WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,401–2,450 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 49 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Static Block Plugin static-block Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute ≤ 2.2 CVE-2026-10780 Wordfence
5.3 Medium Abandoned Contact Form 7 Plugin abandoned-contact-form-7 Broken Access Control Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter No login needed ≤ 2.2 CVE-2026-9187 Wordfence
5.3 Medium Video Conferencing with Zoom Plugin video-conferencing-with-zoom-api Broken Access Control Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action No login needed ≤ 4.6.7 CVE-2026-6964 Wordfence
6.5 Medium Welcart e-Commerce Plugin usc-e-shop Broken Access Control No login needed ≤ 2.11.28 Fixed in 2.11.29 CVE-2026-49775 Patchstack
6.5 Medium FV Flowplayer Video Player Plugin fv-wordpress-flowplayer Cross-Site Scripting < 7.5.51.7212 Fixed in 7.5.51.7212 CVE-2026-49773 Patchstack
4.7 Medium WP Migrate Lite Plugin wp-migrate-db Cross-Site Request Forgery No login needed ≤ 2.7.8 Fixed in 2.7.9 CVE-2026-49043 Patchstack
6.5 Medium XCloner Plugin xcloner-backup-and-restore Information Disclosure Sensitive Data Exposure No login needed ≤ 4.8.6 Fixed in 4.8.7 CVE-2026-48965 Patchstack
6.5 Medium JS Help Desk Plugin js-support-ticket Broken Access Control No login needed ≤ 3.0.9 Fixed in 3.1.0 CVE-2026-48887 Patchstack
6.5 Medium WP Job Portal Plugin wp-job-portal Cross-Site Scripting ≤ 2.5.2 Fixed in 2.5.3 CVE-2026-48880 Patchstack
6.5 Medium Visual Link Preview Plugin visual-link-preview Information Disclosure Sensitive Data Exposure ≤ 2.4.1 Fixed in 2.4.2 CVE-2026-48878 Patchstack
6.5 Medium King Addons for Elementor Plugin king-addons Cross-Site Scripting ≤ 51.1.62 Fixed in 51.1.63 CVE-2026-48870 Patchstack
6.5 Medium Stripe Payments Plugin stripe-payments Other Bypass Vulnerability No login needed ≤ 2.0.98 Fixed in 2.0.99 CVE-2026-42752 Patchstack
6.5 Medium Masteriyo - LMS Plugin learning-management-system Authentication Bypass LMS plugin <= 2.1.8 - Broken Authentication No login needed ≤ 2.1.8 Fixed in 2.1.9 CVE-2026-42743 Patchstack
6.5 Medium Modula Image Gallery Plugin modula-best-grid-gallery Cross-Site Scripting ≤ 2.14.23 Fixed in 2.14.24 CVE-2026-42688 Patchstack
6.5 Medium Simple Membership Plugin simple-membership Cross-Site Scripting ≤ 4.7.2 Fixed in 4.7.3 CVE-2026-42663 Patchstack
6.5 Medium Event Tickets Plugin event-tickets Authentication Bypass Bypass Vulnerability No login needed ≤ 5.27.5 Fixed in 5.27.6.1 CVE-2026-42662 Patchstack
6.5 Medium Contest Gallery Plugin contest-gallery Information Disclosure Sensitive Data Exposure ≤ 28.1.7 Fixed in 29.0.0 CVE-2026-42660 Patchstack
6.5 Medium Advanced Form Integration Plugin advanced-form-integration Broken Access Control ≤ 1.126.12 Fixed in 1.127.0 CVE-2026-42659 Patchstack
6.5 Medium Contest Gallery Plugin contest-gallery Other Other Vulnerability Type No login needed ≤ 28.1.7 Fixed in 29.0.0 CVE-2026-42657 Patchstack
6.5 Medium Contest Gallery Plugin contest-gallery Cross-Site Scripting ≤ 28.1.6 Fixed in 29.0.0 CVE-2026-42656 Patchstack
6.3 Medium Classified Listing Plugin classified-listing Broken Access Control ≤ 5.3.9 Fixed in 5.3.10 CVE-2026-42651 Patchstack
6.5 Medium Classified Listing Plugin classified-listing Broken Access Control No login needed ≤ 5.3.8 Fixed in 5.3.9 CVE-2026-42640 Patchstack
6.5 Medium WP Full Stripe Free Plugin wp-full-stripe-free Authentication Bypass Broken Authentication ≤ 8.4.1 Fixed in 8.4.2 CVE-2026-42378 Patchstack
6.5 Medium ProfilePress Plugin wp-user-avatar Cross-Site Scripting ≤ 4.16.13 Fixed in 4.16.14 CVE-2026-41556 Patchstack
5.8 Medium Simple Cloudflare Turnstile Plugin simple-cloudflare-turnstile Authentication Bypass Broken Authentication No login needed ≤ 1.38.0 Fixed in 1.38.1 CVE-2026-40799 Patchstack
6.5 Medium WPPizza Plugin wppizza Information Disclosure Sensitive Data Exposure ≤ 3.19.9 Fixed in 3.20 CVE-2026-40796 Patchstack
6.5 Medium Amelia Plugin ameliabooking Broken Access Control ≤ 2.2 Fixed in 2.2.1 CVE-2026-40795 Patchstack
6.5 Medium myCred Plugin mycred Broken Access Control ≤ 3.0.3 Fixed in 3.0.4 CVE-2026-40794 Patchstack
6.5 Medium Groundhogg Plugin groundhogg Broken Access Control < 4.4.1 Fixed in 4.4.1 CVE-2026-40793 Patchstack
6.3 Medium KiviCare Plugin kivicare-clinic-management-system Broken Access Control Insecure Direct Object References (IDOR) ≤ 4.2.1 Fixed in 4.3.0 CVE-2026-40792 Patchstack
6.5 Medium WP SMS Plugin wp-sms Information Disclosure Sensitive Data Exposure ≤ 7.2.1 Fixed in 7.2.2 CVE-2026-40790 Patchstack
6.5 Medium WPAdverts Plugin wpadverts Broken Access Control No login needed ≤ 2.3.0 Fixed in 2.3.1 CVE-2026-40782 Patchstack
6.5 Medium rtMedia for WordPress, BuddyPress and bbPress Plugin buddypress-media Broken Access Control ≤ 4.7.9 Fixed in 4.7.10 CVE-2026-40773 Patchstack
6.5 Medium Tutor LMS Plugin tutor Broken Access Control No login needed ≤ 3.9.7 Fixed in 3.9.8 CVE-2026-40743 Patchstack
6.4 Medium Ultra Addons for WPForms Plugin ultra-addons-for-wpforms Broken Access Control ≤ 1.0.11 Fixed in 1.0.12 CVE-2026-39594 Patchstack
6.5 Medium RepairBuddy Plugin computer-repair-shop Broken Access Control ≤ 4.1132 Fixed in 4.1133 CVE-2026-39584 Patchstack
6.5 Medium Shipment Tracker for Woocommerce Plugin shipment-tracker-for-woocommerce Cross-Site Scripting ≤ 1.5.3.2 Fixed in 1.5.3.3 CVE-2026-39540 Patchstack
5.4 Medium WpStream Plugin wpstream Arbitrary File Upload < 4.11.2 Fixed in 4.11.2 CVE-2026-39527 Patchstack
6.5 Medium Booking Activities Plugin booking-activities Broken Access Control No login needed ≤ 1.16.48.1 Fixed in 1.17.0 CVE-2026-39525 Patchstack
6.5 Medium Motors Plugin motors-car-dealership-classified-listings Broken Access Control < 1.4.107 Fixed in 1.4.107 CVE-2026-39515 Patchstack
6.5 Medium JupiterX Core Plugin jupiterx-core Cross-Site Scripting ≤ 4.14.1 Fixed in 4.14.2 CVE-2026-39491 Patchstack
4.4 Medium Download Monitor Plugin download-monitor Path Traversal Non-Arbitrary File Download ≤ 5.1.9 Fixed in 5.1.10 CVE-2026-39489 Patchstack
6.8 Medium Meta Box – WordPress Custom Fields Framework Plugin meta-box Arbitrary File Deletion WordPress Custom Fields Framework plugin <= 5.11.1 - Arbitrary File Deletion No login needed ≤ 5.11.1 Fixed in 5.11.2 CVE-2026-39468 Patchstack
6.3 Medium WP Google Review Slider Plugin wp-google-places-review-slider Cross-Site Scripting No login needed ≤ 18.0 Fixed in 18.1 CVE-2026-39451 Patchstack
6.5 Medium Rank Math SEO Plugin seo-by-rank-math Broken Access Control ≤ 1.0.271 Fixed in 1.0.271.1 CVE-2026-34892 Patchstack
5.3 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Broken Access Control No login needed < 6.6.0 Fixed in 6.6.0 CVE-2026-25440 Patchstack
6.5 Medium Bookify Plugin bookify Broken Access Control ≤ 1.1.1 Fixed in 1.1.2 CVE-2025-69332 Patchstack
6.3 Medium bunny.net Plugin bunnycdn Broken Access Control ≤ 2.3.6 Fixed in 2.3.7 CVE-2025-68049 Patchstack
4.4 Medium PopAd Plugin popad Server-Side Request Forgery ≤ 1.0.4 CVE-2025-60175 Patchstack
6.5 Medium Elizaibots Plugin elizaibot-chatbots Cross-Site Scripting ≤ 1.0.2 CVE-2025-15659 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only