WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 201–250 of 1,456 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 5 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	RomanCart Ecommerce Plugin `romancart-ecommerce`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 2.0.8`	Jun 9, 2026	`CVE-2026-8880`	Wordfence
6.4 Medium	TinyMCE shortcode Addon Plugin `360crest-themeone-tinymce-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btnrel' Shortcode Attribute	`≤ 1.0.0`	Jun 9, 2026	`CVE-2026-10024`	Wordfence
6.4 Medium	Global Body Mass Index Calculator Plugin `global-body-mass-index-calculator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.2`	Jun 9, 2026	`CVE-2026-8883`	Wordfence
6.4 Medium	Extra Settings for RocketChat Plugin `extra-settings-for-rocketchat`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.1`	Jun 9, 2026	`CVE-2026-8841`	Wordfence
6.5 Medium	Photo Gallery by 10Web Plugin `photo-gallery`	SQL Injection Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter	`≤ 1.8.41`	Jun 6, 2026	`CVE-2026-9829`	Wordfence
6.4 Medium	Click to Chat Plugin `click-to-chat-for-whatsapp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Parameter	`≤ 4.39`	Jun 6, 2026	`CVE-2026-7795`	Wordfence
4.3 Medium	Page-list Plugin `page-list`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes	`≤ 6.2`	Jun 6, 2026	`CVE-2026-9008`	Wordfence
6.4 Medium	Simple SEO Slideshow Plugin `simple-seo-slideshow`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.2.8`	Jun 5, 2026	`CVE-2026-8900`	Wordfence
6.4 Medium	Express Payment For Stripe Plugin `wp-stripe-express`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.28.0`	Jun 5, 2026	`CVE-2026-8893`	Wordfence
6.4 Medium	DeMomentSomTres Shortcodes Plugin `demomentsomtres-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.1.1`	Jun 2, 2026	`CVE-2026-8885`	Wordfence
6.4 Medium	Easy Cart Plugin `easy-cart`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.8`	Jun 2, 2026	`CVE-2026-4080`	Wordfence
6.4 Medium	ZeM STL Plugin `zem-stl-viewer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	Jun 2, 2026	`CVE-2026-4081`	Wordfence
6.4 Medium	Simple Divi Shortcode Plugin `simple-divi-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.2`	May 29, 2026	`CVE-2026-9714`	Wordfence
6.5 Medium	Photo Gallery by 10Web Plugin `photo-gallery`	SQL Injection Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute	`≤ 1.8.40`	May 28, 2026	`CVE-2026-7048`	Wordfence
8.8 High	Crawlomatic Multipage Scraper Post Generator Plugin `crawlomatic-multipage-scraper-post-generator`	Remote Code Execution Authenticated (Author+) Remote Code Execution via 'callback_raw' Shortcode Attribute	`≤ 2.7.2`	May 28, 2026	`CVE-2026-9009`	Wordfence
6.4 Medium	Github Shortcode Plugin `github-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 0.1`	May 27, 2026	`CVE-2026-8042`	Wordfence
6.4 Medium	WPBakery Page Builder Addons by Livemesh Plugin `addons-for-visual-composer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.9.4`	May 27, 2026	`CVE-2026-2030`	Wordfence
6.4 Medium	Instant-Quote.co Quotation Page Plugin `iq-quotation-page`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.3.4`	May 27, 2026	`CVE-2026-8884`	Wordfence
6.4 Medium	Post Categories Gallery Plugin `post-category-gallery`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.0`	May 27, 2026	`CVE-2026-8867`	Wordfence
6.4 Medium	Auto Thumbnails Plugin `automatic-thumbnail`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	May 27, 2026	`CVE-2026-8899`	Wordfence
6.4 Medium	hk_shortcode Plugin `hk-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 1.0`	May 27, 2026	`CVE-2026-8886`	Wordfence
6.4 Medium	faq shortocde Plugin `faq-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute	`≤ 1.0`	May 27, 2026	`CVE-2026-8040`	Wordfence
6.4 Medium	Dideo Plugin `wp-dideo`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	May 27, 2026	`CVE-2026-8847`	Wordfence
6.4 Medium	Responsive Check Plugin `responsive-checker-real-time`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.0.3`	May 27, 2026	`CVE-2026-8844`	Wordfence
6.4 Medium	iWR Tooltip Plugin `iwr-tooltip`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	May 27, 2026	`CVE-2026-8894`	Wordfence
6.4 Medium	Easy Prism Syntax Highlighter Plugin `easy-prism-syntax-highlighter`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.2`	May 27, 2026	`CVE-2026-8875`	Wordfence
6.4 Medium	Content Slideshow Plugin `content-slideshow`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 2.4.1`	May 27, 2026	`CVE-2026-8873`	Wordfence
6.4 Medium	Islamic Database Plugin `islamic-database`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	May 27, 2026	`CVE-2026-8845`	Wordfence
6.4 Medium	BitForm Plugin `bitform`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.1.0`	May 27, 2026	`CVE-2026-8891`	Wordfence
6.4 Medium	Tuxquote Plugin `tuxquote`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.3`	May 27, 2026	`CVE-2026-8846`	Wordfence
6.4 Medium	Animate Your Content Plugin `animate-your-content`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.0`	May 27, 2026	`CVE-2026-8872`	Wordfence
6.4 Medium	Formidable Kinetic Plugin `formidable-kinetic`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.1.01`	May 27, 2026	`CVE-2026-8871`	Wordfence
6.4 Medium	My Email Shortcode Plugin `my-email-shortcode`	Cross-Site Scripting [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')]	`≤ 0.91`	May 27, 2026	`CVE-2026-8048`	Wordfence
6.4 Medium	Mutual Funds Data Plugin `mutual-funds-data`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 1.2.1`	May 27, 2026	`CVE-2026-8869`	Wordfence
6.4 Medium	Events In City Plugin `events-in-city`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.0`	May 27, 2026	`CVE-2026-8898`	Wordfence
6.4 Medium	jQuery googleslides Plugin `jquery-googleslides`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.3`	May 27, 2026	`CVE-2026-8866`	Wordfence
6.4 Medium	GNTT Post Title Ticker Plugin `gntt-post-title-ticker`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	May 27, 2026	`CVE-2026-8701`	Wordfence
6.4 Medium	Shortcode Buddy Plugin `shortcode-buddy`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.1.9.5`	May 27, 2026	`CVE-2026-8897`	Wordfence
6.4 Medium	Listen Shortcode Plugin `listen-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	May 27, 2026	`CVE-2026-8887`	Wordfence
7.5 High	Query Shortcode Plugin `query-shortcode`	Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'lens' Shortcode Attribute	`≤ 0.2.1`	May 27, 2026	`CVE-2026-9200`	Wordfence
6.4 Medium	Team Master Plugin `team-master`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.1.2`	May 27, 2026	`CVE-2026-8870`	Wordfence
6.4 Medium	GBI To Print Plugin `gbi-to-print`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute	`≤ 1.0`	May 27, 2026	`CVE-2026-8702`	Wordfence
6.4 Medium	Google+ Link Name Plugin `google-plus-name-link-popup-badge`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	May 27, 2026	`CVE-2026-8842`	Wordfence
6.4 Medium	Single Mailchimp Plugin `single-mailchimp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.4`	May 27, 2026	`CVE-2026-8868`	Wordfence
6.4 Medium	WP Iframe Geo Style for Amazon affiliates Plugin `wp-iframe-geo-style-for-amazon-affiliates`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute	`≤ 1.1`	May 27, 2026	`CVE-2026-8837`	Wordfence
6.4 Medium	Cryptocurrency Prijsvergelijking Widget Plugin `cryptocurrency-prijsvergelijking-widget`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute	`≤ 1.0`	May 27, 2026	`CVE-2026-8698`	Wordfence
6.4 Medium	Responsive Video Embedder Plugin `responsive-video-embedder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.1`	May 27, 2026	`CVE-2026-8877`	Wordfence
5.3 Medium	Nyla Theme `nyla`	Arbitrary Shortcode Execution No login needed	`≤ 1.7`	May 26, 2026	`CVE-2026-39642`	Patchstack
6.1 Medium	WP Blockade Plugin `wp-blockade`	Cross-Site Scripting Reflected Cross-Site Scripting via 'shortcode' Parameter No login needed	`≤ 0.9.14`	May 22, 2026	`CVE-2026-3481`	Wordfence
6.4 Medium	Avada (Fusion) Builder Plugin	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes	`≤ 3.15.2`	May 21, 2026	`CVE-2026-1543`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.