WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 351–400 of 2,150 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 8 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
9.8 Critical	Customer Support Ticket System & Helpdesk Plugin `wp-ticket`	Remote Code Execution Unauthenticated Code Injection via 'path' Parameter No login needed	`≤ 6.0.5`	Jul 23, 2026	`CVE-2026-15011`	Wordfence
9.8 Critical	GoDAM Plugin `godam`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via WPForms File Upload Field No login needed	`≤ 1.12.2`	Jul 23, 2026	`CVE-2026-14282`	Wordfence
9.3 Critical	Ninja Forms Plugin `ninja-forms`	Broken Access Control Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action No login needed	`< 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65049`	VulnCheck
9.3 Critical	Ninja Forms Plugin `ninja-forms`	Cross-Site Scripting Ninja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission Index No login needed	`3.10.4 – < 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65048`	VulnCheck
9.8 Critical	Easy Form Builder by WhiteStudio Plugin `easy-form-builder`	Privilege Escalation Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint No login needed	`≤ 4.0.11`	Jul 21, 2026	`CVE-2026-13439`	Wordfence
9.1 Critical	Kirki Plugin `kirki`	Server-Side Request Forgery Unauthenticated Server-Side Request Forgery via kirki_get_apis No login needed	`< 6.0.12` Fixed in `6.0.12`	Jul 20, 2026	`CVE-2026-13147`	WPScan
9.8 Critical	WordPress Core	SQL Injection REST API batch-route confusion and SQL injection issue leading to Remote Code Execution No login needed	`6.9.0 – < 6.9.5, 7.0.0 – < 7.0.2` Fixed in `6.9.5`	Jul 17, 2026	`CVE-2026-63030`	WPScan
9.8 Critical	AI Chatbot & Workflow Automation by AIWU Plugin	Privilege Escalation Unauthenticated Privilege Escalation via MCP OAuth No login needed	`< 1.5.4` Fixed in `1.5.4`	Jul 17, 2026	`CVE-2026-9810`	WPScan
9.8 Critical	Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit Plugin	Privilege Escalation All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit <= 2.8.4 - Unauthenticated Privilege Escalation via 'aiomatic_call_google_ai_function' No login needed	`≤ 2.8.4`	Jul 17, 2026	`CVE-2026-15982`	Wordfence
9.8 Critical	Bricksforge Plugin	Privilege Escalation Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter No login needed	`≤ 3.1.8.6`	Jul 17, 2026	`CVE-2026-14956`	Wordfence
9.8 Critical	Happy Coders OTP Login for WooCommerce Plugin `happy-coders-otp-login`	Privilege Escalation Unauthenticated Account Takeover via hcotp_auto_login_user No login needed	`1.5 – < 2.8` Fixed in `2.8`	Jul 16, 2026	`CVE-2026-12492`	WPScan
9.8 Critical	SAML Single Sign On Plugin `miniorange-saml-20-single-sign-on`	Authentication Bypass Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion No login needed	`≤ 5.4.3`	Jul 16, 2026	`CVE-2026-15013`	Wordfence
9.8 Critical	Podlove Podcast Publisher Plugin `podlove-podcasting-plugin-for-wordpress`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter No login needed	`≤ 4.5.1`	Jul 14, 2026	`CVE-2026-13001`	Wordfence
9.6 Critical	Word Count and Social Shares Plugin	Arbitrary File Deletion Subscriber+ Arbitrary File Deletion via Path Traversal	`≤ 1.0`	Jul 14, 2026	`CVE-2026-11563`	WPScan
9.8 Critical	Directorist Plugin `directorist`	PHP Object Injection No login needed	`≤ 8.8.2` Fixed in `8.8.3`	Jul 13, 2026	`CVE-2026-59518`	Patchstack
9.3 Critical	AIWU Plugin `ai-copilot-content-generator`	SQL Injection No login needed	`≤ 1.5.4` Fixed in `1.5.5`	Jul 13, 2026	`CVE-2026-59515`	Patchstack
9.8 Critical	MailOptin Plugin `mailoptin`	Privilege Escalation No login needed	`≤ 1.2.77.3` Fixed in `1.2.78.0`	Jul 13, 2026	`CVE-2026-57813`	Patchstack
10.0 Critical	Realtyna Organic IDX Plugin `real-estate-listing-realtyna-wpl`	Remote Code Execution No login needed	`≤ 5.2.0` Fixed in `5.3.0`	Jul 13, 2026	`CVE-2026-57811`	Patchstack
9.8 Critical	Grand Photography Theme `grandphotography`	PHP Object Injection No login needed	`≤ 5.7.8`	Jul 13, 2026	`CVE-2026-57770`	Patchstack
9.8 Critical	RT-Theme 18 \| Extensions Plugin `rt18-extensions`	PHP Object Injection No login needed	`≤ 2.5`	Jul 13, 2026	`CVE-2026-57744`	Patchstack
9.3 Critical	AcyMailing SMTP Newsletter Plugin `acymailing`	SQL Injection No login needed	`≤ 10.11.0` Fixed in `10.11.1`	Jul 13, 2026	`CVE-2026-57739`	Patchstack
9.8 Critical	777 Theme `triple-seven`	PHP Object Injection No login needed	`≤ 1.13.0`	Jul 13, 2026	`CVE-2026-57738`	Patchstack
9.3 Critical	Kirki Plugin `kirki`	SQL Injection No login needed	`≤ 6.0.12` Fixed in `6.0.13`	Jul 13, 2026	`CVE-2026-57726`	Patchstack
9.8 Critical	Kirki Plugin `kirki`	PHP Object Injection No login needed	`≤ 6.0.12` Fixed in `6.0.13`	Jul 13, 2026	`CVE-2026-57724`	Patchstack
10.0 Critical	Aimogen Pro Plugin `aimogen-pro`	Arbitrary File Upload No login needed	`≤ 2.8.3` Fixed in `2.8.3.1`	Jul 13, 2026	`CVE-2026-57719`	Patchstack
9.3 Critical	LatePoint Plugin `latepoint`	SQL Injection No login needed	`≤ 5.6.3` Fixed in `5.6.4`	Jul 13, 2026	`CVE-2026-57714`	Patchstack
9.9 Critical	WoowBot Pro Max Plugin `woowbot-pro-max`	Arbitrary File Upload	`≤ 14.1.7` Fixed in `14.1.8`	Jul 13, 2026	`CVE-2026-57710`	Patchstack
9.3 Critical	Simple Business Directory Pro Plugin `simple-business-directory-pro`	SQL Injection No login needed	`≤ 15.9.4` Fixed in `15.9.5`	Jul 13, 2026	`CVE-2026-57707`	Patchstack
9.3 Critical	Amelia Plugin `ameliabooking`	SQL Injection No login needed	`≤ 2.4.2` Fixed in `2.4.3`	Jul 13, 2026	`CVE-2026-57702`	Patchstack
9.9 Critical	SureDash Plugin `suredash`	Arbitrary File Deletion	`≤ 1.8.0` Fixed in `1.8.1`	Jul 13, 2026	`CVE-2026-57401`	Patchstack
9.1 Critical	User Registration & Membership Plugin `user-registration`	Authentication Bypass Unauthenticated PayPal Webhook Signature Verification Bypass Leading to Membership Activation No login needed	`< 5.2.2` Fixed in `5.2.2`	Jul 13, 2026	`CVE-2026-11964`	WPScan
9.8 Critical	OAuth Single Sign On - SSO (OAuth Client) Plugin `miniorange-oauth-oidc-single-sign-on`	Authentication Bypass SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication No login needed	`≤ 38.5.8` Fixed in `38.5.8.1`	Jul 10, 2026	`CVE-2026-57807`	Patchstack
9.8 Critical	miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin `miniorange-login-openid`	Authentication Bypass Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow No login needed	`≤ 7.7.0`	Jul 10, 2026	`CVE-2026-12761`	Wordfence
9.1 Critical	GEO my WP Plugin `geo-my-wp`	SQL Injection Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters No login needed	`≤ 4.5.4`	Jul 10, 2026	`CVE-2026-15300`	Wordfence
9.8 Critical	Instant Appointment Plugin `instant-appointment`	Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed	`≤ 1.2`	Jul 10, 2026	`CVE-2026-15282`	Wordfence
9.8 Critical	Super Forms Plugin	Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) No login needed	`≤ 6.3.313`	Jul 10, 2026	`CVE-2026-14894`	Wordfence
9.8 Critical	Blocksy Companion Plugin `blocksy-companion`	Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter No login needed	`≤ 2.1.46`	Jul 9, 2026	`CVE-2026-15158`	Wordfence
9.8 Critical	miniOrange OTP Login, Verification and SMS Notifications Plugin `miniorange-otp-verification`	Authentication Bypass Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter No login needed	`≤ 5.5.1`	Jul 9, 2026	`CVE-2026-14245`	Wordfence
9.8 Critical	Blocksy Companion Plugin `blocksy-companion`	Arbitrary File Upload Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments No login needed	`≤ 2.1.46` Fixed in `2.1.47`	Jul 8, 2026	`CVE-2026-58480`	VulnCheck
9.8 Critical	WP Learn Manager Plugin `learn-manager`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action No login needed	`≤ 1.1.8`	Jul 8, 2026	`CVE-2026-12153`	Wordfence
9.1 Critical	Simple Coherent Form Plugin `simple-coherent-form`	Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via 'id' Parameter No login needed	`≤ 2.4.13`	Jul 8, 2026	`CVE-2026-14487`	Wordfence
9.8 Critical	Eventer Plugin	Privilege Escalation Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation No login needed	`≤ 4.4.2`	Jul 8, 2026	`CVE-2026-9701`	Wordfence
9.8 Critical	Uncanny Automator Pro Plugin	Other Backdoor via Compromised Vendor Update Server No login needed	`7.3.0.5 – < 7.3.0.6` Fixed in `7.3.0.6`	Jul 7, 2026	`CVE-2026-12375`	WPScan
9.0 Critical	DoLeads Integrator Plugin	Remote Code Execution Unauthenticated RCE No login needed	`≤ 0.65`	Jul 7, 2026	`CVE-2026-4375`	WPScan
9.8 Critical	WPFunnels Plugin `wpfunnels`	Remote Code Execution Unauthenticated Remote Code Execution via 'postData' Parameter No login needed	`≤ 3.12.7`	Jul 7, 2026	`CVE-2026-14345`	Wordfence
9.1 Critical	Multiple elFinder Plugins Plugin	Remote Code Execution Authenticated OS Command Injection	`< 1.1.9, < 5.4.12, < 2.1.1, …` Fixed in `1.1.9`	Jul 6, 2026	`CVE-2026-6382`	WPScan
9.1 Critical	Printcart Web to Print Product Designer for WooCommerce Plugin `printcart-integration`	Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed	`≤ 2.5.2`	Jul 3, 2026	`CVE-2026-9725`	Wordfence
9.8 Critical	Divi Form Builder Plugin	Arbitrary File Upload Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter No login needed	`≤ 5.1.8`	Jul 2, 2026	`CVE-2026-5524`	Wordfence
9.3 Critical	WP Fast Total Search Plugin `fulltext-search`	SQL Injection No login needed	`≤ 1.80.280` Fixed in `1.81.282`	Jul 2, 2026	`CVE-2026-57683`	Patchstack
9.3 Critical	GeekyBot Plugin `geeky-bot`	SQL Injection No login needed	`≤ 1.2.5` Fixed in `1.2.6`	Jul 2, 2026	`CVE-2026-57679`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.