WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 3,701–3,750 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 75 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.4 Medium SysBasics Customize My Account for WooCommerce Plugin customize-my-account-for-woocommerce Cross-Site Scripting Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'row_type' Parameter ≤ 4.4.14 CVE-2026-15324 Wordfence
4.9 Medium WP Bulk Delete Plugin wp-bulk-delete SQL Injection Authenticated (Administrator+) SQL Injection via 'delete_user_roles' Parameter ≤ 1.4.2 CVE-2026-15727 Wordfence
8.8 High WPFunnels Plugin wpfunnels Privilege Escalation Authenticated (Funnel Manager+) Privilege Escalation via 'group_id' Path Parameter ≤ 3.12.8 CVE-2026-15103 Wordfence
6.4 Medium wpForo Forum Plugin wpforo Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field ≤ 3.1.1 CVE-2026-15021 Wordfence
8.8 High Loco Translate Plugin loco-translate Cross-Site Request Forgery Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter No login needed ≤ 2.8.5 CVE-2026-15005 Wordfence
8.8 High Digits: WordPress Mobile Number Signup and Login Plugin Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via 'digits_reg_userrole' Parameter ≤ 9.1.0.5 CVE-2026-13741 Wordfence
6.4 Medium Tickera Plugin tickera-event-ticketing-system Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute ≤ 3.6.0.0 CVE-2026-13755 Wordfence
4.3 Medium WPBot Plugin chatbot Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function ≤ 8.5.6 CVE-2026-15610 Wordfence
5.3 Medium WPBot Plugin chatbot Broken Access Control Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter No login needed ≤ 8.5.6 CVE-2026-15106 Wordfence
4.9 Medium WP TripAdvisor Review Slider Plugin wp-tripadvisor-review-slider SQL Injection Authenticated (Administrator+) SQL Injection via 'filtersource' Parameter ≤ 14.6 CVE-2026-15651 Wordfence
4.3 Medium Themify Builder Plugin themify-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action ≤ 7.7.7 CVE-2026-15407 Wordfence
8.1 High Uncanny Automator Plugin uncanny-automator PHP Object Injection Unauthenticated PHP Object Injection to Arbitrary File Deletion via Forminator Submitted-Field Token No login needed ≤ 7.3.1.4 CVE-2026-15008 Wordfence
6.5 Medium Tutor LMS Plugin tutor SQL Injection Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array ≤ 4.0.0 CVE-2026-15022 Wordfence
6.5 Medium Tickera Plugin tickera-event-ticketing-system SQL Injection Authenticated (Staff+) SQL Injection via 's' Parameter ≤ 3.6.0.0 CVE-2026-13754 Wordfence
7.2 High Breakdance Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Webhook Action Details No login needed ≤ 2.7.1 CVE-2026-7543 Wordfence
4.3 Medium The Cache Purger Plugin the-cache-purger Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter ≤ 2.3.20 CVE-2026-15350 Wordfence
6.5 Medium Quiz and Survey Master (QSM) Plugin quiz-master-next SQL Injection Authenticated (Custom+) SQL Injection via 'pages' Parameter ≤ 11.2.0 CVE-2026-13767 Wordfence
6.4 Medium WP Delicious Plugin delicious-recipes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute ≤ 1.10.2 CVE-2026-15099 Wordfence
5.5 Medium FunnelKit Plugin funnel-builder Arbitrary File Deletion Admin+ Arbitrary File Deletion via Path Traversal in Template Importer < 3.15.0.6 Fixed in 3.15.0.6 CVE-2026-12979 WPScan
7.1 High FunnelKit Plugin funnel-builder Cross-Site Scripting Reflected XSS via Divi Optin Form No login needed < 3.15.0.6 Fixed in 3.15.0.6 CVE-2026-12978 WPScan
2.7 Low RTMKit Addons for Elementor Plugin Broken Access Control Author+ Site-Wide Theme Builder Template Creation and Activation < 2.0.9 Fixed in 2.0.9 CVE-2026-12907 WPScan
2.7 Low RTMKit Addons for Elementor Plugin Information Disclosure Contributor+ Private Post Title Disclosure < 2.0.9 Fixed in 2.0.9 CVE-2026-12906 WPScan
6.1 Medium Header Footer Builder for Elementor Plugin header-footer-builder-for-elementor Cross-Site Scripting Contributor+ Stored XSS via Template Import No login needed < 1.2.1 Fixed in 1.2.1 CVE-2026-12869 WPScan
6.5 Medium Customer Reviews for WooCommerce Plugin customer-reviews-woocommerce Arbitrary File Upload Unauthenticated Arbitrary Media Upload via cr_upload_media No login needed < 5.113.0 Fixed in 5.113.0 CVE-2026-12684 WPScan
8.1 High Abandoned Cart Lite for WooCommerce Plugin woocommerce-abandoned-cart Privilege Escalation Unauthenticated Account Takeover via Malleable Recovery-Link Token No login needed < 6.8.2 Fixed in 6.8.2 CVE-2026-12585 WPScan
8.8 High Redux Framework Plugin redux-framework Privilege Escalation Subscriber+ Privilege Escalation to Administrator < 4.5.13 Fixed in 4.5.13 CVE-2026-12525 WPScan
5.9 Medium AI Engine Plugin ai-engine Information Disclosure Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR < 3.5.5 Fixed in 3.5.5 CVE-2026-12510 WPScan
9.8 Critical Happy Coders OTP Login for WooCommerce Plugin happy-coders-otp-login Privilege Escalation Unauthenticated Account Takeover via hcotp_auto_login_user No login needed 1.5 – < 2.8 Fixed in 2.8 CVE-2026-12492 WPScan
6.5 Medium WP Job Portal Plugin wp-job-portal SQL Injection Subscriber+ SQL Injection via Applied Resumes 'ta' Parameter < 2.5.5 Fixed in 2.5.5 CVE-2026-12395 WPScan
5.4 Medium LatePoint Plugin Cross-Site Request Forgery Multiple Privileged Actions via CSRF No login needed < 5.6.3 Fixed in 5.6.3 CVE-2026-11866 WPScan
6.1 Medium BetterDocs Plugin betterdocs Cross-Site Scripting Unauthenticated Stored XSS via AI Doc Summarizer Prompt Injection No login needed 4.0.0 – < 4.5.5 Fixed in 4.5.5 CVE-2026-11371 WPScan
4.9 Medium SEO Booster Plugin seo-booster SQL Injection Authenticated (Administrator+) SQL Injection via 'sort_field' Parameter ≤ 7.3.1 CVE-2026-15458 Wordfence
9.8 Critical SAML Single Sign On Plugin miniorange-saml-20-single-sign-on Authentication Bypass Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion No login needed ≤ 5.4.3 CVE-2026-15013 Wordfence
4.9 Medium SEO Booster Plugin seo-booster SQL Injection Authenticated (Administrator+) SQL Injection via 'orderby' Parameter ≤ 7.3.1 CVE-2026-15445 Wordfence
7.2 High RPB Chessboard Plugin rpb-chessboard Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content No login needed ≤ 8.1.2 CVE-2026-13042 Wordfence
6.1 Medium Product Feed Manager For WooCommerce Plugin best-woocommerce-feed Cross-Site Scripting Reflected Cross-Site Scripting via 's' Search Parameter No login needed ≤ 7.6.1 CVE-2026-15306 Wordfence
6.4 Medium Easy Accordion Plugin easy-accordion-free Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Block Attribute ≤ 3.1.6 CVE-2026-15652 Wordfence
6.4 Medium GiveWP Plugin give Cross-Site Scripting Authenticated (Give Worker+) Stored Cross-Site Scripting via 'twitter_message' Sequoia Template Setting ≤ 4.16.3 CVE-2026-14987 Wordfence
6.5 Medium MultiVendorX Plugin dc-woocommerce-multi-vendor SQL Injection Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter ≤ 5.0.9 CVE-2026-12941 Wordfence
4.3 Medium Landing Page Builder Plugin page-builder-add Cross-Site Request Forgery Cross-Site Request Forgery to ulpb_admin_data AJAX Action No login needed ≤ 1.5.3.6 CVE-2026-12409 Wordfence
4.3 Medium Catch Themes Demo Import Plugin catch-themes-demo-import Broken Access Control Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter ≤ 3.3 CVE-2026-15336 Wordfence
7.5 High Advance Product Search- Voice & Ajax Search for WooCommerce Plugin th-advance-product-search SQL Injection Unauthenticated SQL Injection via 's' and 'match' Parameter No login needed ≤ 1.4.4 CVE-2026-12753 Wordfence
4.3 Medium List category posts Plugin list-category-posts Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute ≤ 0.95.0 CVE-2026-12434 Wordfence
4.4 Medium MxChat Plugin mxchat-basic Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting ≤ 3.2.10 CVE-2026-13005 Wordfence
7.5 High Gravity Forms Plugin Path Traversal Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter No login needed ≤ 2.10.4 CVE-2026-12997 Wordfence
8.6 High Quotes Llama Plugin quotes-llama SQL Injection Unauthenticated SQL Injection via sc Parameter No login needed < 3.1.6 Fixed in 3.1.6 CVE-2026-12512 WPScan
8.1 High Shibboleth Plugin shibboleth Authentication Bypass Unauthenticated Administrator Account Creation via Identity Header Spoofing No login needed < 2.5.4 Fixed in 2.5.4 CVE-2026-12281 WPScan
5.5 Medium Kali Forms Plugin Information Disclosure Contributor+ Arbitrary Post Metadata Disclosure via IDOR < 2.4.17 Fixed in 2.4.17 CVE-2026-11580 WPScan
5.3 Medium Kali Forms Plugin Arbitrary File Upload Unauthenticated Media Upload No login needed < 2.4.17 Fixed in 2.4.17 CVE-2026-11579 WPScan
9.8 Critical Podlove Podcast Publisher Plugin podlove-podcasting-plugin-for-wordpress Arbitrary File Upload Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter No login needed ≤ 4.5.1 CVE-2026-13001 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only