WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 201–250 of 569 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Request Forgery Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery No login needed ≤ 5.2.5 CVE-2025-14873 Wordfence
4.3 Medium SEATT: Simple Event Attendance Plugin simple-event-attendance Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Event Deletion No login needed ≤ 1.5.0 CVE-2026-1983 Wordfence
5.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Broken Access Control Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure No login needed ≤ 5.2.6 CVE-2026-1537 Wordfence
6.4 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.1.2 CVE-2026-1922 Wordfence
6.4 Medium Events Listing Widget Plugin events-listing-widget Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field ≤ 1.3.4 CVE-2026-1252 Wordfence
6.5 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting ≤ 3.1.1 Fixed in 3.1.2 CVE-2026-24988 Patchstack
8.8 High WpEvently Plugin mage-eventpress PHP Object Injection Deserialization of untrusted data ≤ 5.0.8 Fixed in 5.0.9 CVE-2026-24954 Patchstack
4.3 Medium WpEvently Plugin mage-eventpress Cross-Site Request Forgery No login needed ≤ 5.1.1 Fixed in 5.1.2 CVE-2026-24942 Patchstack
7.2 High LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Scripting Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 5.2.5 CVE-2026-0617 Wordfence
6.1 Medium Timeline Event History Plugin timeline-event-history Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.2 CVE-2026-1127 Wordfence
4.3 Medium Fraud Prevention For Woocommerce Plugin woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers Information Disclosure Sensitive Data Exposure ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-24553 Patchstack
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control No login needed ≤ 4.2.8.0 Fixed in 4.2.8.1 CVE-2026-24380 Patchstack
8.5 High FooEvents for WooCommerce Plugin fooevents SQL Injection ≤ 1.20.4 Fixed in 1.20.5 CVE-2025-69045 Patchstack
8.8 High Eventin Plugin wp-event-solution PHP Object Injection ≤ 4.1.3 Fixed in 4.1.4 CVE-2025-68047 Patchstack
9.0 Critical Event Tickets with Ticket Scanner Plugin event-tickets-with-ticket-scanner Remote Code Execution No login needed ≤ 2.8.5 Fixed in 2.8.6 CVE-2025-68015 Patchstack
6.5 Medium Event Espresso 4 Decaf Plugin event-espresso-decaf Broken Access Control Settings Change No login needed ≤ 5.0.37.decaf Fixed in 5.0.53.decaf CVE-2025-68007 Patchstack
6.5 Medium Tickera Plugin tickera-event-ticketing-system Broken Access Control ≤ 3.5.6.2 Fixed in 3.5.6.3 CVE-2025-67939 Patchstack
9.9 Critical News Event Plugin news-event Arbitrary File Upload ≤ 1.0.1 Fixed in 1.0.2 CVE-2025-62056 Patchstack
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control Missing Authorization to Authenticated (Subscriber+) Data Migration Control ≤ 6.15.13 CVE-2025-15043 Wordfence
5.3 Medium Community Events Plugin community-events Broken Access Control Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter No login needed ≤ 1.5.6 CVE-2025-14029 Wordfence
5.3 Medium EventPrime - Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Information Disclosure Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API No login needed ≤ 4.2.7.0 CVE-2025-14507 Wordfence
7.2 High Eventin – Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) Plugin wp-event-solution Broken Access Control Event Manager, Event Booking, Calendar, Tickets and Registration Plugin (AI Powered) <= 4.0.51 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting via 'post_settings' No login needed ≤ 4.0.51 CVE-2025-14657 Wordfence
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Broken Access Control Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions No login needed ≤ 1.2.38 CVE-2025-14720 Wordfence
4.3 Medium Tickera Plugin tickera-event-ticketing-system Broken Access Control ≤ 3.5.6.4 Fixed in 3.5.6.5 CVE-2025-69355 Patchstack
5.4 Medium The Events Calendar Plugin the-events-calendar Broken Access Control ≤ 6.15.12.2 Fixed in 6.15.13 CVE-2025-69352 Patchstack
4.3 Medium The Events Calendar Countdown Addon Plugin countdown-for-the-events-calendar Broken Access Control ≤ 1.4.15 Fixed in 1.4.16 CVE-2025-69348 Patchstack
4.3 Medium Event Organiser Plugin event-organiser Broken Access Control ≤ 3.12.8 CVE-2025-69012 Patchstack
5.9 Medium AM Events Plugin am-events Cross-Site Scripting ≤ 1.13.1 CVE-2025-69006 Patchstack
5.3 Medium Google Calendar Events Plugin google-calendar-events Broken Access Control Insecure Direct Object References (IDOR) No login needed ≤ 3.5.9 Fixed in 3.6.0 CVE-2025-68979 Patchstack
6.4 Medium Calendar Plugin calendar Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'event_desc' ≤ 1.3.16 CVE-2025-14548 Wordfence
6.4 Medium Events Manager Plugin events-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode ≤ 7.2.2.1 CVE-2025-12976 Wordfence
4.3 Medium Events Manager – Calendar, Bookings, Tickets, and more! Plugin events-manager Cross-Site Request Forgery Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion No login needed ≤ 7.2.2.2 CVE-2025-12407 Wordfence
5.3 Medium Events Manager Plugin events-manager Information Disclosure Unauthenticated Information Exposure No login needed ≤ 7.2.2.2 CVE-2025-12408 Wordfence
6.5 Medium EventON Plugin eventon Cross-Site Scripting ≤ 4.9.12 CVE-2025-63064 Patchstack
5.3 Medium WP Google Analytics Events Plugin wp-google-analytics-events Information Disclosure Sensitive Data Exposure No login needed ≤ 2.8.2 CVE-2025-63009 Patchstack
4.3 Medium EventPrime Plugin eventprime-event-calendar-management Information Disclosure Sensitive Data Exposure ≤ 4.2.4.1 Fixed in 4.2.5.0 CVE-2025-63007 Patchstack
4.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control ≤ 4.2.4.1 Fixed in 4.2.5.0 CVE-2025-63006 Patchstack
4.3 Medium Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution Plugin fluent-booking Broken Access Control The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management ≤ 1.9.11 CVE-2025-13756 Wordfence
2.7 Low Timetable and Event Schedule by MotoPress Plugin mp-timetable Information Disclosure Contributor+ Event Disclosure via IDOR < 2.4.16 Fixed in 2.4.16 CVE-2025-12954 WPScan
5.3 Medium WpEvently Plugin mage-eventpress Broken Access Control No login needed ≤ 5.0.4 Fixed in 5.0.5 CVE-2025-66083 Patchstack
5.3 Medium WpEvently Plugin mage-eventpress Broken Access Control No login needed ≤ 5.0.4 Fixed in 5.0.5 CVE-2025-66082 Patchstack
7.5 High Community Events Plugin community-events SQL Injection Unauthenticated SQL Injection No login needed ≤ 1.5.4 CVE-2025-12646 Wordfence
7.5 High Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking SQL Injection Amelia <= 1.2.35 - Unauthenticated SQL Injection via search No login needed ≤ 1.2.35 CVE-2025-12482 Wordfence
6.4 Medium Eventbee Ticketing Widget Plugin eventbee-ticketing-widget Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0 CVE-2025-11856 Wordfence
4.3 Medium EventPrime – Events Calendar, Bookings and Tickets Plugin eventprime-event-calendar-management Broken Access Control Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation ≤ 4.2.0.0 CVE-2025-12498 Wordfence
6.5 Medium Ovatheme Events Manager Plugin Broken Access Control Missing Authorization No login needed ≤ 1.8.6 CVE-2025-7663 Wordfence
5.3 Medium imEvent Plugin imevent Broken Access Control No login needed ≤ 3.4.0 CVE-2025-58243 Patchstack
5.3 Medium The Events Calendar Plugin the-events-calendar Information Disclosure Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure No login needed ≤ 6.15.9 CVE-2025-12192 Wordfence
7.5 High The Events Calendar Plugin the-events-calendar SQL Injection Unauthenticated SQL Injection via s No login needed 6.15.1.1 – 6.15.9 CVE-2025-12197 Wordfence
7.2 High Community Events Plugin community-events Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.5.2 CVE-2025-11995 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only