WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 2,851–2,900 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 58 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Skysa Text Ticker App Plugin `skysa-text-ticker-app`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Modification via 'Save Settings' Form No login needed	`≤ 1.4`	May 12, 2026	`CVE-2026-6710`	Wordfence
6.4 Medium	Credits Shortcode Plugin `source-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute	`≤ 1.2`	May 12, 2026	`CVE-2026-6256`	Wordfence
4.3 Medium	Woo Commerce Minimum Weight Plugin `woo-commerce-min-weight`	Cross-Site Request Forgery Cross-Site Request Forgery via Settings Update Form No login needed	`≤ 3.0.1`	May 12, 2026	`CVE-2026-6932`	Wordfence
5.3 Medium	Smart Appointment & Booking Plugin `smart-appointment-booking`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Booking Cancellation No login needed	`≤ 1.0.8`	May 12, 2026	`CVE-2026-5693`	Wordfence
4.3 Medium	Coinbase Commerce for Contact Form 7 Plugin `coinbase-commerce-for-contact-form-7`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter	`≤ 1.1.2`	May 12, 2026	`CVE-2026-6709`	Wordfence
6.4 Medium	Advanced Social Media Icons Plugin `advanced-social-media-icons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode	`≤ 1.2`	May 12, 2026	`CVE-2026-7659`	Wordfence
6.4 Medium	Voyage Plus Plugin `voyage-plus`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode	`≤ 1.0.6`	May 12, 2026	`CVE-2026-5715`	Wordfence
4.3 Medium	Zawgyi Embed Plugin `zawgyi-embed`	Cross-Site Request Forgery Cross-Site Request Forgery via 'zawgyi_forceCSS' Parameter No login needed	`≤ 2.1.1`	May 12, 2026	`CVE-2026-7616`	Wordfence
6.1 Medium	Tm – WordPress Redirection Plugin `tm-wordpress-redirection`	Cross-Site Request Forgery WordPress Redirection <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed	`≤ 1.2`	May 12, 2026	`CVE-2026-7561`	Wordfence
6.4 Medium	Next Date Plugin `nextdate`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute	`≤ 1.0`	May 12, 2026	`CVE-2026-4920`	Wordfence
4.3 Medium	Forms Rb Plugin `forms-rb`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter	`≤ 1.1.9`	May 12, 2026	`CVE-2026-7050`	Wordfence
6.4 Medium	Quick Table Plugin `quick-table`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute	`≤ 1.0.0`	May 12, 2026	`CVE-2026-6237`	Wordfence
6.4 Medium	SP Blog Designer Plugin `sp-blog-designer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'design' Attribute	`≤ 1.0.0`	May 12, 2026	`CVE-2026-4859`	Wordfence
4.8 Medium	GWD Connect Plugin `graphic-web-design-inc`	Broken Access Control Unauthenticated Limited Code Execution via update_agent No login needed	`≤ 2.9`	May 12, 2026	`CVE-2026-6663`	Wordfence
5.3 Medium	Slek Gateway for WooCommerce Plugin `slek-gateway-for-woocommerce`	Information Disclosure Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields No login needed	`≤ 1.0`	May 12, 2026	`CVE-2026-7626`	Wordfence
6.1 Medium	AzonPost Plugin `azonpost`	Cross-Site Scripting Reflected Cross-Site Scripting No login needed	`≤ 1.3`	May 12, 2026	`CVE-2026-7437`	Wordfence
4.9 Medium	WP SEO Structured Data Schema Plugin `wp-seo-structured-data-schema`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via '_kcseo_ative_tab' Parameter	`≤ 2.8.1`	May 12, 2026	`CVE-2026-3604`	Wordfence
6.4 Medium	Bootstrap Shortcode Plugin `bootstrap-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode	`≤ 1.0`	May 12, 2026	`CVE-2026-7661`	Wordfence
4.3 Medium	WP-Redirection Plugin `wp-redirection`	Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed	`≤ 1.0.3`	May 12, 2026	`CVE-2026-7562`	Wordfence
6.4 Medium	Fancy Image Show Plugin `fancy-image-show`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 9.1`	May 12, 2026	`CVE-2026-5340`	Wordfence
4.3 Medium	Rate Star Review Vote Plugin `rate-star-review`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter	`≤ 1.6.4`	May 12, 2026	`CVE-2026-4301`	Wordfence
6.4 Medium	Shortcodely Plugin `shortcodely`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute	`≤ 1.0.1`	May 12, 2026	`CVE-2026-6913`	Wordfence
6.1 Medium	Pricing Tables for WP Plugin `awesome-pricing-tables-lite-by-optimalplugins`	Cross-Site Scripting Reflected Cross-Site Scripting via 'page' Parameter No login needed	`≤ 1.1.0`	May 12, 2026	`CVE-2026-6808`	Wordfence
5.3 Medium	HEL Online Classroom: AI-powered Online Classrooms Plugin `hel-online-classroom`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter No login needed	`≤ 1.0.3`	May 12, 2026	`CVE-2026-6708`	Wordfence
6.4 Medium	Picture Gallery Plugin `picture-gallery`	Cross-Site Scripting WordPress Picture Gallery 1.4.2 Stored XSS via Edit Content URL	`1.4.2`	May 10, 2026	`CVE-2021-47951`	VulnCheck
5.4 Medium	Payments Plugin GetPaid Plugin `invoicing`	Content Injection WordPress GetPaid Plugin 2.4.6 HTML Injection via Help Text	`2.4.6`	May 10, 2026	`CVE-2021-47948`	VulnCheck
6.4 Medium	Filterable Portfolio Gallery Plugin `fg-gallery`	Cross-Site Scripting WordPress Plugin Filterable Portfolio Gallery 1.0 Stored XSS	`1.0`	May 10, 2026	`CVE-2021-47929`	VulnCheck
6.4 Medium	WP Symposium Pro Plugin `wp-symposium-pro`	Cross-Site Scripting WordPress Plugin WP Symposium Pro 2021.10 Stored XSS via wps_admin_forum_add_name	`2021.10`	May 10, 2026	`CVE-2021-47927`	VulnCheck
6.4 Medium	Ultimate Product Catalogue Plugin `ultimate-product-catalogue`	Cross-Site Scripting WordPress Plugin Ultimate Product Catalogue 5.8.2 Stored XSS via price	`5.8.2`	May 10, 2026	`CVE-2021-47924`	VulnCheck
6.4 Medium	Slider by Soliloquy Plugin `soliloquy-lite`	Cross-Site Scripting WordPress Plugin Slider by Soliloquy 2.6.2 Stored XSS	`2.6.2`	May 10, 2026	`CVE-2021-47922`	VulnCheck
6.4 Medium	AccessPress Social Icons Plugin `accesspress-social-icons`	Cross-Site Scripting WordPress Plugin AccessPress Social Icons 1.8.2 Stored XSS	`1.8.2`	May 10, 2026	`CVE-2021-47910`	VulnCheck
5.4 Medium	WordPress Plugin AAWP Plugin	Cross-Site Scripting WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter	`3.16`	May 10, 2026	`CVE-2022-50970`	VulnCheck
6.4 Medium	IP2Location Country Blocker Plugin `ip2location-country-blocker`	Cross-Site Scripting WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS	`2.26.7`	May 10, 2026	`CVE-2022-50961`	VulnCheck
6.1 Medium	International Sms For Contact Form Plugin `cf7-international-sms-integration`	Cross-Site Scripting WordPress International Sms Contact Form 7 Integration 1.2 XSS No login needed	`1.2`	May 10, 2026	`CVE-2022-50960`	VulnCheck
6.1 Medium	Contact Form Builder Plugin `contact-forms-builder`	Cross-Site Scripting WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php No login needed	`1.6.1`	May 10, 2026	`CVE-2022-50959`	VulnCheck
6.1 Medium	Jetpack Plugin `jetpack`	Cross-Site Scripting WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php No login needed	`9.1`	May 10, 2026	`CVE-2022-50958`	VulnCheck
6.2 Medium	amministrazione-aperta Plugin `amministrazione-aperta`	Path Traversal WordPress Plugin amministrazione-aperta 3.7.3 Local File Read No login needed	`3.7.3`	May 10, 2026	`CVE-2022-50956`	VulnCheck
4.3 Medium	Curtain Plugin `curtain`	Cross-Site Request Forgery WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery	`1.0.2`	May 10, 2026	`CVE-2022-50955`	VulnCheck
6.2 Medium	cab-fare-calculator Plugin `cab-fare-calculator`	Local File Inclusion WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion No login needed	`1.0.3`	May 10, 2026	`CVE-2022-50954`	VulnCheck
6.4 Medium	Videos sync PDF Plugin	Cross-Site Scripting WordPress Plugin Videos sync PDF 1.7.4 Stored XSS	`1.7.4`	May 10, 2026	`CVE-2022-50949`	VulnCheck
6.4 Medium	Testimonial Slider and Showcase Plugin `testimonial-slider-and-showcase`	Cross-Site Scripting WordPress Plugin Testimonial Slider and Showcase 2.2.6 Stored XSS	`2.2.6`	May 10, 2026	`CVE-2022-50947`	VulnCheck
6.4 Medium	Netroics Blog Posts Grid Plugin `netroics-blog-posts-grid`	Cross-Site Scripting WordPress Plugin Netroics Blog Posts Grid 1.0 Stored XSS	`1.0`	May 10, 2026	`CVE-2022-50946`	VulnCheck
5.3 Medium	Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity Plugin `logtivity`	Information Disclosure Unauthenticated Information Disclosure via REST API No login needed	`≤ 3.3.6`	May 9, 2026	`CVE-2026-8198`	Wordfence
5.3 Medium	LatePoint Plugin `latepoint`	Privilege Escalation Unauthenticated Account Takeover via Weak Password Recovery Mechanism No login needed	`≤ 5.5.0`	May 9, 2026	`CVE-2026-7652`	Wordfence
6.4 Medium	Sky Addons Plugin `sky-elementor-addons`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Custom Script	`≤ 3.3.2`	May 8, 2026	`CVE-2026-7475`	Wordfence
6.4 Medium	NMR Strava activities Plugin `nmr-strava-activities`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.14`	May 8, 2026	`CVE-2026-5341`	Wordfence
6.4 Medium	E2Pdf – Export Pdf Tool Plugin `e2pdf`	Cross-Site Scripting Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.32.17`	May 8, 2026	`CVE-2026-7650`	Wordfence
4.3 Medium	BEAR Plugin `woo-bulk-editor`	Cross-Site Request Forgery No login needed	`≤ 1.1.5` Fixed in `1.1.6`	May 7, 2026	`CVE-2026-27415`	Patchstack
5.3 Medium	PDF Poster Plugin `pdf-poster`	Broken Access Control No login needed	`≤ 2.4.1` Fixed in `2.5.0`	May 7, 2026	`CVE-2026-27416`	Patchstack
5.9 Medium	WEN Logo Slider Plugin `wen-logo-slider`	Cross-Site Scripting	`≤ 3.4.0` Fixed in `3.5`	May 7, 2026	`CVE-2025-62127`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.