WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 4,151–4,200 of 17,733 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 84 of 1
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Smart Forms Plugin smart-forms Broken Access Control Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure ≤ 2.6.99 CVE-2026-2022 Wordfence
6.4 Medium QuestionPro Surveys Plugin questionpro-surveys Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0 CVE-2026-1901 Wordfence
5.5 Medium User Language Switch Plugin user-language-switch Server-Side Request Forgery Authenticated (Administrator+) Server-Side Request Forgery via 'info_language' Parameter ≤ 1.6.10 CVE-2026-0745 Wordfence
6.4 Medium Payment Page | Payment Form for Stripe Plugin payment-page Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'pricing_plan_select_text_font_family' Parameter ≤ 1.4.6 CVE-2026-0751 Wordfence
5.4 Medium Accordion and Accordion Slider Plugin accordion-and-accordion-slider Broken Access Control Missing Authorization to Authenticated (Contributor+) Attachment Metadata Modification ≤ 1.4.5 CVE-2026-0727 Wordfence
4.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Cross-Site Request Forgery Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery No login needed ≤ 5.2.5 CVE-2025-14873 Wordfence
5.3 Medium One to one user Chat by WPGuppy Plugin wpguppy-lite Information Disclosure Unauthenticated Information Disclosure via Chat Message Interception No login needed ≤ 1.1.4 CVE-2025-6792 Wordfence
6.1 Medium StyleBidet Plugin stylebidet Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.0.0 CVE-2026-1796 Wordfence
5.3 Medium Appointment Booking Calendar Plugin bookr Broken Access Control Missing Authorization to Unauthenticated Arbitrary Appointment Status Modification No login needed ≤ 1.0.2 CVE-2026-1932 Wordfence
4.3 Medium SEATT: Simple Event Attendance Plugin simple-event-attendance Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Event Deletion No login needed ≤ 1.5.0 CVE-2026-1983 Wordfence
6.4 Medium Citations tools Plugin citations-tools Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute ≤ 0.3.2 CVE-2026-1912 Wordfence
6.1 Medium Easy Voice Mail Plugin easy-voice-mail Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'message' No login needed ≤ 1.2.5 CVE-2026-1164 Wordfence
6.4 Medium Simple Wp colorfull Accordion Plugin simple-wp-colorfull-accordion Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute ≤ 1.0 CVE-2026-1904 Wordfence
6.1 Medium personal-authors-category Plugin personal-authors-category Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 0.3 CVE-2026-1754 Wordfence
4.4 Medium AMP Enhancer Plugin amp-enhancer Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via AMP Custom CSS Setting ≤ 1.0.49 CVE-2026-2027 Wordfence
5.3 Medium WP Last Modified Info Plugin wp-last-modified-info Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Post Metadata Modification No login needed ≤ 1.9.5 CVE-2025-14608 Wordfence
5.3 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure No login needed ≤ 3.9.3 CVE-2025-14067 Wordfence
5.3 Medium StickEasy Protected Contact Form Plugin stickeasy-protected-contact-form Information Disclosure Unauthenticated Information Disclosure No login needed ≤ 1.0.1 CVE-2025-13973 Wordfence
4.9 Medium BFG Tools – Extension Zipper Plugin bfg-tools-extension-zipper Path Traversal Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter ≤ 1.0.7 CVE-2025-13681 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Information Disclosure Subscriber+ Sensitive Data Disclosure < 6.0.7.2 Fixed in 6.0.7.2 CVE-2025-15520 WPScan
6.5 Medium Activity Log Plugin winterlock Broken Access Control Missing Authorization to Sensitive Information Exposure via Log File ≤ 1.2.8 CVE-2026-1671 Wordfence
4.8 Medium Converter for Media – Optimize images | Convert WebP & AVIF Plugin webp-converter-for-media Server-Side Request Forgery Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src No login needed ≤ 6.5.1 CVE-2026-1356 Wordfence
5.3 Medium LatePoint – Calendar Booking Plugin for Appointments and Events Plugin latepoint Broken Access Control Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure No login needed ≤ 5.2.6 CVE-2026-1537 Wordfence
5.8 Medium Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) Plugin Broken Access Control Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion No login needed ≤ 4.9.60 CVE-2025-13391 Wordfence
5.5 Medium Duplicate-Post Plugin duplicate-post Cross-Site Scripting Persistent Cross-Site Scripting 0.3 – 3.2.3 Fixed in 3.2.4 CVE-2019-25314 VulnCheck
5.3 Medium WPZOOM Addons for Elementor – Starter Templates & Widgets Plugin wpzoom-elementor-addons Broken Access Control Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more No login needed ≤ 1.3.2 CVE-2026-2295 Wordfence
6.4 Medium IDE Micro code-editor Plugin flask-micro Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute ≤ 1.0.0 CVE-2026-1827 Wordfence
5.3 Medium WaMate Confirm Plugin wamate-confirm Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Phone Number Blocking/Unblocking No login needed ≤ 2.0.1 CVE-2026-1833 Wordfence
4.4 Medium Category Image Plugin category-image Cross-Site Scripting Authenticated (Editor+) Stored Cross-Site Scripting via 'tag-image' Parameter ≤ 2.0 CVE-2026-0815 Wordfence
6.4 Medium OpenPOS Lite Plugin wpos-lite-version Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.0 CVE-2026-1826 Wordfence
6.5 Medium Twitter posts to Blog Plugin twitter-posts-to-blog Broken Access Control Missing Authorization to Unauthenticated Plugin Settings Update No login needed ≤ 1.11.25 CVE-2026-1786 Wordfence
6.4 Medium HTML Shortcodes Plugin html-shortcodes Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.1 CVE-2026-1809 Wordfence
4.3 Medium Invoct – PDF Invoices & Billing for WooCommerce Plugin kirilkirkov-pdf-invoice-manager Broken Access Control PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure ≤ 1.6 CVE-2026-1748 Wordfence
4.4 Medium WPlyr Media Block Plugin wplyr-media-block Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter ≤ 1.3.0 CVE-2026-0724 Wordfence
6.4 Medium BuddyHolis ListSearch Plugin listsearch Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute ≤ 1.1 CVE-2026-1853 Wordfence
4.3 Medium MMA Call Tracking Plugin mma-call-tracking Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed ≤ 2.3.15 CVE-2026-1215 Wordfence
6.4 Medium Slideshow Wp Plugin slideshow-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute ≤ 1.1 CVE-2026-1885 Wordfence
6.4 Medium Microtango Plugin microtango Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 0.9.29 CVE-2026-1821 Wordfence
6.4 Medium WDES Responsive Popup Plugin wdes-responsive-popup Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute ≤ 1.3.6 CVE-2026-1804 Wordfence
6.5 Medium WP eCommerce Plugin PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 3.15.1 CVE-2026-1235 WPScan
6.5 Medium OpenPix Plugin openpix-for-woocommerce Broken Access Control Subscriber+ Payment Gateway Settings Reset ≤ 2.13.3 CVE-2025-15400 WPScan
6.4 Medium Orbisius Random Name Generator Plugin orbisius-random-name-generator Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute ≤ 1.0.2 CVE-2026-1893 Wordfence
6.4 Medium Beaver Builder Page Builder – Drag and Drop Website Builder Plugin beaver-builder-lite-version Broken Access Control Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings ≤ 2.10.0.5 CVE-2026-1231 Wordfence
6.5 Medium SlimStat Analytics Plugin wp-slimstat SQL Injection Authenticated (Subscriber+) SQL Injection via `args` Parameter ≤ 5.3.1 CVE-2025-13431 Wordfence
4.3 Medium Gallery by FooGallery Plugin foogallery Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure ≤ 3.1.9 CVE-2025-15524 Wordfence
5.4 Medium PopupKit Plugin popup-builder-block Broken Access Control Missing Authorization to Sensitive Information Disclosure and Data Deletion ≤ 2.2.0 CVE-2025-14895 Wordfence
6.4 Medium The Events Calendar Shortcode & Block Plugin the-events-calendar-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.1.2 CVE-2026-1922 Wordfence
5.3 Medium WCFM Marketplace Plugin wc-multivendor-marketplace Broken Access Control Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation No login needed ≤ 3.7.0 CVE-2026-1722 Wordfence
6.4 Medium Fluent Forms Plugin fluentform Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module ≤ 6.1.14 CVE-2026-0996 Wordfence
4.3 Medium WCFM Membership – WooCommerce Memberships for Multivendor Marketplace Plugin wc-multivendor-membership Broken Access Control WooCommerce Memberships for Multivendor Marketplace <= 2.11.8 - Insecure Direct Object Reference to Update Membership Payment ≤ 2.11.8 CVE-2025-15147 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only