WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 301–350 of 835 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.1 High | Everest Forms Pro | Cross-Site Scripting No login needed |
≤ 1.9.10 |
CVE-2026-27070 |
Patchstack | |
| 7.5 High | NEX-Forms – Ultimate Forms | Broken Access Control Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification via nf_set_entry_update_id No login needed |
≤ 9.1.9 Fixed in 9.1.10 |
CVE-2026-1947 |
Wordfence | |
| 4.3 Medium | NEX-Forms – Ultimate Forms | Broken Access Control Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license |
≤ 9.1.9 Fixed in 9.1.10 |
CVE-2026-1948 |
Wordfence | |
| 4.3 Medium | Contact Form by WPForms | Broken Access Control |
≤ 1.9.9.3 Fixed in 1.9.9.4 |
CVE-2026-32446 |
Patchstack | |
| 5.3 Medium | Formidable Forms | Price Manipulation Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter No login needed |
≤ 6.28 Fixed in 6.29 |
CVE-2026-2888 |
Wordfence | |
| 7.5 High | Formidable Forms | Broken Access Control Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse No login needed |
≤ 6.28 |
CVE-2026-2890 |
Wordfence | |
| 6.4 Medium | Gravity Forms | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title |
≤ 2.9.28 |
CVE-2026-3492 |
Wordfence | |
| 6.8 Medium | Gutena Forms | Broken Access Control Contributor+ Arbitrary Limited Options Update |
< 1.6.1 Fixed in 1.6.1 |
CVE-2026-1753 |
WPScan | |
| 6.4 Medium | weForms | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API |
≤ 1.6.27 Fixed in 1.6.28 |
CVE-2026-2707 |
Wordfence | |
| 9.8 Critical | Database for Contact Form 7, WPforms, Elementor forms | PHP Object Injection Unauthenticated PHP Object Injection via 'download_csv' No login needed |
≤ 1.4.7 |
CVE-2026-2599 |
Wordfence | |
| 6.5 Medium | Fluent Forms Pro Add On Pack | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion No login needed |
≤ 6.1.17 |
CVE-2026-2899 |
Wordfence | |
| 7.2 High | Fluent Forms Pro | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Draft Form Submission No login needed |
≤ 6.1.17 |
CVE-2026-2365 |
Wordfence | |
| 6.5 Medium | Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder | Broken Access Control Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.6.0 - Authenticated (Contributor+) Limited Options Update in save_gutena_forms_schema() |
≤ 1.6.0 Fixed in 1.6.1 |
CVE-2026-1674 |
Wordfence | |
| 7.2 High | WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed |
≤ 1.1.5 |
CVE-2026-2568 |
Wordfence | |
| 7.5 High | Fluent Forms Pro Add On Pack | Broken Access Control Missing Authorization to Unauthenticated Payment Status modification No login needed |
≤ 6.1.17 |
CVE-2026-2428 |
Wordfence | |
| 6.5 Medium | PDF for Elementor Forms + Drag And Drop Template Builder | Broken Access Control |
≤ 6.3.1 Fixed in 6.5.0 |
CVE-2026-22350 |
Patchstack | |
| 7.1 High | NEX-Forms | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 9.1.7 Fixed in 9.1.8 |
CVE-2025-69326 |
Patchstack | |
| 7.1 High | NEX-Forms | Cross-Site Scripting No login needed |
≤ 9.1.7 Fixed in 9.1.8 |
CVE-2025-69324 |
Patchstack | |
| 7.1 High | iContact for Gravity Forms | Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed |
≤ 1.3.2 |
CVE-2025-68863 |
Patchstack | |
| 6.5 Medium | PDF for WPForms | Broken Access Control |
≤ 6.3.0 Fixed in 6.3.1 |
CVE-2025-68534 |
Patchstack | |
| 9.9 Critical | WPForms Google Sheet Connector | Remote Code Execution |
≤ 4.0.1 Fixed in 4.0.2 |
CVE-2025-67979 |
Patchstack | |
| 4.3 Medium | MailerLite | Broken Access Control |
≤ 1.7.18 Fixed in 1.7.19 |
CVE-2026-25420 |
Patchstack | |
| 5.3 Medium | hCaptcha for WP | Broken Access Control No login needed |
≤ 4.21.1 Fixed in 4.22.0 |
CVE-2026-25315 |
Patchstack | |
| 5.3 Medium | Everest Forms | Arbitrary Shortcode Execution No login needed |
≤ 3.4.1 Fixed in 3.4.2 |
CVE-2026-22422 |
Patchstack | |
| 8.8 High | Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent | Broken Access Control Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation |
0.5.4 – 1.2.1 |
CVE-2025-12845 |
Wordfence | |
| 5.3 Medium | RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login | Price Manipulation Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment No login needed |
≤ 6.0.6.9 |
CVE-2025-14444 |
Wordfence | |
| 4.3 Medium | Kali Forms | Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Form Data Exposure |
≤ 2.4.8 Fixed in 2.4.9 |
CVE-2026-1860 |
Wordfence | |
| 4.4 Medium | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting |
≤ 1.50.2 |
CVE-2026-2002 |
Wordfence | |
| 4.3 Medium | Smart Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure |
≤ 2.6.99 |
CVE-2026-2022 |
Wordfence | |
| 7.5 High | Ninja Forms | Information Disclosure Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action No login needed |
≤ 3.14.0 Fixed in 3.14.1 |
CVE-2026-2268 |
Wordfence | |
| 6.4 Medium | Fluent Forms | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module |
≤ 6.1.14 Fixed in 6.1.15 |
CVE-2026-0996 |
Wordfence | |
| 5.4 Medium | Fluent Forms Pro Add On Pack | Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery via 'saveDataSource' |
≤ 6.1.12 |
CVE-2026-0632 |
Wordfence | |
| 4.3 Medium | WP Forms Signature Contract Add-On | Broken Access Control Broken Access Control to Notice Dismissal |
≤ 1.8.2 Fixed in 1.8.3 |
CVE-2026-24985 |
Patchstack | |
| 5.3 Medium | NEX-Forms – Ultimate Forms | Broken Access Control Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed |
≤ 9.1.8 |
CVE-2025-15510 |
Wordfence | |
| 9.8 Critical | Snow Monkey Forms | Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal No login needed |
≤ 12.0.3 |
CVE-2026-1056 |
Wordfence | |
| 5.3 Medium | Database for Contact Form 7, WPforms, Elementor forms | Broken Access Control Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export No login needed |
≤ 1.4.5 Fixed in 1.4.6 |
CVE-2026-0825 |
Wordfence | |
| 6.4 Medium | Forms Bridge | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute |
≤ 4.2.5 Fixed in 4.3.0 |
CVE-2026-1244 |
Wordfence | |
| 4.3 Medium | SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity | Cross-Site Request Forgery Cross-Site Request Forgery to Survey Cloning No login needed |
≤ 2.5.2 |
CVE-2025-13205 |
Wordfence | |
| 4.3 Medium | SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity | Cross-Site Request Forgery Cross-Site Request Forgery to Survey Renaming No login needed |
≤ 2.5.2 |
CVE-2025-13194 |
Wordfence | |
| 5.4 Medium | Zoho CRM Lead Magnet | Broken Access Control |
≤ 1.8.1.9 |
CVE-2026-24595 |
Patchstack | |
| 8.6 High | HDForms | Arbitrary File Deletion No login needed |
≤ 1.6.1 Fixed in 1.6.2 |
CVE-2025-68912 |
Patchstack | |
| 6.4 Medium | SpiceForms Form Builder | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2025-12178 |
Wordfence | |
| 6.1 Medium | WPForms | Cross-Site Scripting No login needed |
≤ 1.7.8 |
CVE-2020-36919 |
VulnCheck | |
| 5.3 Medium | Forminator Forms – Contact Form, Payment Form & Custom Form Builder | Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export |
≤ 1.49.1 Fixed in 1.49.2 |
CVE-2025-14782 |
Wordfence | |
| 6.8 Medium | Nex-Forms Express WP Form Builder | Cross-Site Scripting Authenticated Stored XSS |
< 9.1.8 Fixed in 9.1.8 |
CVE-2025-14803 |
WPScan | |
| 4.3 Medium | Campaign Monitor | Broken Access Control |
≤ 2.9.1 Fixed in 2.9.2 |
CVE-2026-0674 |
Patchstack | |
| 5.3 Medium | Fluent Forms | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Creation via AI Builder |
≤ 6.1.7 Fixed in 6.1.8 |
CVE-2025-13722 |
Wordfence | |
| 4.9 Medium | Form Vibes – Database Manager for Forms | SQL Injection Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injection |
≤ 1.4.13 Fixed in 1.5 |
CVE-2025-13409 |
Wordfence | |
| 5.3 Medium | Ninja Forms | Information Disclosure Unauthenticated Token Generation and Submission Disclosure No login needed |
< 3.13.3 Fixed in 3.13.3 |
CVE-2025-14072 |
WPScan | |
| 4.3 Medium | Signature Add-On for Gravity Forms | Broken Access Control |
≤ 1.8.6 Fixed in 1.8.7 |
CVE-2025-62099 |
Patchstack |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.