WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 2,901–2,950 of 17,704 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | Bus Ticket Booking with Seat Reservation | Broken Access Control No login needed |
< 5.6.8 Fixed in 5.6.8 |
CVE-2025-66105 |
Patchstack | |
| 5.4 Medium | WPGraphQL | Cross-Site Request Forgery No login needed |
≤ 2.5.3 Fixed in 2.5.4 |
CVE-2025-68604 |
Patchstack | |
| 5.3 Medium | Happy Addons for Elementor | Information Disclosure Sensitive Data Exposure No login needed |
≤ 3.20.8 Fixed in 3.21.0 |
CVE-2026-25468 |
Patchstack | |
| 5.3 Medium | YITH WooCommerce Wishlist | Broken Access Control Insecure Direct Object References (IDOR) No login needed |
≤ 4.12.0 Fixed in 4.13.0 |
CVE-2026-27329 |
Patchstack | |
| 5.3 Medium | Royal Elementor Addons | Broken Access Control No login needed |
< 1.7.1053 Fixed in 1.7.1053 |
CVE-2026-25436 |
Patchstack | |
| 6.5 Medium | Royal Elementor Addons | Cross-Site Scripting |
< 1.7.1053 Fixed in 1.7.1053 |
CVE-2026-27421 |
Patchstack | |
| 6.5 Medium | Forminator Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook |
≤ 1.53.0 |
CVE-2026-6214 |
Wordfence | |
| 6.5 Medium | Appointment Booking Calendar | Broken Access Control Unauthenticated Arbitrary Appointment View, Modification and Deletion No login needed |
≤ 1.6.10.6 |
CVE-2026-4807 |
Wordfence | |
| 5.3 Medium | Forminator Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter |
≤ 1.51.1 |
CVE-2026-6222 |
Wordfence | |
| 6.4 Medium | LatePoint | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update |
≤ 5.5.0 |
CVE-2026-7457 |
Wordfence | |
| 6.4 Medium | Affiliate Program Suite | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode |
≤ 1.2.7 |
CVE-2026-6672 |
Wordfence | |
| 4.9 Medium | Fluent Forms | Path Traversal Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment |
≤ 6.2.1 |
CVE-2026-6344 |
Wordfence | |
| 4.3 Medium | Ninja Tables | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation |
≤ 5.2.6 |
CVE-2026-2306 |
Wordfence | |
| 6.5 Medium | All-in-One WP Migration Unlimited Extension | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download |
≤ 2.83 |
CVE-2026-5753 |
Wordfence | |
| 5.3 Medium | Mercado Pago payments for WooCommerce | Broken Access Control Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure No login needed |
≤ 8.7.11 |
CVE-2026-3208 |
Wordfence | |
| 6.5 Medium | Betheme | Arbitrary File Deletion Authenticated (Contributor+) Arbitrary File Deletion via 'mfn-icon-upload' |
≤ 28.4 |
CVE-2026-6262 |
Wordfence | |
| 4.3 Medium | User Registration & Membership | Broken Access Control Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification |
≤ 5.1.4 |
CVE-2026-3601 |
Wordfence | |
| 5.3 Medium | Forminator – Contact Form, Payment Form & Custom Form Builder | Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter No login needed |
≤ 1.52.0 |
CVE-2026-2729 |
Wordfence | |
| 6.5 Medium | GenerateBlocks | Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Dynamic Tag Replacements |
≤ 2.2.0 |
CVE-2026-3454 |
Wordfence | |
| 6.5 Medium | ElementsKit Elementor Addons | Broken Access Control Missing Authorization to Unauthenticated Widget Content Overwrite No login needed |
≤ 3.8.2 |
CVE-2026-4362 |
Wordfence | |
| 6.4 Medium | Royal Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'Follow Button Text' Parameter |
≤ 1.7.1056 |
CVE-2026-5159 |
Wordfence | |
| 6.4 Medium | WP Carousel Free | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-caption' Attribute |
≤ 2.7.10 |
CVE-2026-4665 |
Wordfence | |
| 6.5 Medium | EmailKit | Path Traversal Authenticated (Author+) Arbitrary File Read via 'emailkit-editor-template' REST Parameter |
≤ 1.6.5 |
CVE-2026-5957 |
Wordfence | |
| 6.4 Medium | Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem | Server-Side Request Forgery Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' |
≤ 3.5.3 |
CVE-2026-2948 |
Wordfence | |
| 4.9 Medium | Loco Translate | Path Traversal Authenticated (Translator+) Path Traversal to Limited File Read via 'ref' Parameter |
≤ 2.8.2 |
CVE-2026-1921 |
Wordfence | |
| 6.1 Medium | Blog Settings | Cross-Site Scripting Reflected Cross-Site Scripting via 'page' Parameter No login needed |
≤ 1.0 |
CVE-2026-6704 |
Wordfence | |
| 6.4 Medium | Simple Owl Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute |
≤ 2.1.1 |
CVE-2026-6255 |
Wordfence | |
| 6.4 Medium | WP-Clippy | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.0.0 |
CVE-2026-5505 |
Wordfence | |
| 6.1 Medium | Publish 2 Ping.fm | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via 'wpPingPingKey' Parameter No login needed |
≤ 1.1 |
CVE-2026-6702 |
Wordfence | |
| 6.4 Medium | Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem | Cross-Site Scripting Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'separatorIconSVG' |
≤ 3.5.3 |
CVE-2026-2868 |
Wordfence | |
| 4.3 Medium | DX Sources | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 2.0.1 |
CVE-2026-6700 |
Wordfence | |
| 5.5 Medium | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute |
≤ 4.10.0 |
CVE-2026-5247 |
Wordfence | |
| 6.5 Medium | Subscribe To Comments Reloaded | Broken Access Control Improper Authorization to Unauthenticated Arbitrary Subscription Management No login needed |
≤ 240119 |
CVE-2026-4409 |
Wordfence | |
| 4.3 Medium | addfreespace | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page No login needed |
≤ 0.1.3 |
CVE-2026-6701 |
Wordfence | |
| 6.1 Medium | Zingaya Click-to-Call | Cross-Site Scripting Reflected Cross-Site Scripting via 'email' Parameter No login needed |
≤ 1.0 |
CVE-2026-6696 |
Wordfence | |
| 6.4 Medium | Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute |
≤ 2.1.0 |
CVE-2026-4730 |
Wordfence | |
| 5.3 Medium | Magic Export & Import | Information Disclosure Unauthenticated PII Disclosure No login needed |
< 1.2.0 Fixed in 1.2.0 |
CVE-2026-5335 |
WPScan | |
| 6.5 Medium | Frontend File Manager | Broken Access Control Subscriber+ Arbitrary Download Access via IDOR |
≤ 23.6 |
CVE-2026-5337 |
WPScan | |
| 6.4 Medium | NextMove Lite - Thank You Page for WooCommerce | Cross-Site Scripting Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode |
≤ 2.23.0 |
CVE-2026-0703 |
Wordfence | |
| 5.3 Medium | Dokan: AI Powered WooCommerce Multivendor Marketplace Solution | Information Disclosure Unauthenticated Information Disclosure in Store Reviews REST API Endpoint No login needed |
≤ 4.3.1 |
CVE-2026-3504 |
Wordfence | |
| 5.8 Medium | Quiz Maker by AYS | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'rate_reason' No login needed |
≤ 6.7.1.29 |
CVE-2026-6817 |
Wordfence | |
| 5.4 Medium | Premium Addons for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_svg' Parameter |
≤ 4.11.70 |
CVE-2026-4790 |
Wordfence | |
| 5.4 Medium | Total | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute |
≤ 2.2.1 |
CVE-2026-5077 |
Wordfence | |
| 5.3 Medium | Royal Addons for Elementor | Broken Access Control Missing Authorization to Unauthenticated Form Action Meta Modification No login needed |
≤ 1.7.1056 |
CVE-2026-4024 |
Wordfence | |
| 6.5 Medium | Geo Mashup | SQL Injection Authenticated (Subscriber+) SQL Injection via 'geo_mashup_null_fields' Parameter |
≤ 1.13.19 |
CVE-2026-6457 |
Wordfence | |
| 5.3 Medium | Booking for Appointments and Events Calendar – Amelia | Broken Access Control Amelia <= 2.1.2 - Unauthenticated Authorization Bypass via Remote Approval Endpoint No login needed |
≤ 2.1.2 |
CVE-2026-6449 |
Wordfence | |
| 5.3 Medium | FundPress | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler No login needed |
≤ 2.0.8 |
CVE-2026-4650 |
Wordfence | |
| 4.4 Medium | Call for Price for WooCommerce | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Call for Price' Label Settings |
≤ 4.2.0 |
CVE-2026-6447 |
Wordfence | |
| 6.4 Medium | Jeg Kit for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute |
≤ 3.1.0 |
CVE-2026-6916 |
Wordfence | |
| 4.4 Medium | Ona | Server-Side Request Forgery Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter |
≤ 1.26 |
CVE-2026-6812 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.