WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 401–450 of 2,150 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 9 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Novalnet Payment Gateway for WooCommerce Plugin woocommerce-novalnet-gateway PHP Object Injection No login needed ≤ 12.10.3 Fixed in 12.10.4 CVE-2026-57677 Patchstack
9.6 Critical Admin and Site Enhancements (ASE) Pro Plugin admin-site-enhancements-pro Cross-Site Scripting No login needed ≤ 8.8.5 Fixed in 8.8.6 CVE-2026-57625 Patchstack
10.0 Critical Blocksy Companion Pro Plugin blocksy-companion-pro Remote Code Execution No login needed ≤ 2.1.46 Fixed in 2.1.47 CVE-2026-57624 Patchstack
9.0 Critical W3 Total Cache Plugin w3-total-cache Remote Code Execution Arbitrary Code Execution No login needed ≤ 2.9.4 Fixed in 2.10.0 CVE-2026-57623 Patchstack
9.8 Critical Booktics Plugin booktics PHP Object Injection No login needed ≤ 1.0.21 Fixed in 1.0.22 CVE-2026-57621 Patchstack
9.1 Critical Five Star Business Profile and Schema Plugin business-profile Remote Code Execution Arbitrary Code Execution ≤ 2.3.19 CVE-2026-27436 Patchstack
9.9 Critical Zegen Theme zegen Arbitrary File Upload ≤ 1.1.9 CVE-2026-27419 Patchstack
9.8 Critical PrivateContent Plugin private-content Privilege Escalation No login needed ≤ 9.9.2 CVE-2026-57692 Patchstack
9.8 Critical SMS Alert Plugin sms-alert Privilege Escalation Unauthenticated Privilege Escalation via Arbitrary Password Reset No login needed ≤ 3.9.5 CVE-2026-11387 Wordfence
9.1 Critical WP-BusinessDirectory Plugin wp-businessdirectory Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter No login needed ≤ 4.0.1 CVE-2026-6070 Wordfence
9.8 Critical EventON - WordPress Virtual Event Calendar Plugin SQL Injection WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter No login needed ≤ 5.0.11 CVE-2026-9711 Wordfence
9.8 Critical ProfileGrid - User Profiles, Groups and Communities Plugin Privilege Escalation User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite No login needed ≤ 5.9.9.5 CVE-2026-12073 Wordfence
9.9 Critical Paid Videochat Turnkey Site Plugin ppv-live-webcams Arbitrary File Deletion ≤ 7.4.8 Fixed in 7.4.9 CVE-2026-57331 Patchstack
9.8 Critical Invoice Generator Plugin invoice-creator Privilege Escalation Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter No login needed ≤ 1.0.0 CVE-2026-12415 Wordfence
9.1 Critical TemplateSpare Plugin templatespare Arbitrary File Upload ≤ 4.2.0 Fixed in 4.2.1 CVE-2026-57658 Patchstack
9.3 Critical Advance Product Search Plugin th-advance-product-search SQL Injection No login needed ≤ 1.4.4 Fixed in 1.4.5 CVE-2026-56070 Patchstack
9.3 Critical JetEngine Plugin jet-engine SQL Injection No login needed ≤ 3.8.10.2 Fixed in 3.8.11 CVE-2026-56068 Patchstack
9.3 Critical JetSmartFilters Plugin jet-smart-filters SQL Injection No login needed ≤ 3.8.3 Fixed in 3.8.3.1 CVE-2026-56067 Patchstack
9.3 Critical Quotes llama Plugin quotes-llama SQL Injection No login needed ≤ 3.1.5 Fixed in 3.1.6 CVE-2026-56062 Patchstack
9.9 Critical Travel Booking Theme travel-booking Arbitrary File Upload ≤ 2.2.5 Fixed in 2.2.6 CVE-2026-56059 Patchstack
9.9 Critical Quform Plugin quform Arbitrary File Upload ≤ 2.23.0 Fixed in 2.23.1 CVE-2026-56058 Patchstack
9.8 Critical Uncanny Automator Pro Plugin uncanny-automator-pro PHP Object Injection No login needed ≤ 7.3.0.6 Fixed in 7.3.0.7 CVE-2026-56057 Patchstack
9.3 Critical 워드프레스 결제 심플페이 Plugin pgall-for-woocommerce SQL Injection No login needed ≤ 5.5.6 Fixed in 5.5.7 CVE-2026-56036 Patchstack
9.3 Critical Library Management System Plugin library-management-system SQL Injection No login needed ≤ 3.5.7 Fixed in 3.5.8 CVE-2026-56034 Patchstack
9.8 Critical Dokan Pro Plugin dokan-pro Privilege Escalation No login needed ≤ 5.0.4 Fixed in 5.0.5 CVE-2026-56033 Patchstack
9.8 Critical Buddyboss Platform Plugin buddyboss-platform PHP Object Injection No login needed ≤ 3.0.4 Fixed in 3.0.5 CVE-2026-56032 Patchstack
9.8 Critical Paytium Plugin paytium Privilege Escalation No login needed ≤ 5.0.2 Fixed in 5.0.3 CVE-2026-56030 Patchstack
9.8 Critical Easy Elements for Elementor – Addons & Website Templates Plugin easy-elements Privilege Escalation Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation No login needed ≤ 1.4.9 Fixed in 1.5.0 CVE-2026-56028 Patchstack
9.9 Critical Booster for WooCommerce Plugin woocommerce-jetpack Arbitrary File Upload ≤ 8.0.1 Fixed in 8.0.2 CVE-2026-56027 Patchstack
9.3 Critical GeoDirectory Plugin geodirectory SQL Injection No login needed ≤ 2.8.162 Fixed in 2.8.163 CVE-2026-54831 Patchstack
9.3 Critical Real Estate 7 Theme realestate-7 SQL Injection No login needed ≤ 3.5.9 Fixed in 3.6.0 CVE-2026-54827 Patchstack
9.3 Critical wpDataTables Plugin wpdatatables SQL Injection No login needed ≤ 7.4 Fixed in 7.4.1 CVE-2026-54825 Patchstack
9.3 Critical JetBooking Plugin jet-booking SQL Injection No login needed ≤ 4.0.4.1 Fixed in 4.0.4.2 CVE-2026-54820 Patchstack
10.0 Critical OMGF Pro Plugin host-google-fonts-pro Arbitrary File Upload No login needed ≤ 5.2.6 Fixed in 5.2.7 CVE-2026-57700 Patchstack
9.3 Critical YMC Filter Plugin ymc-smart-filter SQL Injection No login needed ≤ 3.11.5 Fixed in 3.11.6 CVE-2026-54836 Patchstack
9.3 Critical Premmerce Wishlist for WooCommerce Plugin premmerce-woocommerce-wishlist SQL Injection No login needed ≤ 1.1.11 Fixed in 1.1.12 CVE-2026-54849 Patchstack
9.3 Critical MDTF Plugin wp-meta-data-filter-and-taxonomy-filter SQL Injection No login needed ≤ 1.3.7 Fixed in 1.3.8 CVE-2026-54843 Patchstack
9.9 Critical Widget Options Plugin widget-options Remote Code Execution ≤ 4.2.3 Fixed in 4.2.4 CVE-2026-54823 Patchstack
9.8 Critical Invoice Generator Plugin invoice-creator Privilege Escalation Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter No login needed ≤ 1.0.0 CVE-2026-12416 Wordfence
9.8 Critical SignUp & SignIn Plugin signup-signin Privilege Escalation Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover No login needed ≤ 1.0.0 CVE-2026-12417 Wordfence
9.8 Critical WooCommerce Plugin woocommerce Remote Code Execution WooCommerce 7.1.0 Remote Code Execution via class-wc-meta-box-product-images.php No login needed 7.1.0 CVE-2022-50972 VulnCheck
9.8 Critical Branda – White Label & Branding, Free Login Page Customizer Plugin branda-white-labeling Privilege Escalation White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover No login needed ≤ 3.4.29 CVE-2026-11551 Wordfence
9.8 Critical BetterDocs Pro Plugin Local File Inclusion Unauthenticated Local File Inclusion via doc_style No login needed ≤ 3.8.0 CVE-2026-7515 Wordfence
9.1 Critical Avada (Fusion) Builder Plugin fusion-builder Arbitrary File Deletion Unauthenticated Arbitrary File Deletion via Form Entry Value No login needed ≤ 3.15.3 CVE-2026-8713 Wordfence
9.3 Critical Motors Plugin motors-car-dealership-classified-listings SQL Injection No login needed ≤ 1.4.109 Fixed in 1.4.110 CVE-2026-54812 Patchstack
9.3 Critical GIFT4U Plugin gift4u-gift-cards-all-in-one-for-woo SQL Injection No login needed ≤ 1.0.10 Fixed in 1.1.0 CVE-2026-54809 Patchstack
9.3 Critical WP Travel Gutenberg Blocks Plugin wp-travel-blocks SQL Injection No login needed ≤ 3.9.4 Fixed in 3.9.5 CVE-2026-54808 Patchstack
9.8 Critical Creatify Theme creatify PHP Object Injection No login needed ≤ 1.5 CVE-2025-60236 Patchstack
9.8 Critical The Hospital Theme nrghospital PHP Object Injection No login needed ≤ 1.8.1 CVE-2025-60231 Patchstack
9.3 Critical Cargo Shipping Location for WooCommerce Plugin cargo-shipping-location-for-woocommerce SQL Injection No login needed ≤ 5.6 Fixed in 5.7 CVE-2026-54815 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only