WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 351–400 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 8 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	fyyd podcast shortcodes Plugin `fyyd-podcast-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute	`≤ 0.3.1`	Mar 21, 2026	`CVE-2026-4084`	Wordfence
6.4 Medium	WPFAQBlock– FAQ & Accordion Plugin For Gutenberg Plugin `wpfaqblock`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute	`≤ 1.1`	Mar 21, 2026	`CVE-2026-1093`	Wordfence
6.4 Medium	Ad Short Plugin `ad-short`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'client' Shortcode Attribute	`≤ 2.0.1`	Mar 21, 2026	`CVE-2026-4067`	Wordfence
6.4 Medium	Outgrow Plugin `outgrow`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute	`≤ 2.1`	Mar 21, 2026	`CVE-2026-1889`	Wordfence
6.4 Medium	Ecover Builder For Dummies Plugin `ecover-builder-for-dummies`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.0`	Mar 21, 2026	`CVE-2026-4077`	Wordfence
6.4 Medium	iVysilani Shortcode Plugin `ivysilani-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute	`≤ 3.0`	Mar 21, 2026	`CVE-2026-1851`	Wordfence
6.4 Medium	Post Flagger Plugin `post-flagger`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'slug' Shortcode Attribute	`≤ 1.1`	Mar 21, 2026	`CVE-2026-1854`	Wordfence
6.4 Medium	WP NG Weather Plugin `wp-ng-weather`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.9`	Mar 21, 2026	`CVE-2026-1822`	Wordfence
6.4 Medium	WP Random Button Plugin `wp-random-button`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute	`≤ 1.0`	Mar 21, 2026	`CVE-2026-4086`	Wordfence
6.4 Medium	Scoreboard for HTML5 Games Lite Plugin `scoreboard-for-html5-game-lite`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.2`	Mar 20, 2026	`CVE-2026-4083`	Wordfence
5.3 Medium	Instant Popup Builder Plugin `instant-popup-builder`	Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter No login needed	`≤ 1.1.7`	Mar 19, 2026	`CVE-2026-3475`	Wordfence
5.3 Medium	Latest Post Shortcode Plugin `latest-post-shortcode`	Broken Access Control No login needed	`≤ 14.2.1` Fixed in `14.2.2`	Mar 13, 2026	`CVE-2026-31916`	Patchstack
6.4 Medium	WP ULike Plugin `wp-ulike`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute	`≤ 5.0.1`	Mar 11, 2026	`CVE-2026-2358`	Wordfence
6.4 Medium	NextScripts: Social Networks Auto-Poster Plugin `social-networks-auto-poster-facebook-twitter-g`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode	`≤ 4.4.6`	Mar 10, 2026	`CVE-2026-3228`	Wordfence
6.4 Medium	Show YouTube video Plugin `show-youtube-video`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.1`	Mar 7, 2026	`CVE-2026-1825`	Wordfence
6.4 Medium	Infomaniak Connect for OpenID Plugin `infomaniak-connect-openid`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.2`	Mar 7, 2026	`CVE-2026-1824`	Wordfence
6.4 Medium	Consensus Embed Plugin `consensus-embed`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute	`≤ 1.6`	Mar 7, 2026	`CVE-2026-1823`	Wordfence
6.4 Medium	Media Library Alt Text Editor Plugin `media-library-alt-text-editor`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_id' Shortcode Attribute	`≤ 1.0.0`	Mar 7, 2026	`CVE-2026-1820`	Wordfence
6.4 Medium	DA Media GigList Plugin `damedia-giglist`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'list_title' Shortcode Attribute	`≤ 1.9.0`	Mar 7, 2026	`CVE-2026-1805`	Wordfence
6.4 Medium	MyQtip – easy qTip2 Plugin `myqtip-easy-qtip2`	Cross-Site Scripting easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 2.0.5`	Mar 7, 2026	`CVE-2026-1574`	Wordfence
6.4 Medium	Wueen Plugin `wueen`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode	`≤ 0.2.0`	Mar 7, 2026	`CVE-2026-1569`	Wordfence
6.4 Medium	Hammas Calendar Plugin `hammas-calendar`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute	`≤ 1.5.11`	Mar 7, 2026	`CVE-2026-1902`	Wordfence
6.4 Medium	My Calendar – Accessible Event Manager Plugin `my-calendar`	Cross-Site Scripting Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.7.3`	Mar 4, 2026	`CVE-2026-2355`	Wordfence
6.5 Medium	WP-Members Membership Plugin `wp-members`	SQL Injection Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute	`≤ 3.5.5.1`	Mar 4, 2026	`CVE-2026-2363`	Wordfence
6.4 Medium	Electric Enquiries Plugin `electric-enquiries`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute	`≤ 1.1`	Feb 27, 2026	`CVE-2025-14142`	Wordfence
6.4 Medium	Livemesh Addons for Beaver Builder Plugin `addons-for-beaver-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes	`≤ 3.9.2`	Feb 26, 2026	`CVE-2026-2029`	Wordfence
6.4 Medium	Secure Copy Content Protection and Content Locking Plugin `secure-copy-content-protection`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute	`≤ 5.0.1`	Feb 25, 2026	`CVE-2026-2367`	Wordfence
6.4 Medium	Quiz Maker Plugin `quiz-maker`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 6.7.1.7`	Feb 20, 2026	`CVE-2026-2384`	Wordfence
6.5 Medium	Shortcoder Plugin `shortcoder`	Cross-Site Scripting	`≤ 6.5.1` Fixed in `6.5.2`	Feb 19, 2026	`CVE-2026-27074`	Patchstack
5.3 Medium	XStore Theme `xstore`	Arbitrary Shortcode Execution No login needed	`≤ 9.6.4` Fixed in `9.6.5`	Feb 19, 2026	`CVE-2026-25006`	Patchstack
5.3 Medium	Everest Forms Plugin `everest-forms`	Arbitrary Shortcode Execution No login needed	`≤ 3.4.1` Fixed in `3.4.2`	Feb 19, 2026	`CVE-2026-22422`	Patchstack
6.4 Medium	YaMaps Plugin `yamaps`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters	`≤ 0.6.40`	Feb 19, 2026	`CVE-2025-14851`	Wordfence
6.4 Medium	Groups Plugin `groups`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode	`≤ 3.10.0`	Feb 19, 2026	`CVE-2026-0549`	Wordfence
6.4 Medium	XO Event Calendar Plugin `xo-event-calendar`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode	`≤ 3.2.10`	Feb 19, 2026	`CVE-2026-0556`	Wordfence
6.4 Medium	Album and Image Gallery Plus Lightbox Plugin `album-and-image-gallery-plus-lightbox`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode	`≤ 2.1.7`	Feb 19, 2026	`CVE-2025-13612`	Wordfence
6.4 Medium	s2Member Plugin `s2member`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 251005`	Feb 19, 2026	`CVE-2025-13732`	Wordfence
6.4 Medium	Complianz \| GDPR/CCPA Cookie Consent Plugin `complianz-gdpr`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 7.4.3`	Feb 18, 2026	`CVE-2025-11185`	Wordfence
5.4 Medium	SiteOrigin Widgets Bundle Plugin `so-widgets-bundle`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution	`≤ 1.70.4`	Feb 18, 2026	`CVE-2026-2127`	Wordfence
6.4 Medium	WP Event Aggregator Plugin `wp-event-aggregator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.8.7`	Feb 18, 2026	`CVE-2026-1941`	Wordfence
6.4 Medium	InteractiveCalculator Plugin `interactivecalculator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.0.3`	Feb 18, 2026	`CVE-2026-1807`	Wordfence
6.4 Medium	Display During Conditional Shortcode Plugin `display-during-conditional-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter	`≤ 1.2`	Feb 18, 2026	`CVE-2025-6460`	Wordfence
6.4 Medium	Filestack Plugin `filepicker-media-uploader`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 2.0.8`	Feb 18, 2026	`CVE-2025-13959`	Wordfence
6.4 Medium	myCred Plugin `mycred`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode	`≤ 2.9.7.3`	Feb 14, 2026	`CVE-2026-0550`	Wordfence
6.4 Medium	Simple Plyr Plugin `simple-plyr`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute	`≤ 0.0.1`	Feb 14, 2026	`CVE-2026-1915`	Wordfence
6.4 Medium	ZoomifyWP Free Plugin `tz-zoomifywp-free`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute	`≤ 1.1`	Feb 14, 2026	`CVE-2026-1187`	Wordfence
6.4 Medium	UpMenu Plugin `upmenu`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute	`≤ 3.1`	Feb 14, 2026	`CVE-2026-1910`	Wordfence
6.4 Medium	Best-wp-google-map Plugin `best-wp-google-map`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute	`≤ 2.1`	Feb 14, 2026	`CVE-2026-1096`	Wordfence
6.4 Medium	MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin `masterstudy-lms-learning-management-system`	Cross-Site Scripting for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode	`≤ 3.7.11`	Feb 14, 2026	`CVE-2026-0559`	Wordfence
6.4 Medium	Sphere Manager Plugin `sphere-manager`	Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute	`≤ 1.0.2`	Feb 14, 2026	`CVE-2026-1905`	Wordfence
6.4 Medium	WP Data Access Plugin `wp-data-access`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode	`≤ 5.5.63`	Feb 14, 2026	`CVE-2026-0557`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.