WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,758 vulnerabilities, 1,866 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,263 High 9,249 Medium 17,900 Low 346

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 12, 2026.

Showing 201–250 of 741 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 15
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium CartFlows Plugin cartflows Broken Access Control ≤ 2.2.3 Fixed in 2.2.4 CVE-2026-39477 Patchstack
4.4 Medium Whole Enquiry Cart for WooCommerce Plugin whole-cart-enquiry Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'woowhole_success_msg' Parameter ≤ 1.2.1 CVE-2026-2838 Wordfence
5.3 Medium MainWP Child Reports Plugin mainwp-child-reports Broken Access Control Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API ≤ 2.2.6 Fixed in 2.3 CVE-2026-4299 Wordfence
5.4 Medium Smart Slider 3 Plugin smart-slider-3 Broken Access Control Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation ≤ 3.5.1.33 Fixed in 3.5.1.34 CVE-2026-4065 Wordfence
6.5 Medium SQL Chart Builder Plugin SQL Injection Unauthenticated SQL Injection No login needed < 2.3.8 Fixed in 2.3.8 CVE-2026-4079 WPScan
6.4 Medium Simple Shopping Cart Plugin wordpress-simple-paypal-shopping-cart Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode ≤ 5.2.4 Fixed in 5.2.5 CVE-2026-0552 Wordfence
6.5 Medium Smart Slider 3 Plugin smart-slider-3 Path Traversal Authenticated (Subscriber+) Arbitrary File Read via actionExportAll ≤ 3.5.1.33 Fixed in 3.5.1.34 CVE-2026-3098 Wordfence
7.1 High Abandoned Cart Recovery for WooCommerce Plugin woo-abandoned-cart-recovery Cross-Site Scripting No login needed ≤ <= 1.1.10 Fixed in 1.1.11 CVE-2026-32526 Patchstack
8.1 High WoodMart Theme woodmart PHP Object Injection No login needed ≤ 8.3.8 Fixed in 8.3.9 CVE-2026-23971 Patchstack
4.3 Medium Smart Custom Fields Plugin smart-custom-fields Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search ≤ 5.0.6 Fixed in 5.0.7 CVE-2026-4066 Wordfence
6.4 Medium Sina Extension for Elementor Plugin sina-extension-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget` ≤ 3.7.0 CVE-2025-6229 Wordfence
4.4 Medium Ricerca – advanced search Plugin ricerca-smart-search Cross-Site Scripting advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings ≤ 1.1.12 CVE-2026-2837 Wordfence
6.5 Medium Pre* Party Resource Hints Plugin pre-party-browser-hints SQL Injection Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter ≤ 1.8.20 CVE-2026-4087 Wordfence
5.3 Medium Smarter Analytics Plugin smarter-analytics Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter No login needed ≤ 2.0 CVE-2026-3570 Wordfence
6.5 Medium ilGhera Carta Docente for WooCommerce Plugin wc-carta-docente Path Traversal Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'cert' Parameter ≤ 1.5.0 Fixed in 1.5.1 CVE-2026-2421 Wordfence
5.3 Medium BigHearts Theme bighearts Broken Access Control No login needed ≤ 3.1.14 Fixed in 3.1.15 CVE-2026-32439 Patchstack
8.5 High WP EasyCart Plugin wp-easycart SQL Injection ≤ 5.8.13 Fixed in 5.8.14 CVE-2026-32422 Patchstack
4.3 Medium WPC Smart Wishlist for WooCommerce Plugin woo-smart-wishlist Broken Access Control ≤ 5.0.8 Fixed in 5.0.9 CVE-2026-32407 Patchstack
5.3 Medium WoodMart Theme woodmart Information Disclosure Sensitive Data Exposure No login needed ≤ 8.3.9 Fixed in 8.4.0 CVE-2026-32405 Patchstack
5.3 Medium Filter & Grids Plugin ymc-smart-filter Broken Access Control No login needed ≤ 3.5.1 Fixed in 3.5.2 CVE-2026-32397 Patchstack
5.4 Medium SmartFix Theme smartfix Broken Access Control ≤ 1.2.4 Fixed in 1.2.4 CVE-2026-32391 Patchstack
5.3 Medium Preschool and Kindergarten Plugin preschool-and-kindergarten Broken Access Control No login needed ≤ 1.2.5 Fixed in 1.2.6 CVE-2026-32337 Patchstack
6.5 Medium immonex Kickstart Plugin immonex-kickstart Cross-Site Scripting ≤ 1.13.0 Fixed in 1.13.4 CVE-2026-31918 Patchstack
4.4 Medium Carta Online Plugin carta-online Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings ≤ 2.13.0 CVE-2026-1071 Wordfence
8.1 High smart SEO Theme smartseo Local File Inclusion No login needed ≤ 2.9 CVE-2026-28117 Patchstack
8.1 High Artrium Theme artrium Local File Inclusion No login needed ≤ 1.0.14 CVE-2026-28097 Patchstack
8.1 High Police Department Theme police-department Local File Inclusion No login needed ≤ 2.17 CVE-2026-28049 Patchstack
8.1 High FlashMart Plugin flashmart Local File Inclusion No login needed ≤ 2.0.15 CVE-2026-28048 Patchstack
7.1 High Starto Theme starto Cross-Site Scripting No login needed ≤ 2.2.5 Fixed in 2.2.5 CVE-2026-27352 Patchstack
8.1 High Crown Art Theme crown-art Local File Inclusion No login needed ≤ 1.2.11 CVE-2026-22434 Patchstack
8.1 High Wolmart Theme wolmart Local File Inclusion No login needed ≤ 1.9.6 CVE-2026-22385 Patchstack
7.1 High PixelYourSite – Your smart PIXEL (TAG) Manager Plugin pixelyoursite Cross-Site Scripting Your smart PIXEL (TAG) Manager plugin <= 11.2.0.1 - Cross Site Scripting (XSS) No login needed ≤ 11.2.0.1 Fixed in 11.2.0.2 CVE-2026-27072 Patchstack
8.1 High A-Mart Theme a-mart Local File Inclusion No login needed ≤ 1.0.2 CVE-2026-22361 Patchstack
6.5 Medium Cartify - WooCommerce Gutenberg Theme cartify Broken Access Control WooCommerce Gutenberg WordPress Theme theme <= 1.3 - Arbitrary Content Deletion ≤ 1.3 CVE-2025-69385 Patchstack
9.3 Critical Wolmart Core Plugin wolmart-core SQL Injection No login needed ≤ 1.9.6 Fixed in 1.9.7 CVE-2025-69337 Patchstack
9.3 Critical Allmart Plugin allmart-core SQL Injection No login needed ≤ 1.1 CVE-2025-69304 Patchstack
6.5 Medium Addonify Floating Cart For WooCommerce Plugin addonify-floating-cart Broken Access Control No login needed ≤ 1.2.17 CVE-2025-68025 Patchstack
6.5 Medium Sunshine Photo Cart Plugin sunshine-photo-cart Broken Access Control No login needed ≤ 3.5.6.2 Fixed in 3.5.7.1 CVE-2025-67973 Patchstack
7.1 High FluentCart Plugin fluent-cart Cross-Site Scripting No login needed ≤ 1.3.0 Fixed in 1.3.0 CVE-2025-67971 Patchstack
5.9 Medium Schedula Plugin schedula-smart-appointment-booking Broken Access Control No login needed ≤ 1.0 Fixed in 1.1 CVE-2025-67970 Patchstack
4.3 Medium Penci AI SmartContent Creator Plugin penci-ai Broken Access Control ≤ 2.0 CVE-2026-27055 Patchstack
7.2 High CartFlows Plugin cartflows PHP Object Injection ≤ 2.1.19 Fixed in 2.2.0 CVE-2026-25316 Patchstack
7.2 High Smart Auto Upload Images Plugin smart-auto-upload-images Server-Side Request Forgery ≤ 1.2.2 Fixed in 1.2.3 CVE-2026-23803 Patchstack
6.4 Medium Smartsupp – live chat, AI shopping assistant and chatbots Plugin smartsupp-live-chat Cross-Site Scripting live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 3.9.1 Fixed in 3.9.2 CVE-2025-12448 Wordfence
7.2 High Cart All In One For WooCommerce Plugin woo-cart-all-in-one Remote Code Execution Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting ≤ 1.1.21 CVE-2026-2019 Wordfence
8.8 High Ecwid by Lightspeed Ecommerce Shopping Cart Plugin ecwid-shopping-cart Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access ≤ 7.0.7 Fixed in 7.0.8 CVE-2026-1750 Wordfence
4.3 Medium Smart Forms Plugin smart-forms Broken Access Control Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure ≤ 2.6.99 CVE-2026-2022 Wordfence
5.3 Medium WPZOOM Addons for Elementor – Starter Templates & Widgets Plugin wpzoom-elementor-addons Broken Access Control Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more No login needed ≤ 1.3.2 Fixed in 1.3.3 CVE-2026-2295 Wordfence
6.4 Medium Smart Appointment & Booking Plugin smart-appointment-booking Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action ≤ 1.0.7 Fixed in 1.0.8 CVE-2026-0742 Wordfence
5.3 Medium Sunshine Photo Cart Plugin sunshine-photo-cart Broken Access Control No login needed ≤ 3.5.7.2 Fixed in 3.5.7.3 CVE-2026-24994 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only