WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,314 vulnerabilities, 1,598 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,174 High 9,038 Medium 17,767 Low 335

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 9, 2026.

Showing 351–400 of 474 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 8 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium FastBook Plugin fastbook-responsive-appointment-booking-and-scheduling-system Cross-Site Request Forgery No login needed ≤ 1.1 CVE-2025-26593 Patchstack
4.3 Medium CubePoints Plugin cubepoints Cross-Site Request Forgery No login needed ≤ 3.2.1 CVE-2025-28952 Patchstack
9.8 Critical Profitori Plugin profitori Broken Access Control Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint No login needed 2.0.6.0 – 2.1.1.3 CVE-2025-4631 Wordfence
8.3 High SUMO Reward Points Plugin rewardsystem Local File Inclusion No login needed ≤ 30.7.0 CVE-2025-32925 Patchstack
4.3 Medium QuickCal - Appointment Booking Calendar Plugin quickcal Information Disclosure Sensitive Data Exposure ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-32299 Patchstack
8.8 High QuickCal - Appointment Booking Calendar Plugin quickcal Cross-Site Request Forgery CSRF to Privilege Escalation No login needed ≤ 1.0.15 Fixed in 1.0.16 CVE-2025-32310 Patchstack
5.3 Medium Latepoint Plugin latepoint Broken Access Control Unauthenticated Insecure Direct Object Reference No login needed ≤ 5.1.92 CVE-2025-3769 Wordfence
4.3 Medium TrueBooker Plugin truebooker-appointment-booking Cross-Site Request Forgery No login needed ≤ 1.0.7 Fixed in 1.0.8 CVE-2025-47543 Patchstack
5.3 Medium Appointment Booking Calendar Plugin appointment-booking-calendar Broken Access Control No login needed ≤ 1.3.92 Fixed in 1.3.93 CVE-2025-46247 Patchstack
8.2 High Appointment Booking Calendar Plugin appointment-booking-calendar Cross-Site Request Forgery CSRF to SQL Injection No login needed ≤ 1.3.92 Fixed in 1.3.93 CVE-2025-46241 Patchstack
7.6 High BMA Lite Plugin bma-lite-appointment-booking-and-scheduling SQL Injection ≤ 1.4.2 Fixed in 1.4.3 CVE-2025-39518 Patchstack
7.6 High BookingPress Plugin bookingpress-appointment-booking SQL Injection ≤ 1.1.28 Fixed in 1.1.38 CVE-2025-31910 Patchstack
4.3 Medium Easy!Appointments Plugin easyappointments Cross-Site Request Forgery Cross Site Request Forgery (CSRF) to Settings Change No login needed ≤ 1.4.2 Fixed in 1.4.3 CVE-2025-31828 Patchstack
6.5 Medium Appointy Appointment Scheduler Plugin appointy-appointment-scheduler Cross-Site Request Forgery CSRF to Settings Change No login needed ≤ 4.2.1 CVE-2025-31601 Patchstack
6.6 Medium Appointify Plugin appointify Arbitrary File Upload ≤ 1.0.8 CVE-2025-31577 Patchstack
5.3 Medium Booking for Appointments and Events Calendar – Amelia Plugin ameliabooking Information Disclosure Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure No login needed ≤ 1.2.19 CVE-2025-2578 Wordfence
5.4 Medium Easy Booked – Appointment Booking and Scheduling Management System Plugin easy-booked Cross-Site Request Forgery No login needed ≤ 2.4.5 Fixed in 2.4.6 CVE-2025-22634 Patchstack
6.5 Medium LatePoint Plugin latepoint Cross-Site Scripting ≤ 5.1.6 Fixed in 5.1.7 CVE-2025-30836 Patchstack
7.3 High Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.6.8.5 CVE-2025-1119 Wordfence
6.1 Medium Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin simply-schedule-appointments Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.6.8.3 CVE-2024-13431 Wordfence
6.4 Medium Point Maker Plugin point-maker Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 0.1.6 CVE-2024-12815 Wordfence
7.5 High Doctor Appointment Booking Plugin doctor-appointment-booking Local File Inclusion ≤ 1.0.0 CVE-2025-27264 Patchstack
8.5 High Doctor Appointment Booking Plugin doctor-appointment-booking SQL Injection ≤ 1.0.0 CVE-2025-27263 Patchstack
7.1 High Appointment Buddy Widget Plugin appointment-buddy-online-appointment-booking-by-accrete Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.2 CVE-2025-25099 Patchstack
7.1 High Swift Calendar Online Appointment Scheduling Plugin online-appointment-scheduling-software Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.3 CVE-2025-23526 Patchstack
6.1 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting Reflected XSS No login needed < 5.0.0 Fixed in 5.0.0 CVE-2024-12737 WPScan
6.5 Medium Pinpoint Booking System – #1 WordPress Booking Plugin booking-system SQL Injection #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection ≤ 2.9.9.5.4 CVE-2024-13235 Wordfence
6.4 Medium Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin embed-any-document Server-Side Request Forgery Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode ≤ 2.7.5 CVE-2025-1043 Wordfence
8.8 High GetBookingsWp - Appointments & Bookings Plugin Basic Version Plugin get-bookings-wp Privilege Escalation Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover ≤ 1.1.27 CVE-2024-13677 Wordfence
9.8 Critical Oliver POS – A WooCommerce Point of Sale (POS) Plugin oliver-pos Information Disclosure A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation No login needed ≤ 2.4.2.3 CVE-2024-13513 Wordfence
4.9 Medium SuperSaaS – online appointment scheduling Plugin supersaas-appointment-scheduling Cross-Site Scripting online appointment scheduling <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via after Parameter ≤ 2.1.12 CVE-2025-0862 Wordfence
7.1 High WP BASE Booking Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting No login needed ≤ 5.0.0 Fixed in 5.1.0 CVE-2025-22684 Patchstack
6.5 Medium BookingPress Plugin bookingpress-appointment-booking Cross-Site Scripting ≤ 1.1.25 Fixed in 1.1.26 CVE-2025-24732 Patchstack
7.1 High Instant Appointment Plugin instant-appointment Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2 CVE-2025-23672 Patchstack
7.1 High VikAppointments Services Booking Calendar Plugin vikappointments Cross-Site Request Forgery CSRF to Stored XSS No login needed ≤ 1.2.16 Fixed in 1.2.17 CVE-2025-22719 Patchstack
4.3 Medium Point Theme point Cross-Site Request Forgery No login needed ≤ 1.1 CVE-2024-37931 Patchstack
5.3 Medium Appointment Hour Booking Plugin appointment-hour-booking Broken Access Control No login needed ≤ 1.4.23 Fixed in 1.4.24 CVE-2023-45649 Patchstack
9.8 Critical WooCommerce Point of Sale Plugin Broken Access Control Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change No login needed ≤ 6.1.0 CVE-2024-11281 Wordfence
6.5 Medium Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress Plugin bookingpress-appointment-booking SQL Injection BookingPress <= 1.1.21 - Authenticated (Contributor+) SQL Injection ≤ 1.1.21 CVE-2024-11726 Wordfence
6.5 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db ≤ 4.9.2 CVE-2024-12558 Wordfence
6.1 Medium WP BASE Booking of Appointments, Services and Events Plugin wp-base-booking-of-appointments-services-and-events Cross-Site Scripting Reflected Cross-Site Scripting via status Parameter No login needed ≤ 4.9.1 CVE-2024-12469 Wordfence
9.3 Critical Instant Appointment Plugin instant-appointment SQL Injection No login needed ≤ 1.2 CVE-2024-54361 Patchstack
6.4 Medium Koalendar – Events & Appointments Booking Calendar Plugin koalendar-free-booking-widget Cross-Site Scripting Events & Appointments Booking Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter ≤ 1.0.2 CVE-2024-11855 Wordfence
6.3 Medium Pinpoint Booking System Plugin booking-system Broken Access Control ≤ 2.9.9.5.7 Fixed in 2.9.9.5.8 CVE-2024-54252 Patchstack
5.4 Medium Booking Ultra Pro Plugin booking-ultra-pro Broken Access Control ≤ 1.1.12 Fixed in 1.1.13 CVE-2023-32601 Patchstack
4.3 Medium WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin timetics Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion ≤ 1.0.27 CVE-2024-11275 Wordfence
6.1 Medium Ultimate Endpoints With Rest Api Plugin custom-wp-rest-api Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.2.2 CVE-2024-12260 Wordfence
5.0 Medium Booking calendar, Appointment Booking System Plugin booking-calendar Broken Access Control ≤ 3.2.3 Fixed in 3.2.4 CVE-2023-24407 Patchstack
4.3 Medium Easy Appointments Plugin easy-appointments Cross-Site Scripting Auth. Stored Cross-Site Scripting (XSS) No login needed ≤ 3.10.7 Fixed in 3.11.1 CVE-2023-30748 Patchstack
8.5 High Pinpoint Booking System Plugin booking-system SQL Injection ≤ 2.9.9.5.1 Fixed in 2.9.9.5.2 CVE-2024-53815 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only