WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 251–300 of 2,150 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 6 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.1 Critical ProSolution WP Client Plugin prosolution-wp-client SQL Injection Unauthenticated Blind SQLi via 'jobID' Parameter No login needed < 2.0.6 Fixed in 2.0.6 CVE-2026-19053 WPScan
9.8 Critical Single Sign On For TNG Plugin single-sign-on-for-tng Authentication Bypass Unauthenticated Arbitrary Password Reset No login needed < 2.2.0 Fixed in 2.2.0 CVE-2026-16299 WPScan
9.8 Critical FoodBoxBooker Plugin foodboxbooker Privilege Escalation Unauthenticated Arbitrary Password Reset No login needed < 1.0.7 Fixed in 1.0.7 CVE-2026-16298 WPScan
9.8 Critical InfiniteWP Client Plugin iwp-client Privilege Escalation Unauthenticated Administrator Account Takeover on Multisite No login needed < 1.13.6 Fixed in 1.13.6 CVE-2026-15038 WPScan
9.1 Critical WP Directory Kit Plugin wpdirectorykit SQL Injection Unauthenticated SQL Injection via 'field_search' Parameter No login needed 1.5.4 – < 1.5.5 Fixed in 1.5.5 CVE-2026-18473 WPScan
9.8 Critical AI Copilot – Content Generator Plugin ai-copilot-content-generator Privilege Escalation Content Generator <= 1.5.6 - Unauthenticated Privilege Escalation via Custom Workflow Route No login needed ≤ 1.5.6 CVE-2026-14526 Wordfence
9.8 Critical Ajax Search Lite Plugin ajax-search-lite PHP Object Injection Unauthenticated PHP Object Injection via Search Statistics REST Endpoint No login needed < 4.14.5 Fixed in 4.14.5 CVE-2026-16258 WPScan
9.1 Critical MStore API Plugin mstore-api Price Manipulation Unauthenticated Payment Bypass via Multiple Payment Gateways No login needed < 4.21.0 Fixed in 4.21.0 CVE-2026-16038 WPScan
9.8 Critical WP Events Manager Plugin wp-events-manager Price Manipulation Subscriber+ Payment Bypass via 'qty' Parameter No login needed < 2.2.5 Fixed in 2.2.5 CVE-2026-14205 WPScan
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' No login needed ≤ 1.2.3 CVE-2026-14364 Wordfence
9.8 Critical TrueBooker Plugin truebooker-appointment-booking Broken Access Control Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' No login needed ≤ 1.2.3 CVE-2026-14365 Wordfence
10.0 Critical Premium SEO Plugin Remote Code Execution Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection) No login needed Not stated CVE-2026-14812 WPScan
9.1 Critical CTX Feed Plugin webappick-product-feed-for-woocommerce Remote Code Execution ≤ 6.6.42 Fixed in 6.6.43 CVE-2026-66709 Patchstack
10.0 Critical Type Hub Plugin typehub Arbitrary File Upload No login needed ≤ 2.0.6 CVE-2026-66665 Patchstack
9.8 Critical Frontend Admin by DynamiApps Plugin acf-frontend-form-element Privilege Escalation No login needed ≤ 3.29.10 CVE-2026-66662 Patchstack
9.3 Critical WordPress File Upload Plugin wp-file-upload Arbitrary File Upload SQL Injection No login needed ≤ 5.1.7 Fixed in 5.1.8 CVE-2026-66447 Patchstack
9.8 Critical AI ANN Theme ann PHP Object Injection No login needed ≤ 1.29.0 CVE-2026-65581 Patchstack
9.8 Critical Agricola Theme agricola PHP Object Injection No login needed ≤ 1.21.0 CVE-2026-65579 Patchstack
9.8 Critical Agora Theme agora PHP Object Injection No login needed ≤ 1.9 CVE-2026-65578 Patchstack
9.8 Critical Advice Theme advice PHP Object Injection No login needed ≤ 1.18.0 CVE-2026-65577 Patchstack
9.8 Critical Adrena Theme adrena PHP Object Injection No login needed ≤ 1.2.14 CVE-2026-65576 Patchstack
9.8 Critical Accalia Theme accalia PHP Object Injection No login needed ≤ 1.5.3 CVE-2026-65575 Patchstack
9.8 Critical Abogado Theme abogado PHP Object Injection No login needed ≤ 1.18 CVE-2026-65574 Patchstack
9.8 Critical Abelle Theme abelle PHP Object Injection No login needed ≤ 1.22 CVE-2026-65573 Patchstack
9.8 Critical A.Williams Theme alisha-williams PHP Object Injection No login needed ≤ 1.3.1 CVE-2026-65572 Patchstack
9.8 Critical 69 Clothing Theme clothing69 PHP Object Injection No login needed ≤ 1.2.11.1 CVE-2026-65571 Patchstack
9.8 Critical WPBruiser {no- Captcha anti-Spam} Plugin goodbye-captcha PHP Object Injection No login needed ≤ 3.1.43 CVE-2026-65556 Patchstack
10.0 Critical Spider Analyser – WordPress搜索引擎蜘蛛分析插件 Plugin spider-analyser Remote Code Execution WordPress搜索引擎蜘蛛分析插件 plugin <= 2.1.3 - Remote Code Execution (RCE) No login needed ≤ 2.1.3 CVE-2026-65553 Patchstack
9.8 Critical Export User Data Plugin export-user-data PHP Object Injection No login needed ≤ 2.2.6 CVE-2026-65552 Patchstack
9.9 Critical Betheme Theme betheme Remote Code Execution ≤ 28.4.2 CVE-2026-65548 Patchstack
9.3 Critical Qode Tours Plugin qode-tours SQL Injection No login needed ≤ 3.1.3.1 CVE-2026-65546 Patchstack
9.3 Critical WP OAuth Server Plugin miniorange-oauth-20-server SQL Injection No login needed ≤ 6.2.0 Fixed in 6.2.1 CVE-2026-65520 Patchstack
9.3 Critical Simply Schedule Appointments Plugin simply-schedule-appointments SQL Injection No login needed ≤ 1.6.12.10 Fixed in 1.6.12.11 CVE-2026-65508 Patchstack
9.8 Critical AIWU Plugin ai-copilot-content-generator Privilege Escalation No login needed ≤ 1.5.6 Fixed in 1.5.8 CVE-2026-65507 Patchstack
9.8 Critical Ajax Search Lite Plugin ajax-search-lite PHP Object Injection No login needed ≤ 4.14.4 Fixed in 4.14.5 CVE-2026-28139 Patchstack
9.8 Critical Kadence WooCommerce Email Designer Plugin kadence-woocommerce-email-designer Privilege Escalation No login needed ≤ 1.5.19 Fixed in 1.5.19.1 CVE-2026-28005 Patchstack
9.1 Critical WPCargo Track & Trace Plugin wpcargo SQL Injection Unauthenticated SQL Injection via wpcargo_tracking_number No login needed < 8.0.4 Fixed in 8.0.4 CVE-2026-12713 WPScan
9.1 Critical Drag and Drop Multiple File Upload for WooCommerce Plugin drag-and-drop-multiple-file-upload-for-woocommerce Arbitrary File Upload Unauthenticated File Deletion via Nonce Oracle No login needed < 1.1.8 Fixed in 1.1.8 CVE-2026-16054 WPScan
9.1 Critical Easy Post Submission Plugin easy-post-submission Broken Access Control Missing Authorization No login needed ≤ 2.3.0 CVE-2026-4431 Wordfence
9.1 Critical Multi Uploader for Gravity Forms Plugin gf-multi-uploader Broken Access Control Missing Authorization to Unauthenticated Arbitrary Media Deletion No login needed ≤ 1.1.8 CVE-2026-5581 Wordfence
9.1 Critical Ajax Load More Plugin ajax-load-more SQL Injection Unauthenticated SQL Injection via custom_args No login needed < 8.0.1 Fixed in 8.0.1 CVE-2026-15360 WPScan
9.1 Critical Login/Signup with Phone Number, OTP Verification Plugin Privilege Escalation Unauthenticated Account Takeover via OTP Brute Force No login needed < 1.8.71 Fixed in 1.8.71 CVE-2026-15210 WPScan
10.0 Critical Custom Fields for WooCommerce Plugin Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal No login needed < 1.5.1 Fixed in 1.5.1 CVE-2026-16940 WPScan
9.3 Critical Membership Plugin – Kadence Memberships Plugin restrict-content Privilege Escalation Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover No login needed ≤ 4.0.0 CVE-2026-9273 Wordfence
9.3 Critical Easy Dropbox Integration Plugin Broken Access Control Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX No login needed < 2.2.0 Fixed in 2.2.0 CVE-2026-15958 WPScan
9.8 Critical ImproveSEO Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload Leading to Remote Code Execution No login needed ≤ 2.0.11 CVE-2026-16618 WPScan
9.8 Critical Chama Plugin Broken Access Control Unauthenticated Arbitrary User Password Reset No login needed < 1.0.13 Fixed in 1.0.13 CVE-2026-16300 WPScan
9.8 Critical Personal QR Message Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.0 CVE-2026-16250 WPScan
9.8 Critical Insert or Embed Articulate Content into Plugin Arbitrary File Upload Editor+ Arbitrary File Upload No login needed ≤ 4.3000000027 CVE-2026-16060 WPScan
9.4 Critical Simple Membership Plugin simple-membership Privilege Escalation Unauthenticated Administrator Account Takeover via Registration Username Collision No login needed < 4.7.8 Fixed in 4.7.8 CVE-2026-15930 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only