WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 251–300 of 835 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.1 High | CformsII | Cross-Site Request Forgery No login needed |
≤ 15.1.3 Fixed in 15.1.4 |
CVE-2026-39436 |
Patchstack | |
| 4.3 Medium | Vedrixa Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action |
≤ 1.1.1 Fixed in 1.2.0 |
CVE-2026-8692 |
Wordfence | |
| 5.0 Medium | PDF for Elementor Forms + Drag And Drop Template Builder | Broken Access Control |
≤ 5.5.1 Fixed in 5.6.1 |
CVE-2026-45443 |
Patchstack | |
| 9.8 Critical | Piotnet Forms | Arbitrary File Upload Unauthenticated Arbitrary File Upload via Form File Upload No login needed |
≤ 2.1.40 |
CVE-2026-4883 |
Wordfence | |
| 4.9 Medium | NEX-Forms – Ultimate Forms | SQL Injection Ultimate Forms Plugin for WordPress <= 9.1.12 - Authenticated (Administrator+) SQL Injection via 'table' Parameter |
≤ 9.1.12 Fixed in 9.1.13 |
CVE-2026-7046 |
Wordfence | |
| 9.8 Critical | Receive Notifications After Form Submitting – Form Notify for Any Forms | Authentication Bypass Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback No login needed |
≤ 1.1.10 Fixed in 1.1.11 |
CVE-2026-5229 |
Wordfence | |
| 8.2 High | Fluent Forms | Broken Access Control Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter |
≤ 6.2.0 Fixed in 6.2.1 |
CVE-2026-5395 |
Wordfence | |
| 8.2 High | Fluent Forms | Broken Access Control Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter |
≤ 6.1.21 |
CVE-2026-5396 |
Wordfence | |
| 6.4 Medium | Fluent Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute |
≤ 6.2.1 Fixed in 6.2.2 |
CVE-2026-6828 |
Wordfence | |
| 8.5 High | Views for WPForms | SQL Injection |
≤ 3.4.6 Fixed in 3.4.7 |
CVE-2026-42742 |
Patchstack | |
| 8.5 High | Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend | SQL Injection Display & Edit Ninja Forms Submissions on your site frontend plugin <= 3.3.2 - SQL Injection |
≤ 3.3.2 Fixed in 3.3.3 |
CVE-2026-42741 |
Patchstack | |
| 4.3 Medium | Forms Rb | Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter |
≤ 1.1.9 |
CVE-2026-7050 |
Wordfence | |
| 6.1 Medium | Contact Form Builder | Cross-Site Scripting WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php No login needed |
1.6.1 |
CVE-2022-50959 |
VulnCheck | |
| 6.5 Medium | Forminator Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook |
≤ 1.53.0 Fixed in 1.53.0.1 |
CVE-2026-6214 |
Wordfence | |
| 5.3 Medium | Forminator Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter |
≤ 1.51.1 Fixed in 1.52 |
CVE-2026-6222 |
Wordfence | |
| 4.9 Medium | Fluent Forms | Path Traversal Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment |
≤ 6.2.1 Fixed in 6.2.2 |
CVE-2026-6344 |
Wordfence | |
| 7.5 High | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Path Traversal Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' No login needed |
≤ 1.52.1 Fixed in 1.52.2 |
CVE-2026-5192 |
Wordfence | |
| 7.2 High | NEX-Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names No login needed |
≤ 9.1.11 Fixed in 9.1.12 |
CVE-2026-5063 |
Wordfence | |
| 7.2 High | Gravity Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater No login needed |
≤ 2.10.0 |
CVE-2026-5110 |
Wordfence | |
| 7.2 High | Gravity Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater No login needed |
≤ 2.10.0 |
CVE-2026-5111 |
Wordfence | |
| 7.2 High | Gravity Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Product Option No login needed |
≤ 2.10.0 |
CVE-2026-5109 |
Wordfence | |
| 7.2 High | Gravity Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input No login needed |
≤ 2.10.0 |
CVE-2026-5113 |
Wordfence | |
| 7.2 High | Gravity Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater No login needed |
≤ 2.10.0 |
CVE-2026-5112 |
Wordfence | |
| 7.3 High | SureForms Pro | Broken Access Control No login needed |
≤ 2.8.0 Fixed in 2.8.1 |
CVE-2026-42377 |
Patchstack | |
| 4.3 Medium | HubSpot All-In-One Marketing - Forms, Popups, Live Chat | Broken Access Control Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure |
≤ 11.3.32 Fixed in 11.3.33 |
CVE-2025-11762 |
Wordfence | |
| 9.9 Critical | FunnelFormsPro | Remote Code Execution |
≤ 3.8.1 |
CVE-2026-39440 |
Patchstack | |
| 8.1 High | Everest Forms | Path Traversal Unauthenticated Arbitrary File Read and Deletion via Upload Field 'old_files' Parameter No login needed |
≤ 3.4.4 Fixed in 3.4.5 |
CVE-2026-5478 |
Wordfence | |
| 5.3 Medium | Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | Broken Access Control Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.1.21 - Insecure Direct Object Reference in Stripe SCA Confirmation to Unauthenticated Payment Status Modification No login needed |
6.1.21 Fixed in 6.2.0 |
CVE-2026-4160 |
Wordfence | |
| 8.1 High | Contact Form by WPForms | Cross-Site Request Forgery No login needed |
≤ 1.10.0.2 Fixed in 1.10.0.3 |
CVE-2026-40764 |
Patchstack | |
| 5.3 Medium | Mailercloud – Integrate webforms and synchronize website contacts | Broken Access Control Integrate webforms and synchronize website contacts plugin <= 1.0.7 - Broken Access Control No login needed |
≤ 1.0.7 |
CVE-2026-39713 |
Patchstack | |
| 5.3 Medium | leadlovers forms | Broken Access Control No login needed |
≤ 1.0.2 |
CVE-2026-39657 |
Patchstack | |
| 6.4 Medium | Magic Conversation For Gravity Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 3.0.97 |
CVE-2026-1396 |
Wordfence | |
| 9.8 Critical | Everest Forms | PHP Object Injection Unauthenticated PHP Object Injection via Form Entry Metadata No login needed |
≤ 3.4.3 Fixed in 3.4.4 |
CVE-2026-3296 |
Wordfence | |
| 6.1 Medium | Gravity Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field No login needed |
≤ 2.9.30 |
CVE-2026-4394 |
Wordfence | |
| 4.7 Medium | Gravity Forms | Cross-Site Scripting Reflected Cross-Site Scripting via 'form_ids' Parameter No login needed |
≤ 2.9.30 |
CVE-2026-4406 |
Wordfence | |
| 9.8 Critical | Ninja Forms - File Upload | Arbitrary File Upload File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload No login needed |
≤ 3.3.26 |
CVE-2026-0740 |
Wordfence | |
| 4.3 Medium | Database for Contact Form 7, WPforms, Elementor forms | Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode |
≤ 1.4.9 |
CVE-2026-3831 |
Wordfence | |
| 4.3 Medium | User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor | Broken Access Control Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field |
≤ 3.15.5 Fixed in 3.15.6 |
CVE-2026-3139 |
Wordfence | |
| 9.8 Critical | Everest Forms Pro | Remote Code Execution Unauthenticated Remote Code Execution via Calculation Field No login needed |
≤ 1.9.12 Fixed in 2.0.0 |
CVE-2026-3300 |
Wordfence | |
| 6.5 Medium | Ninja Forms | Information Disclosure Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token |
≤ 3.14.1 Fixed in 3.14.2 |
CVE-2026-1307 |
Wordfence | |
| 7.5 High | SureForms | Other Unauthenticated Payment Amount Validation Bypass via 'form_id' No login needed |
≤ 2.5.2 Fixed in 2.6.0 |
CVE-2026-4987 |
Wordfence | |
| 5.3 Medium | FormLift for Infusionsoft Web Forms | Broken Access Control Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow No login needed |
≤ 7.5.21 Fixed in 7.5.22 |
CVE-2026-4281 |
Wordfence | |
| 6.5 Medium | WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms | Broken Access Control |
≤ <= 1.1.5 Fixed in 1.1.6 |
CVE-2026-32527 |
Patchstack | |
| 8.8 High | weForms | PHP Object Injection No login needed |
≤ <= 1.6.26 Fixed in 1.6.27 |
CVE-2026-32484 |
Patchstack | |
| 6.5 Medium | Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms | Broken Access Control |
≤ 1.2.2 Fixed in 1.2.3 |
CVE-2026-25430 |
Patchstack | |
| 6.5 Medium | Contact Form by WPForms | Information Disclosure Sensitive Data Exposure No login needed |
≤ 1.9.8.7 Fixed in 1.9.9.2 |
CVE-2026-25339 |
Patchstack | |
| 7.5 High | WP Cost Estimation & Payment Forms Builder | Broken Access Control No login needed |
≤ 10.3.0 Fixed in 10.3.0 |
CVE-2026-24363 |
Patchstack | |
| 6.4 Medium | Integration with Hubspot Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.2.2 |
CVE-2026-1908 |
Wordfence | |
| 5.6 Medium | Contact Form, Survey, Quiz & Popup Form Builder – ARForms | Arbitrary Shortcode Execution ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution No login needed |
≤ 1.7.2 |
CVE-2024-13785 |
Wordfence | |
| 9.8 Critical | Kali Forms | Remote Code Execution Unauthenticated Remote Code Execution via form_process No login needed |
≤ 2.4.9 Fixed in 2.4.10 |
CVE-2026-3584 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.