WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.
Showing 201–250 of 1,279 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Islamic Database | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0 |
CVE-2026-8845 |
Wordfence | |
| 6.4 Medium | BitForm | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.1.0 |
CVE-2026-8891 |
Wordfence | |
| 6.4 Medium | Tuxquote | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.3 |
CVE-2026-8846 |
Wordfence | |
| 6.4 Medium | Animate Your Content | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0.0 |
CVE-2026-8872 |
Wordfence | |
| 6.4 Medium | Formidable Kinetic | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.1.01 |
CVE-2026-8871 |
Wordfence | |
| 6.4 Medium | My Email Shortcode | Cross-Site Scripting [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')] |
≤ 0.91 |
CVE-2026-8048 |
Wordfence | |
| 6.4 Medium | Mutual Funds Data | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute |
≤ 1.2.1 |
CVE-2026-8869 |
Wordfence | |
| 6.4 Medium | Events In City | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 3.0 |
CVE-2026-8898 |
Wordfence | |
| 6.4 Medium | jQuery googleslides | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.3 |
CVE-2026-8866 |
Wordfence | |
| 6.4 Medium | GNTT Post Title Ticker | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0 |
CVE-2026-8701 |
Wordfence | |
| 6.4 Medium | Shortcode Buddy | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.1.9.5 |
CVE-2026-8897 |
Wordfence | |
| 6.4 Medium | Listen Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0 |
CVE-2026-8887 |
Wordfence | |
| 6.4 Medium | Team Master | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.1.2 |
CVE-2026-8870 |
Wordfence | |
| 6.4 Medium | GBI To Print | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'div' Shortcode Attribute |
≤ 1.0 |
CVE-2026-8702 |
Wordfence | |
| 6.4 Medium | Google+ Link Name | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0 |
CVE-2026-8842 |
Wordfence | |
| 6.4 Medium | Single Mailchimp | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.4 |
CVE-2026-8868 |
Wordfence | |
| 6.4 Medium | WP Iframe Geo Style for Amazon affiliates | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'adid' Shortcode Attribute |
≤ 1.1 |
CVE-2026-8837 |
Wordfence | |
| 6.4 Medium | Cryptocurrency Prijsvergelijking Widget | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute |
≤ 1.0 |
CVE-2026-8698 |
Wordfence | |
| 6.4 Medium | Responsive Video Embedder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 0.1 |
CVE-2026-8877 |
Wordfence | |
| 5.3 Medium | Nyla | Arbitrary Shortcode Execution No login needed |
≤ 1.7 |
CVE-2026-39642 |
Patchstack | |
| 6.1 Medium | WP Blockade | Cross-Site Scripting Reflected Cross-Site Scripting via 'shortcode' Parameter No login needed |
≤ 0.9.14 |
CVE-2026-3481 |
Wordfence | |
| 6.4 Medium | Avada (Fusion) Builder | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Shortcodes |
≤ 3.15.2 |
CVE-2026-1543 |
Wordfence | |
| 6.4 Medium | Faces of Users | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute |
≤ 0.0.3 |
CVE-2026-8038 |
Wordfence | |
| 6.4 Medium | Logo Manager For Enamad | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute |
≤ 0.7.4 |
CVE-2026-6549 |
Wordfence | |
| 6.4 Medium | Sticky | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute |
≤ 2.5.6 |
CVE-2026-6397 |
Wordfence | |
| 6.4 Medium | The7 | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter |
≤ 14.3.2 |
CVE-2026-6646 |
Wordfence | |
| 6.4 Medium | Bold Page Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode |
≤ 5.6.8 |
CVE-2026-3694 |
Wordfence | |
| 6.5 Medium | Avada Builder | Path Traversal Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter |
≤ 3.15.2 |
CVE-2026-4782 |
Wordfence | |
| 6.4 Medium | Fluent Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute |
≤ 6.2.1 |
CVE-2026-6828 |
Wordfence | |
| 6.5 Medium | Advanced Custom Fields: Extended | Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed |
≤ 0.9.2.3 |
CVE-2025-15463 |
Wordfence | |
| 6.4 Medium | scratchblocks for WP | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute |
≤ 1.0.1 |
CVE-2026-6247 |
Wordfence | |
| 6.4 Medium | Credits Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute |
≤ 1.2 |
CVE-2026-6256 |
Wordfence | |
| 6.4 Medium | Advanced Social Media Icons | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode |
≤ 1.2 |
CVE-2026-7659 |
Wordfence | |
| 6.4 Medium | Voyage Plus | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode |
≤ 1.0.6 |
CVE-2026-5715 |
Wordfence | |
| 6.4 Medium | Next Date | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute |
≤ 1.0 |
CVE-2026-4920 |
Wordfence | |
| 6.4 Medium | Quick Table | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute |
≤ 1.0.0 |
CVE-2026-6237 |
Wordfence | |
| 6.4 Medium | Bootstrap Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode |
≤ 1.0 |
CVE-2026-7661 |
Wordfence | |
| 6.4 Medium | Fancy Image Show | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 9.1 |
CVE-2026-5340 |
Wordfence | |
| 6.4 Medium | Shortcodely | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute |
≤ 1.0.1 |
CVE-2026-6913 |
Wordfence | |
| 6.4 Medium | NMR Strava activities | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0.14 |
CVE-2026-5341 |
Wordfence | |
| 6.4 Medium | E2Pdf – Export Pdf Tool | Cross-Site Scripting Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
≤ 1.32.17 |
CVE-2026-7650 |
Wordfence | |
| 6.4 Medium | Affiliate Program Suite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode |
≤ 1.2.7 |
CVE-2026-6672 |
Wordfence | |
| 6.4 Medium | Simple Owl Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute |
≤ 2.1.1 |
CVE-2026-6255 |
Wordfence | |
| 6.4 Medium | WP-Clippy | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0.0 |
CVE-2026-5505 |
Wordfence | |
| 5.5 Medium | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute |
≤ 4.10.0 |
CVE-2026-5247 |
Wordfence | |
| 6.4 Medium | Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute |
≤ 2.1.0 |
CVE-2026-4730 |
Wordfence | |
| 6.4 Medium | NextMove Lite - Thank You Page for WooCommerce | Cross-Site Scripting Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode |
≤ 2.23.0 |
CVE-2026-0703 |
Wordfence | |
| 6.4 Medium | Jeg Kit for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute |
≤ 3.1.0 |
CVE-2026-6916 |
Wordfence | |
| 6.4 Medium | Simple Link Directory | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 8.9.2 |
CVE-2026-7209 |
Wordfence | |
| 6.4 Medium | WPC Smart Messages for WooCommerce | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute |
≤ 4.2.8 |
CVE-2026-6725 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.