WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 4,301–4,350 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 87 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
4.3 Medium	WS Form LITE Plugin `ws-form`	Authentication Bypass Subscriber+ Arbitrary Settings Update	`< 1.11.8` Fixed in `1.11.8`	Jul 1, 2026	`CVE-2026-11562`	WPScan
8.1 High	Royal MCP Plugin `royal-mcp`	Broken Access Control Subscriber+ Insufficient Authorization in MCP Tools	`< 1.4.26` Fixed in `1.4.26`	Jul 1, 2026	`CVE-2026-10750`	WPScan
7.5 High	Ninja Forms Plugin `ninja-forms`	Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint No login needed	`≤ 3.14.1`	Jul 1, 2026	`CVE-2026-1239`	Wordfence
7.5 High	BookingPress Appointment Booking Pro Plugin `bookingpress-appointment-booking-pro`	SQL Injection Unauthenticated SQL Injection via 'store_service_date' Parameter No login needed	`≤ 5.7.1`	Jul 1, 2026	`CVE-2026-11823`	Wordfence
6.4 Medium	JetWidgets For Elementor Plugin `jetwidgets-for-elementor`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting	`≤ 1.0.21`	Jul 1, 2026	`CVE-2026-11380`	Wordfence
5.3 Medium	WPForms Plugin `wpforms-lite`	Content Injection Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name No login needed	`≤ 1.10.2`	Jul 1, 2026	`CVE-2026-12127`	Wordfence
6.5 Medium	LearnPress Plugin `learnpress`	Broken Access Control Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'userId' Parameter	`≤ 4.3.9.1`	Jul 1, 2026	`CVE-2026-11988`	Wordfence
9.1 Critical	WP-BusinessDirectory Plugin `wp-businessdirectory`	Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter No login needed	`≤ 4.0.1`	Jul 1, 2026	`CVE-2026-6070`	Wordfence
4.3 Medium	Appointment Booking Calendar Plugin `appointment-booking-calendar`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure	`≤ 1.4.02`	Jul 1, 2026	`CVE-2026-12113`	Wordfence
4.3 Medium	GiveWP Plugin `give`	Cross-Site Request Forgery No login needed	`≤ 4.15.3`	Jul 1, 2026	`CVE-2026-11981`	Wordfence
6.4 Medium	Event Organiser Plugin `event-organiser`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via eo_events Shortcode	`≤ 3.12.9`	Jul 1, 2026	`CVE-2026-2387`	Wordfence
7.2 High	Custom Payment Gateways for WooCommerce Plugin `custom-payment-gateways-woocommerce`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'alg_wc_cpg_input_fields' Parameter No login needed	`≤ 2.1.0`	Jul 1, 2026	`CVE-2026-7517`	Wordfence
7.5 High	Video Gallery Plugin `youtube-showcase`	Information Disclosure Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter	`≤ 4.0.3`	Jul 1, 2026	`CVE-2026-12923`	Wordfence
6.4 Medium	FV Flowplayer Video Player Plugin `fv-wordpress-flowplayer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'video_player' Shortcode	`≤ 7.5.51.7212`	Jul 1, 2026	`CVE-2026-12135`	Wordfence
6.5 Medium	Taskbuilder Plugin `taskbuilder`	SQL Injection Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter	`≤ 5.0.8`	Jul 1, 2026	`CVE-2026-12090`	Wordfence
6.1 Medium	WP Google Review Slider Plugin `wp-google-places-review-slider`	Cross-Site Scripting Reflected Cross-Site Scripting via 'place' Parameter No login needed	`≤ 18.1`	Jul 1, 2026	`CVE-2026-13015`	Wordfence
4.3 Medium	Kadence Blocks Plugin `kadence-blocks`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions	`≤ 3.7.7`	Jul 1, 2026	`CVE-2026-12902`	Wordfence
6.5 Medium	Taskbuilder Plugin `taskbuilder`	SQL Injection Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter	`≤ 5.0.8`	Jul 1, 2026	`CVE-2026-12110`	Wordfence
7.5 High	Visualizer Plugin `visualizer`	Broken Access Control Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint No login needed	`≤ 4.0.3`	Jul 1, 2026	`CVE-2026-13468`	Wordfence
6.4 Medium	Tutor LMS Plugin `tutor`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Lesson Attachment Title	`≤ 3.9.13`	Jul 1, 2026	`CVE-2026-13443`	Wordfence
6.4 Medium	Kali Forms Plugin `kali-forms`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'kaliforms_field_components' Parameter	`≤ 2.4.13`	Jul 1, 2026	`CVE-2026-9107`	Wordfence
7.2 High	WPBot Plugin `chatbot`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter No login needed	`≤ 8.4.9`	Jul 1, 2026	`CVE-2026-13731`	Wordfence
4.3 Medium	Kadence Blocks Plugin `kadence-blocks`	Broken Access Control Insecure Direct Object Reference to Authenticated (Contributor+) Arbitrary Optimizer Data Deletion/Read/Modification via 'post_path' Parameter	`≤ 3.7.7`	Jul 1, 2026	`CVE-2026-12904`	Wordfence
6.4 Medium	GiveWP Plugin `give`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via 'block_id' Shortcode Attribute	`≤ 4.16.0`	Jul 1, 2026	`CVE-2026-13246`	Wordfence
4.3 Medium	JoomSport Plugin `joomsport-sports-league-results-management`	Broken Access Control Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action	`≤ 5.7.8`	Jul 1, 2026	`CVE-2026-12133`	Wordfence
7.2 High	Webmention Plugin `webmention`	Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties No login needed	`≤ 5.8.0`	Jun 30, 2026	`CVE-2026-10513`	Wordfence
7.2 High	Ajax Load More - Filters Plugin	Cross-Site Scripting Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field No login needed	`≤ 3.4.1`	Jun 30, 2026	`CVE-2026-8141`	Wordfence
9.8 Critical	EventON - WordPress Virtual Event Calendar Plugin	SQL Injection WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter No login needed	`≤ 5.0.11`	Jun 30, 2026	`CVE-2026-9711`	Wordfence
8.0 High	Export User Data Plugin `export-user-data`	PHP Object Injection Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field	`≤ 2.2.6`	Jun 30, 2026	`CVE-2026-12240`	Wordfence
4.9 Medium	Fluent Booking Plugin `fluent-booking`	Information Disclosure Calendar Manager+ Sensitive Information Disclosure via Attendee Export	`< 2.1.2` Fixed in `2.1.2`	Jun 30, 2026	`CVE-2026-9576`	WPScan
8.6 High	WP Support Plus Responsive Ticket System Plugin	SQL Injection Unauthenticated SQL Injection via filter[elements] Array Keys No login needed	`≤ 9.1.2`	Jun 30, 2026	`CVE-2026-11590`	WPScan
8.8 High	WP Support Plus Responsive Ticket System Plugin	Cross-Site Scripting Unauthenticated Stored XSS via File Upload No login needed	`≤ 9.1.2`	Jun 30, 2026	`CVE-2026-11589`	WPScan
5.9 Medium	Kali Forms Plugin	Cross-Site Scripting Contributor+ Stored XSS via Form Field Caption	`< 2.4.13` Fixed in `2.4.13`	Jun 30, 2026	`CVE-2026-11581`	WPScan
9.8 Critical	ProfileGrid - User Profiles, Groups and Communities Plugin	Privilege Escalation User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite No login needed	`≤ 5.9.9.5`	Jun 30, 2026	`CVE-2026-12073`	Wordfence
5.3 Medium	Premium Addons for KingComposer Plugin `premium-addons-for-kingcomposer`	Broken Access Control Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions No login needed	`≤ 1.1.1`	Jun 30, 2026	`CVE-2026-12349`	Wordfence
6.5 Medium	PixMagix Plugin `pixmagix`	Path Traversal Authenticated (Author+) Path Traversal in 'layers[].id' Parameter	`≤ 1.7.2`	Jun 30, 2026	`CVE-2026-11367`	Wordfence
4.4 Medium	Editorial Rating Plugin `editorial-rating`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field	`≤ 4.0.5`	Jun 30, 2026	`CVE-2026-12560`	Wordfence
4.3 Medium	Plugin for Google Analytics by IO technologies Plugin `io-engagement-analytics`	Cross-Site Request Forgery Cross-Site Request Forgery via 'ga_id' Parameter No login needed	`≤ 1.1`	Jun 30, 2026	`CVE-2026-8944`	Wordfence
4.4 Medium	Team Members Plugin `team-showcase-supreme`	Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter	`≤ 8.7`	Jun 30, 2026	`CVE-2026-12114`	Wordfence
6.5 Medium	Colissimo Officiel : Méthodes de livraison pour WooCommerce Plugin `colissimo-shipping-methods-for-woocommerce`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 2.9.0` Fixed in `2.10.0`	Jun 29, 2026	`CVE-2026-57341`	Patchstack
6.5 Medium	Japanized For WooCommerce Plugin `woocommerce-for-japan`	Broken Access Control No login needed	`≤ 2.9.12` Fixed in `2.9.13`	Jun 29, 2026	`CVE-2026-57340`	Patchstack
6.6 Medium	Business Directory Plugin `business-directory-plugin`	Broken Access Control No login needed	`≤ 6.4.23` Fixed in `6.4.24`	Jun 29, 2026	`CVE-2026-57339`	Patchstack
7.1 High	ARForms Plugin `arforms`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 7.1.2` Fixed in `7.2`	Jun 29, 2026	`CVE-2026-57338`	Patchstack
7.1 High	Landing Page Builder Plugin `page-builder-add`	Cross-Site Scripting No login needed	`≤ 1.5.3.5` Fixed in `1.5.3.6`	Jun 29, 2026	`CVE-2026-57337`	Patchstack
7.1 High	Jobify Theme `jobify`	Cross-Site Scripting No login needed	`≤ 4.3.2` Fixed in `4.3.3`	Jun 29, 2026	`CVE-2026-57336`	Patchstack
6.5 Medium	Ads by WPQuads Plugin `quick-adsense-reloaded`	Broken Access Control	`≤ 3.0.3` Fixed in `3.0.4`	Jun 29, 2026	`CVE-2026-57335`	Patchstack
6.5 Medium	WP User Frontend Plugin `wp-user-frontend`	Broken Access Control No login needed	`≤ 4.3.7` Fixed in `4.3.8`	Jun 29, 2026	`CVE-2026-57334`	Patchstack
7.1 High	Link Whisper Free Plugin `link-whisper`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 0.9.4` Fixed in `0.9.5`	Jun 29, 2026	`CVE-2026-57333`	Patchstack
7.1 High	Wallet System for WooCommerce Plugin `wallet-system-for-woocommerce`	Broken Access Control	`≤ 2.7.6` Fixed in `2.7.7`	Jun 29, 2026	`CVE-2026-57332`	Patchstack
9.9 Critical	Paid Videochat Turnkey Site Plugin `ppv-live-webcams`	Arbitrary File Deletion	`≤ 7.4.8` Fixed in `7.4.9`	Jun 29, 2026	`CVE-2026-57331`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.