WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 251–300 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	ITERAS Plugin `iteras`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.8.2`	Apr 24, 2026	`CVE-2026-4078`	Wordfence
6.5 Medium	Rescue Shortcodes Plugin `rescue-shortcodes`	Cross-Site Scripting	`≤ 3.3` Fixed in `3.4`	Apr 23, 2026	`CVE-2025-62110`	Patchstack
6.4 Medium	Gallagher Website Design Plugin `gallagher-website-design`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute	`≤ 2.6.4`	Apr 22, 2026	`CVE-2026-1913`	Wordfence
6.4 Medium	CI HUB Connector Plugin `ci-hub-connector`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.2.106`	Apr 22, 2026	`CVE-2026-4353`	Wordfence
6.4 Medium	Posts map Plugin `posts-map`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute	`≤ 0.1.3`	Apr 22, 2026	`CVE-2026-6236`	Wordfence
6.4 Medium	Text Snippets Plugin `text-snippet`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'w' Shortcode Attribute	`≤ 0.0.1`	Apr 22, 2026	`CVE-2026-5748`	Wordfence
6.4 Medium	Quran Live Multilanguage Plugin `quran-live`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.3`	Apr 22, 2026	`CVE-2026-4074`	Wordfence
6.4 Medium	Simple Random Posts Shortcode Plugin `simple-random-posts-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'container_right_width' Shortcode Attribute	`≤ 0.3`	Apr 22, 2026	`CVE-2026-6246`	Wordfence
6.4 Medium	Easy Social Photos Gallery Plugin `my-instagram-feed`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper_class' Shortcode Attribute	`≤ 3.1.2`	Apr 22, 2026	`CVE-2026-4085`	Wordfence
6.4 Medium	WPMK Block Plugin `wpmk-block`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.1`	Apr 22, 2026	`CVE-2026-4125`	Wordfence
6.4 Medium	SlideShowPro SC Plugin `slideshowpro-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'album' Shortcode Attribute	`≤ 1.0.2`	Apr 22, 2026	`CVE-2026-5767`	Wordfence
6.4 Medium	Twittee Text Tweet Plugin `twittee-text-tweet`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.0.8`	Apr 22, 2026	`CVE-2026-4089`	Wordfence
4.3 Medium	Table Manager Plugin `table-manager`	Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via 'table' Shortcode Attribute	`≤ 1.0.0`	Apr 22, 2026	`CVE-2026-4126`	Wordfence
6.4 Medium	Slider Bootstrap Carousel Plugin `slider-bootstrap-carousel`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.7`	Apr 22, 2026	`CVE-2026-4076`	Wordfence
6.4 Medium	Switch CTA Box Plugin `switch-cta-box`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 1.1`	Apr 22, 2026	`CVE-2026-4088`	Wordfence
6.4 Medium	ER Swiffy Insert Plugin `er-swiffy-insert`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.0`	Apr 22, 2026	`CVE-2026-4082`	Wordfence
6.4 Medium	Bread & Butter: Content Gating for Verified Leads Plugin `bread-butter`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 8.2.0.25`	Apr 22, 2026	`CVE-2026-4279`	Wordfence
6.4 Medium	EMC Scheduling Manager Plugin `embed-calendly-scheduling`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via calendly Shortcode	`≤ 4.4`	Apr 19, 2026	`CVE-2026-0868`	Wordfence
5.4 Medium	Categories Images Plugin `categories-images`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'z_taxonomy_image' Shortcode	`≤ 3.3.1`	Apr 18, 2026	`CVE-2026-2505`	Wordfence
6.4 Medium	Content Blocks (Custom Post Widget) Plugin `custom-post-widget`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via content_block Shortcode	`≤ 3.3.9`	Apr 18, 2026	`CVE-2026-0894`	Wordfence
6.1 Medium	Hostel Plugin `hostel`	Cross-Site Scripting Reflected Cross-Site Scripting via 'shortcode_id' Parameter No login needed	`≤ 1.1.6`	Apr 18, 2026	`CVE-2026-1838`	Wordfence
6.4 Medium	Pz-LinkCard Plugin `pz-linkcard`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 2.5.8.1`	Apr 17, 2026	`CVE-2026-2434`	Wordfence
5.3 Medium	Quiz and Survey Master (QSM) Plugin `quiz-master-next`	Content Injection Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields No login needed	`≤ 10.1.0`	Apr 17, 2026	`CVE-2026-5797`	Wordfence
6.4 Medium	Email Encoder – Protect Email Addresses and Phone Numbers Plugin `email-encoder-bundle`	Cross-Site Scripting Protect Email Addresses and Phone Numbers <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via eeb_mailto Shortcode	`≤ 2.4.4`	Apr 16, 2026	`CVE-2026-2840`	Wordfence
6.4 Medium	WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters Plugin	Cross-Site Scripting Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'put_wpgm' Shortcode	`≤ 4.8.7`	Apr 16, 2026	`CVE-2025-13364`	Wordfence
6.4 Medium	BetterDocs Plugin `betterdocs`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 4.3.8`	Apr 16, 2026	`CVE-2026-3875`	Wordfence
6.1 Medium	CodeColorer Plugin `codecolorer`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'class' attribute in 'cc' Comment Shortcode No login needed	`≤ 0.10.1`	Apr 16, 2026	`CVE-2026-4032`	Wordfence
6.4 Medium	WP Shortcodes Plugin — Shortcodes Ultimate Plugin `shortcodes-ultimate`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via su_box Shortcode	`≤ 7.4.9`	Apr 16, 2026	`CVE-2026-3885`	Wordfence
6.4 Medium	WP YouTube Lyte Plugin `wp-youtube-lyte`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via lyte Shortcode	`≤ 1.7.29`	Apr 16, 2026	`CVE-2026-3299`	Wordfence
6.4 Medium	Power Charts Plugin `wpgo-power-charts-lite`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 0.1.0`	Apr 15, 2026	`CVE-2026-4011`	Wordfence
6.4 Medium	WM JqMath Plugin `wm-jqmath`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute	`≤ 1.3`	Apr 15, 2026	`CVE-2026-3998`	Wordfence
5.3 Medium	Katalogportal-pdf-sync Widget Plugin `katalogportal-pdf-sync`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action No login needed	`≤ 1.0.0`	Apr 15, 2026	`CVE-2026-3649`	Wordfence
6.4 Medium	Coachific Shortcode Plugin `coachific-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute	`≤ 1.0`	Apr 15, 2026	`CVE-2026-4005`	Wordfence
6.4 Medium	WP Circliful Plugin `wp-circliful`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.2`	Apr 15, 2026	`CVE-2026-3659`	Wordfence
6.4 Medium	VI: Include Post By Plugin `vi-include-post-by`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute	`≤ 0.4.200706`	Apr 15, 2026	`CVE-2026-5717`	Wordfence
6.5 Medium	Germanized for WooCommerce Plugin `woocommerce-germanized`	Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed	`≤ 3.20.5`	Apr 14, 2026	`CVE-2026-2582`	Wordfence
6.4 Medium	ShopLentor Plugin `woolentor-addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute	`≤ 3.3.5`	Apr 14, 2026	`CVE-2026-4059`	Wordfence
6.4 Medium	Surbma \| Booking.com Plugin `surbma-bookingcom-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 2.1`	Apr 14, 2026	`CVE-2026-1607`	Wordfence
6.4 Medium	List category posts Plugin `list-category-posts`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode	`≤ 0.94.0`	Apr 9, 2026	`CVE-2026-3005`	Wordfence
6.4 Medium	Download Manager Plugin `download-manager`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.3.52`	Apr 9, 2026	`CVE-2026-5357`	Wordfence
6.4 Medium	OSM Plugin `osm`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute	`≤ 6.1.15`	Apr 9, 2026	`CVE-2026-4429`	Wordfence
6.4 Medium	Extensions for Leaflet Map Plugin `extensions-leaflet-map`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'elevation-track' Shortcode	`≤ 4.14`	Apr 8, 2026	`CVE-2026-5451`	Wordfence
6.4 Medium	WP Visitor Statistics (Real Time Traffic) Plugin `wp-stats-manager`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'height' Shortcode Attribute	`≤ 8.4`	Apr 8, 2026	`CVE-2026-4303`	Wordfence
6.4 Medium	PrivateContent Free Plugin `privatecontent-free`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute	`≤ 1.2.0`	Apr 8, 2026	`CVE-2026-4025`	Wordfence
6.4 Medium	pdfl.io Plugin `pdfl-io`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Shortcode Attribute	`≤ 1.0.5`	Apr 8, 2026	`CVE-2026-4073`	Wordfence
5.3 Medium	tagDiv Composer Plugin `td-composer`	Arbitrary Shortcode Execution No login needed	`≤ 5.4.3`	Apr 8, 2026	`CVE-2026-39712`	Patchstack
5.3 Medium	Mogi Theme `mogi`	Arbitrary Shortcode Execution No login needed	`≤ 1.2.3`	Apr 8, 2026	`CVE-2026-39637`	Patchstack
5.3 Medium	Uminex Theme `uminex`	Arbitrary Shortcode Execution No login needed	`≤ 1.0.9`	Apr 8, 2026	`CVE-2026-39629`	Patchstack
5.3 Medium	DukaMarket Theme `dukamarket`	Arbitrary Shortcode Execution No login needed	`≤ 1.3.0`	Apr 8, 2026	`CVE-2026-39628`	Patchstack
5.3 Medium	Armania Theme `armania`	Arbitrary Shortcode Execution No login needed	`≤ 1.4.8`	Apr 8, 2026	`CVE-2026-39626`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.