WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 4,451–4,500 of 29,211 vulnerabilities

Known WordPress vulnerabilities, page 90 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
7.5 High	Print Invoice & Delivery Notes for WooCommerce Plugin `woocommerce-delivery-notes`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 7.1.1` Fixed in `7.1.2`	Jun 26, 2026	`CVE-2026-56060`	Patchstack
9.9 Critical	Travel Booking Theme `travel-booking`	Arbitrary File Upload	`≤ 2.2.5` Fixed in `2.2.6`	Jun 26, 2026	`CVE-2026-56059`	Patchstack
9.9 Critical	Quform Plugin `quform`	Arbitrary File Upload	`≤ 2.23.0` Fixed in `2.23.1`	Jun 26, 2026	`CVE-2026-56058`	Patchstack
9.8 Critical	Uncanny Automator Pro Plugin `uncanny-automator-pro`	PHP Object Injection No login needed	`≤ 7.3.0.6` Fixed in `7.3.0.7`	Jun 26, 2026	`CVE-2026-56057`	Patchstack
8.8 High	RealHomes Theme `realhomes`	PHP Object Injection	`≤ 4.5.3` Fixed in `4.5.4`	Jun 26, 2026	`CVE-2026-56055`	Patchstack
6.5 Medium	Payment Gateway Based Fees and Discounts for WooCommerce Plugin `checkout-fees-for-woocommerce`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 3.0.0` Fixed in `3.1.0`	Jun 26, 2026	`CVE-2026-56048`	Patchstack
7.1 High	perfmatters Plugin `perfmatters`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 2.6.3` Fixed in `2.6.4`	Jun 26, 2026	`CVE-2026-56047`	Patchstack
6.5 Medium	ListingPro Theme `listingpro`	Cross-Site Scripting	`≤ 2.9.11` Fixed in `2.9.12`	Jun 26, 2026	`CVE-2026-56046`	Patchstack
7.1 High	Automatic Plugin `wp-automatic`	Cross-Site Scripting No login needed	`< 3.135.1` Fixed in `3.135.1`	Jun 26, 2026	`CVE-2026-56045`	Patchstack
7.1 High	Blog2Social Plugin `blog2social`	Cross-Site Scripting No login needed	`≤ 8.9.2` Fixed in `8.9.3`	Jun 26, 2026	`CVE-2026-56044`	Patchstack
7.1 High	Customer Reviews for WooCommerce Plugin `customer-reviews-woocommerce`	Cross-Site Scripting No login needed	`≤ 5.110.1` Fixed in `5.111.0`	Jun 26, 2026	`CVE-2026-56043`	Patchstack
7.1 High	Responsive Lightbox Plugin `responsive-lightbox`	Cross-Site Scripting No login needed	`≤ 2.7.6` Fixed in `2.7.7`	Jun 26, 2026	`CVE-2026-56041`	Patchstack
7.1 High	Gutenverse Form Plugin `gutenverse-form`	Cross-Site Scripting No login needed	`≤ 2.4.7` Fixed in `2.5.0`	Jun 26, 2026	`CVE-2026-56040`	Patchstack
7.1 High	Quick Interest Slider Plugin `quick-interest-slider`	Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed	`≤ 3.1.6` Fixed in `3.1.7`	Jun 26, 2026	`CVE-2026-56039`	Patchstack
8.8 High	Frisbii Pay Plugin `reepay-checkout-gateway`	Privilege Escalation	`≤ 1.8.2` Fixed in `1.8.2.1`	Jun 26, 2026	`CVE-2026-56038`	Patchstack
9.3 Critical	워드프레스 결제 심플페이 Plugin `pgall-for-woocommerce`	SQL Injection No login needed	`≤ 5.5.6` Fixed in `5.5.7`	Jun 26, 2026	`CVE-2026-56036`	Patchstack
8.6 High	BitFire Security Plugin `bitfire`	Other Multiple Vulnerabilities No login needed	`≤ 5.0.3` Fixed in `5.0.4`	Jun 26, 2026	`CVE-2026-56035`	Patchstack
9.3 Critical	Library Management System Plugin `library-management-system`	SQL Injection No login needed	`≤ 3.5.7` Fixed in `3.5.8`	Jun 26, 2026	`CVE-2026-56034`	Patchstack
9.8 Critical	Dokan Pro Plugin `dokan-pro`	Privilege Escalation No login needed	`≤ 5.0.4` Fixed in `5.0.5`	Jun 26, 2026	`CVE-2026-56033`	Patchstack
9.8 Critical	Buddyboss Platform Plugin `buddyboss-platform`	PHP Object Injection No login needed	`≤ 3.0.4` Fixed in `3.0.5`	Jun 26, 2026	`CVE-2026-56032`	Patchstack
8.1 High	Uncanny Automator Plugin `uncanny-automator`	PHP Object Injection No login needed	`≤ 7.3.1.2` Fixed in `7.3.1.3`	Jun 26, 2026	`CVE-2026-56031`	Patchstack
9.8 Critical	Paytium Plugin `paytium`	Privilege Escalation No login needed	`≤ 5.0.2` Fixed in `5.0.3`	Jun 26, 2026	`CVE-2026-56030`	Patchstack
7.5 High	CorvusPay WooCommerce Payment Gateway Plugin `corvuspay-woocommerce-integration`	Authentication Bypass Broken Authentication No login needed	`≤ 2.7.4` Fixed in `2.7.5`	Jun 26, 2026	`CVE-2026-56029`	Patchstack
9.8 Critical	Easy Elements for Elementor – Addons & Website Templates Plugin `easy-elements`	Privilege Escalation Addons & Website Templates plugin <= 1.4.9 - Privilege Escalation No login needed	`≤ 1.4.9` Fixed in `1.5.0`	Jun 26, 2026	`CVE-2026-56028`	Patchstack
9.9 Critical	Booster for WooCommerce Plugin `woocommerce-jetpack`	Arbitrary File Upload	`≤ 8.0.1` Fixed in `8.0.2`	Jun 26, 2026	`CVE-2026-56027`	Patchstack
6.4 Medium	utm.codes Plugin `utm-dot-codes`	Server-Side Request Forgery	`≤ 1.9.0` Fixed in `1.9.1`	Jun 26, 2026	`CVE-2026-56026`	Patchstack
7.5 High	Paymob for WooCommerce Plugin `paymob-for-woocommerce`	Broken Access Control No login needed	`≤ 4.1.2`	Jun 26, 2026	`CVE-2026-56025`	Patchstack
7.1 High	MapPress Maps Plugin `mappress-google-maps-for-wordpress`	Cross-Site Scripting No login needed	`≤ 2.97.3` Fixed in `2.97.4`	Jun 26, 2026	`CVE-2026-56011`	Patchstack
8.8 High	Abandoned Cart Pro for WooCommerce Plugin `woocommerce-abandon-cart-pro`	Privilege Escalation	`≤ 10.4.0` Fixed in `10.4.1`	Jun 26, 2026	`CVE-2026-56010`	Patchstack
8.8 High	Fusion Builder Plugin `fusion-builder`	Privilege Escalation	`≤ 3.15.4` Fixed in `3.15.5`	Jun 26, 2026	`CVE-2026-56008`	Patchstack
7.5 High	Stylish Cost Calculator Plugin `stylish-cost-calculator`	Broken Access Control No login needed	`≤ 8.3.9` Fixed in `8.3.10`	Jun 26, 2026	`CVE-2026-54847`	Patchstack
7.5 High	Syncee Premium Dropshipping & Wholesale Plugin `syncee-global-dropshipping`	Broken Access Control No login needed	`≤ 1.0.27` Fixed in `1.0.28`	Jun 26, 2026	`CVE-2026-54846`	Patchstack
7.3 High	Newsletters Plugin `newsletters-lite`	Broken Access Control No login needed	`≤ 4.13` Fixed in `4.14`	Jun 26, 2026	`CVE-2026-54840`	Patchstack
7.5 High	Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups Plugin `trinity-backup`	Information Disclosure Backup, Migrate, Restore, Clone & Schedule Backups plugin <= 2.0.9 - Sensitive Data Exposure No login needed	`≤ 2.0.9` Fixed in `2.0.10`	Jun 26, 2026	`CVE-2026-54839`	Patchstack
7.5 High	Intranet & Private Site – All-In-One Intranet Plugin `all-in-one-intranet`	Broken Access Control All-In-One Intranet plugin <= 1.8.1 - Broken Access Control No login needed	`≤ 1.8.1` Fixed in `1.9.0`	Jun 26, 2026	`CVE-2026-54837`	Patchstack
7.5 High	Five Star Restaurant Menu Plugin `food-and-drink-menu`	Broken Access Control No login needed	`≤ 2.5.2` Fixed in `2.5.3`	Jun 26, 2026	`CVE-2026-54835`	Patchstack
7.5 High	Object Cache 4 everyone Plugin `object-cache-4-everyone`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 2.3.2` Fixed in `2.3.3`	Jun 26, 2026	`CVE-2026-54834`	Patchstack
7.4 High	Enable CORS Plugin `enable-cors`	Other Backdoor No login needed	`≤ 2.0.3` Fixed in `2.0.4`	Jun 26, 2026	`CVE-2026-54833`	Patchstack
7.5 High	Gutenverse Companion Plugin `gutenverse-companion`	Broken Access Control No login needed	`≤ 2.5.0` Fixed in `2.5.1`	Jun 26, 2026	`CVE-2026-54832`	Patchstack
9.3 Critical	GeoDirectory Plugin `geodirectory`	SQL Injection No login needed	`≤ 2.8.162` Fixed in `2.8.163`	Jun 26, 2026	`CVE-2026-54831`	Patchstack
9.3 Critical	Real Estate 7 Theme `realestate-7`	SQL Injection No login needed	`≤ 3.5.9` Fixed in `3.6.0`	Jun 26, 2026	`CVE-2026-54827`	Patchstack
7.6 High	SupportCandy Plugin `supportcandy`	Broken Access Control Insecure Direct Object References (IDOR)	`≤ 3.4.6` Fixed in `3.4.7`	Jun 26, 2026	`CVE-2026-54826`	Patchstack
9.3 Critical	wpDataTables Plugin `wpdatatables`	SQL Injection No login needed	`≤ 7.4` Fixed in `7.4.1`	Jun 26, 2026	`CVE-2026-54825`	Patchstack
7.5 High	Ads by WPQuads Plugin `quick-adsense-reloaded`	Information Disclosure Sensitive Data Exposure No login needed	`≤ 3.0.3` Fixed in `3.0.4`	Jun 26, 2026	`CVE-2026-54824`	Patchstack
9.3 Critical	JetBooking Plugin `jet-booking`	SQL Injection No login needed	`≤ 4.0.4.1` Fixed in `4.0.4.2`	Jun 26, 2026	`CVE-2026-54820`	Patchstack
6.5 Medium	User Registration Plugin `user-registration`	Broken Access Control No login needed	`≤ 5.2.2` Fixed in `5.2.3`	Jun 26, 2026	`CVE-2026-52701`	Patchstack
5.3 Medium	SiteGround Email Marketing Plugin `siteground-email-marketing`	Broken Access Control No login needed	`≤ 1.7.5` Fixed in `1.7.6`	Jun 26, 2026	`CVE-2026-24547`	Patchstack
6.5 Medium	BNE Testimonials Plugin `bne-testimonials`	Cross-Site Scripting	`≤ 2.0.8`	Jun 26, 2026	`CVE-2025-68075`	Patchstack
6.5 Medium	Image Carousel Plugin `image-carousel`	Cross-Site Scripting	`≤ 1.0.0.41`	Jun 26, 2026	`CVE-2025-68074`	Patchstack
7.5 High	Goya Core Plugin `goya-core`	Local File Inclusion	`< 1.0.9.4` Fixed in `1.0.9.4`	Jun 26, 2026	`CVE-2025-68064`	Patchstack

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.