WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 2,951–3,000 of 29,070 vulnerabilities

Known WordPress vulnerabilities, page 60 of 1
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High Pronamic Pay Plugin pronamic-ideal Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field ≤ 10.1.0 CVE-2026-16635 Wordfence
6.4 Medium Powerkit Plugin powerkit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute ≤ 3.1.0 CVE-2026-15644 Wordfence
6.5 Medium CubeWP Framework Plugin cubewp-framework SQL Injection Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter ≤ 1.1.30 CVE-2026-6453 Wordfence
5.3 Medium WooCommerce PayPal Payments Plugin woocommerce-paypal-payments Information Disclosure Unauthenticated Sensitive Information Disclosure No login needed ≤ 3.3.2 CVE-2025-14073 Wordfence
6.1 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Reflected Cross-Site Scripting via 'param' No login needed ≤ 6.2.8 CVE-2026-17571 Wordfence
4.9 Medium WPvivid Plugin wpvivid-backuprestore SQL Injection Authenticated (Administrator+) SQL Injection via 'export_data' Parameter ≤ 0.9.131 CVE-2026-17555 Wordfence
9.8 Critical Single Sign On For TNG Plugin single-sign-on-for-tng Privilege Escalation Unauthenticated Privilege Escalation via Unverified Password Change No login needed ≤ 2.0.0 CVE-2026-15964 Wordfence
6.5 Medium Advanced Views Plugin acf-views Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints ≤ 3.9.1 CVE-2026-17580 Wordfence
6.4 Medium GamiPress Plugin gamipress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode ≤ 7.9.9.1 CVE-2026-16091 Wordfence
6.4 Medium Powerkit Plugin powerkit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.1.0 CVE-2026-15649 Wordfence
5.3 Medium PixelYourSite Plugin pixelyoursite Information Disclosure Unauthenticated Sensitive Information Exposure via Order-Received Endpoint Missing Key Validation No login needed ≤ 11.2.1, < 12.6.1 Fixed in 12.6.1 CVE-2026-18059 Wordfence
6.4 Medium Cozy Blocks Plugin cozy-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'layoutCircle.alignment' Block Attribute ≤ 2.2.11 CVE-2026-15950 Wordfence
6.6 Medium Payment forms, Buy now buttons, and Invoicing System | GetPaid Plugin invoicing Local File Inclusion Authenticated (Administrator+) Local File Inclusion via Payment Form 'type' Element Field ≤ 2.8.56 CVE-2026-17605 Wordfence
8.1 High NEX-Forms Plugin nex-forms-express-wp-form-builder Arbitrary File Deletion Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter ≤ 9.2.3 CVE-2026-15450 Wordfence
7.2 High MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder Plugin mailchimp-subscribe-sm Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Form Field Values No login needed ≤ 4.3.3 CVE-2026-15052 Wordfence
8.1 High Kali Forms Plugin kali-forms Remote Code Execution Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter No login needed ≤ 2.4.20 CVE-2026-16144 Wordfence
4.9 Medium Icegram Mailer Plugin icegram-mailer SQL Injection Authenticated (Administrator+) SQL Injection via 'fields' Parameter ≤ 1.0.12 CVE-2026-15951 Wordfence
4.9 Medium GSheetConnector Plugin cf7-google-sheets-connector SQL Injection Authenticated (Administrator+) SQL Injection via 's' Parameter ≤ 5.2.1 CVE-2026-16614 Wordfence
5.3 Medium Database Collation Fix Plugin database-collation-fix SQL Injection Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter ≤ 1.2.10 CVE-2026-15018 Wordfence
5.3 Medium Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder Plugin gutena-forms Broken Access Control Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_bulk_action() No login needed ≤ 1.9.0 CVE-2026-11995 Wordfence
6.4 Medium Download Manager Plugin download-manager Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute ≤ 3.3.66 CVE-2026-16685 Wordfence
6.4 Medium GamiPress Plugin gamipress Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode ≤ 7.9.9.1 CVE-2026-16090 Wordfence
6.4 Medium Kadence Blocks Plugin kadence-blocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'toggleIcon' Block Attribute ≤ 3.7.8 CVE-2026-18435 Wordfence
6.4 Medium Kadence Blocks Plugin kadence-blocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Identity Block Inner Image Content ≤ 3.7.8.1 CVE-2026-18062 Wordfence
6.4 Medium Powerkit Plugin powerkit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'nav' Shortcode Attribute ≤ 3.1.0 CVE-2026-15645 Wordfence
6.4 Medium Advanced Woo Labels Plugin advanced-woo-labels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_color' Parameter ≤ 2.48 CVE-2026-15662 Wordfence
4.9 Medium Kirki Plugin kirki Path Traversal Authenticated (Editor+) Path Traversal to Arbitrary File Write (Zip Slip) ≤ 6.0.13 CVE-2026-15601 Wordfence
6.5 Medium Icegram Engage Plugin icegram SQL Injection Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter ≤ 3.1.42 CVE-2026-16087 Wordfence
6.4 Medium GenerateBlocks Plugin generateblocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes ≤ 2.3.0 CVE-2026-13458 Wordfence
4.3 Medium RealHomes Memberships Plugin inspiry-memberships Broken Access Control Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action ≤ 3.0.9 CVE-2026-10782 Wordfence
6.4 Medium Easy Property Listings Plugin easy-property-listings Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'facebook' User Contact Method ≤ 3.5.24 CVE-2026-16684 Wordfence
8.8 High AI Engine Plugin ai-engine Cross-Site Request Forgery Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match No login needed ≤ 3.6.5 CVE-2026-15988 Wordfence
4.3 Medium Jeg Kit for Elementor Plugin jeg-elementor-kit Information Disclosure Authenticated (Contributor+) Exposure of Sensitive Information via 'JkitDashboardOption' Inline Script ≤ 3.1.1 CVE-2026-2916 Wordfence
4.3 Medium Theme Editor Plugin theme-editor Cross-Site Request Forgery Cross-Site Request Forgery to CSS Modification No login needed ≤ 3.1 CVE-2025-14469 Wordfence
5.3 Medium YOP Poll Plugin yop-poll Authentication Bypass Unauthenticated Vote Restriction Bypass via IP Header Spoofing No login needed 7.0.0 – < 7.0.6 Fixed in 7.0.6 CVE-2026-14840 WPScan
7.5 High Mapster WP Maps Plugin mapster-wp-maps Information Disclosure Unauthenticated Private and Draft Post Content Disclosure No login needed < 1.24.0 Fixed in 1.24.0 CVE-2026-14839 WPScan
2.2 Low Event Tickets Plugin Broken Access Control Contributor+ Seating Layout and Ticket Inventory Modification via IDOR < 5.29.0.1 Fixed in 5.29.0.1 CVE-2026-14823 WPScan
5.3 Medium Event Tickets Plugin Broken Access Control Unauthenticated PayPal Order Status Manipulation No login needed < 5.29.0.1 Fixed in 5.29.0.1 CVE-2026-14822 WPScan
6.5 Medium Authora - Easy Login with Mobile Number Plugin Privilege Escalation Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure No login needed < 1.7.7 Fixed in 1.7.7 CVE-2026-14561 WPScan
6.5 Medium Pixel Tag Manager for WooCommerce Plugin pixel-manager-for-woocommerce Broken Access Control Unauthenticated Forged Conversion Event Submission No login needed < 2.2.1 Fixed in 2.2.1 CVE-2026-14315 WPScan
5.4 Medium WordPress Download Manager Plugin Cross-Site Scripting Author+ Stored XSS via Package Title < 3.3.66 Fixed in 3.3.66 CVE-2026-14292 WPScan
2.7 Low Amelia Plugin Authentication Bypass Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment < 2.4.4 Fixed in 2.4.4 CVE-2026-14214 WPScan
2.7 Low Brizy – Page Builder Plugin brizy Information Disclosure Page Builder < 2.8.18 - Contributor+ Sensitive Information Disclosure via get_post_info < 2.8.18 Fixed in 2.8.18 CVE-2026-14195 WPScan
4.3 Medium Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Cross-Site Request Forgery Podcast Contributor/Group/Role Creation and Deletion via CSRF No login needed < 4.5.3 Fixed in 4.5.3 CVE-2026-13729 WPScan
7.1 High Dynamic Pricing With Discount Rules for WooCommerce Plugin aco-woo-dynamic-pricing Cross-Site Scripting Reflected XSS via wdpAjax No login needed < 5.0.0 Fixed in 5.0.0 CVE-2026-13725 WPScan
5.3 Medium Pixelavo Plugin pixelavo Server-Side Request Forgery Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX No login needed < 1.5.4 Fixed in 1.5.4 CVE-2026-13604 WPScan
9.1 Critical Participants Database Plugin participants-database SQL Injection Unauthenticated SQL Injection via List Search No login needed < 2.7.8.4 Fixed in 2.7.8.4 CVE-2026-13596 WPScan
6.5 Medium WC Buckaroo BPE Gateway Plugin Broken Access Control Subscriber+ Unauthorized Order Refund < 4.9.0 Fixed in 4.9.0 CVE-2026-13329 WPScan
7.2 High Theme Demo Import Plugin Arbitrary File Upload Admin+ Arbitrary File Upload ≤ 1.1.3 CVE-2026-13157 WPScan
5.4 Medium wpForo Forum Plugin wpforo Cross-Site Scripting Subscriber+ Stored XSS via Profile Location Field < 3.1.2 Fixed in 3.1.2 CVE-2026-12696 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only