WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 30,513 vulnerabilities, 2,009 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 26, 2026.
Showing 401–450 of 30,513 vulnerabilities
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 7.2 High | User Registration PRO | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header No login needed |
≤ 6.2.9 |
CVE-2026-87111 |
Wordfence | |
| 10.0 Critical | The Grid | Remote Code Execution No login needed |
≤ 2.8.1 Fixed in 2.8.2 |
CVE-2026-94169 |
Patchstack | |
| 8.1 High | Gravity Forms | PHP Object Injection No login needed |
< 3.1.1 Fixed in 3.1.1 |
CVE-2026-97296 |
Patchstack | |
| 7.1 High | Houzez | Cross-Site Scripting No login needed |
≤ 4.4.0 Fixed in 4.4.1 |
CVE-2026-96339 |
Patchstack | |
| 9.3 Critical | Green Popups | SQL Injection No login needed |
< 7.6.3 Fixed in 7.6.3 |
CVE-2026-94388 |
Patchstack | |
| 5.3 Medium | Site Reviews | Broken Access Control No login needed |
≤ 8.3.4 Fixed in 8.3.5 |
CVE-2026-110366 |
Patchstack | |
| 8.8 High | WP Photo Album Plus | Remote Code Execution Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action |
≤ 9.3.02.002 |
CVE-2026-92115 |
Wordfence | |
| 5.4 Medium | User Registration & Membership | Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution via display_name |
≤ 5.2.8 Fixed in 5.3.0 |
CVE-2026-15222 |
Wordfence | |
| 2.7 Low | WP Mail Logging | Information Disclosure Authenticated (Administrator+) Sensitive Information Exposure in LIKE Wildcard in Personal Data Export Email |
≤ 1.17.0 Fixed in 1.17.1 |
CVE-2026-109401 |
Wordfence | |
| 7.2 High | WPConsent | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) No login needed |
≤ 1.1.9 Fixed in 1.2.0 |
CVE-2026-97640 |
Wordfence | |
| 5.4 Medium | WPeMatico RSS Feed Fetcher | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import No login needed |
≤ 2.9 Fixed in 2.9.1 |
CVE-2026-110252 |
Wordfence | |
| 7.2 High | HivePress | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value No login needed |
≤ 1.7.32 Fixed in 1.8.0 |
CVE-2026-109193 |
Wordfence | |
| 9.8 Critical | Sunshine Photo Cart | PHP Object Injection Unauthenticated PHP Object Injection via 'key' Parameter No login needed |
≤ 3.7.4 Fixed in 3.7.5 |
CVE-2026-104730 |
Wordfence | |
| 6.5 Medium | WSP MCP | Information Disclosure Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool |
≤ 2.9.5 Fixed in 2.9.6 |
CVE-2026-109382 |
Wordfence | |
| 4.3 Medium | WP Map Block | Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints |
≤ 3.0.0 Fixed in 3.1.0 |
CVE-2026-19798 |
Wordfence | |
| 6.4 Medium | HivePress | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode |
≤ 1.7.32 Fixed in 1.8.0 |
CVE-2026-109388 |
Wordfence | |
| 7.2 High | TranslatePress | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers No login needed |
≤ 3.3.7 Fixed in 3.3.8 |
CVE-2026-107768 |
Wordfence | |
| 4.8 Medium | WP Compress | Privilege Escalation Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint No login needed |
≤ 7.25.00 Fixed in 7.26.00 |
CVE-2026-104755 |
Wordfence | |
| 6.4 Medium | WebberZone Top 10 | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute |
≤ 4.5.2 Fixed in 4.5.3 |
CVE-2026-110290 |
Wordfence | |
| 8.8 High | YaySMTP | Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension |
≤ 2.7.7 Fixed in 2.7.8 |
CVE-2026-92553 |
Wordfence | |
| 6.4 Medium | GeoDirectory | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field |
≤ 2.8.192 Fixed in 2.8.193 |
CVE-2026-111069 |
Wordfence | |
| 6.8 Medium | Photo Engine (Media Organizer & Lightroom) | Broken Access Control Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action No login needed |
≤ 6.5.6 Fixed in 6.5.7 |
CVE-2026-107770 |
Wordfence | |
| 4.9 Medium | WP Booking System | SQL Injection Authenticated (Administrator+) SQL Injection via 'orderby' Parameter |
≤ 2.1.0.1 Fixed in 2.1.0.2 |
CVE-2026-111178 |
Wordfence | |
| 7.2 High | CP Multi View Events Calendar | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter No login needed |
≤ 1.4.42 Fixed in 1.4.43 |
CVE-2026-110701 |
Wordfence | |
| 6.4 Medium | Premium Packages | Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes |
≤ 7.2.8 Fixed in 7.3.0 |
CVE-2026-110664 |
Wordfence | |
| 5.3 Medium | HUSKY | Information Disclosure Unauthenticated Sensitive Information Exposure in 'woof_tm_data' Localized Script No login needed |
≤ 1.4.5 |
CVE-2026-107646 |
Wordfence | |
| 2.7 Low | Product Delivery Date for WooCommerce – Lite | Information Disclosure Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions |
< 3.3.2 Fixed in 3.3.2 |
CVE-2026-110191 |
WPScan | |
| 6.8 Medium | affiliate-toolkit | SQL Injection Editor+ SQL Injection via orderby Parameter |
< 3.8.9 Fixed in 3.8.9 |
CVE-2026-110179 |
WPScan | |
| 7.4 High | OTP Login & Register Woocommerce | Privilege Escalation Unauthenticated Account Takeover via OTP Brute Force No login needed |
< 2.7.3 Fixed in 2.7.3 |
CVE-2026-110135 |
WPScan | |
| 2.7 Low | Smush | Broken Access Control Admin+ Network-Wide Plugin Settings Update on Multisite |
< 4.3.4 Fixed in 4.3.4 |
CVE-2026-110039 |
WPScan | |
| 8.8 High | Salon Booking System | Cross-Site Request Forgery Administrator Account Creation via CSRF No login needed |
< 10.31.9 Fixed in 10.31.9 |
CVE-2026-110015 |
WPScan | |
| 5.3 Medium | Salon Booking System | Broken Access Control Unauthenticated Booking Creation with Arbitrary Customer ID and Status No login needed |
< 10.31.9 Fixed in 10.31.9 |
CVE-2026-110014 |
WPScan | |
| 4.8 Medium | Salon Booking System | Authentication Bypass Unauthenticated Salon REST API Access via Predictable Access-Token No login needed |
< 10.31.9 Fixed in 10.31.9 |
CVE-2026-110013 |
WPScan | |
| 4.3 Medium | Salon Booking System | Information Disclosure Subscriber+ Booking PII Disclosure via REST bookings/upcoming |
< 10.31.3 Fixed in 10.31.3 |
CVE-2026-110012 |
WPScan | |
| 4.2 Medium | MB Custom Post Types & Custom Taxonomies | Broken Access Control Subscriber+ Missing Authorization via CPT UI Migration |
< 2.12.2 Fixed in 2.12.2 |
CVE-2026-109982 |
WPScan | |
| 4.3 Medium | Visual Form Builder | Information Disclosure Subscriber+ Sensitive Data Disclosure via Dashboard Widget |
≤ 3.1 |
CVE-2026-105974 |
WPScan | |
| 4.3 Medium | Visual Form Builder | Broken Access Control Subscriber+ Arbitrary Form Field Reordering via Missing Authorization |
≤ 3.1 |
CVE-2026-105973 |
WPScan | |
| 6.8 Medium | Mobile Builder | SQL Injection Unauthenticated SQLi via 'delivery_id' Parameter No login needed |
≤ 1.4.2 |
CVE-2026-103696 |
WPScan | |
| 5.3 Medium | Document Gallery | Information Disclosure Unauthenticated Non-Public Attachment Disclosure via dg_generate_gallery and dg_generate_icons No login needed |
≤ 5.1.1 |
CVE-2026-74923 |
WPScan | |
| 5.3 Medium | Coinsnap Bitcoin Crowdfunding | Information Disclosure Unauthenticated Payment Record Forgery via Webhook Secret Disclosure No login needed |
≤ 1.2.0 |
CVE-2026-92427 |
WPScan | |
| 6.8 Medium | WX Subscribe | SQL Injection Unauthenticated SQLi via 'attach' Parameter No login needed |
≤ 1.2.1 |
CVE-2026-91833 |
WPScan | |
| 6.5 Medium | Subscribe to Comments | Information Disclosure Unauthenticated Subscription Management Key Disclosure via Forged Comment Cookie No login needed |
< 2.3.3 Fixed in 2.3.3 |
CVE-2026-91830 |
WPScan | |
| 7.2 High | User Profile Builder | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via First Name Field No login needed |
≤ 4.0.3 Fixed in 4.0.4 |
CVE-2026-100186 |
Wordfence | |
| 8.0 High | Search Regex | Remote Code Execution Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption |
≤ 3.5 |
CVE-2026-104932 |
Wordfence | |
| 6.1 Medium | Tutor LMS | Cross-Site Scripting Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter |
≤ 4.0.8 Fixed in 4.0.9 |
CVE-2026-88963 |
Wordfence | |
| 8.8 High | PilotPress | Privilege Escalation Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter |
≤ 2.0.43 |
CVE-2026-85659 |
Wordfence | |
| 7.2 High | NotificationX | Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route No login needed |
≤ 3.3.3 Fixed in 3.3.4 |
CVE-2026-109513 |
Wordfence | |
| 6.5 Medium | Vitepos | SQL Injection Authenticated (Vendor+) SQL Injection via 'src_by[].val' Parameter via 'bt' Operator |
≤ 3.6.1 Fixed in 3.6.2 |
CVE-2026-109414 |
Wordfence | |
| 7.2 High | SiteOrigin CSS | Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink No login needed |
≤ 1.6.7 |
CVE-2026-107764 |
Wordfence | |
| 7.2 High | SiteOrigin CSS | Cross-Site Scripting Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector No login needed |
≤ 1.6.7 |
CVE-2026-111122 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the attacker needs no account, as the publisher's text states it, or as the score assumes when the text does not say.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. Some publishers only give the last affected version; when their references show the fix, the fixed release is the first one on wordpress.org after that version. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.