WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 301–350 of 17,674 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 7 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	WP Maps Plugin `wp-google-map-plugin`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter	`≤ 4.9.8`	Sep 25, 2026	`CVE-2026-13179`	Wordfence
4.9 Medium	SSL Zen Plugin `ssl-zen`	Path Traversal Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'file_name' Parameter	`≤ 4.7.42`	Sep 25, 2026	`CVE-2026-17602`	Wordfence
6.4 Medium	User Profile Builder Plugin `profile-builder`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field	`≤ 4.0.2`	Sep 25, 2026	`CVE-2026-93656`	Wordfence
6.1 Medium	SSL Zen Plugin `ssl-zen`	Cross-Site Scripting Reflected Cross-Site Scripting via 'uri' Parameter No login needed	`≤ 4.7.42`	Sep 25, 2026	`CVE-2026-17577`	Wordfence
6.4 Medium	wpForo Forum Plugin `wpforo`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field	`≤ 3.1.6`	Sep 25, 2026	`CVE-2026-93747`	Wordfence
6.1 Medium	WPForms Plugin `wpforms-lite`	Cross-Site Scripting Reflected Cross-Site Scripting via 'page_title' POST Parameter No login needed	`≤ 2.0.2`	Sep 25, 2026	`CVE-2026-88996`	Wordfence
6.4 Medium	Better Messages Plugin `bp-better-messages`	Cross-Site Scripting Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name	`≤ 3.0.4`	Sep 25, 2026	`CVE-2026-94376`	Wordfence
6.4 Medium	Gutenverse Plugin `gutenverse`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute	`≤ 4.0.8`	Sep 25, 2026	`CVE-2026-92746`	Wordfence
4.3 Medium	Blog2Social: Social Media Auto Post & Scheduler Plugin `blog2social`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers	`≤ 9.1.0`	Sep 25, 2026	`CVE-2026-92829`	Wordfence
5.3 Medium	Online Scheduling and Appointment Booking System Plugin `bookly-responsive-appointment-booking-tool`	Broken Access Control Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data No login needed	`≤ 28.2`	Sep 25, 2026	`CVE-2026-92799`	Wordfence
6.4 Medium	GeoDirectory Plugin `geodirectory`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter	`≤ 2.8.183`	Sep 25, 2026	`CVE-2026-96766`	Wordfence
4.3 Medium	OpenStation Plugin `desktop-mode`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint	`≤ 1.1.7`	Sep 25, 2026	`CVE-2026-19775`	Wordfence
6.5 Medium	Better Messages Plugin `bp-better-messages`	SQL Injection Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter	`≤ 3.0.4`	Sep 25, 2026	`CVE-2026-93899`	Wordfence
6.1 Medium	JetFormBuilder Plugin `jetformbuilder`	Cross-Site Scripting Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field No login needed	`≤ 3.6.5.3`	Sep 25, 2026	`CVE-2026-92212`	Wordfence
6.4 Medium	GeoDirectory Plugin `geodirectory`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')	`≤ 2.8.181`	Sep 25, 2026	`CVE-2026-93897`	Wordfence
4.0 Medium	Link Library Plugin `link-library`	Server-Side Request Forgery Unauthenticated SSRF via Reciprocal Link Validation No login needed	`7.8.8 – < 7.9.6` Fixed in `7.9.6`	Sep 25, 2026	`CVE-2026-78397`	WPScan
4.1 Medium	Link Library Plugin `link-library`	Path Traversal Contributor+ Path Traversal via 'filepath' Parameter	`< 7.9.6` Fixed in `7.9.6`	Sep 25, 2026	`CVE-2026-78394`	WPScan
6.1 Medium	Link Library Plugin `link-library`	Cross-Site Scripting Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links No login needed	`< 7.9.6` Fixed in `7.9.6`	Sep 25, 2026	`CVE-2026-78393`	WPScan
6.4 Medium	CSS & JavaScript Toolbox Plugin `css-javascript-toolbox`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode	`≤ 12.0.6`	Sep 25, 2026	`CVE-2025-14814`	Wordfence
4.3 Medium	Spectra Legacy – Gutenberg Blocks Plugin `ultimate-addons-for-gutenberg`	Information Disclosure Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure	`≤ 2.20.0`	Sep 24, 2026	`CVE-2026-16302`	Wordfence
6.5 Medium	Custom Thank You Page for WooCommerce Plugin `wc-custom-thank-you`	Broken Access Control Missing Authorization to Unauthenticated Settings Export and Settings Reset No login needed	`≤ 1.1.2`	Sep 24, 2026	`CVE-2026-4806`	Wordfence
4.3 Medium	MailerLite – Signup forms (official) Plugin `official-mailerlite-sign-up-forms`	Broken Access Control Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion	`≤ 1.7.21`	Sep 24, 2026	`CVE-2026-3253`	Wordfence
5.4 Medium	Kirki – Freeform Page Builder, Website Builder & Customizer Plugin `kirki`	Server-Side Request Forgery Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter No login needed	`≤ 6.2.0`	Sep 24, 2026	`CVE-2026-18335`	Wordfence
6.4 Medium	WP Multilang – Translation and Multilingual Plugin	Cross-Site Scripting Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content	`≤ 2.4.31`	Sep 24, 2026	`CVE-2026-15731`	Wordfence
4.3 Medium	Events Manager Plugin `events-manager`	Information Disclosure Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter	`7.4.1 – < 7.4.5` Fixed in `7.4.5`	Sep 24, 2026	`CVE-2026-93662`	WPScan
6.8 Medium	WPeMatico RSS Feed Fetcher Plugin `wpematico`	Cross-Site Scripting Contributor+ Stored XSS via Word to Category	`< 2.8.26` Fixed in `2.8.26`	Sep 24, 2026	`CVE-2026-89005`	WPScan
6.8 Medium	WPeMatico RSS Feed Fetcher Plugin `wpematico`	Cross-Site Scripting Contributor+ Stored XSS via Campaign Item Preview	`< 2.8.26` Fixed in `2.8.26`	Sep 24, 2026	`CVE-2026-89002`	WPScan
4.3 Medium	MasterStudy LMS Plugin	Broken Access Control Subscriber+ Lesson Completion Record Creation	`< 3.7.50` Fixed in `3.7.50`	Sep 24, 2026	`CVE-2026-88847`	WPScan
5.3 Medium	MasterStudy LMS 2.3.0 Plugin	Broken Access Control < 3.7.50 - Unauthenticated Account Creation with Registration Disabled No login needed	`2.3.0 – < 3.7.50` Fixed in `3.7.50`	Sep 24, 2026	`CVE-2026-88846`	WPScan
4.3 Medium	MasterStudy LMS 2.3.0 Plugin	Broken Access Control < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import	`2.3.0 – < 3.7.50` Fixed in `3.7.50`	Sep 24, 2026	`CVE-2026-88845`	WPScan
4.3 Medium	Masteriyo LMS Plugin `learning-management-system`	Information Disclosure Subscriber+ Quiz Answer Key Disclosure	`< 3.4.2` Fixed in `3.4.2`	Sep 24, 2026	`CVE-2026-82850`	WPScan
4.3 Medium	Masteriyo LMS Plugin `learning-management-system`	Information Disclosure Subscriber+ Arbitrary User Course Progress Disclosure via IDOR	`< 3.4.2` Fixed in `3.4.2`	Sep 24, 2026	`CVE-2026-82849`	WPScan
6.5 Medium	10Web Booster Plugin `tenweb-speed-optimizer`	Information Disclosure Unauthenticated Connection Secret Disclosure and Deletion No login needed	`< 2.34.0` Fixed in `2.34.0`	Sep 24, 2026	`CVE-2026-82195`	WPScan
6.8 Medium	CMB2 Plugin `cmb2`	Privilege Escalation Subscriber+ Arbitrary Option Corruption via oEmbed Handler	`< 2.13.0` Fixed in `2.13.0`	Sep 24, 2026	`CVE-2026-80338`	WPScan
6.8 Medium	WPForms Lite Plugin	Broken Access Control Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent No login needed	`1.8.8.2 – < 2.0.2` Fixed in `2.0.2`	Sep 24, 2026	`CVE-2026-74991`	WPScan
6.5 Medium	YITH WooCommerce Request A Quote Plugin `yith-woocommerce-request-a-quote`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`< 4.46.1` Fixed in `4.46.1`	Sep 23, 2026	`CVE-2026-95602`	Patchstack
5.3 Medium	TrustedLogin Connector Plugin `trustedlogin-connector`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.0.3` Fixed in `2.0.4`	Sep 23, 2026	`CVE-2026-95600`	Patchstack
5.3 Medium	Team Plugin `tlp-team`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 6.0.0` Fixed in `6.0.1`	Sep 23, 2026	`CVE-2026-95592`	Patchstack
6.5 Medium	Ultimate Addons for Contact Form 7 Plugin `ultimate-addons-for-contact-form-7`	Cross-Site Scripting	`≤ 3.5.50` Fixed in `3.5.51`	Sep 23, 2026	`CVE-2026-95586`	Patchstack
6.5 Medium	PixelYourSite – Your smart PIXEL (TAG) Manager Plugin `pixelyoursite`	Cross-Site Scripting Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS)	`≤ 11.4.1` Fixed in `11.4.2`	Sep 23, 2026	`CVE-2026-95530`	Patchstack
6.5 Medium	Conekta Payment Gateway Plugin `conekta-payment-gateway`	Broken Access Control No login needed	`≤ 6.2.4` Fixed in `6.2.5`	Sep 23, 2026	`CVE-2026-95527`	Patchstack
6.5 Medium	WP User Frontend Plugin `wp-user-frontend`	Arbitrary File Deletion	`≤ 4.3.11` Fixed in `4.3.12`	Sep 23, 2026	`CVE-2026-95525`	Patchstack
5.3 Medium	WP User Frontend Plugin `wp-user-frontend`	Authentication Bypass Bypass Vulnerability No login needed	`≤ 4.3.11` Fixed in `4.3.12`	Sep 23, 2026	`CVE-2026-95524`	Patchstack
6.5 Medium	WP User Frontend Plugin `wp-user-frontend`	Authentication Bypass Bypass Vulnerability	`≤ 4.3.11` Fixed in `4.3.12`	Sep 23, 2026	`CVE-2026-95523`	Patchstack
5.3 Medium	Netgsm Plugin `netgsm`	Other Bypass Vulnerability No login needed	`≤ 2.10.0` Fixed in `2.10.2`	Sep 23, 2026	`CVE-2026-95514`	Patchstack
6.5 Medium	Podcast Importer SecondLine Plugin `podcast-importer-secondline`	Cross-Site Scripting	`≤ 1.5.6` Fixed in `1.5.8`	Sep 23, 2026	`CVE-2026-94682`	Patchstack
6.5 Medium	The Post Grid Plugin `the-post-grid`	Cross-Site Scripting	`≤ 7.9.5` Fixed in `7.9.6`	Sep 23, 2026	`CVE-2026-94680`	Patchstack
5.4 Medium	Fluent Support Plugin `fluent-support`	Broken Access Control	`≤ 2.3.2` Fixed in `2.4.0`	Sep 23, 2026	`CVE-2026-94679`	Patchstack
6.5 Medium	The Post Grid Plugin `the-post-grid`	Cross-Site Scripting	`≤ 7.9.5` Fixed in `7.9.6`	Sep 23, 2026	`CVE-2026-94671`	Patchstack
6.5 Medium	ElementsKit Elementor addons Lite Plugin `elementskit-lite`	Cross-Site Scripting	`≤ 4.0.5` Fixed in `4.0.6`	Sep 23, 2026	`CVE-2026-94500`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.