WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,262 vulnerabilities, 1,570 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,170 High 9,029 Medium 17,733 Low 330

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 8, 2026.

Showing 401–450 of 1,279 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 9 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	Percent to Infograph Plugin `percent-to-infograph`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	Feb 14, 2026	`CVE-2026-1939`	Wordfence
6.4 Medium	Ravelry Designs Widget Plugin `ravelry-designs-widget`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sb_ravelry_designs' Shortcode 'layout' Attribute	`≤ 1.0.0`	Feb 14, 2026	`CVE-2026-1903`	Wordfence
6.4 Medium	QuestionPro Surveys Plugin `questionpro-surveys`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0`	Feb 14, 2026	`CVE-2026-1901`	Wordfence
6.4 Medium	Citations tools Plugin `citations-tools`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'code' Shortcode Attribute	`≤ 0.3.2`	Feb 14, 2026	`CVE-2026-1912`	Wordfence
6.4 Medium	Simple Wp colorfull Accordion Plugin `simple-wp-colorfull-accordion`	Cross-Site Scripting Authenticated (Contributor+) Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 1.0`	Feb 14, 2026	`CVE-2026-1904`	Wordfence
6.4 Medium	IDE Micro code-editor Plugin `flask-micro`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute	`≤ 1.0.0`	Feb 11, 2026	`CVE-2026-1827`	Wordfence
6.4 Medium	OpenPOS Lite Plugin `wpos-lite-version`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.0`	Feb 11, 2026	`CVE-2026-1826`	Wordfence
6.4 Medium	HTML Shortcodes Plugin `html-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.1`	Feb 11, 2026	`CVE-2026-1809`	Wordfence
6.4 Medium	BuddyHolis ListSearch Plugin `listsearch`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute	`≤ 1.1`	Feb 11, 2026	`CVE-2026-1853`	Wordfence
6.4 Medium	Slideshow Wp Plugin `slideshow-wp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute	`≤ 1.1`	Feb 11, 2026	`CVE-2026-1885`	Wordfence
6.4 Medium	Microtango Plugin `microtango`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.9.29`	Feb 11, 2026	`CVE-2026-1821`	Wordfence
6.4 Medium	WDES Responsive Popup Plugin `wdes-responsive-popup`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute	`≤ 1.3.6`	Feb 11, 2026	`CVE-2026-1804`	Wordfence
6.4 Medium	Orbisius Random Name Generator Plugin `orbisius-random-name-generator`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute	`≤ 1.0.2`	Feb 11, 2026	`CVE-2026-1893`	Wordfence
6.4 Medium	The Events Calendar Shortcode & Block Plugin `the-events-calendar-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.1.2`	Feb 10, 2026	`CVE-2026-1922`	Wordfence
6.4 Medium	OMIGO Plugin `omigo`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.3`	Feb 7, 2026	`CVE-2026-1573`	Wordfence
6.5 Medium	The Bucketlister Plugin `the-bucketlister`	SQL Injection Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes	`≤ 0.1.5`	Feb 7, 2026	`CVE-2025-15477`	Wordfence
6.4 Medium	Wonka Slide Plugin `wonka-slide`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 1.3.3`	Feb 7, 2026	`CVE-2026-1613`	Wordfence
6.4 Medium	Wikiloops Track Player Plugin `wikiloops-track-player`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 1.0.1`	Feb 7, 2026	`CVE-2026-1611`	Wordfence
6.4 Medium	Video Onclick Plugin `video-onclick`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 0.4.7`	Feb 7, 2026	`CVE-2026-1608`	Wordfence
6.4 Medium	Simple Bible Verse via Shortcode Plugin `simple-bible-verse-via-shortcode`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 1.1`	Feb 7, 2026	`CVE-2026-1570`	Wordfence
6.4 Medium	Bold Page Builder Plugin `bold-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 5.4.8`	Feb 7, 2026	`CVE-2025-12159`	Wordfence
6.4 Medium	Bold Builder Plugin `bold-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode	`≤ 5.5.1`	Feb 7, 2026	`CVE-2025-12803`	Wordfence
6.4 Medium	Bold Page Builder Plugin `bold-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode	`≤ 5.6.1`	Feb 7, 2026	`CVE-2025-15267`	Wordfence
6.4 Medium	Employee Directory Plugin `employee-staff-directory`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute	`≤ 1.2.1`	Feb 6, 2026	`CVE-2026-1279`	Wordfence
6.4 Medium	WaveSurfer-WP Plugin `wavesurfer-wp`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute	`≤ 2.8.3`	Feb 6, 2026	`CVE-2026-1909`	Wordfence
6.4 Medium	Orange Confort+ accessibility toolbar Plugin `orange-confort-plus`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 0.7`	Feb 6, 2026	`CVE-2026-1808`	Wordfence
6.4 Medium	Docus Plugin `docus`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.6`	Feb 6, 2026	`CVE-2026-1888`	Wordfence
4.3 Medium	Timeline Block Plugin `timeline-block-block`	Broken Access Control Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute	`≤ 1.3.3`	Feb 6, 2026	`CVE-2026-1228`	Wordfence
6.4 Medium	Essential Widgets Plugin `essential-widgets`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes	`≤ 3.0`	Feb 5, 2026	`CVE-2026-0867`	Wordfence
4.3 Medium	Latest Post Shortcode Plugin `latest-post-shortcode`	Broken Access Control	`≤ 14.2.0` Fixed in `14.2.1`	Feb 3, 2026	`CVE-2026-24995`	Patchstack
6.5 Medium	The Events Calendar Shortcode & Block Plugin `the-events-calendar-shortcode`	Cross-Site Scripting	`≤ 3.1.1` Fixed in `3.1.2`	Feb 3, 2026	`CVE-2026-24988`	Patchstack
6.4 Medium	Passster – Password Protect Pages and Content Plugin `content-protector`	Cross-Site Scripting Password Protect Pages and Content <= 4.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 4.2.24`	Jan 28, 2026	`CVE-2025-14865`	Wordfence
6.4 Medium	Buy Now Plus Plugin `buy-now-plus`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 1.0.2`	Jan 28, 2026	`CVE-2026-1295`	Wordfence
6.4 Medium	Forms Bridge Plugin `forms-bridge`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute	`≤ 4.2.5`	Jan 28, 2026	`CVE-2026-1244`	Wordfence
6.4 Medium	LeadBI Plugin `leadbi`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute	`≤ 1.7`	Jan 24, 2026	`CVE-2026-1189`	Wordfence
6.4 Medium	CM CSS Columns Plugin `cm-css-columns`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute	`≤ 1.2.1`	Jan 24, 2026	`CVE-2026-1098`	Wordfence
6.4 Medium	Administrative Shortcodes Plugin `administrative-shortcodes`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes	`≤ 0.3.4`	Jan 24, 2026	`CVE-2026-1099`	Wordfence
6.4 Medium	ThemeRuby Multi Authors Plugin `themeruby-multi-authors`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes	`≤ 1.0.0`	Jan 24, 2026	`CVE-2026-1097`	Wordfence
6.4 Medium	Canto Testimonials Plugin `canto-testimonials`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute	`≤ 1.0`	Jan 24, 2026	`CVE-2026-1095`	Wordfence
4.3 Medium	Simple Crypto Shortcodes Plugin `simple-crypto-shortcodes`	Cross-Site Request Forgery Cross-Site Request Forgery to Plugin Settings Update No login needed	`≤ 1.0.2`	Jan 24, 2026	`CVE-2025-14903`	Wordfence
6.4 Medium	WP DSGVO Tools (GDPR) Plugin `shapepress-dsgvo`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'lw_content_block' Shortcode	`≤ 3.1.36`	Jan 23, 2026	`CVE-2026-0914`	Wordfence
6.4 Medium	RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging Plugin `wp-rss-aggregator`	Cross-Site Scripting RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode	`≤ 5.0.10`	Jan 23, 2026	`CVE-2025-14745`	Wordfence
6.4 Medium	Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin `uncanny-automator`	Cross-Site Scripting Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 6.10.0.2`	Jan 23, 2026	`CVE-2025-15522`	Wordfence
6.5 Medium	Penci Shortcodes & Performance Plugin `penci-shortcodes`	Cross-Site Scripting	`≤ 6.1` Fixed in `6.2`	Jan 22, 2026	`CVE-2026-24354`	Patchstack
4.3 Medium	User Registration Plugin `user-registration`	Arbitrary Shortcode Execution	`≤ 4.4.9` Fixed in `5.0`	Jan 22, 2026	`CVE-2026-24353`	Patchstack
5.3 Medium	DeepDigital Theme `deepdigital`	Arbitrary Shortcode Execution No login needed	`≤ 1.0.2`	Jan 22, 2026	`CVE-2026-22469`	Patchstack
5.3 Medium	FluentForm Plugin `fluentform`	Arbitrary Shortcode Execution No login needed	`≤ 6.1.11` Fixed in `6.1.12`	Jan 22, 2026	`CVE-2025-69001`	Patchstack
5.3 Medium	WoodMart Theme `woodmart`	Arbitrary Shortcode Execution No login needed	`≤ 8.3.7` Fixed in `8.3.8`	Jan 22, 2026	`CVE-2025-47600`	Patchstack
6.4 Medium	CubeWP Plugin `cubewp-framework`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode	`≤ 1.1.26`	Jan 17, 2026	`CVE-2025-8615`	Wordfence
6.4 Medium	User Submitted Posts Plugin `user-submitted-posts`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode	`≤ 20260110`	Jan 16, 2026	`CVE-2026-0913`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.