WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,501–2,550 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 51 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
9.9 Critical	WebinarIgnition Plugin `webinar-ignition`	Arbitrary File Deletion	`≤ 4.08.253` Fixed in `4.08.253`	May 27, 2026	`CVE-2026-42757`	Patchstack
9.9 Critical	QuickWebP – Compress / Optimize Images & Convert WebP \| SEO Friendly Plugin `quickwebp`	Arbitrary File Deletion Compress / Optimize Images & Convert WebP \| SEO Friendly plugin <= 3.2.7 - Arbitrary File Deletion	`≤ 3.2.7` Fixed in `3.2.8`	May 27, 2026	`CVE-2026-42756`	Patchstack
9.3 Critical	TableOn Plugin `posts-table-filterable`	SQL Injection No login needed	`≤ 1.0.5.1` Fixed in `1.0.6`	May 27, 2026	`CVE-2026-42755`	Patchstack
7.1 High	Favicon Plugin `favicon-by-realfavicongenerator`	Cross-Site Scripting No login needed	`≤ 1.3.46` Fixed in `1.3.47`	May 27, 2026	`CVE-2026-42754`	Patchstack
7.3 High	WCFM Membership Plugin `wc-multivendor-membership`	Broken Access Control No login needed	`≤ 2.11.10` Fixed in `2.11.11`	May 27, 2026	`CVE-2026-42753`	Patchstack
6.5 Medium	Booking Manager Plugin `booking-manager`	Cross-Site Scripting	`≤ 2.1.18` Fixed in `2.1.19`	May 27, 2026	`CVE-2026-42751`	Patchstack
6.5 Medium	WPComplete Plugin `wpcomplete`	Cross-Site Scripting	`≤ 2.9.5.4` Fixed in `2.9.5.5`	May 27, 2026	`CVE-2026-42750`	Patchstack
7.1 High	Disable Comments for Any Post Types (Remove comments) Plugin `comments-plus`	Authentication Bypass Broken Authentication	`≤ 1.3.0` Fixed in `1.3.1`	May 27, 2026	`CVE-2026-42749`	Patchstack
9.9 Critical	WPify Woo Czech Plugin `wpify-woo`	Arbitrary File Upload	`≤ 5.4.1` Fixed in `5.4.2`	May 27, 2026	`CVE-2026-42748`	Patchstack
9.3 Critical	Easy Form Builder Plugin `easy-form-builder`	SQL Injection No login needed	`≤ 4.0.6` Fixed in `4.0.7`	May 27, 2026	`CVE-2026-42747`	Patchstack
7.3 High	Smart Online Order for Clover Plugin `clover-online-orders`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 1.6.0` Fixed in `1.6.1`	May 27, 2026	`CVE-2026-42746`	Patchstack
7.3 High	Smart Online Order for Clover Plugin `clover-online-orders`	Authentication Bypass Broken Authentication No login needed	`≤ 1.6.0` Fixed in `1.6.1`	May 27, 2026	`CVE-2026-42745`	Patchstack
6.5 Medium	Ads by WPQuads Plugin `quick-adsense-reloaded`	Other Bypass Vulnerability No login needed	`≤ 3.0.2` Fixed in `3.0.3`	May 27, 2026	`CVE-2026-42744`	Patchstack
9.3 Critical	Tainacan Plugin `tainacan`	SQL Injection No login needed	`≤ 1.0.3` Fixed in `1.1.0`	May 27, 2026	`CVE-2026-42740`	Patchstack
7.1 High	Advanced IP Blocker Plugin `advanced-ip-blocker`	Cross-Site Scripting No login needed	`≤ 8.10.7` Fixed in `8.10.8`	May 27, 2026	`CVE-2026-42739`	Patchstack
7.1 High	Smart Online Order for Clover Plugin `clover-online-orders`	Cross-Site Scripting No login needed	`≤ 1.6.0` Fixed in `1.6.1`	May 27, 2026	`CVE-2026-42738`	Patchstack
8.6 High	VikBooking Hotel Booking Engine & PMS Plugin `vikbooking`	Arbitrary File Deletion No login needed	`≤ 1.8.9` Fixed in `1.8.10`	May 27, 2026	`CVE-2026-42737`	Patchstack
7.5 High	BP Better Messages Plugin `bp-better-messages`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 2.14.16` Fixed in `2.15.0`	May 27, 2026	`CVE-2026-42736`	Patchstack
8.2 High	KiviCare Plugin `kivicare-clinic-management-system`	Authentication Bypass Broken Authentication No login needed	`≤ 4.3.0` Fixed in `4.4.0`	May 27, 2026	`CVE-2026-42735`	Patchstack
7.1 High	WPCS Plugin `currency-switcher`	Cross-Site Scripting No login needed	`≤ 1.3.1` Fixed in `1.3.2`	May 27, 2026	`CVE-2026-42733`	Patchstack
6.5 Medium	Ads by WPQuads Plugin `quick-adsense-reloaded`	Authentication Bypass Broken Authentication No login needed	`≤ 3.0.2` Fixed in `3.0.3`	May 27, 2026	`CVE-2026-42732`	Patchstack
8.5 High	MasterStudy LMS Plugin `masterstudy-lms-learning-management-system`	SQL Injection	`≤ 3.7.29` Fixed in `3.7.30`	May 27, 2026	`CVE-2026-42730`	Patchstack
7.1 High	HT Contact Form 7 Plugin `ht-contactform`	Cross-Site Scripting No login needed	`≤ 2.8.2` Fixed in `2.8.3`	May 27, 2026	`CVE-2026-42728`	Patchstack
6.5 Medium	Checkout Files Upload for WooCommerce Plugin `checkout-files-upload-woocommerce`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 2.2.5` Fixed in `2.2.6`	May 27, 2026	`CVE-2026-42725`	Patchstack
7.1 High	Geo Mashup Plugin `geo-mashup`	Cross-Site Scripting No login needed	`≤ 1.13.19` Fixed in `1.13.20`	May 27, 2026	`CVE-2026-42734`	Patchstack
9.8 Critical	miniorange otp verification Plugin `miniorange-otp-verification`	Privilege Escalation No login needed	`≤ 5.4.9` Fixed in `5.5.0`	May 27, 2026	`CVE-2026-42731`	Patchstack
7.1 High	PropertyHive Plugin `propertyhive`	Cross-Site Scripting No login needed	`≤ 2.2.2` Fixed in `2.2.3`	May 27, 2026	`CVE-2026-42729`	Patchstack
9.3 Critical	Active Products Tables for WooCommerce Plugin `profit-products-tables-for-woocommerce`	SQL Injection No login needed	`≤ 1.0.8` Fixed in `1.0.9`	May 27, 2026	`CVE-2026-42727`	Patchstack
6.5 Medium	AWP Classifieds Plugin `another-wordpress-classifieds-plugin`	Broken Access Control No login needed	`≤ 4.4.5` Fixed in `4.4.6`	May 27, 2026	`CVE-2026-42726`	Patchstack
6.5 Medium	Master Slider Plugin `master-slider`	Cross-Site Scripting	`≤ 3.10.8` Fixed in `3.10.9`	May 27, 2026	`CVE-2026-48968`	Patchstack
6.5 Medium	GenerateBlocks Plugin `generateblocks`	Information Disclosure Sensitive Data Exposure	`≤ 2.1.0` Fixed in `2.1.1`	May 27, 2026	`CVE-2026-48877`	Patchstack
7.1 High	Themebox - Digital Products Ecommerce Theme `themebox`	Cross-Site Scripting Digital Products Ecommerce theme <= 1.4.2 - Cross Site Scripting (XSS) No login needed	`≤ 1.4.2`	May 27, 2026	`CVE-2025-52747`	Patchstack
7.1 High	Felan Framework Plugin `felan-framework`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 1.1.3`	May 27, 2026	`CVE-2025-22741`	Patchstack
4.3 Medium	GoStats Plugin `gostats-for-wordpress`	Cross-Site Request Forgery Cross-Site Request Forgery via gostats_manage() Function No login needed	`≤ 1.4`	May 27, 2026	`CVE-2026-8943`	Wordfence
4.3 Medium	Yoast SEO Plugin `wordpress-seo`	Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter	`≤ 26.5`	May 27, 2026	`CVE-2025-14481`	Wordfence
7.1 High	Woocommerce Envato Affiliates Plugin `wooenvato`	Broken Access Control Settings Change	`≤ 1.2.1`	May 26, 2026	`CVE-2025-14361`	Patchstack
5.3 Medium	Taxi Booking Manager for WooCommerce Plugin `ecab-taxi-booking-manager`	Broken Access Control No login needed	`≤ 2.0.1` Fixed in `2.0.2`	May 26, 2026	`CVE-2026-25426`	Patchstack
4.3 Medium	Tiktok Feed Plugin `b-tiktok-feed`	Broken Access Control	`≤ 1.0.24` Fixed in `1.0.25`	May 26, 2026	`CVE-2026-24520`	Patchstack
4.3 Medium	WpBookingly Plugin `service-booking-manager`	Broken Access Control	`≤ 1.2.9` Fixed in `1.3.0`	May 26, 2026	`CVE-2026-25444`	Patchstack
6.3 Medium	WpTravelly Plugin `tour-booking-manager`	Broken Access Control	`≤ 2.1.5` Fixed in `2.1.6`	May 26, 2026	`CVE-2026-27331`	Patchstack
5.3 Medium	Paid Videochat Turnkey Site Plugin `ppv-live-webcams`	Broken Access Control No login needed	`≤ 7.3.23` Fixed in `7.3.24`	May 26, 2026	`CVE-2026-24590`	Patchstack
4.3 Medium	RepairBuddy Plugin `computer-repair-shop`	Broken Access Control	`≤ 4.1121` Fixed in `4.1125`	May 26, 2026	`CVE-2026-24638`	Patchstack
6.5 Medium	Geo Mashup Plugin `geo-mashup`	Cross-Site Scripting	`≤ 1.13.18` Fixed in `1.13.19`	May 26, 2026	`CVE-2026-27427`	Patchstack
5.3 Medium	Nyla Theme `nyla`	Arbitrary Shortcode Execution No login needed	`≤ 1.7`	May 26, 2026	`CVE-2026-39642`	Patchstack
7.5 High	SW Core Plugin `sw_core`	Local File Inclusion	`≤ 1.7.18`	May 26, 2026	`CVE-2026-39661`	Patchstack
5.3 Medium	Mayosis Core Plugin `mayosis-core`	Broken Access Control No login needed	`≤ 5.4.7`	May 26, 2026	`CVE-2026-39655`	Patchstack
5.4 Medium	NanoCare Theme `nanocare`	Broken Access Control	`< 1.2.2` Fixed in `1.2.2`	May 25, 2026	`CVE-2026-32389`	Patchstack
6.5 Medium	SePay Gateway Plugin `sepay-gateway`	Information Disclosure Sensitive Data Exposure	`≤ 1.1.20` Fixed in `1.1.21`	May 25, 2026	`CVE-2026-42763`	Patchstack
9.3 Critical	eMagicOne Store Manager Plugin `store-manager-connector`	SQL Injection No login needed	`≤ 1.3.2`	May 25, 2026	`CVE-2026-42773`	Patchstack
9.3 Critical	JetEngine Plugin `jet-engine`	SQL Injection No login needed	`≤ 3.8.8.1` Fixed in `3.8.8.2`	May 25, 2026	`CVE-2026-42774`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.