WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 401–450 of 1,456 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 9 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	MyQtip – easy qTip2 Plugin `myqtip-easy-qtip2`	Cross-Site Scripting easy qTip2 <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 2.0.5`	Mar 7, 2026	`CVE-2026-1574`	Wordfence
6.4 Medium	Wueen Plugin `wueen`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode	`≤ 0.2.0`	Mar 7, 2026	`CVE-2026-1569`	Wordfence
7.5 High	JS Archive List Plugin `jquery-archive-list-widget`	PHP Object Injection Authenticated (Contributor+) PHP Object Injection via 'included' Shortcode Attribute	`≤ 6.1.7`	Mar 7, 2026	`CVE-2026-2020`	Wordfence
6.4 Medium	Hammas Calendar Plugin `hammas-calendar`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'apix' Shortcode Attribute	`≤ 1.5.11`	Mar 7, 2026	`CVE-2026-1902`	Wordfence
6.4 Medium	My Calendar – Accessible Event Manager Plugin `my-calendar`	Cross-Site Scripting Accessible Event Manager <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.7.3`	Mar 4, 2026	`CVE-2026-2355`	Wordfence
6.5 Medium	WP-Members Membership Plugin `wp-members`	SQL Injection Authenticated (Contributor+) SQL Injection via 'order_by' Shortcode Attribute	`≤ 3.5.5.1`	Mar 4, 2026	`CVE-2026-2363`	Wordfence
6.4 Medium	Electric Enquiries Plugin `electric-enquiries`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Shortcode Attribute	`≤ 1.1`	Feb 27, 2026	`CVE-2025-14142`	Wordfence
6.4 Medium	Livemesh Addons for Beaver Builder Plugin `addons-for-beaver-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes	`≤ 3.9.2`	Feb 26, 2026	`CVE-2026-2029`	Wordfence
6.4 Medium	Secure Copy Content Protection and Content Locking Plugin `secure-copy-content-protection`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute	`≤ 5.0.1`	Feb 25, 2026	`CVE-2026-2367`	Wordfence
9.8 Critical	Applay - Shortcodes Plugin `applay-shortcodes`	PHP Object Injection Shortcodes plugin <= 3.7 - PHP Object Injection No login needed	`≤ 3.7`	Feb 20, 2026	`CVE-2026-22384`	Patchstack
6.4 Medium	Quiz Maker Plugin `quiz-maker`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 6.7.1.7`	Feb 20, 2026	`CVE-2026-2384`	Wordfence
6.5 Medium	Shortcoder Plugin `shortcoder`	Cross-Site Scripting	`≤ 6.5.1` Fixed in `6.5.2`	Feb 19, 2026	`CVE-2026-27074`	Patchstack
5.3 Medium	XStore Theme `xstore`	Arbitrary Shortcode Execution No login needed	`≤ 9.6.4` Fixed in `9.6.5`	Feb 19, 2026	`CVE-2026-25006`	Patchstack
5.3 Medium	Everest Forms Plugin `everest-forms`	Arbitrary Shortcode Execution No login needed	`≤ 3.4.1` Fixed in `3.4.2`	Feb 19, 2026	`CVE-2026-22422`	Patchstack
6.4 Medium	YaMaps Plugin `yamaps`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Parameters	`≤ 0.6.40`	Feb 19, 2026	`CVE-2025-14851`	Wordfence
6.4 Medium	Groups Plugin `groups`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode	`≤ 3.10.0`	Feb 19, 2026	`CVE-2026-0549`	Wordfence
6.4 Medium	XO Event Calendar Plugin `xo-event-calendar`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'xo_event_field' shortcode	`≤ 3.2.10`	Feb 19, 2026	`CVE-2026-0556`	Wordfence
6.4 Medium	Album and Image Gallery Plus Lightbox Plugin `album-and-image-gallery-plus-lightbox`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode	`≤ 2.1.7`	Feb 19, 2026	`CVE-2025-13612`	Wordfence
6.4 Medium	s2Member Plugin `s2member`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 251005`	Feb 19, 2026	`CVE-2025-13732`	Wordfence
6.4 Medium	Complianz \| GDPR/CCPA Cookie Consent Plugin `complianz-gdpr`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 7.4.3`	Feb 18, 2026	`CVE-2025-11185`	Wordfence
5.4 Medium	SiteOrigin Widgets Bundle Plugin `so-widgets-bundle`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution	`≤ 1.70.4`	Feb 18, 2026	`CVE-2026-2127`	Wordfence
6.4 Medium	WP Event Aggregator Plugin `wp-event-aggregator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.8.7`	Feb 18, 2026	`CVE-2026-1941`	Wordfence
6.4 Medium	InteractiveCalculator Plugin `interactivecalculator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 1.0.3`	Feb 18, 2026	`CVE-2026-1807`	Wordfence
6.4 Medium	Display During Conditional Shortcode Plugin `display-during-conditional-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter	`≤ 1.2`	Feb 18, 2026	`CVE-2025-6460`	Wordfence
6.4 Medium	Filestack Plugin `filepicker-media-uploader`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 2.0.8`	Feb 18, 2026	`CVE-2025-13959`	Wordfence
6.4 Medium	myCred Plugin `mycred`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'mycred_load_coupon' Shortcode	`≤ 2.9.7.3`	Feb 14, 2026	`CVE-2026-0550`	Wordfence
7.5 High	Flexi Product Slider and Grid for WooCommerce Plugin `flexi-product-slider-grid`	Local File Inclusion Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute	`≤ 1.0.5`	Feb 14, 2026	`CVE-2026-1988`	Wordfence
6.4 Medium	Simple Plyr Plugin `simple-plyr`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'poster' Shortcode Attribute	`≤ 0.0.1`	Feb 14, 2026	`CVE-2026-1915`	Wordfence
6.4 Medium	ZoomifyWP Free Plugin `tz-zoomifywp-free`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'filename' Shortcode Attribute	`≤ 1.1`	Feb 14, 2026	`CVE-2026-1187`	Wordfence
6.4 Medium	UpMenu Plugin `upmenu`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute	`≤ 3.1`	Feb 14, 2026	`CVE-2026-1910`	Wordfence
6.4 Medium	Best-wp-google-map Plugin `best-wp-google-map`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute	`≤ 2.1`	Feb 14, 2026	`CVE-2026-1096`	Wordfence
6.4 Medium	MasterStudy LMS WordPress Plugin – for Online Courses and Education Plugin `masterstudy-lms-learning-management-system`	Cross-Site Scripting for Online Courses and Education <= 3.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'stm_lms_courses_grid_display' Shortcode	`≤ 3.7.11`	Feb 14, 2026	`CVE-2026-0559`	Wordfence
6.4 Medium	Sphere Manager Plugin `sphere-manager`	Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'width' Shortcode Attribute	`≤ 1.0.2`	Feb 14, 2026	`CVE-2026-1905`	Wordfence
6.4 Medium	WP Data Access Plugin `wp-data-access`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpda_app' Shortcode	`≤ 5.5.63`	Feb 14, 2026	`CVE-2026-0557`	Wordfence
6.4 Medium	Percent to Infograph Plugin `percent-to-infograph`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	Feb 14, 2026	`CVE-2026-1939`	Wordfence
6.4 Medium	Ravelry Designs Widget Plugin `ravelry-designs-widget`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute	`≤ 1.0.0`	Feb 14, 2026	`CVE-2026-1903`	Wordfence
6.4 Medium	QuestionPro Surveys Plugin `questionpro-surveys`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	Feb 14, 2026	`CVE-2026-1901`	Wordfence
6.4 Medium	Citations tools Plugin `citations-tools`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute	`≤ 0.3.2`	Feb 14, 2026	`CVE-2026-1912`	Wordfence
6.4 Medium	Simple Wp colorfull Accordion Plugin `simple-wp-colorfull-accordion`	Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 1.0`	Feb 14, 2026	`CVE-2026-1904`	Wordfence
6.4 Medium	IDE Micro code-editor Plugin `flask-micro`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 1.0.0`	Feb 11, 2026	`CVE-2026-1827`	Wordfence
6.4 Medium	OpenPOS Lite Plugin `wpos-lite-version`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.0`	Feb 11, 2026	`CVE-2026-1826`	Wordfence
6.4 Medium	HTML Shortcodes Plugin `html-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.1`	Feb 11, 2026	`CVE-2026-1809`	Wordfence
6.4 Medium	BuddyHolis ListSearch Plugin `listsearch`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute	`≤ 1.1`	Feb 11, 2026	`CVE-2026-1853`	Wordfence
6.4 Medium	Slideshow Wp Plugin `slideshow-wp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute	`≤ 1.1`	Feb 11, 2026	`CVE-2026-1885`	Wordfence
6.4 Medium	Microtango Plugin `microtango`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.9.29`	Feb 11, 2026	`CVE-2026-1821`	Wordfence
6.4 Medium	WDES Responsive Popup Plugin `wdes-responsive-popup`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute	`≤ 1.3.6`	Feb 11, 2026	`CVE-2026-1804`	Wordfence
6.4 Medium	Orbisius Random Name Generator Plugin `orbisius-random-name-generator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute	`≤ 1.0.2`	Feb 11, 2026	`CVE-2026-1893`	Wordfence
6.4 Medium	The Events Calendar Shortcode & Block Plugin `the-events-calendar-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.1.2`	Feb 10, 2026	`CVE-2026-1922`	Wordfence
6.4 Medium	OMIGO Plugin `omigo`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.3`	Feb 7, 2026	`CVE-2026-1573`	Wordfence
6.5 Medium	The Bucketlister Plugin `the-bucketlister`	SQL Injection Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes	`≤ 0.1.5`	Feb 7, 2026	`CVE-2025-15477`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.