WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,851–2,900 of 16,921 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 58 of 1
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Seriously Simple Podcasting Plugin seriously-simple-podcasting Broken Access Control No login needed ≤ 3.14.2 Fixed in 3.14.3 CVE-2026-39505 Patchstack
5.4 Medium InstaWP Connect Plugin instawp-connect Broken Access Control ≤ 0.1.2.5 Fixed in 0.1.2.7 CVE-2026-39504 Patchstack
5.3 Medium FOX Plugin woocommerce-currency-switcher Broken Access Control No login needed ≤ 1.4.5 Fixed in 1.4.6 CVE-2026-39501 Patchstack
6.5 Medium themesflat-addons-for-elementor Plugin themesflat-addons-for-elementor Cross-Site Scripting ≤ 2.3.2 Fixed in 2.3.3 CVE-2026-39500 Patchstack
7.6 High FOX Plugin woocommerce-currency-switcher SQL Injection ≤ 1.4.5 Fixed in 1.4.6 CVE-2026-39497 Patchstack
7.6 High YayMail Plugin yaymail SQL Injection ≤ 4.3.3 Fixed in 4.3.4 CVE-2026-39496 Patchstack
8.5 High Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection ≤ 1.6.9.27 Fixed in 1.6.9.29 CVE-2026-39495 Patchstack
6.5 Medium SureCart Plugin surecart Broken Access Control ≤ 4.0.2 Fixed in 4.0.3 CVE-2026-39488 Patchstack
7.6 High Amelia Plugin ameliabooking SQL Injection ≤ 2.1.1 Fixed in 2.1.2 CVE-2026-39487 Patchstack
8.5 High Download Monitor Plugin download-monitor SQL Injection ≤ 5.1.8 Fixed in 5.1.9 CVE-2026-39486 Patchstack
4.3 Medium Youtube Embed Plus Plugin youtube-embed-plus Broken Access Control ≤ 14.2.4 Fixed in 14.2.5 CVE-2026-39485 Patchstack
4.7 Medium Hide My WP Ghost Plugin hide-my-wp Open Redirect No login needed ≤ 7.0.00 Fixed in 7.0.00 CVE-2026-39484 Patchstack
6.5 Medium VK All in One Expansion Unit Plugin vk-all-in-one-expansion-unit Cross-Site Scripting ≤ 9.113.3 Fixed in 9.113.4 CVE-2026-39483 Patchstack
6.5 Medium Post Expirator Plugin post-expirator Cross-Site Scripting ≤ 4.9.4 Fixed in 4.10.0 CVE-2026-39482 Patchstack
7.6 High OttoKit Plugin suretriggers SQL Injection ≤ 1.1.20 Fixed in 1.1.21 CVE-2026-39479 Patchstack
4.3 Medium CartFlows Plugin cartflows Broken Access Control ≤ 2.2.3 Fixed in 2.2.4 CVE-2026-39477 Patchstack
4.3 Medium User Feedback Plugin userfeedback-lite Broken Access Control ≤ 1.10.1 Fixed in 1.11.0 CVE-2026-39476 Patchstack
7.6 High User Feedback Plugin userfeedback-lite SQL Injection ≤ 1.10.1 Fixed in 1.11.0 CVE-2026-39475 Patchstack
5.3 Medium Simple History Plugin simple-history Information Disclosure Sensitive Data Exposure No login needed ≤ 5.24.0 Fixed in 5.24.1 CVE-2026-39473 Patchstack
4.3 Medium PageLayer Plugin pagelayer Information Disclosure Sensitive Data Exposure ≤ 2.0.8 Fixed in 2.0.9 CVE-2026-39469 Patchstack
7.6 High Broken Link Checker Plugin broken-link-checker SQL Injection ≤ 2.4.7 Fixed in 2.4.8 CVE-2026-39466 Patchstack
5.5 Medium Coming Soon Page, Under Construction & Maintenance Mode by SeedProd Plugin coming-soon Server-Side Request Forgery ≤ 6.19.8 Fixed in 6.19.9 CVE-2026-39464 Patchstack
6.4 Medium TableOn – WordPress Posts Table Filterable Plugin posts-table-filterable Cross-Site Scripting WordPress Posts Table Filterable <= 1.0.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute ≤ 1.0.4.4 CVE-2026-3513 Wordfence
5.3 Medium Hustle – Email Marketing, Lead Generation, Optins, Popups Plugin wordpress-popup Broken Access Control Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation No login needed ≤ 7.8.10.2 CVE-2026-2263 Wordfence
5.4 Medium Ocean Extra Plugin ocean-extra Broken Access Control ≤ 2.5.3 Fixed in 2.5.4 CVE-2026-34903 Patchstack
5.3 Medium LTL Freight Quotes – Worldwide Express Edition Plugin ltl-freight-quotes-worldwide-express-edition Broken Access Control Worldwide Express Edition plugin <= 5.2.1 - Broken Access Control No login needed ≤ 5.2.1 Fixed in 5.2.2 CVE-2026-34899 Patchstack
7.5 High Simple Social Media Share Buttons Plugin simple-social-buttons Cross-Site Request Forgery No login needed ≤ 6.2.0 Fixed in 6.2.1 CVE-2026-34904 Patchstack
7.5 High Under Construction, Coming Soon & Maintenance Mode Plugin under-construction-maintenance-mode Cross-Site Request Forgery No login needed ≤ 2.1.1 Fixed in 2.1.2 CVE-2026-34896 Patchstack
5.3 Medium Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More Plugin charitable Other Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.9.7 - Insufficient Verification of Data Authenticity to Unauthenticated Donation Status Forgery via Stripe Webhook No login needed ≤ 1.8.9.7 CVE-2026-3177 Wordfence
6.5 Medium Media LIbrary Assistant Plugin media-library-assistant Cross-Site Scripting ≤ 3.34 Fixed in 3.35 CVE-2026-34897 Patchstack
8.5 High Media LIbrary Assistant Plugin media-library-assistant SQL Injection ≤ 3.34 Fixed in 3.35 CVE-2026-34885 Patchstack
6.4 Medium Simple Shopping Cart Plugin wordpress-simple-paypal-shopping-cart Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shortcode ≤ 5.2.4 CVE-2026-0552 Wordfence
6.4 Medium Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem Plugin gutenverse Cross-Site Scripting Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'imageLoad' ≤ 3.4.6 CVE-2026-2924 Wordfence
6.5 Medium MSTW League Manager Plugin mstw-league-manager Cross-Site Scripting ≤ 2.10 CVE-2026-34890 Patchstack
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting < 3.21.4 Fixed in 3.21.4 CVE-2026-34889 Patchstack
6.5 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting ≤ 2.7.0 Fixed in 2.7.1 CVE-2026-34887 Patchstack
6.4 Medium Ibtana - WordPress Website Builder Plugin ibtana-visual-editor Cross-Site Scripting WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.2.5.7 CVE-2026-1834 Wordfence
5.4 Medium OpenStreetMap Plugin osm Cross-Site Scripting WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with… prior to 6.1.15 CVE-2026-33559 jpcert
9.1 Critical Nelio AB Testing Plugin nelio-ab-testing Remote Code Execution ≤ <= 8.2.7 Fixed in 8.2.8 CVE-2026-32573 Patchstack
6.8 Medium YML for Yandex Market Plugin yml-for-yandex-market Arbitrary File Deletion ≤ < 5.3.0 Fixed in 5.3.0 CVE-2026-32567 Patchstack
5.4 Medium PPWP Plugin password-protect-page Broken Access Control ≤ <= 1.9.15 Fixed in 1.9.16 CVE-2026-32562 Patchstack
7.5 High Restrict Content Plugin restrict-content Broken Access Control No login needed ≤ <= 3.2.22 Fixed in 3.2.23 CVE-2026-32546 Patchstack
7.1 High Taboola Pixel Plugin taboola-pixel Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ <= 1.1.4 Fixed in 1.1.5 CVE-2026-32545 Patchstack
7.1 High OOPSpam Anti-Spam Plugin oopspam-anti-spam Cross-Site Scripting No login needed ≤ <= 1.2.62 Fixed in 1.2.63 CVE-2026-32544 Patchstack
7.1 High Fusion Builder Plugin fusion-builder Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ < 3.15.0 Fixed in 3.15.0 CVE-2026-32542 Patchstack
6.5 Medium Premmerce Redirect Manager Plugin premmerce-redirect-manager Broken Access Control ≤ <= 1.0.12 Fixed in 1.0.13 CVE-2026-32541 Patchstack
7.1 High Bookly Plugin bookly-responsive-appointment-booking-tool Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ <= 26.7 Fixed in 26.8 CVE-2026-32540 Patchstack
9.3 Critical PublishPress Revisions Plugin revisionary SQL Injection No login needed ≤ <= 3.7.23 Fixed in 3.7.24 CVE-2026-32539 Patchstack
7.5 High SMTP Mailer Plugin smtp-mailer Information Disclosure Sensitive Data Exposure No login needed ≤ <= 1.1.24 Fixed in 1.1.25 CVE-2026-32538 Patchstack
7.5 High Visual Portfolio, Photo Gallery & Post Grid Plugin visual-portfolio Local File Inclusion ≤ <= 3.5.1 Fixed in 3.5.2 CVE-2026-32537 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only