WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 4,101–4,150 of 17,733 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 83 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Popup Box – Easily Create WordPress Popups Plugin popup-box Cross-Site Scripting Easily Create WordPress Popups <= 3.2.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.12 CVE-2025-12122 Wordfence
4.3 Medium PDF Invoices & Packing Slips for WooCommerce Plugin woocommerce-pdf-invoices-packing-slips Broken Access Control Missing Authorization to Authenticated (Subscriber+) Peppol Identifier Modification ≤ 5.6.0 CVE-2026-1906 Wordfence
4.3 Medium Keybase.io Verification Plugin wp-keybase-verification Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.4.5 CVE-2026-1072 Wordfence
6.5 Medium Taskbuilder Plugin taskbuilder SQL Injection Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters ≤ 5.0.2 CVE-2026-1639 Wordfence
6.4 Medium VK All in One Expansion Unit Plugin vk-all-in-one-expansion-unit Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title ≤ 9.112.3 CVE-2025-11737 Wordfence
4.3 Medium WP Plugin Info Card Plugin wp-plugin-info-card Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Custom Plugin Entry Creation No login needed ≤ 6.2.0 CVE-2026-2023 Wordfence
4.3 Medium EmailKit – Email Customizer for WooCommerce & WP Plugin emailkit Broken Access Control Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification ≤ 1.6.2 CVE-2026-1925 Wordfence
4.7 Medium URL Shortify Plugin url-shortify Open Redirect Unauthenticated Open Redirect via 'redirect_to' Parameter No login needed ≤ 1.12.1 CVE-2026-1277 Wordfence
4.4 Medium WP 404 Auto Redirect Plugin wp-404-auto-redirect-to-similar-post Cross-Site Scripting Authenticated (Admin+) Stored Cross-Site Scripting ≤ 1.0.5 CVE-2025-12037 Wordfence
6.4 Medium Display During Conditional Shortcode Plugin display-during-conditional-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter ≤ 1.2 CVE-2025-6460 Wordfence
6.1 Medium Frontend Post Submission Manager Lite Plugin frontend-post-submission-manager-lite Open Redirect Unauthenticated Open Redirect via 'requested_page' Parameter No login needed 1.0.0 – 1.2.7 CVE-2026-1296 Wordfence
4.3 Medium Order Splitter for WooCommerce Plugin wc-order-splitter Broken Access Control Missing Authorization to Authenticated (Subscriber+) Order Information Exposure ≤ 5.3.5 CVE-2025-12075 Wordfence
6.4 Medium Filestack Plugin filepicker-media-uploader Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 2.0.8 CVE-2025-13959 Wordfence
4.3 Medium Frontend User Notes Plugin frontend-user-notes Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification ≤ 2.1.0 CVE-2025-12071 Wordfence
5.3 Medium Context Blog Theme context-blog Information Disclosure Unauthenticated Private Post Disclosure No login needed ≤ 1.2.5 CVE-2025-12074 Wordfence
6.5 Medium SP Project & Document Manager Plugin sp-client-document-manager Broken Access Control Broken Access Control to XSS ≤ 4.70 CVE-2024-31118 Patchstack
6.5 Medium Custom Content by Country (by Shield Security) Plugin custom-content-by-country Broken Access Control No login needed ≤ 3.1.2 CVE-2022-41650 Patchstack
4.3 Medium Gutenberg Blocks by Kadence Blocks Plugin kadence-blocks Broken Access Control Missing Authorization ≤ 3.5.32 CVE-2026-2608 Wordfence
5.8 Medium Frontend File Manager Plugin Information Disclosure Unauthenticated Arbitrary Email Sending No login needed ≤ 23.5 CVE-2026-0829 WPScan
5.3 Medium EventPrime Plugin eventprime-event-calendar-management Broken Access Control Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint No login needed ≤ 4.2.8.4 CVE-2026-1657 Wordfence
4.4 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Scripting Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 1.50.2 CVE-2026-2002 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control Subscriber+ Form Creation < 6.0.7.2 Fixed in 6.0.7.2 CVE-2026-0929 WPScan
6.5 Medium Element Pack Addons for Elementor Plugin bdthemes-element-pack-lite Path Traversal Authenticated (Contributor+) Arbitrary File Read ≤ 8.3.17 CVE-2026-1793 Wordfence
4.3 Medium Media Library Folders Plugin media-library-plus Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename ≤ 8.3.6 CVE-2026-2312 Wordfence
6.4 Medium Essential Addons for Elementor Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget ≤ 6.5.9 CVE-2026-1512 Wordfence
4.9 Medium Mail Mint Plugin mail-mint SQL Injection Authenticated (Administrator+) SQL Injection via Multiple API Endpoints ≤ 1.19.2 CVE-2026-1258 Wordfence
6.4 Medium myCred Plugin mycred Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode ≤ 2.9.7.3 CVE-2026-0550 Wordfence
4.3 Medium Modula Image Gallery – Photo Grid & Video Gallery Plugin modula-best-grid-gallery Broken Access Control Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing ≤ 2.13.6 CVE-2026-1254 Wordfence
5.0 Medium MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar Plugin mp3-music-player-by-sonaar Server-Side Request Forgery Music Player, Podcast Player & Radio by Sonaar 5.3 - 5.10 - Authenticated (Author+) Server-Side Request Forgery 5.3 – 5.10 CVE-2026-1249 Wordfence
5.4 Medium Scheduler Widget Plugin scheduler-widget Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification ≤ 0.1.6 CVE-2026-1987 Wordfence
6.4 Medium Simple Plyr Plugin simple-plyr Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute ≤ 0.0.1 CVE-2026-1915 Wordfence
6.4 Medium ZoomifyWP Free Plugin tz-zoomifywp-free Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute ≤ 1.1 CVE-2026-1187 Wordfence
6.4 Medium Chatbot for WordPress by Collect.chat ⚡️ Plugin collectchat Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Field ≤ 2.4.8 CVE-2026-0736 Wordfence
6.4 Medium Press3D Plugin press3d Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block ≤ 1.0.2 CVE-2026-1985 Wordfence
4.4 Medium User Language Switch Plugin user-language-switch Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'tab_color_picker_language_switch' Parameter ≤ 1.6.10 CVE-2026-0735 Wordfence
4.4 Medium Link Hopper Plugin link-hopper Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'hop_name' Parameter ≤ 2.5 CVE-2025-15483 Wordfence
6.4 Medium UpMenu Plugin upmenu Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute ≤ 3.1 CVE-2026-1910 Wordfence
5.3 Medium MailChimp Campaigns Plugin olalaweb-mailchimp-campaign-manager Broken Access Control Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection No login needed ≤ 3.2.4 CVE-2026-1303 Wordfence
6.4 Medium Best-wp-google-map Plugin best-wp-google-map Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute ≤ 2.1 CVE-2026-1096 Wordfence
4.4 Medium Allow HTML in Category Descriptions Plugin allow-html-in-category-descriptions Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via Category Descriptions ≤ 1.2.4 CVE-2026-0693 Wordfence
6.4 Medium MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin masterstudy-lms-learning-management-system Cross-Site Scripting for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode ≤ 3.7.11 CVE-2026-0559 Wordfence
6.4 Medium Sphere Manager Plugin sphere-manager Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute ≤ 1.0.2 CVE-2026-1905 Wordfence
4.3 Medium WP Quick Contact Us Plugin wp-quick-contact-us Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2026-1394 Wordfence
5.3 Medium CallbackKiller service widget Plugin callbackkiller-service-widget Broken Access Control Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update No login needed ≤ 1.2 CVE-2026-1944 Wordfence
6.4 Medium WP Data Access Plugin wp-data-access Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode ≤ 5.5.63 CVE-2026-0557 Wordfence
4.3 Medium MDirector Newsletter Plugin mdirector-newsletter Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 4.5.8 CVE-2025-14852 Wordfence
6.4 Medium Percent to Infograph Plugin percent-to-infograph Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0 CVE-2026-1939 Wordfence
6.1 Medium Address Bar Ads Plugin address-bar-ads Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.0.0 CVE-2026-1795 Wordfence
6.4 Medium Ravelry Designs Widget Plugin ravelry-designs-widget Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute ≤ 1.0.0 CVE-2026-1903 Wordfence
6.1 Medium Geo Widet Plugin geowidget Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.0 CVE-2026-1792 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only