WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 251–300 of 1,456 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
9.8 Critical	Avada (Fusion) Builder Plugin `fusion-builder`	Remote Code Execution Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler No login needed	`≤ 3.15.2`	May 21, 2026	`CVE-2026-6279`	Wordfence
6.4 Medium	Faces of Users Plugin `faces-of-users`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute	`≤ 0.0.3`	May 20, 2026	`CVE-2026-8038`	Wordfence
6.4 Medium	Logo Manager For Enamad Plugin `logo-manager-for-enamad`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 0.7.4`	May 20, 2026	`CVE-2026-6549`	Wordfence
6.4 Medium	Sticky Plugin `sticky`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute	`≤ 2.5.6`	May 20, 2026	`CVE-2026-6397`	Wordfence
6.4 Medium	The7 Theme `dt-the7`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 'link' Parameter	`≤ 14.3.2`	May 15, 2026	`CVE-2026-6646`	Wordfence
6.4 Medium	Bold Page Builder Plugin `bold-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode	`≤ 5.6.8`	May 14, 2026	`CVE-2026-3694`	Wordfence
6.5 Medium	Avada Builder Plugin	Path Traversal Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter	`≤ 3.15.2`	May 13, 2026	`CVE-2026-4782`	Wordfence
6.4 Medium	Fluent Forms Plugin `fluentform`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute	`≤ 6.2.1`	May 13, 2026	`CVE-2026-6828`	Wordfence
6.5 Medium	Advanced Custom Fields: Extended Plugin `acf-extended`	Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed	`≤ 0.9.2.3`	May 12, 2026	`CVE-2025-15463`	Wordfence
6.4 Medium	scratchblocks for WP Plugin `scratchblocks-for-wp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute	`≤ 1.0.1`	May 12, 2026	`CVE-2026-6247`	Wordfence
6.4 Medium	Credits Shortcode Plugin `source-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute	`≤ 1.2`	May 12, 2026	`CVE-2026-6256`	Wordfence
6.4 Medium	Advanced Social Media Icons Plugin `advanced-social-media-icons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'social' Shortcode	`≤ 1.2`	May 12, 2026	`CVE-2026-7659`	Wordfence
6.4 Medium	Voyage Plus Plugin `voyage-plus`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'post-content' Shortcode	`≤ 1.0.6`	May 12, 2026	`CVE-2026-5715`	Wordfence
6.4 Medium	Next Date Plugin `nextdate`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute	`≤ 1.0`	May 12, 2026	`CVE-2026-4920`	Wordfence
6.4 Medium	Quick Table Plugin `quick-table`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute	`≤ 1.0.0`	May 12, 2026	`CVE-2026-6237`	Wordfence
6.4 Medium	Bootstrap Shortcode Plugin `bootstrap-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'box' Shortcode	`≤ 1.0`	May 12, 2026	`CVE-2026-7661`	Wordfence
6.4 Medium	Fancy Image Show Plugin `fancy-image-show`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 9.1`	May 12, 2026	`CVE-2026-5340`	Wordfence
6.4 Medium	Shortcodely Plugin `shortcodely`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'widget_area' Shortcode Attribute	`≤ 1.0.1`	May 12, 2026	`CVE-2026-6913`	Wordfence
6.4 Medium	NMR Strava activities Plugin `nmr-strava-activities`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.14`	May 8, 2026	`CVE-2026-5341`	Wordfence
6.4 Medium	E2Pdf – Export Pdf Tool Plugin `e2pdf`	Cross-Site Scripting Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.32.17`	May 8, 2026	`CVE-2026-7650`	Wordfence
6.4 Medium	Affiliate Program Suite Plugin `slicewp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode	`≤ 1.2.7`	May 6, 2026	`CVE-2026-6672`	Wordfence
6.4 Medium	Simple Owl Shortcodes Plugin `simple-owl-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'num' Shortcode Attribute	`≤ 2.1.1`	May 5, 2026	`CVE-2026-6255`	Wordfence
6.4 Medium	WP-Clippy Plugin `wp-clippy`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.0`	May 5, 2026	`CVE-2026-5505`	Wordfence
5.5 Medium	Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories Plugin `post-expirator`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute	`≤ 4.10.0`	May 5, 2026	`CVE-2026-5247`	Wordfence
6.4 Medium	Charts Ninja: Create Beautiful Graphs & Charts and Easily Add Them to Your Website Plugin `charts-ninja-graphs-and-charts`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'chartid' Shortcode Attribute	`≤ 2.1.0`	May 5, 2026	`CVE-2026-4730`	Wordfence
6.4 Medium	NextMove Lite - Thank You Page for WooCommerce Plugin `woo-thank-you-page-nextmove-lite`	Cross-Site Scripting Thank You Page for WooCommerce <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'xlwcty_current_date' Shortcode	`≤ 2.23.0`	May 2, 2026	`CVE-2026-0703`	Wordfence
6.4 Medium	Jeg Kit for Elementor Plugin `jeg-elementor-kit`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sg_content_number_prefix' Shortcode Attribute	`≤ 3.1.0`	May 2, 2026	`CVE-2026-6916`	Wordfence
6.4 Medium	Simple Link Directory Plugin `simple-link-directory`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 8.9.2`	May 2, 2026	`CVE-2026-7209`	Wordfence
6.4 Medium	WPC Smart Messages for WooCommerce Plugin `wpc-smart-messages`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute	`≤ 4.2.8`	Apr 28, 2026	`CVE-2026-6725`	Wordfence
6.4 Medium	ITERAS Plugin `iteras`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.8.2`	Apr 24, 2026	`CVE-2026-4078`	Wordfence
6.5 Medium	Rescue Shortcodes Plugin `rescue-shortcodes`	Cross-Site Scripting	`≤ 3.3` Fixed in `3.4`	Apr 23, 2026	`CVE-2025-62110`	Patchstack
6.4 Medium	Gallagher Website Design Plugin `gallagher-website-design`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute	`≤ 2.6.4`	Apr 22, 2026	`CVE-2026-1913`	Wordfence
6.4 Medium	CI HUB Connector Plugin `ci-hub-connector`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.2.106`	Apr 22, 2026	`CVE-2026-4353`	Wordfence
6.4 Medium	Posts map Plugin `posts-map`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute	`≤ 0.1.3`	Apr 22, 2026	`CVE-2026-6236`	Wordfence
6.4 Medium	Text Snippets Plugin `text-snippet`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute	`≤ 0.0.1`	Apr 22, 2026	`CVE-2026-5748`	Wordfence
6.4 Medium	Quran Live Multilanguage Plugin `quran-live`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.3`	Apr 22, 2026	`CVE-2026-4074`	Wordfence
6.4 Medium	Simple Random Posts Shortcode Plugin `simple-random-posts-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute	`≤ 0.3`	Apr 22, 2026	`CVE-2026-6246`	Wordfence
6.4 Medium	Easy Social Photos Gallery Plugin `my-instagram-feed`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute	`≤ 3.1.2`	Apr 22, 2026	`CVE-2026-4085`	Wordfence
6.4 Medium	WPMK Block Plugin `wpmk-block`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.1`	Apr 22, 2026	`CVE-2026-4125`	Wordfence
6.4 Medium	SlideShowPro SC Plugin `slideshowpro-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute	`≤ 1.0.2`	Apr 22, 2026	`CVE-2026-5767`	Wordfence
6.4 Medium	Twittee Text Tweet Plugin `twittee-text-tweet`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.0.8`	Apr 22, 2026	`CVE-2026-4089`	Wordfence
4.3 Medium	Table Manager Plugin `table-manager`	Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute	`≤ 1.0.0`	Apr 22, 2026	`CVE-2026-4126`	Wordfence
6.4 Medium	Slider Bootstrap Carousel Plugin `slider-bootstrap-carousel`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.7`	Apr 22, 2026	`CVE-2026-4076`	Wordfence
6.4 Medium	Switch CTA Box Plugin `switch-cta-box`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 1.1`	Apr 22, 2026	`CVE-2026-4088`	Wordfence
6.4 Medium	ER Swiffy Insert Plugin `er-swiffy-insert`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.0`	Apr 22, 2026	`CVE-2026-4082`	Wordfence
6.4 Medium	Bread & Butter: Content Gating for Verified Leads Plugin `bread-butter`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 8.2.0.25`	Apr 22, 2026	`CVE-2026-4279`	Wordfence
6.4 Medium	EMC Scheduling Manager Plugin `embed-calendly-scheduling`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode	`≤ 4.4`	Apr 19, 2026	`CVE-2026-0868`	Wordfence
5.4 Medium	Categories Images Plugin `categories-images`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode	`≤ 3.3.1`	Apr 18, 2026	`CVE-2026-2505`	Wordfence
6.4 Medium	Content Blocks (Custom Post Widget) Plugin `custom-post-widget`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode	`≤ 3.3.9`	Apr 18, 2026	`CVE-2026-0894`	Wordfence
6.1 Medium	Hostel Plugin `hostel`	Cross-Site Scripting Reflected Cross-Site Scripting via 'shortcode_id' Parameter No login needed	`≤ 1.1.6`	Apr 18, 2026	`CVE-2026-1838`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.