WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 3,451–3,500 of 17,704 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 5.3 Medium | PeproDev Ultimate Invoice | Information Disclosure Unauthenticated Invoice Archive Download No login needed |
≤ 2.2.5 |
CVE-2026-2343 |
WPScan | |
| 6.4 Medium | Easy Image Gallery | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta |
≤ 1.5.3 |
CVE-2026-4766 |
Wordfence | |
| 6.5 Medium | Product Filter for WooCommerce by WBW | Broken Access Control Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE No login needed |
≤ 3.1.2 |
CVE-2026-3138 |
Wordfence | |
| 6.5 Medium | LearnDash LMS | SQL Injection Authenticated (Contributor+) SQL Injection via 'filters[orderby_order]' Parameter |
≤ 5.0.3 |
CVE-2026-3079 |
Wordfence | |
| 5.4 Medium | User Registration & Membership | Broken Access Control Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation |
≤ 5.1.4 |
CVE-2026-4056 |
Wordfence | |
| 4.3 Medium | LearnPress | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion |
≤ 4.3.2.8 |
CVE-2026-3225 |
Wordfence | |
| 4.3 Medium | Smart Custom Fields | Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search |
≤ 5.0.6 |
CVE-2026-4066 |
Wordfence | |
| 6.5 Medium | Quiz and Survey Master (QSM) | SQL Injection Authenticated (Contributor+) SQL Injection via 'merged_question' Parameter |
≤ 10.3.5 |
CVE-2026-2412 |
Wordfence | |
| 5.3 Medium | King Addons for Elementor | Information Disclosure Unauthenticated API Keys Disclosure No login needed |
≤ 51.1.49 |
CVE-2025-13997 |
Wordfence | |
| 6.4 Medium | Sina Extension for Elementor | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `Fancy Text Widget` And `Countdown Widget` |
≤ 3.7.0 |
CVE-2025-6229 |
Wordfence | |
| 5.3 Medium | ThemeREX Addons | Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed |
< 2.38.5 Fixed in 2.38.5 |
CVE-2026-1969 |
WPScan | |
| 5.3 Medium | ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More | Information Disclosure WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure No login needed |
≤ 2.2.12 |
CVE-2025-10734 |
Wordfence | |
| 5.3 Medium | ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More | Information Disclosure WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure to Data Export No login needed |
≤ 2.2.12 |
CVE-2025-10731 |
Wordfence | |
| 6.5 Medium | ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More | Broken Access Control WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.10 - Incorrect Authorization to Unauthenticated Information Exposure and Data Manipulation No login needed |
≤ 2.2.10 |
CVE-2025-10736 |
Wordfence | |
| 6.4 Medium | Yoast SEO | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute |
≤ 27.1.1 |
CVE-2026-3427 |
Wordfence | |
| 6.4 Medium | Show Posts list | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.1.0 |
CVE-2026-4022 |
Wordfence | |
| 6.4 Medium | Ed's Social Share | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 2.0 |
CVE-2026-2501 |
Wordfence | |
| 6.4 Medium | FuseDesk | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'emailtext' Shortcode Attribute |
≤ 6.8 |
CVE-2026-1914 |
Wordfence | |
| 6.5 Medium | Task Manager | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter No login needed |
≤ 3.0.2 |
CVE-2026-4004 |
Wordfence | |
| 4.4 Medium | Mandatory Field | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Fields |
≤ 1.6.8 |
CVE-2026-1278 |
Wordfence | |
| 4.4 Medium | Ricerca – advanced search | Cross-Site Scripting advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings |
≤ 1.1.12 |
CVE-2026-2837 |
Wordfence | |
| 4.4 Medium | Weaver Show Posts | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Additional Classes to Wrap Posts' Widget Setting |
≤ 1.8.1 |
CVE-2026-2121 |
Wordfence | |
| 6.4 Medium | PQ Addons – Creative Elementor Widgets | Cross-Site Scripting Creative Elementor Widgets <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Attributes |
≤ 1.0.0 |
CVE-2026-1397 |
Wordfence | |
| 6.4 Medium | Text Toggle | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute |
≤ 1.1 |
CVE-2026-3997 |
Wordfence | |
| 6.1 Medium | Post Snippits | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update No login needed |
≤ 1.0 |
CVE-2026-2723 |
Wordfence | |
| 4.3 Medium | Neos Connector for Fakturama | Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed |
≤ 0.0.14 |
CVE-2026-4143 |
Wordfence | |
| 4.4 Medium | Wikilookup | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Popup Width' Setting |
≤ 1.1.5 |
CVE-2026-3354 |
Wordfence | |
| 4.4 Medium | Review Map by RevuKangaroo | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings |
≤ 1.7 |
CVE-2026-4161 |
Wordfence | |
| 6.5 Medium | Hr Press Lite | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure |
≤ 1.0.2 |
CVE-2026-2720 |
Wordfence | |
| 6.4 Medium | Sherk Custom Post Type Displays | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute |
≤ 1.2.1 |
CVE-2026-3554 |
Wordfence | |
| 6.5 Medium | ElementCamp | SQL Injection Authenticated (Author+) SQL Injection via 'meta_query[compare]' Parameter |
≤ 2.3.6 |
CVE-2026-2503 |
Wordfence | |
| 4.4 Medium | Comment SPAM Wiper | Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'API Key' Setting |
≤ 1.2.1 |
CVE-2026-3353 |
Wordfence | |
| 6.5 Medium | Task Manager | Path Traversal Authenticated (Subscriber+) Arbitrary File Read |
≤ 3.0.2 |
CVE-2026-2351 |
Wordfence | |
| 6.4 Medium | Twitter Feeds | Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'tweet_title' Shortcode Attribute |
≤ 1.0.0 |
CVE-2026-1911 |
Wordfence | |
| 6.4 Medium | Logo Slider | Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode |
≤ 4.9.0 |
CVE-2026-0609 |
Wordfence | |
| 5.3 Medium | Punnel | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action No login needed |
≤ 1.3.1 |
CVE-2026-3645 |
Wordfence | |
| 6.4 Medium | Schema Shortcode | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode |
≤ 1.0 |
CVE-2026-1575 |
Wordfence | |
| 6.4 Medium | Integration with Hubspot Forms | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 1.2.2 |
CVE-2026-1908 |
Wordfence | |
| 6.4 Medium | Multi Post Carousel by Category | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides' Shortcode Attribute |
≤ 1.4 |
CVE-2026-1275 |
Wordfence | |
| 6.4 Medium | Paypal Shortcodes | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' and 'name' Shortcode Attributes |
≤ 0.3 |
CVE-2026-3617 |
Wordfence | |
| 6.1 Medium | Comment Genius | Cross-Site Scripting Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] No login needed |
≤ 1.2.5 |
CVE-2026-1647 |
Wordfence | |
| 5.5 Medium | Multi Functional Flexi Lightbox | Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via 'message' Parameter |
≤ 1.2 |
CVE-2026-3347 |
Wordfence | |
| 6.1 Medium | itsukaita | Cross-Site Scripting Reflected Cross-Site Scripting via 'day_from' Parameter No login needed |
≤ 0.1.2 |
CVE-2026-2427 |
Wordfence | |
| 6.4 Medium | WordPress PayPal Donation | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute |
≤ 1.01 |
CVE-2026-4072 |
Wordfence | |
| 5.3 Medium | e-shot | Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action No login needed |
≤ 1.0.2 |
CVE-2026-3546 |
Wordfence | |
| 6.4 Medium | MinhNhut Link Gateway | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes |
≤ 3.6.1 |
CVE-2026-3333 |
Wordfence | |
| 6.5 Medium | Pre* Party Resource Hints | SQL Injection Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter |
≤ 1.8.20 |
CVE-2026-4087 |
Wordfence | |
| 4.3 Medium | login_register | Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting No login needed |
≤ 1.2.0 |
CVE-2026-1503 |
Wordfence | |
| 5.6 Medium | Contact Form, Survey, Quiz & Popup Form Builder – ARForms | Arbitrary Shortcode Execution ARForms <= 1.7.2 - Unauthenticated Blind Arbitrary Shortcode Execution No login needed |
≤ 1.7.2 |
CVE-2024-13785 |
Wordfence | |
| 6.4 Medium | Sheets2Table | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'titles' Shortcode Attribute |
≤ 0.4.1 |
CVE-2026-3619 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.