WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 351–400 of 675 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 8 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution Plugin `fluent-booking`	Broken Access Control The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management	`≤ 1.9.11`	Dec 3, 2025	`CVE-2025-13756`	Wordfence
4.9 Medium	Bookme Plugin `bookme-free-appointment-booking-system`	SQL Injection Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter	`≤ 4.2`	Nov 25, 2025	`CVE-2025-13385`	Wordfence
5.3 Medium	Booking Calendar Contact Form Plugin `booking-calendar-contact-form`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter No login needed	`≤ 1.2.60`	Nov 22, 2025	`CVE-2025-13318`	Wordfence
5.3 Medium	Appointment Booking Calendar Plugin `appointment-booking-calendar`	Broken Access Control Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter No login needed	`≤ 1.3.96`	Nov 22, 2025	`CVE-2025-13317`	Wordfence
6.4 Medium	HotelRunner Booking Widget Plugin `hotelrunner`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 5.2.4`	Nov 21, 2025	`CVE-2025-13135`	Wordfence
5.3 Medium	Booking Plugin for WordPress Appointments – Time Slot Plugin `timeslot`	Broken Access Control Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending No login needed	`≤ 1.4.7`	Nov 19, 2025	`CVE-2025-12842`	Wordfence
7.5 High	Booking for Appointments and Events Calendar – Amelia Plugin `ameliabooking`	SQL Injection Amelia <= 1.2.35 - Unauthenticated SQL Injection via search No login needed	`≤ 1.2.35`	Nov 16, 2025	`CVE-2025-12482`	Wordfence
6.5 Medium	Booking Calendar Plugin `booking`	Cross-Site Scripting	`≤ 10.14.7` Fixed in `10.14.8`	Nov 13, 2025	`CVE-2025-64381`	Patchstack
6.5 Medium	Booking Manager Plugin `booking-manager`	Cross-Site Scripting	`≤ 2.1.17` Fixed in `2.1.18`	Nov 13, 2025	`CVE-2025-64275`	Patchstack
5.4 Medium	Appointment Booking Calendar Plugin `appointment-booking-calendar`	Broken Access Control	`≤ 1.3.95` Fixed in `1.3.96`	Nov 13, 2025	`CVE-2025-64261`	Patchstack
7.5 High	Booking Calendar \| Appointment Booking \| Bookit Plugin `bookit`	Broken Access Control Missing Authorization to Unauthenticated Stripe Connection No login needed	`≤ 2.5.0`	Nov 12, 2025	`CVE-2025-12633`	Wordfence
5.3 Medium	Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings Plugin `hydra-booking`	Price Manipulation All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass No login needed	`≤ 1.1.27`	Nov 11, 2025	`CVE-2025-12788`	Wordfence
5.3 Medium	Hydra Booking – All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings Plugin `hydra-booking`	Broken Access Control All in One Appointment Booking System \| Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation No login needed	`≤ 1.1.27`	Nov 11, 2025	`CVE-2025-12787`	Wordfence
7.2 High	Alex Reservations: Smart Restaurant Booking Plugin `alex-reservations`	Arbitrary File Upload Authenticated (Admin+) Arbitrary File Upload	`≤ 2.2.3`	Nov 8, 2025	`CVE-2025-12399`	Wordfence
4.3 Medium	EventPrime – Events Calendar, Bookings and Tickets Plugin `eventprime-event-calendar-management`	Broken Access Control Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation	`≤ 4.2.0.0`	Nov 8, 2025	`CVE-2025-12498`	Wordfence
5.3 Medium	Course Booking System Plugin `course-booking-system`	Broken Access Control Missing Authorization to Unauthenticated Booking Data Export No login needed	`≤ 6.1.5`	Nov 8, 2025	`CVE-2025-12042`	Wordfence
8.1 High	Alloggio - Hotel Booking Theme `alloggio`	Local File Inclusion Hotel Booking Theme theme <= 1.8 - Local File Inclusion No login needed	`≤ 1.8`	Nov 6, 2025	`CVE-2025-64287`	Patchstack
5.3 Medium	VikBooking Hotel Booking Engine & PMS Plugin `vikbooking`	Broken Access Control No login needed	`≤ 1.8.2` Fixed in `1.8.3`	Nov 6, 2025	`CVE-2025-5803`	Patchstack
7.1 High	Booking and Rental Manager Plugin `booking-and-rental-manager-for-woocommerce`	Cross-Site Scripting No login needed	`≤ 2.5.3` Fixed in `2.5.4`	Nov 6, 2025	`CVE-2025-49904`	Patchstack
8.8 High	Service Finder Bookings Plugin	Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Account Takeover	`< 6.1` Fixed in `6.1`	Nov 1, 2025	`CVE-2025-6574`	Wordfence
8.8 High	Service Finder Bookings Plugin	Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via change_candidate_password	`≤ 6.0`	Nov 1, 2025	`CVE-2025-5949`	Wordfence
5.4 Medium	Flights & Hotels Booking WP Plugin `adiaha-hotel`	Broken Access Control	`≤ 3.1`	Oct 27, 2025	`CVE-2025-62916`	Patchstack
7.1 High	HotelRunner Booking Widget Plugin `hotelrunner`	Cross-Site Request Forgery No login needed	`≤ 1.6`	Oct 22, 2025	`CVE-2025-60168`	Patchstack
8.5 High	Hydra Booking Plugin `hydra-booking`	SQL Injection	`≤ 1.1.10` Fixed in `1.1.11`	Oct 22, 2025	`CVE-2025-49378`	Patchstack
6.3 Medium	Hydra Booking Plugin `hydra-booking`	Broken Access Control	`≤ 1.1.9` Fixed in `1.1.10`	Oct 22, 2025	`CVE-2025-49377`	Patchstack
4.5 Medium	Booking Manager Plugin `booking-manager`	Broken Access Control Contributor+ Booking Deletion	`< 2.1.15` Fixed in `2.1.15`	Oct 10, 2025	`CVE-2025-10124`	WPScan
9.8 Critical	WP Travel Engine – Tour Booking Plugin – Tour Operator Software Plugin `wp-travel-engine`	Local File Inclusion Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion No login needed	`≤ 6.6.7`	Oct 9, 2025	`CVE-2025-7634`	Wordfence
9.8 Critical	WP Travel Engine – Tour Booking Plugin – Tour Operator Software Plugin `wp-travel-engine`	Arbitrary File Deletion Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming No login needed	`≤ 6.6.7`	Oct 9, 2025	`CVE-2025-7526`	Wordfence
6.5 Medium	Easy Hotel Booking Plugin `easy-hotel`	Cross-Site Scripting	`≤ 1.9.0`	Sep 22, 2025	`CVE-2025-57938`	Patchstack
4.3 Medium	Advanced Appointment Booking & Scheduling Plugin `advanced-appointment-booking-scheduling`	Cross-Site Request Forgery No login needed	`≤ 2.1`	Sep 22, 2025	`CVE-2025-57978`	Patchstack
5.9 Medium	eZee Online Hotel Booking Engine Plugin `online-booking-engine`	Cross-Site Scripting	`≤ 1.0.0`	Sep 22, 2025	`CVE-2025-58661`	Patchstack
9.8 Critical	Service Finder Bookings Plugin	Privilege Escalation Unauthenticated Privilege Escalation via claim_business No login needed	`≤ 6.0`	Sep 19, 2025	`CVE-2025-5948`	Wordfence
9.1 Critical	WP Hotel Booking Plugin `wp-hotel-booking`	Broken Access Control Subscriber+ Rating Manipulation No login needed	`< 2.2.3` Fixed in `2.2.3`	Sep 18, 2025	`CVE-2025-8942`	WPScan
5.3 Medium	Salon Booking System Plugin `salon-booking-system`	Broken Access Control Missing Authorization to Unauthenticated AJAX Actions Execution No login needed	`≤ 10.22`	Sep 11, 2025	`CVE-2025-8492`	Wordfence
7.1 High	WooCommerce Booking Bundle Hours Plugin `woo-booking-bundle-hours`	Cross-Site Request Forgery No login needed	`≤ 0.7.4` Fixed in `0.7.5`	Sep 9, 2025	`CVE-2025-58991`	Patchstack
6.5 Medium	WP Simple Booking Calendar Plugin `wp-simple-booking-calendar`	Broken Access Control	`≤ 2.0.13` Fixed in `2.0.14`	Sep 9, 2025	`CVE-2025-39541`	Patchstack
6.5 Medium	Course Booking Platform Plugin `course-booking-platform`	Cross-Site Scripting	`≤ 1.0.0`	Sep 5, 2025	`CVE-2025-58887`	Patchstack
6.5 Medium	Booking Ultra Pro Plugin `booking-ultra-pro`	Cross-Site Scripting	`≤ 1.1.21` Fixed in `1.1.22`	Sep 3, 2025	`CVE-2025-58633`	Patchstack
6.4 Medium	Booking Calendar Plugin `booking`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 10.14.1`	Aug 28, 2025	`CVE-2025-9346`	Wordfence
6.5 Medium	Booking System Trafft Plugin `booking-system-trafft`	Cross-Site Scripting	`≤ 1.0.14` Fixed in `1.0.15`	Aug 27, 2025	`CVE-2025-58213`	Patchstack
7.2 High	Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin Plugin `wp-event-solution`	Server-Side Request Forgery Eventin <= 4.0.37 - Unauthenticated Server-Side Request Forgery No login needed	`≤ 4.0.37`	Aug 23, 2025	`CVE-2025-7813`	Wordfence
8.1 High	Uxper Booking Plugin `uxper-booking`	Local File Inclusion No login needed	`≤ 1.3.3`	Aug 20, 2025	`CVE-2025-49892`	Patchstack
8.5 High	Uxper Booking Plugin `uxper-booking`	SQL Injection	`≤ 1.3.3`	Aug 20, 2025	`CVE-2025-49891`	Patchstack
6.5 Medium	Webba Booking Plugin `webba-booking-lite`	Broken Access Control No login needed	`≤ 5.1.20` Fixed in `5.1.22`	Aug 20, 2025	`CVE-2025-54040`	Patchstack
9.1 Critical	Online Booking & Scheduling Calendar for WordPress by vcita Plugin `meeting-scheduler-by-vcita`	Arbitrary File Upload	`≤ 4.5.3` Fixed in `4.5.5`	Aug 20, 2025	`CVE-2025-54677`	Patchstack
9.8 Critical	Taxi Booking Manager for WooCommerce Plugin `ecab-taxi-booking-manager`	Authentication Bypass Broken Authentication No login needed	`≤ 1.3.0` Fixed in `1.3.1`	Aug 20, 2025	`CVE-2025-54713`	Patchstack
9.8 Critical	Taxi Booking Manager for Woocommerce \| E-cab Plugin `ecab-taxi-booking-manager`	Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover No login needed	`≤ 1.3.0`	Aug 16, 2025	`CVE-2025-8898`	Wordfence
5.9 Medium	Webba Booking Plugin `webba-booking-lite`	Cross-Site Scripting	`≤ 6.0.5` Fixed in `6.0.6`	Aug 14, 2025	`CVE-2025-54729`	Patchstack
6.5 Medium	Online Booking & Scheduling Calendar for WordPress by vcita Plugin `meeting-scheduler-by-vcita`	Cross-Site Scripting	`≤ 4.5.3` Fixed in `4.5.5`	Aug 14, 2025	`CVE-2025-54676`	Patchstack
7.5 High	Event Manager, Event Calendar and Booking Plugin `eventin-pro`	Broken Access Control Arbitrary Content Deletion No login needed	`≤ 4.0.24` Fixed in `4.0.25`	Aug 14, 2025	`CVE-2025-52731`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.