WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 3,101–3,150 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 63 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	MetForm Pro Plugin	Price Manipulation Unauthenticated Payment Amount Manipulation via 'mf-calculation' No login needed	`≤ 3.9.7`	Apr 15, 2026	`CVE-2026-1782`	Wordfence
6.1 Medium	OPEN-BRAIN Plugin `open-brain`	Cross-Site Request Forgery No login needed	`≤ 0.5.0`	Apr 15, 2026	`CVE-2026-4091`	Wordfence
5.3 Medium	Katalogportal-pdf-sync Widget Plugin `katalogportal-pdf-sync`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action No login needed	`≤ 1.0.0`	Apr 15, 2026	`CVE-2026-3649`	Wordfence
6.4 Medium	Coachific Shortcode Plugin `coachific-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute	`≤ 1.0`	Apr 15, 2026	`CVE-2026-4005`	Wordfence
4.3 Medium	Petje.af Plugin `petje-af`	Cross-Site Request Forgery Cross-Site Request Forgery to Account Deletion via 'petjeaf_disconnect' AJAX Action No login needed	`≤ 2.1.8`	Apr 15, 2026	`CVE-2026-4002`	Wordfence
5.3 Medium	e-shot Plugin `e-shot-form-builder`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX No login needed	`≤ 1.0.2`	Apr 15, 2026	`CVE-2026-3642`	Wordfence
6.4 Medium	WP Circliful Plugin `wp-circliful`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.2`	Apr 15, 2026	`CVE-2026-3659`	Wordfence
6.4 Medium	VI: Include Post By Plugin `vi-include-post-by`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'class_container' Shortcode Attribute	`≤ 0.4.200706`	Apr 15, 2026	`CVE-2026-5717`	Wordfence
4.3 Medium	Inquiry form to posts or pages Plugin `inquiry-form-to-posts-or-pages`	Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via 'inq_header' Parameter No login needed	`≤ 1.0`	Apr 15, 2026	`CVE-2026-6293`	Wordfence
5.4 Medium	Avada (Fusion) Builder Plugin	Privilege Escalation Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution	`≤ 3.15.1`	Apr 15, 2026	`CVE-2026-1509`	Wordfence
5.3 Medium	Advanced Custom Fields (ACF®) Plugin `advanced-custom-fields`	Broken Access Control Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters No login needed	`≤ 6.7.0`	Apr 15, 2026	`CVE-2026-4812`	Wordfence
4.3 Medium	Avada (Fusion) Builder Plugin	Information Disclosure Authenticated (Subscriber+) Sensitive Information Exposure via Insecure Direct Object Reference	`≤ 3.15.1`	Apr 15, 2026	`CVE-2026-1541`	Wordfence
4.4 Medium	List View Google Calendar Plugin `list-view-google-calendar`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Event Description	`≤ 7.4.3`	Apr 14, 2026	`CVE-2026-2396`	Wordfence
5.3 Medium	3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery Plugin `interactive-3d-flipbook-powered-physics-engine`	Broken Access Control PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure No login needed	`≤ 1.16.17`	Apr 14, 2026	`CVE-2026-1314`	Wordfence
6.5 Medium	Eleganzo Theme	Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary Directory Deletion	`≤ 1.2`	Apr 14, 2026	`CVE-2025-15470`	Wordfence
5.3 Medium	Nexi XPay Plugin `cartasi-x-pay`	Broken Access Control Missing Authorization to Unauthenticated Order Status Modification No login needed	`≤ 8.3.0`	Apr 14, 2026	`CVE-2025-15565`	Wordfence
4.3 Medium	Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) Plugin	Broken Access Control Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure	`≤ 4.1.8`	Apr 14, 2026	`CVE-2026-4109`	Wordfence
6.5 Medium	Germanized for WooCommerce Plugin `woocommerce-germanized`	Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed	`≤ 3.20.5`	Apr 14, 2026	`CVE-2026-2582`	Wordfence
4.4 Medium	WholeSale Products Dynamic Pricing Management WooCommerce Plugin `wholesale-products-dynamic-pricing-management-woocommerce`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings	`≤ 1.2`	Apr 14, 2026	`CVE-2026-4479`	Wordfence
6.4 Medium	ShopLentor Plugin `woolentor-addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute	`≤ 3.3.5`	Apr 14, 2026	`CVE-2026-4059`	Wordfence
6.4 Medium	Surbma \| Booking.com Plugin `surbma-bookingcom-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 2.1`	Apr 14, 2026	`CVE-2026-1607`	Wordfence
6.1 Medium	User Registration & Membership Plugin `user-registration`	Open Redirect Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter No login needed	`≤ 5.1.4`	Apr 13, 2026	`CVE-2026-6203`	Wordfence
6.8 Medium	Form Maker Plugin `form-maker`	SQL Injection No login needed	`< 1.15.38` Fixed in `1.15.38`	Apr 13, 2026	`CVE-2025-15441`	WPScan
4.3 Medium	Tutor LMS Plugin `tutor`	Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification	`≤ 3.9.7`	Apr 11, 2026	`CVE-2026-3371`	Wordfence
5.0 Medium	UsersWP Plugin `userswp`	Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery via 'uwp_crop' Parameter	`≤ 1.2.58`	Apr 11, 2026	`CVE-2026-4979`	Wordfence
6.4 Medium	BlockArt Blocks Plugin `blockart-blocks`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'clientId' Block Attribute	`≤ 2.2.15`	Apr 11, 2026	`CVE-2026-3498`	Wordfence
6.5 Medium	LifterLMS Plugin `lifterlms`	SQL Injection Authenticated (Custom+) SQL Injection via 'order' Parameter	`≤ 9.2.1`	Apr 11, 2026	`CVE-2026-5207`	Wordfence
6.4 Medium	Greenshift Plugin `greenshift-animation-and-page-builder-blocks`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute	`≤ 12.8.9`	Apr 11, 2026	`CVE-2026-4895`	Wordfence
6.1 Medium	Optimole Plugin `optimole-wp`	Cross-Site Scripting Reflected Cross-Site Scripting via Page Profiler URL No login needed	`≤ 4.2.3`	Apr 11, 2026	`CVE-2026-5226`	Wordfence
5.4 Medium	Tutor LMS Plugin `tutor`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment	`≤ 3.9.7`	Apr 11, 2026	`CVE-2026-3358`	Wordfence
6.5 Medium	YITH WooCommerce Wishlist Plugin `yith-woocommerce-wishlist`	Broken Access Control Unauthenticated Arbitrary Wishlist Renaming via IDOR No login needed	`< 4.13.0` Fixed in `4.13.0`	Apr 10, 2026	`CVE-2026-4432`	WPScan
6.5 Medium	YML for Yandex Market Plugin `yml-for-yandex-market`	Remote Code Execution Shop Manager+ RCE via Feed Generation No login needed	`< 5.0.26` Fixed in `5.0.26`	Apr 10, 2026	`CVE-2025-14545`	WPScan
6.4 Medium	AddFunc Head & Footer Code Plugin `addfunc-head-footer-code`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields	`≤ 2.3`	Apr 10, 2026	`CVE-2026-2305`	Wordfence
4.3 Medium	UsersWP Plugin `userswp`	Broken Access Control Authenticated (Subscriber+) Restricted Usermeta Modification via 'htmlvar' Parameter	`≤ 1.2.58`	Apr 10, 2026	`CVE-2026-4977`	Wordfence
6.1 Medium	Royal WordPress Backup & Restore Plugin `royal-backup-reset`	Cross-Site Scripting Reflected Cross-Site Scripting via 'wpr_pending_template' Parameter No login needed	`≤ 1.0.16`	Apr 10, 2026	`CVE-2026-4305`	Wordfence
4.3 Medium	Aruba HiSpeed Cache Plugin `aruba-hispeed-cache`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Reset No login needed	`≤ 3.0.4`	Apr 10, 2026	`CVE-2026-1924`	Wordfence
6.4 Medium	Webling Plugin `webling`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'title' Parameter	`≤ 3.9.0`	Apr 10, 2026	`CVE-2026-1263`	Wordfence
4.3 Medium	Download Manager Plugin `download-manager`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Media File Protection Removal	`≤ 3.3.51`	Apr 10, 2026	`CVE-2026-4057`	Wordfence
5.3 Medium	Customer Reviews for WooCommerce Plugin `customer-reviews-woocommerce`	Authentication Bypass Unauthenticated Authentication Bypass to Arbitrary Review Submission via 'key' Parameter No login needed	`≤ 5.103.0`	Apr 10, 2026	`CVE-2026-4664`	Wordfence
5.4 Medium	WP-Optimize Plugin `wp-optimize`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation	`≤ 4.5.0`	Apr 10, 2026	`CVE-2026-2712`	Wordfence
6.1 Medium	adivaha Travel Plugin `adiaha-hotel`	Cross-Site Scripting WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile No login needed	`2.3`	Apr 9, 2026	`CVE-2023-54358`	VulnCheck
5.3 Medium	Online Scheduling and Appointment Booking System – Bookly Plugin `bookly-responsive-appointment-booking-tool`	Price Manipulation Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips' No login needed	`≤ 27.0`	Apr 9, 2026	`CVE-2026-2519`	Wordfence
6.4 Medium	List category posts Plugin `list-category-posts`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode	`≤ 0.94.0`	Apr 9, 2026	`CVE-2026-3005`	Wordfence
6.4 Medium	UsersWP Plugin `userswp`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via User Badge Link Substitution	`≤ 1.2.60`	Apr 9, 2026	`CVE-2026-5742`	Wordfence
6.4 Medium	Ultimate FAQ Accordion Plugin `ultimate-faqs`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content	`≤ 2.4.7`	Apr 9, 2026	`CVE-2026-4336`	Wordfence
4.4 Medium	Experto Dashboard for WooCommerce Plugin `experto-custom-dashboard`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Navigation Font Size' Setting	`≤ 1.0.4`	Apr 9, 2026	`CVE-2026-3574`	Wordfence
4.3 Medium	MStore API Plugin `mstore-api`	Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update	`≤ 4.18.3`	Apr 9, 2026	`CVE-2026-3568`	Wordfence
6.4 Medium	Download Manager Plugin `download-manager`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.3.52`	Apr 9, 2026	`CVE-2026-5357`	Wordfence
6.4 Medium	OSM Plugin `osm`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker_name' Shortcode Attribute	`≤ 6.1.15`	Apr 9, 2026	`CVE-2026-4429`	Wordfence
5.4 Medium	Ziggeo Plugin `ziggeo`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action	`≤ 3.1.1`	Apr 9, 2026	`CVE-2026-4124`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.