WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 201–250 of 378 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium QuickCal - Appointment Booking Calendar Plugin quickcal Information Disclosure Sensitive Data Exposure ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-32299 Patchstack
8.8 High QuickCal - Appointment Booking Calendar Plugin quickcal Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-32310 Patchstack
6.4 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin Broken Access Control Events Calendar, Bookings and Tickets < 3.5.0 - Subscriber+ Arbitrary booking settings update 3.4.9 – < 3.5.0 Fixed in 3.5.0 CVE-2024-4665 WPScan
4.8 Medium Event Calendar Plugin Cross-Site Scripting Admin+ Stored XSS ≤ 1.0.4 CVE-2024-8701 WPScan
7.5 High Event Calendar Plugin Broken Access Control Unauthenticated Arbitrary Calendar Deletion No login needed ≤ 1.0.4 CVE-2024-8700 WPScan
4.8 Medium The Events Calendar Plugin the-events-calendar Cross-Site Scripting Admin+ Stored XSS < 6.6.4 Fixed in 6.6.4 CVE-2024-8493 WPScan
7.5 High Event Manager, Events Calendar, Tickets, Registrations – Eventin Plugin wp-event-solution Path Traversal Eventin <= 4.0.26 - Unauthenticated Arbitrary File Read No login needed ≤ 4.0.26 CVE-2025-3419 Wordfence
4.3 Medium Simple calendar for Elementor Plugin simple-calendar-for-elementor Cross-Site Request Forgery No login needed ≤ 1.6.5 Fixed in 1.6.6 CVE-2025-47542 Patchstack
7.1 High Availability Calendar Plugin availability Cross-Site Request Forgery No login needed ≤ 0.2.4 CVE-2025-46528 Patchstack
7.1 High Contact Form 7 Calendar Plugin cf7-calendar Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 3.0.1 CVE-2025-46510 Patchstack
4.3 Medium Simple calendar for Elementor Plugin simple-calendar-for-elementor Cross-Site Request Forgery No login needed ≤ 1.6.4 Fixed in 1.6.5 CVE-2025-46249 Patchstack
5.3 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Broken Access Control No login needed ≤ 1.3.92 Fixed in 1.3.93 CVE-2025-46247 Patchstack
8.2 High Appointment Booking Calendar Plugin appointment-booking-calendar Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 1.3.92 Fixed in 1.3.93 CVE-2025-46241 Patchstack
7.1 High WordPress Events Calendar Plugin – connectDaily Plugin connect-daily-web-calendar Cross-Site Request Forgery connectDaily plugin <= 1.5.4 - CSRF to Cross-Site Scripting No login needed ≤ 1.5.4 Fixed in 1.5.5 CVE-2025-32597 Patchstack
4.3 Medium Online Booking & Scheduling Calendar for WordPress by vcita Plugin meeting-scheduler-by-vcita Information Disclosure Sensitive Data Exposure ≤ 4.5.5 Fixed in 4.6.0 CVE-2025-32238 Patchstack
6.5 Medium Tockify Events Calendar Plugin tockify-events-calendar Cross-Site Scripting ≤ 2.2.13 Fixed in 2.3.0 CVE-2025-32174 Patchstack
6.5 Medium Booking Calendar and Notification Plugin booking-calendar-and-notification Authentication Bypass Broken Authentication No login needed ≤ 4.0.3 CVE-2025-31381 Patchstack
9.3 Critical Booking Calendar and Notification Plugin booking-calendar-and-notification SQL Injection No login needed ≤ 4.0.3 CVE-2025-31403 Patchstack
7.1 High CGM Event Calendar Plugin cgm-event-calendar Cross-Site Scripting No login needed ≤ 0.8.5 CVE-2025-31462 Patchstack
6.5 Medium Ethiopian Calendar Plugin ethiopian-calendar Cross-Site Scripting ≤ 1.1.1 CVE-2025-31589 Patchstack
4.3 Medium Multi Days Events and Multi Events in One Day Calendar Plugin dragon-calendar-free-version Cross-Site Request Forgery No login needed ≤ 1.1.3 CVE-2025-31572 Patchstack
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Information Disclosure Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure No login needed ≤ 1.2.19 CVE-2025-2578 Wordfence
6.5 Medium Simple Google Calendar Outlook Events Block Widget Plugin simple-google-icalendar-widget Cross-Site Scripting ≤ 2.5.0 Fixed in 2.6.0 CVE-2025-22497 Patchstack
7.6 High bizcalendar-web Plugin bizcalendar-web SQL Injection ≤ 1.1.0.34 Fixed in 1.1.0.35 CVE-2025-30843 Patchstack
8.5 High WP Google Calendar Manager Plugin wp-gcalendar SQL Injection ≤ 2.1 CVE-2025-28939 Patchstack
7.1 High Another Events Calendar Plugin another-events-calendar Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.7.0 CVE-2025-26536 Patchstack
6.1 Medium Registrations for The Events Calendar Plugin registrations-for-the-events-calendar Cross-Site Scripting Admin+ Stored XSS No login needed < 2.13.4 Fixed in 2.13.4 CVE-2024-10703 WPScan
5.3 Medium Event Manager, Events Calendar, Tickets, Registrations – Eventin Plugin wp-event-solution Broken Access Control Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update No login needed ≤ 4.0.24 CVE-2025-1766 Wordfence
8.8 High Event Manager, Events Calendar, Tickets, Registrations – Eventin Plugin wp-event-solution Local File Inclusion Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion ≤ 4.0.24 CVE-2025-1770 Wordfence
7.3 High Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.6.8.5 CVE-2025-1119 Wordfence
6.1 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.8.3 CVE-2024-13431 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Broken Access Control Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export ≤ 4.0.7.3 CVE-2024-13526 Wordfence
8.8 High Events Calendar for GeoDirectory Plugin events-for-geodirectory PHP Object Injection ≤ 2.3.14 Fixed in 2.3.15 CVE-2025-26967 Patchstack
7.1 High Swift Calendar Online Appointment Scheduling Plugin online-appointment-scheduling-software Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.3 CVE-2025-23526 Patchstack
6.5 Medium Booking Calendar and Notification Plugin booking-calendar-and-notification Broken Access Control Missing Authorization via wpcb_all_bookings, wpcb_update_booking_post, and wpcb_delete_posts Functions No login needed ≤ 4.0.3 CVE-2024-13746 Wordfence
6.4 Medium Events Calendar Made Simple – Pie Calendar Plugin pie-calendar Cross-Site Scripting Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode ≤ 1.2.5 CVE-2025-1410 Wordfence
7.5 High Events Manager – Calendar, Bookings, Tickets, and more! Plugin events-manager SQL Injection Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter No login needed ≤ 6.6.3 CVE-2024-11260 Wordfence
5.3 Medium WP Booking Calendar Plugin Broken Access Control Unauthenticated Post-Confirmation Booking Manipulation No login needed ≤ 10.10 CVE-2024-13821 Wordfence
5.4 Medium Event Kikfyre Plugin kikfyre-events-calendar-tickets Broken Access Control ≤ 2.1.8 CVE-2025-25110 Patchstack
5.4 Medium The Events Calendar Plugin the-events-calendar Cross-Site Request Forgery No login needed ≤ 6.7.0 Fixed in 6.7.1 CVE-2025-24537 Patchstack
5.9 Medium Booking Calendar Contact Form Plugin booking-calendar-contact-form Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.2.55 Fixed in 1.2.56 CVE-2025-24723 Patchstack
6.4 Medium The Events Calendar Plugin the-events-calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 6.9.0 CVE-2024-12118 Wordfence
7.1 High VikAppointments Services Booking Calendar Plugin vikappointments Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.2.16 Fixed in 1.2.17 CVE-2025-22719 Patchstack
6.4 Medium Event Registration Calendar By vcita Plugin event-registration-calendar-by-vcita Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.0 CVE-2024-11870 Wordfence
6.4 Medium Booking Calendar Plugin booking Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'booking' Shortcode ≤ 10.9.2 CVE-2024-13323 Wordfence
6.5 Medium WP FullCalendar Plugin wp-fullcalendar Cross-Site Scripting ≤ 1.5 Fixed in 1.6 CVE-2025-22261 Patchstack
6.1 Medium Booking Calendar and Booking Calendar Pro <= Multiple Versions Plugin booking-calendar Cross-Site Scripting Reflected Cross-Site Scripting via 'calendar_id' No login needed ≤ 3.2.19, ≤ 11.2.19 CVE-2024-12077 Wordfence
4.3 Medium The Events Calendar Plugin the-events-calendar Cross-Site Request Forgery No login needed ≤ 6.5.1.4 Fixed in 6.5.1.5 CVE-2024-37518 Patchstack
6.5 Medium Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress Plugin bookingpress-appointment-booking SQL Injection BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection ≤ 1.1.21 CVE-2024-11726 Wordfence
6.5 Medium Booking Calendar WpDevArt Plugin booking-calendar SQL Injection Authenticated (Contributor+) SQL Injection ≤ 3.2.19 CVE-2024-10856 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only