WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 401–450 of 16,788 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 9 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
5.3 Medium	Passster Plugin `content-protector`	Broken Access Control No login needed	`≤ 4.3.13` Fixed in `4.3.14`	Sep 11, 2026	`CVE-2026-62114`	Patchstack
4.3 Medium	Slim SEO Plugin `slim-seo`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 4.10.0` Fixed in `4.10.1`	Sep 11, 2026	`CVE-2026-62113`	Patchstack
7.6 High	Amelia Plugin `ameliabooking`	SQL Injection	`≤ 2.4.9` Fixed in `2.4.10`	Sep 11, 2026	`CVE-2026-62112`	Patchstack
6.5 Medium	Simple Payment Plugin `simple-payment`	Cross-Site Scripting	`≤ 2.5.4` Fixed in `2.5.6`	Sep 11, 2026	`CVE-2026-62111`	Patchstack
6.5 Medium	Bold Page Builder Plugin `bold-page-builder`	Cross-Site Scripting	`≤ 5.9.9` Fixed in `5.9.10`	Sep 11, 2026	`CVE-2026-62110`	Patchstack
7.6 High	Sky Addons for Elementor Plugin `sky-elementor-addons`	SQL Injection	`≤ 3.8.4` Fixed in `3.8.5`	Sep 11, 2026	`CVE-2026-62109`	Patchstack
8.8 High	Masteriyo - LMS Plugin `learning-management-system`	PHP Object Injection LMS plugin <= 3.4.0 - PHP Object Injection	`≤ 3.4.0` Fixed in `3.4.1`	Sep 11, 2026	`CVE-2026-62107`	Patchstack
8.8 High	SMS Alert Order Notifications Plugin `sms-alert`	Privilege Escalation	`≤ 3.9.9` Fixed in `4.0.0`	Sep 11, 2026	`CVE-2026-62106`	Patchstack
9.8 Critical	ThemeREX Addons Plugin `trx_addons`	PHP Object Injection No login needed	`< 2.45.0` Fixed in `2.45.0`	Sep 11, 2026	`CVE-2026-62105`	Patchstack
9.8 Critical	Everest Forms Plugin `everest-forms`	PHP Object Injection No login needed	`≤ 3.6.0` Fixed in `3.6.1`	Sep 11, 2026	`CVE-2026-62103`	Patchstack
8.8 High	Gato GraphQL Plugin `gatographql`	Privilege Escalation	`≤ 19.2.3` Fixed in `19.2.4`	Sep 11, 2026	`CVE-2026-62102`	Patchstack
5.3 Medium	Quiz And Survey Master Plugin `quiz-master-next`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 11.2.5` Fixed in `11.2.6`	Sep 11, 2026	`CVE-2026-62140`	Patchstack
5.3 Medium	Deposits and Partial Payments for WooCommerce Plugin `advanced-partial-payment-or-deposit-for-woocommerce`	Broken Access Control No login needed	`≤ 3.1.0` Fixed in `4.0.1`	Sep 11, 2026	`CVE-2026-27378`	Patchstack
7.5 High	AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution Plugin `acymailing`	Path Traversal An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter No login needed	`≤ 11.0.4`	Sep 10, 2026	`CVE-2026-77807`	Wordfence
7.5 High	WP Fast Total Search Plugin `fulltext-search`	Broken Access Control No login needed	`≤ 1.82.284` Fixed in `1.83.286`	Sep 10, 2026	`CVE-2026-84821`	Patchstack
7.1 High	WPAdverts Plugin `wpadverts`	Cross-Site Scripting No login needed	`≤ 2.3.3` Fixed in `2.3.4`	Sep 10, 2026	`CVE-2026-84819`	Patchstack
7.1 High	WPCS Plugin `currency-switcher`	Cross-Site Scripting No login needed	`≤ 1.3.2` Fixed in `1.3.3`	Sep 10, 2026	`CVE-2026-84816`	Patchstack
8.1 High	SiteSkite Plugin `siteskite`	Privilege Escalation No login needed	`≤ 2.1.5` Fixed in `2.1.6`	Sep 10, 2026	`CVE-2026-81805`	Patchstack
7.5 High	ZHBackup – Backup, Restore & Migration Plugin `zhbackup`	Information Disclosure Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure No login needed	`≤ 2.4.2` Fixed in `2.4.3`	Sep 10, 2026	`CVE-2026-81804`	Patchstack
7.5 High	RepairBuddy Plugin `computer-repair-shop`	Remote Code Execution	`≤ 4.1224` Fixed in `4.1225`	Sep 10, 2026	`CVE-2026-81803`	Patchstack
8.1 High	WP-Stateless Plugin `wp-stateless`	Broken Access Control Settings Change	`≤ 4.4.1` Fixed in `4.4.2`	Sep 10, 2026	`CVE-2026-81801`	Patchstack
9.3 Critical	Verified Reviews (Avis Vérifiés) Plugin `netreviews`	SQL Injection No login needed	`≤ 2.4.6`	Sep 10, 2026	`CVE-2026-81800`	Patchstack
7.5 High	Return Refund and Exchange For WooCommerce Plugin `woo-refund-and-exchange-lite`	Broken Access Control No login needed	`≤ 4.6.4`	Sep 10, 2026	`CVE-2026-81799`	Patchstack
7.3 High	WP Travel Plugin `wp-travel`	Authentication Bypass Broken Authentication No login needed	`≤ 12.0.3` Fixed in `12.0.4`	Sep 10, 2026	`CVE-2026-81796`	Patchstack
7.1 High	Page Visits Counter – Lite Plugin `page-visits-counter-lite`	Cross-Site Scripting Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) No login needed	`≤ 1.2.3`	Sep 10, 2026	`CVE-2026-81795`	Patchstack
7.5 High	Shirt Product Designer for WooCommerce Plugin `woo-shirt-product-designer`	Broken Access Control No login needed	`1.0.4`	Sep 10, 2026	`CVE-2026-81794`	Patchstack
6.5 Medium	Salon booking system Plugin `salon-booking-system`	Broken Access Control No login needed	`≤ 10.31.9`	Sep 10, 2026	`CVE-2026-81793`	Patchstack
6.5 Medium	EventON Plugin `eventon-lite`	Cross-Site Scripting	`≤ 2.5.7`	Sep 10, 2026	`CVE-2026-81791`	Patchstack
8.6 High	Advanced Product Fields Extended for WooCommerce Plugin `advanced-product-fields-for-woocommerce-extended`	Arbitrary File Deletion No login needed	`≤ 3.1.6` Fixed in `3.1.7`	Sep 10, 2026	`CVE-2026-81789`	Patchstack
6.3 Medium	IMPress for IDX Broker Plugin `idx-broker-platinum`	Broken Access Control	`≤ 3.3.0`	Sep 10, 2026	`CVE-2026-81788`	Patchstack
6.5 Medium	IMPress for IDX Broker Plugin `idx-broker-platinum`	Authentication Bypass Broken Authentication No login needed	`≤ 3.3.0`	Sep 10, 2026	`CVE-2026-81787`	Patchstack
7.5 High	Thank You Page Customizer for WooCommerce Plugin `woo-thank-you-page-customizer`	Broken Access Control No login needed	`≤ 1.2.2`	Sep 10, 2026	`CVE-2026-81786`	Patchstack
6.5 Medium	BuddyForms Plugin `buddyforms`	Broken Access Control No login needed	`≤ 2.9.0`	Sep 10, 2026	`CVE-2026-81785`	Patchstack
8.1 High	Wise Chat Plugin `wise-chat`	PHP Object Injection No login needed	`≤ 3.4`	Sep 10, 2026	`CVE-2026-81784`	Patchstack
7.1 High	MailMunch – Grow your Email List Plugin `mailmunch`	Authentication Bypass Grow your Email List plugin <= 3.2.5 - Broken Authentication	`≤ 3.2.5`	Sep 10, 2026	`CVE-2026-81783`	Patchstack
6.5 Medium	WP Docs Plugin `wp-docs`	Cross-Site Scripting	`≤ 2.3.1`	Sep 10, 2026	`CVE-2026-81782`	Patchstack
6.5 Medium	Youzify Plugin `youzify`	Path Traversal Arbitrary File Download	`≤ 1.3.7`	Sep 10, 2026	`CVE-2026-81275`	Patchstack
6.5 Medium	Robokassa payment gateway for Woocommerce Plugin `robokassa`	Broken Access Control No login needed	`≤ 1.8.9`	Sep 10, 2026	`CVE-2026-78536`	Patchstack
5.6 Medium	Simple Cloudflare Turnstile Plugin `simple-cloudflare-turnstile`	Authentication Bypass Captcha Bypass No login needed	`≤ 1.42.1` Fixed in `1.42.3`	Sep 10, 2026	`CVE-2026-66674`	Patchstack
6.5 Medium	Simple Cloudflare Turnstile Plugin `simple-cloudflare-turnstile`	Content Injection No login needed	`≤ 1.42.1` Fixed in `1.42.3`	Sep 10, 2026	`CVE-2026-66632`	Patchstack
6.5 Medium	Groundhogg Plugin `groundhogg`	Path Traversal	`≤ 4.7.1` Fixed in `4.7.2`	Sep 10, 2026	`CVE-2026-85310`	Patchstack
6.4 Medium	Builderall Plugin `builderall-cheetah-for-wp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting	`≤ 3.0.2`	Sep 10, 2026	`CVE-2026-15820`	Wordfence
4.3 Medium	Builderall Plugin `builderall-cheetah-for-wp`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter	`≤ 3.0.2`	Sep 10, 2026	`CVE-2026-15823`	Wordfence
6.4 Medium	Builderall Plugin `builderall-cheetah-for-wp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting	`≤ 3.0.2`	Sep 10, 2026	`CVE-2026-15796`	Wordfence
4.8 Medium	Hustle Plugin `wordpress-popup`	Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders No login needed	`7.0.0.1 – < 7.8.14.2` Fixed in `7.8.14.2`	Sep 9, 2026	`CVE-2026-80440`	WPScan
6.4 Medium	Podlove Podcast Publisher Plugin `podlove-podcasting-plugin-for-wordpress`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter	`≤ 4.5.5`	Sep 9, 2026	`CVE-2026-75966`	Wordfence
7.2 High	Hide My WP Ghost Plugin `hide-my-wp`	Server-Side Request Forgery No login needed	`≤ 7.0.09` Fixed in `7.0.10`	Sep 8, 2026	`CVE-2026-81806`	Patchstack
7.5 High	WooCommerce Plugin `woocommerce`	Denial of Service Denial of Service Attack No login needed	`< 11.1.0` Fixed in `11.1.0`	Sep 8, 2026	`CVE-2026-48888`	Patchstack
7.1 High	Unbounce Landing Pages Plugin `unbounce`	Broken Access Control	`≤ 1.1.4`	Sep 8, 2026	`CVE-2026-81781`	Patchstack
7.5 High	Csomagpontok és szállítási címkék WooCommerce-hez Plugin `hungarian-pickup-points-for-woocommerce`	Broken Access Control No login needed	`< 4.2.8` Fixed in `4.2.8`	Sep 8, 2026	`CVE-2026-81790`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.