.35 Fixed in 3.9.35 |
CVE-2026-76554 |
WPScan | |
| 5.5 Medium | JetFormBuilder | Arbitrary File Deletion Admin+ Arbitrary File Deletion via Server-Side Validation Callback |
3.5.6.2 – < 3.6.5.3 Fixed in 3.6.5.3 |
CVE-2026-19860 |
WPScan | |
| 3.5 Low | Business Name Generator | Cross-Site Scripting Admin+ Stored XSS via Button Color Setting |
≤ 1.3 |
CVE-2025-15698 |
WPScan | |
| 4.3 Medium | Nimble Builder | Information Disclosure Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins |
≤ 3.3.8 |
CVE-2026-16557 |
WPScan | |
| 8.8 High | Save as PDF Plugin by PDFCrowd | Remote Code Execution Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attribute |
≤ 4.6.1 Fixed in 4.6.2 |
CVE-2026-92807 |
Wordfence | |
| 6.1 Medium | Pochipp | Cross-Site Scripting Reflected Cross-Site Scripting via 'keyword' Parameter No login needed |
≤ 1.20.2 Fixed in 1.20.3 |
CVE-2026-92967 |
Wordfence | |
| 4.4 Medium | WP2Social Auto Publish | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter |
≤ 2.4.12 Fixed in 2.4.13 |
CVE-2026-12042 |
Wordfence | |
| 9.1 Critical | WP Recipe Maker | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content No login needed |
≤ 10.8.1 Fixed in 10.8.2 |
CVE-2026-89274 |
Wordfence | |
| 5.3 Medium | Better Messages | Information Disclosure Unauthenticated Information Exposure Spoofing via 'X-Real-IP' Header via /guests/register No login needed |
≤ 2.15.33 Fixed in 3.0.0 |
CVE-2026-89093 |
Wordfence | |
| 6.1 Medium | Tutor LMS | Cross-Site Scripting Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters No login needed |
≤ 4.0.8 Fixed in 4.0.9 |
CVE-2026-89081 |
Wordfence | |
| 9.1 Critical | Forminator Forms | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter No login needed |
≤ 1.57.2 Fixed in 1.57.2.1 |
CVE-2026-92229 |
Wordfence | |
| 6.5 Medium | Better Messages | Broken Access Control Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint |
≤ 2.15.33 Fixed in 3.0.0 |
CVE-2026-89334 |
Wordfence | |
| 4.3 Medium | Tutor LMS | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter |
≤ 4.0.8 Fixed in 4.0.9 |
CVE-2026-88944 |
Wordfence | |
| 7.5 High | WP Photo Album Plus | Remote Code Execution Authenticated (Subscriber+) Remote Code Execution via Multipart Upload Filename via ImageMagick Argument Injection |
≤ 9.2.09.002 Fixed in 9.2.10.001 |
CVE-2026-87909 |
Wordfence | |
| 9.8 Critical | Gravity Forms | Arbitrary File Upload Unauthenticated Arbitrary File Upload via Hidden File Upload Field No login needed |
≤ 3.1.0.4 |
CVE-2026-84434 |
Wordfence | |
| 6.5 Medium | Divi Essentials | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action |
≤ 5.8.1 |
CVE-2026-15760 |
Wordfence | |
| 4.3 Medium | SEO Booster | Broken Access Control Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback() |
≤ 7.4.7 Fixed in 7.4.8 |
CVE-2026-15660 |
Wordfence | |
| 7.2 High | Asset CleanUp: Page Speed Booster | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content No login needed |
≤ 1.4.0.5 Fixed in 1.4.0.6 |
CVE-2026-13354 |
Wordfence | |
| 6.5 Medium | Tutor LMS | Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Exposure via 'student_id' Parameter |
≤ 4.0.8 Fixed in 4.0.9 |
CVE-2026-89333 |
Wordfence | |
| 6.4 Medium | WPComplete | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute |
≤ 2.9.9.0 |
CVE-2026-77820 |
Wordfence | |
| 8.8 High | WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box | Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload via Media Import |
2.0 – 3.8.3 |
CVE-2026-93031 |
Wordfence | |
| 7.2 High | Popup Maker | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter No login needed |
≤ 1.24.0 Fixed in 1.25.0 |
CVE-2026-87915 |
Wordfence | |
| 6.4 Medium | Popup Maker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via post_title |
≤ 1.24.0 Fixed in 1.25.0 |
CVE-2026-15797 |
Wordfence | |
| 5.4 Medium | WP Recipe Maker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint |
≤ 10.8.1 |
CVE-2026-90884 |
Wordfence | |
| 7.2 High | Jeg Kit for Elementor | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content No login needed |
≤ 3.2.16 Fixed in 3.2.17 |
CVE-2026-18405 |
Wordfence | |
| 8.1 High | Master Addons for Elementor | Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter |
≤ 3.2.2 Fixed in 3.2.3 |
CVE-2026-85410 |
Wordfence | |
| 7.2 High | Complianz GDPR/CCPA Cookie Consent Banner | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex No login needed |
≤ 7.5.4 Fixed in 7.5.5 |
CVE-2026-83561 |
Wordfence | |
| 4.4 Medium | CSS & JavaScript Toolbox | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields |
≤ 12.0.6 Fixed in 12.0.7 |
CVE-2025-13533 |
Wordfence | |
| 6.1 Medium | Qi Addons For Elementor | Cross-Site Scripting Reflected DOM-Based Cross-Site Scripting via 's' Parameter No login needed |
≤ 1.11 Fixed in 1.11.1 |
CVE-2026-92249 |
Wordfence | |
| 7.5 High | Location Manager | SQL Injection Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters No login needed |
≤ 2.3.38 |
CVE-2026-85705 |
Wordfence | |
| 6.5 Medium | Photo Gallery by 10Web | SQL Injection Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute |
≤ 1.8.44 Fixed in 1.8.45 |
CVE-2026-85652 |
Wordfence | |
| 7.5 High | WP Multi Store Locator Pro | SQL Injection Unauthenticated SQL Injection via 'store_locator_search_radius' Parameter No login needed |
≤ 4.5.1 |
CVE-2026-15275 |
Wordfence | |
| 4.3 Medium | WP Easy Pay | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion |
≤ 4.5.0 Fixed in 4.5.1 |
CVE-2026-12739 |
Wordfence | |
| 4.9 Medium | Store Exporter | Path Traversal Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter |
≤ 2.8.0 Fixed in 2.8.1 |
CVE-2026-16777 |
Wordfence | |
| 5.4 Medium | FileBird – WordPress Media Library Folders & File Manager | Cross-Site Scripting WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting |
≤ 6.5.6 Fixed in 6.5.7 |
CVE-2026-15004 |
Wordfence | |
| 6.4 Medium | Kubio AI Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content |
≤ 2.8.4 Fixed in 2.8.5 |
CVE-2026-14472 |
Wordfence | |
| 8.8 High | Mapster WP Maps | Privilege Escalation Authenticated (Subscriber+) Arbitrary User Meta Write via 'acf-photo-gallery-groups' Parameter |
≤ 1.23.0 Fixed in 1.24.0 |
CVE-2026-12954 |
Wordfence | |
| 4.9 Medium | NEX-Forms | SQL Injection Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter |
≤ 9.3.0 Fixed in 9.3.1 |
CVE-2026-75961 |
Wordfence | |
| 7.5 High | Printcart Web to Print Product Designer for WooCommerce | Path Traversal Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters No login needed |
≤ 2.8.5 Fixed in 2.8.6 |
CVE-2026-14323 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.