WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 3,601–3,650 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 73 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Tickera Plugin tickera-event-ticketing-system SQL Injection Authenticated (Staff+) SQL Injection via 'tc_order_status_filter' Parameter ≤ 3.6.0.1 CVE-2026-15448 Wordfence
6.4 Medium Header Footer Script Adder Plugin header-and-footer-script-adder Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta ≤ 2.1 CVE-2026-15394 Wordfence
4.4 Medium WP Encryption Plugin wp-letsencrypt-ssl Path Traversal Authenticated (Administrator+) Arbitrary File Write via 'imploded' Parameter ≤ 7.8.6.6 CVE-2026-15786 Wordfence
6.5 Medium Registrations for the Events Calendar Plugin registrations-for-the-events-calendar SQL Injection Authenticated (Contributor+) SQL Injection via 'standard' Parameter ≤ 3.2 CVE-2026-13119 Wordfence
6.5 Medium AI Copilot Plugin ai-copilot-content-generator SQL Injection Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter ≤ 1.5.4 CVE-2026-13009 Wordfence
6.3 Medium Premium Packages Plugin wpdm-premium-packages Authentication Bypass Authentication Bypass to Non-Admin via 'wpdmppdl' Parameter ≤ 7.0.4 CVE-2026-15348 Wordfence
8.8 High MDJM Event Management Plugin mobile-dj-manager Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers ≤ 1.7.8.4 CVE-2026-15017 Wordfence
9.8 Critical Customer Support Ticket System & Helpdesk Plugin wp-ticket Remote Code Execution Unauthenticated Code Injection via 'path' Parameter No login needed ≤ 6.0.5 CVE-2026-15011 Wordfence
6.4 Medium Grid/List View for WooCommerce Plugin gridlist-view-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute ≤ 3.0.9 CVE-2026-15794 Wordfence
6.4 Medium Equalize Digital Accessibility Checker Plugin accessibility-checker Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'html' Parameter ≤ 1.46.0 CVE-2026-14481 Wordfence
9.8 Critical GoDAM Plugin godam Arbitrary File Upload Unauthenticated Arbitrary File Upload via WPForms File Upload Field No login needed ≤ 1.12.2 CVE-2026-14282 Wordfence
6.5 Medium Premium Packages Plugin wpdm-premium-packages SQL Injection Authenticated (Admin+) SQL Injection via 'orderby' Parameter ≤ 7.0.4 CVE-2026-15906 Wordfence
4.4 Medium Brands for WooCommerce Plugin brands-for-woocommerce Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field ≤ 3.8.8 CVE-2026-15647 Wordfence
6.4 Medium Brands for WooCommerce Plugin brands-for-woocommerce Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute ≤ 3.8.8 CVE-2026-15646 Wordfence
5.3 Medium GutenKit Plugin gutenkit-blocks-addon Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints No login needed ≤ 2.4.12 CVE-2026-15827 Wordfence
6.5 Medium Tickera Plugin tickera-event-ticketing-system SQL Injection Authenticated (Staff+) SQL Injection via 'tc_event_filter' Parameter ≤ 3.6.0.1 CVE-2026-15761 Wordfence
6.5 Medium WCPOS Plugin woocommerce-pos Path Traversal Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter ≤ 1.9.8 CVE-2026-16078 Wordfence
6.4 Medium Bulk Page Generator Plugin lpagery Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title ≤ 2.5.7 CVE-2026-15404 Wordfence
7.5 High Product Designer for WooCommerce WordPress | Lumise Plugin SQL Injection Unauthenticated SQL Injection via 'id' Parameter in Cart JSON Upload No login needed ≤ 2.1.1 CVE-2026-9713 Wordfence
6.4 Medium WP Shortcode by MyThemeShop Plugin wp-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute ≤ 1.4.17 CVE-2026-9635 Wordfence
7.2 High ARforms Plugin arforms Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'password' Field Values No login needed ≤ 7.2.1 CVE-2026-12421 Wordfence
6.4 Medium Web Push Notifications Plugin webpushr-web-push-notifications Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'webpushr_notification_title' Post Meta Parameter ≤ 4.39.0 CVE-2026-9729 Wordfence
4.8 Medium Post Status Notifier Lite Plugin post-status-notifier-lite Cross-Site Scripting Reflected XSS via mod Parameter < 1.13.0 Fixed in 1.13.0 CVE-2026-9577 WPScan
6.1 Medium WP Compress Plugin wp-compress-image-optimizer Cross-Site Scripting Reflected XSS via test_zone No login needed < 7.10.04 Fixed in 7.10.04 CVE-2026-9066 WPScan
7.5 High Security Ninja (Premium) Plugin Authentication Bypass Two-Factor Authentication Bypass via secnin_skip_2fa No login needed < 5.290 Fixed in 5.290 CVE-2026-14291 WPScan
7.5 High Praison AI SEO Plugin Broken Access Control Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure) No login needed < 5.0.7 Fixed in 5.0.7 CVE-2026-12082 WPScan
7.2 High FormCraft Plugin formcraft-form-builder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters No login needed ≤ 3.9.14 CVE-2026-7232 Wordfence
7.2 High SUMO Reward Points for WooCommerce Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter No login needed ≤ 32.7.0 CVE-2026-7534 Wordfence
6.5 Medium Contact Form 7 – Dynamic Text Extension Plugin contact-form-7-dynamic-text-extension Arbitrary Shortcode Execution Dynamic Text Extension <= 5.0.7 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 5.0.7 CVE-2025-13146 Wordfence
6.4 Medium Ultimate Addons for Elementor Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes ≤ 2.9.1 CVE-2026-15787 Wordfence
5.3 Medium Timetics Plugin timetics Broken Access Control Unauthenticated Booking Auto-Approval via Arbitrary payment_method No login needed < 1.0.57 Fixed in 1.0.57 CVE-2026-14322 WPScan
7.5 High Events Manager Plugin events-manager SQL Injection Unauthenticated SQL Injection via PHP Object Injection in Booking Registration No login needed < 7.3.7 Fixed in 7.3.7 CVE-2026-12987 WPScan
8.8 High Product Addons – WowAddons Plugin Cross-Site Scripting WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload No login needed < 1.6.15 Fixed in 1.6.15 CVE-2026-12968 WPScan
8.1 High WP Foodbakery Plugin Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action ≤ 4.9 CVE-2026-15802 Wordfence
7.5 High Ninja Forms Plugin ninja-forms Other Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields No login needed < 3.14.9 Fixed in 3.14.9 CVE-2026-65052 VulnCheck
6.5 Medium Ninja Forms Plugin ninja-forms Other Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler No login needed < 3.14.9 Fixed in 3.14.9 CVE-2026-65051 VulnCheck
6.5 Medium Ninja Forms Plugin ninja-forms Broken Access Control Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors < 3.14.9 Fixed in 3.14.9 CVE-2026-65050 VulnCheck
9.3 Critical Ninja Forms Plugin ninja-forms Broken Access Control Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action No login needed < 3.14.9 Fixed in 3.14.9 CVE-2026-65049 VulnCheck
9.3 Critical Ninja Forms Plugin ninja-forms Cross-Site Scripting Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index No login needed 3.10.4 – < 3.14.9 Fixed in 3.14.9 CVE-2026-65048 VulnCheck
7.2 High MapSVG Plugin mapsvg-lite-interactive-vector-maps Arbitrary File Upload Authenticated (Administrator+) Arbitrary File Upload via '/mapsvg/v1/svgfile' Endpoint ≤ 8.14.0 CVE-2026-1771 Wordfence
6.4 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget ≤ 6.6.11 CVE-2026-15145 Wordfence
4.3 Medium Tutor LMS Elementor Addons Plugin tutor-lms-elementor-addons Broken Access Control Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation ≤ 4.0.0 CVE-2026-1372 Wordfence
4.3 Medium WPBot AI ChatBot Plugin Broken Access Control Subscriber+ RAG Settings Update < 8.2.0 Fixed in 8.2.0 CVE-2026-14185 WPScan
7.5 High Bpost Shipping Platform Plugin SQL Injection Unauthenticated SQL Injection No login needed < 3.2.3 Fixed in 3.2.3 CVE-2026-8082 WPScan
5.4 Medium Academy LMS Plugin academy Broken Access Control Subscriber+ Cross-User Lesson Note and Progress Modification via IDOR < 3.8.1 Fixed in 3.8.1 CVE-2026-14184 WPScan
4.3 Medium Classified Listing Plugin classified-listing Information Disclosure Subscriber+ Payment Receipt Disclosure via IDOR < 5.3.9 Fixed in 5.3.9 CVE-2026-14183 WPScan
6.5 Medium Bit Form Plugin bit-form Authentication Bypass Unauthenticated Workflow Trigger via Authentication Bypass No login needed < 3.1.0 Fixed in 3.1.0 CVE-2026-13694 WPScan
5.9 Medium Bit Form Plugin bit-form Path Traversal Unauthenticated Arbitrary File Read via Path Traversal No login needed < 3.1.0 Fixed in 3.1.0 CVE-2026-13693 WPScan
8.8 High CRT Addons for Elementor Plugin Cross-Site Scripting Unauthenticated Stored XSS via Contact Form No login needed < 1.6.7 Fixed in 1.6.7 CVE-2026-11767 WPScan
9.8 Critical Easy Form Builder by WhiteStudio Plugin easy-form-builder Privilege Escalation Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint No login needed ≤ 4.0.11 CVE-2026-13439 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only