WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 4,001–4,050 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 81 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.5 High Hide My WP Lite Plugin hide-wp-login Path Traversal Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter No login needed ≤ 1.3 CVE-2026-13347 Wordfence
7.5 High EscortWP Theme Other Content Deletion via Vendor-Authored Backdoor No login needed ≤ 3.6.2 CVE-2026-12685 WPScan
5.3 Medium LA-Studio Element Kit for Elementor Plugin lastudio-element-kit Broken Access Control Unauthenticated Open Registration No login needed < 1.6.1 Fixed in 1.6.1 CVE-2026-12276 WPScan
6.4 Medium All-in-One Video Gallery Plugin all-in-one-video-gallery Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter ≤ 4.8.5 CVE-2026-12123 Wordfence
6.4 Medium BuddyHolis TableSearch Plugin tablesearch Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.1.0 CVE-2026-15301 Wordfence
9.1 Critical GEO my WP Plugin geo-my-wp SQL Injection Unauthenticated SQL Injection via 'distance' / 'lat' / 'lng' Parameters No login needed ≤ 4.5.4 CVE-2026-15300 Wordfence
6.4 Medium Animation Addons for Elementor Plugin animation-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget ≤ 2.6.3 CVE-2026-15299 Wordfence
7.2 High TelSender Plugin telsender Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title No login needed ≤ 1.14.14 CVE-2026-15298 Wordfence
6.1 Medium Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) Plugin mailin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 3.1.77 CVE-2026-15297 Wordfence
6.4 Medium affiliate-toolkit – WP Affiliate Plugin with Amazon Plugin affiliate-toolkit-starter Cross-Site Scripting WP Affiliate Plugin with Amazon <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.7.0 CVE-2026-15296 Wordfence
8.0 High WP Business Intelligence Lite Plugin wp-business-intelligence-lite Broken Access Control Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification ≤ 3.2.0 CVE-2026-15293 Wordfence
6.4 Medium Sudoku Shortcode Plugin sudoku-shortcode Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'background' Shortcode Attribute ≤ 1.0.0 CVE-2026-15292 Wordfence
7.5 High Chat Help – Click to Chat Button & Form Plugin chat-help Broken Access Control Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed ≤ 3.1.3 CVE-2026-15291 Wordfence
7.5 High Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin ultimate-member SQL Injection User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.10.1 - Unauthenticated Blind SQL Injection No login needed ≤ 2.10.1 CVE-2026-15290 Wordfence
5.9 Medium Booking calendar, Appointment Booking System Plugin booking-calendar SQL Injection Unauthenticated Time-Based SQL Injection via 'wpdevart_id' No login needed ≤ 3.2.17 CVE-2026-15289 Wordfence
7.5 High SureForms – Drag and Drop Form Builder Plugin sureforms Price Manipulation Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation No login needed ≤ 2.2.1 CVE-2026-15288 Wordfence
6.5 Medium rtMedia for WordPress, BuddyPress and bbPress Plugin buddypress-media SQL Injection Authenticated (Subscriber+) SQL Injection ≤ 4.6.18 CVE-2026-15287 Wordfence
4.3 Medium Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin kadence-blocks Broken Access Control Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication ≤ 3.5.32 CVE-2026-15286 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes ≤ 6.4.11 CVE-2026-15285 Wordfence
6.4 Medium King Addons for Elementor Plugin king-addons Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'form_page_id' Parameter ≤ 51.1.62 CVE-2026-15284 Wordfence
5.3 Medium ARMember Plugin armember-membership Path Traversal Directory Traversal via X-FILENAME No login needed ≤ 4.0.27 CVE-2026-15302 Wordfence
4.4 Medium WPvivid Backup for MainWP Plugin wpvivid-backup-mainwp Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 0.9.33 CVE-2026-15283 Wordfence
9.8 Critical Instant Appointment Plugin instant-appointment Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 1.2 CVE-2026-15282 Wordfence
7.2 High Post Export Import with Media Plugin post-export-import-with-media Arbitrary File Upload Authenticated (Administrator+) Arbitrary File Upload via Trailing-Dot Filename Bypass in ZIP Media Import ≤ 1.13.1 CVE-2026-13430 Wordfence
5.4 Medium WPCafe Plugin wp-cafe Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API ≤ 3.0.14 CVE-2026-11818 Wordfence
6.1 Medium WP Hotel Booking Plugin wp-hotel-booking Cross-Site Scripting Reflected Cross-Site Scripting via 'check_in_date' and 'check_out_date' Parameters No login needed ≤ 2.3.1 CVE-2026-11392 Wordfence
8.8 High Salon Booking System Plugin salon-booking-system Cross-Site Request Forgery Cross-Site Request Forgery to Remote Code Execution via 'value' Parameter No login needed ≤ 10.30.32 CVE-2026-15070 Wordfence
9.8 Critical Super Forms Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) No login needed ≤ 6.3.313 CVE-2026-14894 Wordfence
5.4 Medium Fluent Forms Plugin fluentform Broken Access Control Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id' ≤ 6.2.1 CVE-2026-5069 Wordfence
8.1 High LoginPress Pro Plugin Authentication Bypass Unauthenticated Authentication Bypass via Unverified OAuth Email in Spotify OAuth Callback No login needed ≤ 6.2.3 CVE-2026-12598 Wordfence
8.1 High LoginPress Pro Plugin Authentication Bypass Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback No login needed ≤ 6.2.3 CVE-2026-12595 Wordfence
8.1 High LoginPress Pro Plugin Authentication Bypass Unauthenticated Authentication Bypass via Unverified OAuth Email via GitHub OAuth Callback No login needed ≤ 6.2.3 CVE-2026-12597 Wordfence
8.8 High UsersWP Plugin userswp Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field ≤ 1.2.65 CVE-2026-13492 Wordfence
7.2 High WP Cost Estimation & Payment Forms Builder (E&P Forms) Plugin Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter No login needed ≤ 10.5.97 CVE-2026-9253 Wordfence
6.5 Medium Blocks for ACF Fields Plugin acf-field-blocks Broken Access Control Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter ≤ 1.6.2 CVE-2026-12428 Wordfence
5.3 Medium Easy Invoice Plugin easy-invoice Broken Access Control Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions No login needed ≤ 2.2.19 CVE-2026-9021 Wordfence
4.3 Medium Employee, Leave and Recruitment Management System Plugin hr-management Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action ≤ 1.2.2 CVE-2026-9237 Wordfence
4.3 Medium DHL eCommerce (Benelux) for WooCommerce Plugin dhlpwc Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions ≤ 2.2.3 CVE-2026-9235 Wordfence
7.1 High Bit Form Plugin bit-form Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter ≤ 3.1.1 CVE-2026-14372 Wordfence
4.3 Medium DSGVO All in one for WP Plugin dsgvo-all-in-one-for-wp Broken Access Control Missing Authorization to Authenticated (Subscriber+) Settings Reset ≤ 4.9 CVE-2026-4298 Wordfence
8.8 High Divi Torque Lite Plugin addons-for-divi Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint No login needed ≤ 4.2.3 CVE-2026-4275 Wordfence
7.2 High EventPrime Plugin eventprime-event-calendar-management Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter No login needed ≤ 4.3.4.2 CVE-2026-13441 Wordfence
5.3 Medium CorvusPay WooCommerce Payment Gateway Plugin corvuspay-woocommerce-integration Broken Access Control Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter No login needed ≤ 2.7.4 CVE-2026-9028 Wordfence
5.3 Medium CorvusPay WooCommerce Payment Gateway Plugin corvuspay-woocommerce-integration Price Manipulation Unauthenticated Improper Verification of Cryptographic Signature to Payment Bypass via /wp-json/corvuspay/success/ REST Endpoint No login needed ≤ 2.7.4 CVE-2026-9027 Wordfence
4.3 Medium Colissimo Officiel : Méthodes de livraison pour WooCommerce Plugin colissimo-shipping-methods-for-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action ≤ 2.9.0 CVE-2026-9240 Wordfence
9.8 Critical Blocksy Companion Plugin blocksy-companion Arbitrary File Upload Unauthenticated Arbitrary File Upload via 'blc-review-images[]' Parameter No login needed ≤ 2.1.46 CVE-2026-15158 Wordfence
4.3 Medium Hydra Booking Plugin hydra-booking Broken Access Control Authenticated (Custom+) Insecure Direct Object Reference to Sensitive Information Exposure via 'booking_id' Parameter ≤ 1.2.1 CVE-2026-12433 Wordfence
4.9 Medium Mail Mint Plugin mail-mint SQL Injection Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter ≤ 1.24.2 CVE-2026-14342 Wordfence
9.8 Critical miniOrange OTP Login, Verification and SMS Notifications Plugin miniorange-otp-verification Authentication Bypass Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter No login needed ≤ 5.5.1 CVE-2026-14245 Wordfence
7.2 High Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder Plugin popup-maker Broken Access Control Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation ≤ 1.22.0 CVE-2026-8848 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only