WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,751–2,800 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 56 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.0 Medium	PDF for Elementor Forms + Drag And Drop Template Builder Plugin `pdf-for-elementor-forms`	Broken Access Control	`≤ 5.5.1` Fixed in `5.6.1`	May 20, 2026	`CVE-2026-45443`	Patchstack
5.3 Medium	Slider Revolution Plugin	Information Disclosure Unauthenticated Sensitive Information Exposure via 'sliders/stream' No login needed	`6.0 – 6.7.54, 7.0 – 7.0.9`	May 20, 2026	`CVE-2026-6728`	Wordfence
4.3 Medium	Anomify AI Plugin `anomify`	Cross-Site Request Forgery No login needed	`≤ 0.3.6`	May 20, 2026	`CVE-2026-6405`	Wordfence
5.8 Medium	Decent Comments Plugin `decent-comments`	Information Disclosure Unauthenticated Email Address Disclosure No login needed	`< 3.0.2` Fixed in `3.0.2`	May 20, 2026	`CVE-2026-7385`	WPScan
6.1 Medium	Email Encoder Plugin `email-encoder-bundle`	Cross-Site Scripting Unauthenticated Stored XSS No login needed	`< 2.4.7` Fixed in `2.4.7`	May 20, 2026	`CVE-2026-5776`	WPScan
6.4 Medium	AI Chatbot & Workflow Automation by AIWU Plugin `ai-copilot-content-generator`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header	`≤ 1.4.14`	May 20, 2026	`CVE-2026-2955`	Wordfence
4.3 Medium	Photo Gallery, Sliders, Proofing and Themes Plugin `nextgen-gallery`	Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Image Deletion via REST API	`≤ 4.2.0`	May 20, 2026	`CVE-2026-6566`	Wordfence
4.3 Medium	All in One SEO Plugin `all-in-one-seo-pack`	Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data	`≤ 4.9.7`	May 20, 2026	`CVE-2026-5075`	Wordfence
5.3 Medium	Xpro Addons — 140+ Widgets for Elementor Plugin `xpro-elementor-addons`	Broken Access Control Missing Authorization to Unauthenticated Xpro Template Creation No login needed	`≤ 1.5.0`	May 20, 2026	`CVE-2025-15369`	Wordfence
6.4 Medium	Faces of Users Plugin `faces-of-users`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute	`≤ 0.0.3`	May 20, 2026	`CVE-2026-8038`	Wordfence
6.4 Medium	Logo Manager For Enamad Plugin `logo-manager-for-enamad`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 0.7.4`	May 20, 2026	`CVE-2026-6549`	Wordfence
6.1 Medium	Word 2 Cash Plugin `word-2-cash`	Cross-Site Request Forgery Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page No login needed	`≤ 0.9.2`	May 20, 2026	`CVE-2026-6395`	Wordfence
4.3 Medium	Bottom Bar Plugin `bottom-bar`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed	`≤ 0.1.7`	May 20, 2026	`CVE-2026-6401`	Wordfence
4.3 Medium	Child Height Predictor by Ostheimer Plugin `child-height-predictor`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update via Plugin Settings Form No login needed	`≤ 1.3`	May 20, 2026	`CVE-2026-6400`	Wordfence
4.9 Medium	Read More & Accordion Plugin `expand-maker`	SQL Injection Authenticated (Administrator+) SQL Injection via 'orderby' Parameter	`≤ 3.5.7`	May 20, 2026	`CVE-2026-7472`	Wordfence
4.4 Medium	General Options Plugin `general-options`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter	`≤ 1.1.0`	May 20, 2026	`CVE-2026-6399`	Wordfence
6.5 Medium	Oliver POS Plugin `oliver-pos`	Broken Access Control Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header No login needed	`≤ 2.4.2.6`	May 20, 2026	`CVE-2026-6072`	Wordfence
4.3 Medium	Remove Yellow BGBOX Plugin `remove-yellow-bgbox`	Cross-Site Request Forgery No login needed	`≤ 1.0`	May 20, 2026	`CVE-2026-8424`	Wordfence
4.3 Medium	Amazon Scraper Plugin `amazon-scraper`	Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update No login needed	`≤ 1.1`	May 20, 2026	`CVE-2026-8419`	Wordfence
6.4 Medium	診断ジェネレータ作成プラグイン Plugin `os-diagnosis-generator`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter	`≤ 1.4.16`	May 20, 2026	`CVE-2026-5293`	Wordfence
5.4 Medium	Nexa Blocks Plugin `nexa-blocks`	Server-Side Request Forgery Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter No login needed	`≤ 1.1.1`	May 20, 2026	`CVE-2026-6394`	Wordfence
6.1 Medium	BLOGCHAT Chat System Plugin `blogchat-chat-system`	Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update No login needed	`≤ 1.3.6.3`	May 20, 2026	`CVE-2026-8420`	Wordfence
6.1 Medium	Sentence To SEO (keywords, description and tags) Plugin `sentence-to-seo`	Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters No login needed	`≤ 1.0`	May 20, 2026	`CVE-2026-6391`	Wordfence
4.3 Medium	TypeSquare Webfonts for ConoHa Plugin `ts-webfonts-for-conoha`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter	`≤ 2.0.4`	May 20, 2026	`CVE-2026-8610`	Wordfence
6.1 Medium	VatanSMS WP SMS Plugin `wp-sms-vatansms-com`	Cross-Site Scripting Reflected Cross-Site Scripting via 'page' Parameter No login needed	`≤ 1.01`	May 20, 2026	`CVE-2026-7462`	Wordfence
6.1 Medium	SponsorMe Plugin `sponsorme`	Cross-Site Scripting Reflected Cross-Site Scripting via PHP_SELF Parameter No login needed	`≤ 0.5.2`	May 20, 2026	`CVE-2026-8626`	Wordfence
4.3 Medium	JaviBola Custom Theme Test Plugin `javibola-custom-theme`	Cross-Site Request Forgery No login needed	`≤ 2.0.5`	May 20, 2026	`CVE-2026-8423`	Wordfence
4.3 Medium	Bigfishgames Syndicate Plugin `bigfishgames-syndicate`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Reset and Update No login needed	`≤ 1.2`	May 20, 2026	`CVE-2026-6452`	Wordfence
6.1 Medium	Correct Prices Plugin `correct-prices`	Cross-Site Scripting Reflected Cross-Site Scripting via PHP_SELF Parameter No login needed	`≤ 1.0`	May 20, 2026	`CVE-2026-8627`	Wordfence
4.4 Medium	Anomify AI Plugin `anomify`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter	`≤ 0.3.6`	May 20, 2026	`CVE-2026-6404`	Wordfence
6.5 Medium	Infility Global Plugin `infility-global`	SQL Injection Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter	`≤ 2.15.16`	May 20, 2026	`CVE-2026-8685`	Wordfence
6.4 Medium	Sticky Plugin `sticky`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute	`≤ 2.5.6`	May 20, 2026	`CVE-2026-6397`	Wordfence
6.1 Medium	LJ comments import: reloaded Plugin `lj-comments-import-reloaded`	Cross-Site Scripting Reflected Cross-Site Scripting via PHP_SELF Parameter No login needed	`≤ 0.97.1`	May 20, 2026	`CVE-2026-8624`	Wordfence
4.3 Medium	Games Catalog Plugin `game-catalog`	Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Game/Post Deletion No login needed	`≤ 1.2.0`	May 20, 2026	`CVE-2026-8418`	Wordfence
6.5 Medium	Kirki Plugin `kirki`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action	`≤ 6.0.6`	May 19, 2026	`CVE-2026-8096`	Wordfence
4.3 Medium	Presto Player Plugin `presto-player`	Broken Access Control	`≤ 4.1.3` Fixed in `4.1.4`	May 19, 2026	`CVE-2026-45442`	Patchstack
5.4 Medium	Feeds for YouTube Plugin	Broken Access Control Subscriber+ License Data Deletion	`< 2.6.4` Fixed in `2.6.4`	May 18, 2026	`CVE-2026-1631`	WPScan
6.2 Medium	Simple Fields Plugin	Local File Inclusion Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath No login needed	`0.2 – 0.3.5`	May 17, 2026	`CVE-2018-25324`	VulnCheck
6.4 Medium	Cookie Law Bar Plugin `cookie-law-bar`	Cross-Site Scripting WordPress Plugin Cookie Law Bar 1.2.1 Stored XSS via clb_bar_msg	`1.2.1`	May 16, 2026	`CVE-2021-47957`	VulnCheck
6.2 Medium	Backup Plugin	Local File Inclusion WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion No login needed	`2.3.9`	May 16, 2026	`CVE-2020-37246`	VulnCheck
6.4 Medium	Theme Wibar Theme	Cross-Site Scripting WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component	`1.1.8`	May 16, 2026	`CVE-2020-37235`	VulnCheck
6.4 Medium	Buddypress Plugin `buddypress`	Cross-Site Scripting WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting	`6.2.0`	May 16, 2026	`CVE-2020-37233`	VulnCheck
4.3 Medium	Multicollab: Content Team Collaboration and Editorial Workflow Plugin `commenting-feature`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Collaboration Comment	`≤ 5.2`	May 16, 2026	`CVE-2025-4202`	Wordfence
5.3 Medium	Essential Chat Support Plugin `essential-chat-support`	Broken Access Control Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter No login needed	`≤ 1.0.1`	May 16, 2026	`CVE-2026-8681`	Wordfence
4.3 Medium	Classified Listing Plugin `classified-listing`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions	`≤ 5.3.10`	May 15, 2026	`CVE-2026-7563`	Wordfence
4.3 Medium	Notify Odoo Plugin `notify-odoo`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed	`≤ 1.0.1`	May 15, 2026	`CVE-2026-8425`	Wordfence
6.4 Medium	Advanced Custom Fields: Font Awesome Field Plugin `advanced-custom-fields-font-awesome`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via JSON Field	`≤ 5.0.2`	May 15, 2026	`CVE-2026-6415`	Wordfence
4.9 Medium	NEX-Forms – Ultimate Forms Plugin `nex-forms-express-wp-form-builder`	SQL Injection Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter	`≤ 9.1.12`	May 15, 2026	`CVE-2026-7046`	Wordfence
6.5 Medium	Smartcat Translator for WPML Plugin `smartcat-wpml`	Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Update No login needed	`≤ 3.1.77`	May 15, 2026	`CVE-2026-4683`	Wordfence
6.4 Medium	The7 Theme `dt-the7`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter	`≤ 14.3.2`	May 15, 2026	`CVE-2026-6646`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.