WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 301–350 of 30,513 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.1 Medium | Bootstrap Shortcodes | Cross-Site Scripting The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in… |
< 3.4.6 Fixed in 3.4.6 |
CVE-2026-112111 |
mitre | |
| 8.5 High | Support Genix | SQL Injection |
≤ 1.4.54 Fixed in 1.4.55 |
CVE-2026-110895 |
Patchstack | |
| 9.8 Critical | Conversational Forms for ChatBot | PHP Object Injection No login needed |
≤ 1.5.1 Fixed in 1.5.2 |
CVE-2026-110886 |
Patchstack | |
| 6.5 Medium | Kit (formerly ConvertKit) | Broken Access Control No login needed |
≤ 3.4.6 Fixed in 3.4.7 |
CVE-2026-110880 |
Patchstack | |
| 8.1 High | Login with phone number | Privilege Escalation No login needed |
≤ 1.8.77 Fixed in 1.8.78 |
CVE-2026-110373 |
Patchstack | |
| 8.8 High | Strong Testimonials | PHP Object Injection |
≤ 3.3.12 Fixed in 3.3.13 |
CVE-2026-107436 |
Patchstack | |
| 6.5 Medium | 2Way VideoCalls and Random Chat | Authentication Bypass Broken Authentication No login needed |
≤ 6.1.5 Fixed in 6.1.6 |
CVE-2026-110883 |
Patchstack | |
| 7.5 High | Electronic Signature Add-on for Fluent Forms | Broken Access Control Insecure Direct Object References (IDOR) No login needed |
≤ 2.0.5 Fixed in 2.0.6 |
CVE-2026-110383 |
Patchstack | |
| 7.1 High | Booktics | Cross-Site Scripting No login needed |
≤ 1.0.29 Fixed in 1.0.30 |
CVE-2026-109895 |
Patchstack | |
| 9.3 Critical | Booktics | SQL Injection No login needed |
≤ 1.0.29 Fixed in 1.0.30 |
CVE-2026-109894 |
Patchstack | |
| 7.1 High | PowerPack Lite for Beaver Builder | Cross-Site Scripting No login needed |
≤ 1.3.1 Fixed in 1.3.2 |
CVE-2026-110897 |
Patchstack | |
| 7.1 High | Simply Schedule Appointments | Cross-Site Scripting No login needed |
≤ 1.6.12.35 Fixed in 1.6.12.37 |
CVE-2026-110382 |
Patchstack | |
| 9.8 Critical | OttoKit | Privilege Escalation No login needed |
≤ 1.1.40 Fixed in 1.1.41 |
CVE-2026-110372 |
Patchstack | |
| 7.1 High | eStore | Cross-Site Scripting No login needed |
≤ 1.6.13 Fixed in 1.6.14 |
CVE-2026-108485 |
Patchstack | |
| 6.5 Medium | HivePress | Content Injection |
≤ 1.7.32 Fixed in 1.8.0 |
CVE-2026-110885 |
Patchstack | |
| 6.5 Medium | Advanced File Manager | Broken Access Control No login needed |
≤ 5.4.14 Fixed in 6.0.0 |
CVE-2026-110365 |
Patchstack | |
| 7.7 High | Modern Events Calendar (Lite & Pro) | SQL Injection Subscriber+ SQLi via mec_fes_csv_export |
< 7.37.0 Fixed in 7.37.0 |
CVE-2026-96534 |
WPScan | |
| 4.9 Medium | AI Engine | Broken Access Control Editor+ Arbitrary Post Modification via update_media_metadata and approve_media |
< 3.7.9 Fixed in 3.7.9 |
CVE-2026-111041 |
WPScan | |
| 7.1 High | WP Photo Album Plus | Cross-Site Scripting Reflected XSS via 'wppa-cat' Parameter No login needed |
< 9.2.11.002 Fixed in 9.2.11.002 |
CVE-2026-110981 |
WPScan | |
| 4.9 Medium | AI Engine | Broken Access Control Editor+ Arbitrary Post Deletion via reject_media |
< 3.7.9 Fixed in 3.7.9 |
CVE-2026-110976 |
WPScan | |
| 6.5 Medium | Modern Events Calendar Lite | Broken Access Control Subscriber+ Arbitrary Post Modification via IDOR |
< 7.36.4 Fixed in 7.36.4 |
CVE-2026-110070 |
WPScan | |
| 4.3 Medium | Modern Events Calendar Lite | Information Disclosure Subscriber+ Sensitive Data Disclosure via mec_event_bookings and mec_attendees AJAX Actions |
< 7.37.0 Fixed in 7.37.0 |
CVE-2026-110069 |
WPScan | |
| 4.3 Medium | Salon Booking System | Information Disclosure Subscriber+ Coupon Code Disclosure via Discounts REST Route |
< 10.31.11 Fixed in 10.31.11 |
CVE-2026-110035 |
WPScan | |
| 6.8 Medium | Salon Booking System | Cross-Site Scripting Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url' |
< 10.31.11 Fixed in 10.31.11 |
CVE-2026-110033 |
WPScan | |
| 5.5 Medium | Salon Booking System | Broken Access Control Salon Staff+ Administrator Role Demotion via Customer Editor |
< 10.31.11 Fixed in 10.31.11 |
CVE-2026-110032 |
WPScan | |
| 7.2 High | Salon Booking System | Privilege Escalation Salon Staff+ Privilege Escalation to Administrator via Case-Insensitive User Meta Key |
10.17 – < 10.31.11 Fixed in 10.31.11 |
CVE-2026-110031 |
WPScan | |
| 4.9 Medium | Tasty Recipes Lite | Broken Access Control Contributor+ Taxonomy Term Creation, Renaming and Deletion |
1.2 – < 1.2.11 Fixed in 1.2.11 |
CVE-2026-110026 |
WPScan | |
| 5.4 Medium | Otter Blocks | Open Redirect Unauthenticated Open Redirect via Stripe Checkout Block No login needed |
< 3.2.3 Fixed in 3.2.3 |
CVE-2026-109937 |
WPScan | |
| 5.3 Medium | Product Designer | Broken Access Control Unauthenticated Design Template Data Injection No login needed |
≤ 1.0.40 |
CVE-2026-87844 |
WPScan | |
| 4.3 Medium | SMS Alert Order Notifications | Broken Access Control |
≤ 4.0.1 Fixed in 4.0.2 |
CVE-2026-110882 |
Patchstack | |
| 7.1 High | PAYCOMET for WooCommerce | Cross-Site Scripting No login needed |
≤ 5.45 |
CVE-2026-109701 |
Patchstack | |
| 7.5 High | Gantry 5 Framework | Information Disclosure Sensitive Data Exposure No login needed |
≤ 5.6.4 |
CVE-2026-110889 |
Patchstack | |
| 5.4 Medium | weForms | Arbitrary File Deletion Unauthenticated Limited Media File Deletion via 'wpuf_files' Parameter No login needed |
≤ 1.6.28 |
CVE-2026-110253 |
Wordfence | |
| 6.4 Medium | YMC Filter | Cross-Site Scripting Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter |
≤ 3.12.19 Fixed in 3.12.20 |
CVE-2026-109983 |
Wordfence | |
| 7.2 High | European VAT Compliance Assistant for WooCommerce | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header No login needed |
≤ 1.36.10 Fixed in 1.36.11 |
CVE-2026-100316 |
Wordfence | |
| 7.2 High | Payment forms, Buy now buttons, and Invoicing System | GetPaid | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter No login needed |
≤ 2.8.61 Fixed in 2.8.62 |
CVE-2026-111110 |
Wordfence | |
| 7.1 High | Fancy Comments | Cross-Site Scripting No login needed |
≤ 1.2.21 |
CVE-2026-110384 |
Patchstack | |
| 6.5 Medium | ThirstyAffiliates | Information Disclosure Unauthenticated Non-Public Affiliate Link Destination Disclosure and Click Statistic Injection No login needed |
< 3.12.1 Fixed in 3.12.1 |
CVE-2026-97314 |
WPScan | |
| 5.3 Medium | WP User Manager | Price Manipulation Unauthenticated Account Creation via Stripe Registration Payment Bypass No login needed |
2.9 – < 2.9.20 Fixed in 2.9.20 |
CVE-2026-110527 |
WPScan | |
| 6.6 Medium | Frontend Admin by DynamiApps | PHP Object Injection Admin+ PHP Object Injection |
≤ 3.29.13 |
CVE-2026-81344 |
WPScan | |
| 5.3 Medium | Frontend Admin by DynamiApps | Broken Access Control Unauthenticated ACF Options Page Field Update via Form Submission No login needed |
≤ 3.29.13 |
CVE-2026-81343 |
WPScan | |
| 5.0 Medium | WP Data Access | Server-Side Request Forgery Subscriber+ SSRF |
< 5.5.88 Fixed in 5.5.88 |
CVE-2026-106470 |
WPScan | |
| 6.8 Medium | Ukr-To-Lat | SQL Injection Contributor+ SQLi via Term Name |
≤ 1.3.5 |
CVE-2026-104122 |
WPScan | |
| 5.3 Medium | PeachPay | Information Disclosure Unauthenticated Order Key Disclosure via ConvesioPay BTCPay Status Check No login needed |
1.117.9 – < 1.120.70 Fixed in 1.120.70 |
CVE-2026-103376 |
WPScan | |
| 4.3 Medium | Patreon | Open Redirect Open Redirect via 'state' Parameter No login needed |
< 1.10.0 Fixed in 1.10.0 |
CVE-2026-92432 |
WPScan | |
| 5.9 Medium | Contact Form 7 Signature Addon | Path Traversal Unauthenticated Arbitrary File Read via Path Traversal in Email Attachments No login needed |
≤ 4.2.2 |
CVE-2026-104246 |
WPScan | |
| 6.5 Medium | Patreon | Cross-Site Request Forgery Patreon Integration Takeover via CSRF No login needed |
< 1.10.0 Fixed in 1.10.0 |
CVE-2026-92433 |
WPScan | |
| 3.7 Low | Patreon | Broken Access Control Unauthenticated Taxonomy and Term Enumeration No login needed |
< 1.10.0 Fixed in 1.10.0 |
CVE-2026-92431 |
WPScan | |
| 6.8 Medium | BSK PDF Manager | SQL Injection Contributor+ SQLi via tags_specific Shortcode Attribute |
≤ 3.8.1 |
CVE-2026-91074 |
WPScan | |
| 8.1 High | User Registration & Membership | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag |
≤ 5.2.8 Fixed in 5.3.0 |
CVE-2026-92798 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.