WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 3,501–3,550 of 17,704 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 71 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Lobot Slider Administrator Plugin lobot-slider-administrator Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 0.6.0 CVE-2026-3331 Wordfence
4.3 Medium SR WP Minify HTML Plugin sr-wp-minify-html Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 2.1 CVE-2026-1392 Wordfence
5.3 Medium Appmax Plugin appmax Broken Access Control Missing Authorization to Order Status Manipulation and Arbitrary Order Creation via Webhook Endpoint No login needed ≤ 1.0.3 CVE-2026-3641 Wordfence
5.3 Medium REST API TO MiniProgram Plugin rest-api-to-miniprogram Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter No login needed ≤ 5.1.2 CVE-2026-3460 Wordfence
6.4 Medium WP Games Embed Plugin wp-games-embed Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.1beta CVE-2026-3996 Wordfence
4.3 Medium Xhanch - My Advanced Settings Plugin xhanch-my-advanced-settings Cross-Site Request Forgery My Advanced Settings <= 1.1.2 - Cross-Site Request Forgery to Settings Update No login needed ≤ 1.1.2 CVE-2026-3332 Wordfence
4.3 Medium UiPress lite | Effortless custom dashboards, admin themes and pages Plugin uipress-lite Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update ≤ 3.5.09 CVE-2026-2294 Wordfence
5.3 Medium Build App Online Plugin build-app-online Broken Access Control Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action No login needed ≤ 1.0.23 CVE-2026-3651 Wordfence
6.4 Medium Any Post Slider Plugin any-post-slider Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_type' Shortcode Attribute ≤ 1.0.4 CVE-2026-1899 Wordfence
4.3 Medium Group Chat & Video Chat by AtomChat Plugin atomchat Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Options Update ≤ 1.1.7 CVE-2026-1253 Wordfence
6.4 Medium Tour & Activity Operator Plugin for TourCMS Plugin tour-operator-plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.7.0 CVE-2026-1806 Wordfence
4.3 Medium Company Posts for LinkedIn Plugin company-posts-for-linkedin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion ≤ 1.0.0 CVE-2026-1935 Wordfence
4.4 Medium Survey Plugin survey Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings ≤ 1.1 CVE-2026-1247 Wordfence
6.4 Medium Simple Football Scoreboard Plugin simple-football-score-board Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0 CVE-2026-1891 Wordfence
6.4 Medium Go Night Pro | WordPress Dark Mode Plugin go-night-pro Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'margin' Shortcode Attribute ≤ 1.1.0 CVE-2026-1886 Wordfence
6.1 Medium Alfie – Feed Plugin alfie-the-productfeedtool-wp-plugin Cross-Site Request Forgery Feed Plugin <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'naam' Parameter No login needed ≤ 1.2.1 CVE-2026-4069 Wordfence
6.1 Medium WP-WebAuthn Plugin wp-webauthn Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.3.4 CVE-2025-13910 Wordfence
6.4 Medium Ed's Font Awesome Plugin eds-font-awesome Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 2.0 CVE-2026-2496 Wordfence
4.4 Medium Reward Video Ad Plugin applixir Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings ≤ 1.6 CVE-2026-2424 Wordfence
4.3 Medium Speedup Optimization Plugin speedup-optimization Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action ≤ 1.5.9 CVE-2026-4127 Wordfence
6.4 Medium fyyd podcast shortcodes Plugin fyyd-podcast-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute ≤ 0.3.1 CVE-2026-4084 Wordfence
6.4 Medium WPFAQBlock– FAQ & Accordion Plugin For Gutenberg Plugin wpfaqblock Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute ≤ 1.1 CVE-2026-1093 Wordfence
6.4 Medium Ad Short Plugin ad-short Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute ≤ 2.0.1 CVE-2026-4067 Wordfence
5.3 Medium WP-Chatbot for Messenger Plugin wp-chatbot Broken Access Control Missing Authorization to Unauthenticated Chatbot Configuration Takeover No login needed ≤ 4.9 CVE-2026-3506 Wordfence
6.1 Medium rexCrawler Plugin rexcrawler Cross-Site Scripting Reflected Cross-Site Scripting via 'url' and 'regex' Parameters No login needed ≤ 1.0.15 CVE-2026-2277 Wordfence
6.4 Medium Outgrow Plugin outgrow Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute ≤ 2.1 CVE-2026-1889 Wordfence
6.4 Medium Ecover Builder For Dummies Plugin ecover-builder-for-dummies Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute ≤ 1.0 CVE-2026-4077 Wordfence
6.4 Medium iVysilani Shortcode Plugin ivysilani-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute ≤ 3.0 CVE-2026-1851 Wordfence
4.3 Medium Redirect countdown Plugin redirect-countdown Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2026-1390 Wordfence
4.3 Medium Add Google Social Profiles to Knowledge Graph Box Plugin add-google-social-profiles-to-knowledge-graph-box Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2026-1393 Wordfence
4.3 Medium WP Posts Re-order Plugin wp-posts-re-order Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2026-1378 Wordfence
6.4 Medium Post Flagger Plugin post-flagger Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute ≤ 1.1 CVE-2026-1854 Wordfence
6.4 Medium WP NG Weather Plugin wp-ng-weather Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0.9 CVE-2026-1822 Wordfence
6.4 Medium WP Random Button Plugin wp-random-button Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute ≤ 1.0 CVE-2026-4086 Wordfence
6.5 Medium App Builder – Create Native Android & iOS Apps On The Flight Plugin app-builder Privilege Escalation Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter No login needed ≤ 5.5.10 CVE-2026-2375 Wordfence
5.3 Medium Smarter Analytics Plugin smarter-analytics Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter No login needed ≤ 2.0 CVE-2026-3570 Wordfence
5.3 Medium Canto Plugin canto Broken Access Control Missing Authorization to Unauthenticated File Upload No login needed ≤ 3.1.1 CVE-2026-3335 Wordfence
4.9 Medium EmailKit Plugin emailkit Path Traversal Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter ≤ 1.6.3 CVE-2026-3474 Wordfence
6.4 Medium Autoptimize Plugin autoptimize Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes ≤ 3.1.14 CVE-2026-2430 Wordfence
5.3 Medium RepairBuddy Plugin computer-repair-shop Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action No login needed ≤ 4.1132 CVE-2026-3567 Wordfence
6.4 Medium Image Alt Text Manager Plugin alt-manager Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Post Title ≤ 1.8.2 CVE-2026-3350 Wordfence
6.1 Medium iTracker360 Plugin itracker360 Cross-Site Request Forgery Cross-Site Request Forgery to Stored Cross-Site Scripting via 'itracker_license' Settings Field No login needed ≤ 2.2.0 CVE-2026-3572 Wordfence
6.4 Medium Contact List Plugin contact-list Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter ≤ 3.0.18 CVE-2026-3516 Wordfence
6.4 Medium Autoptimize Plugin autoptimize Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value ≤ 3.1.14 CVE-2026-2352 Wordfence
6.4 Medium Scoreboard for HTML5 Games Lite Plugin scoreboard-for-html5-game-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.2 CVE-2026-4083 Wordfence
4.4 Medium Keep Backup Daily Plugin keep-backup-daily Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via Backup Title ≤ 2.1.2 CVE-2026-3577 Wordfence
6.3 Medium TotalContest Lite Plugin totalcontest-lite PHP Object Injection ≤ 2.9.1 CVE-2026-0677 Patchstack
5.9 Medium Special Box for Content Plugin special-box-for-content Cross-Site Scripting ≤ 1 CVE-2024-31119 Patchstack
5.3 Medium RockPress Plugin ft-rockpress Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions No login needed ≤ 1.0.17 CVE-2026-3550 Wordfence
4.4 Medium CM Custom Reports Plugin cm-custom-reports Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Labels ≤ 1.2.7 CVE-2026-2432 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only