WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 201–250 of 471 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Appointment Bookings for Zoom GoogleMeet and more – Wappointment Plugin wappointment Broken Access Control Wappointment <= 2.7.6 - Unauthenticated Insecure Direct Object Reference via Predictable 'edit_key' / 'appointmentkey' Parameter No login needed ≤ 2.7.6 CVE-2026-9188 Wordfence
8.8 High LatePoint Plugin latepoint Privilege Escalation Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter ≤ 5.6.3 CVE-2026-13228 Wordfence
6.5 Medium MotoPress Appointment Booking Plugin motopress-appointment-lite SQL Injection Authenticated (Staff+) SQL Injection via 's' Parameter ≤ 2.4.5 CVE-2026-13454 Wordfence
8.8 High Dokan Pro Plugin Privilege Escalation Authenticated (Vendor+) Privilege Escalation via update_capabilities REST Endpoint ≤ 5.0.4 CVE-2026-12224 Wordfence
7.5 High Ninja Forms Plugin ninja-forms Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint No login needed ≤ 3.14.1 CVE-2026-1239 Wordfence
7.5 High BookingPress Appointment Booking Pro Plugin bookingpress-appointment-booking-pro SQL Injection Unauthenticated SQL Injection via 'store_service_date' Parameter No login needed ≤ 5.7.1 CVE-2026-11823 Wordfence
4.3 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure ≤ 1.4.02 CVE-2026-12113 Wordfence
7.5 High Visualizer Plugin visualizer Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint No login needed ≤ 4.0.3 CVE-2026-13468 Wordfence
6.4 Medium CodePeople Post Map for Google Maps Plugin codepeople-post-map Cross-Site Scripting Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta ≤ 1.2.6 CVE-2026-13335 Wordfence
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting No login needed ≤ 1.6.12.2 Fixed in 1.6.12.4 CVE-2026-57317 Patchstack
7.5 High WP Forms Connector Plugin wp-forms-connector Broken Access Control Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint No login needed ≤ 1.8 CVE-2026-9178 Wordfence
5.3 Medium Devs Accounting Plugin devs-accounting Broken Access Control Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint No login needed ≤ 1.2.0 CVE-2026-9172 Wordfence
5.3 Medium STRABL Plugin strabl-a-checkout-solution Broken Access Control Unauthenticated Arbitrary Webhook Creation via REST API Endpoint No login needed ≤ 4.5 CVE-2026-3640 Wordfence
5.3 Medium WP DSGVO Tools (GDPR) Plugin shapepress-dsgvo Broken Access Control Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters) No login needed ≤ 3.1.39 CVE-2026-10034 Wordfence
6.4 Medium Appointment Booking Calendar Plugin creavi-booking-service Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Booking Field Label ≤ 1.4.4 CVE-2026-1856 Wordfence
4.3 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter ≤ 1.4.01 CVE-2026-12111 Wordfence
5.3 Medium Event Koi Lite Plugin eventkoi-lite Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints No login needed ≤ 1.3.13.1 CVE-2026-10029 Wordfence
6.4 Medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program Plugin mycred Cross-Site Scripting Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrap' Shortcode Attribute ≤ 3.1 CVE-2026-8607 Wordfence
7.5 High JetEngine Plugin jet-engine SQL Injection Unauthenticated SQL Injection via Listing Grid Load More AJAX Endpoint No login needed ≤ 3.8.10.1 CVE-2026-12360 Wordfence
7.5 High LatePoint Plugin latepoint Privilege Escalation Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset ≤ 5.5.1 CVE-2026-8176 Wordfence
7.5 High LatePoint Plugin latepoint Privilege Escalation ≤ 5.5.1 Fixed in 5.5.2 CVE-2026-49083 Patchstack
9.1 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control No login needed ≤ 1.1.9 Fixed in 1.2.0 CVE-2026-48881 Patchstack
7.5 High Bookly Plugin bookly-responsive-appointment-booking-tool Information Disclosure Sensitive Data Exposure No login needed ≤ 27.4 Fixed in 27.5 CVE-2026-42667 Patchstack
7.5 High Simply Schedule Appointments Plugin simply-schedule-appointments Information Disclosure Sensitive Data Exposure No login needed < 1.6.11.2 Fixed in 1.6.11.2 CVE-2026-42384 Patchstack
8.1 High WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Privilege Escalation No login needed ≤ 5.9.0 Fixed in 6.0.0 CVE-2026-39587 Patchstack
7.5 High Easy Appointments Plugin easy-appointments Broken Access Control No login needed ≤ 3.12.21 Fixed in 3.12.22 CVE-2026-39513 Patchstack
9.3 Critical Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection No login needed ≤ 1.6.9.27 Fixed in 1.6.9.29 CVE-2026-39493 Patchstack
7.1 High Simply Schedule Appointments Plugin simply-schedule-appointments Cross-Site Scripting No login needed ≤ 1.6.10.6 Fixed in 1.6.11.0 CVE-2026-39447 Patchstack
7.2 High Online Scheduling and Appointment Booking System – Bookly Plugin bookly-responsive-appointment-booking-tool Cross-Site Scripting Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie No login needed ≤ 27.2 CVE-2026-5513 Wordfence
5.3 Medium MapPress Maps Plugin mappress-google-maps-for-wordpress Broken Access Control Unauthenticated Insecure Direct Object Reference via REST API Endpoints No login needed ≤ 2.96.6 CVE-2026-8839 Wordfence
5.3 Medium WPForms Plugin wpforms-lite Other Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint No login needed ≤ 1.10.0.4 CVE-2026-7792 Wordfence
4.3 Medium LatePoint Plugin latepoint Cross-Site Request Forgery Cross-Site Request Forgery via invoices__change_status Action No login needed ≤ 5.6.0 CVE-2026-9719 Wordfence
7.5 High Simple History – Track, Log, and Audit WordPress Changes Plugin simple-history Privilege Escalation Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint ≤ 5.26.0 CVE-2026-7459 Wordfence
5.3 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint No login needed ≤ 1.6.11.8 CVE-2026-6937 Wordfence
4.3 Medium 3D Viewer Plugin ar-vr-3d-model-try-on Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint ≤ 2.0.1 CVE-2026-8682 Wordfence
7.5 High Appointment Booking Calendar Plugin simply-schedule-appointments SQL Injection Unauthenticated SQL Injection via 'append_where_sql' Parameter No login needed ≤ 1.6.11.8 CVE-2026-7797 Wordfence
7.2 High LiteSpeed Cache Plugin litespeed-cache Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via QUIC.cloud CCSS/UCSS REST API Endpoints No login needed ≤ 7.7 CVE-2026-3375 Wordfence
5.3 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Denial of Service Unauthenticated Denial of Service No login needed ≤ 1.6.11.5 CVE-2026-7493 Wordfence
4.3 Medium Slider by Soliloquy Plugin soliloquy-lite Information Disclosure Authenticated (Subscriber+) Information Disclosure via REST API Endpoint ≤ 2.8.1 CVE-2026-7636 Wordfence
4.3 Medium LatePoint Plugin latepoint Cross-Site Request Forgery Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route No login needed ≤ 5.3.2 CVE-2026-5365 Wordfence
5.3 Medium Smart Appointment & Booking Plugin smart-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Booking Cancellation No login needed ≤ 1.0.8 CVE-2026-5693 Wordfence
5.3 Medium LatePoint Plugin latepoint Privilege Escalation Unauthenticated Account Takeover via Weak Password Recovery Mechanism No login needed ≤ 5.5.0 CVE-2026-7652 Wordfence
6.5 Medium Appointment Booking Calendar Plugin simply-schedule-appointments Broken Access Control Unauthenticated Arbitrary Appointment View, Modification and Deletion No login needed ≤ 1.6.10.6 CVE-2026-4807 Wordfence
6.4 Medium LatePoint Plugin latepoint Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update ≤ 5.5.0 CVE-2026-7457 Wordfence
7.2 High LatePoint Plugin latepoint Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter No login needed ≤ 5.5.0 CVE-2026-7332 Wordfence
7.5 High easy-paypal-events-tickets Plugin easy-paypal-events-tickets Information Disclosure Easy PayPal Events & Tickets < 1.4 Information Disclosure via QR Code Endpoint No login needed < 1.4.0 Fixed in 1.4.0 CVE-2026-41471 VulnCheck
5.3 Medium Dokan: AI Powered WooCommerce Multivendor Marketplace Solution Plugin dokan-lite Information Disclosure Unauthenticated Information Disclosure in Store Reviews REST API Endpoint No login needed ≤ 4.3.1 CVE-2026-3504 Wordfence
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Broken Access Control Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint No login needed ≤ 2.1.2 CVE-2026-6449 Wordfence
6.5 Medium Widgets for Social Photo Feed Plugin social-photo-feed-widget Broken Access Control Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpoints No login needed ≤ 1.8 CVE-2025-14726 Wordfence
9.8 Critical User Verification by PickPlugins Plugin user-verification Authentication Bypass Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint No login needed ≤ 2.0.46 CVE-2026-7458 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only