Wordpress vulnerabilities

Products

• Wordpress 361
• Buddypress 17
• Wordpress-develop 17
• Mu 10
• Adserve 3
• Core 3
• Sniplets Plugin 3
• Blix 2
• Geo Controller 2
• Math Comment Spam Protection Plugin 2
• Max Addons Pro For Bricks 2
• Pay-with-tweet 2
• Royal-elementor-addons 2
• Wassup Plugin 2

Newest

• buddypress WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability CVE-2026-115965 Public exploit 8.5 HighOctober 29, 2026
• buddypress WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability CVE-2026-111850 8.5 HighOctober 28, 2026
• wordpress core, wordpress +1 more WordPress Core Remote File Inclusion Vulnerability CVE-2026-87902 In KEVPublic exploitFix available EPSS 95.8% 8.1 HighSeptember 22, 2026
• buddypress BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion CVE-2024-12145 4.3 MediumSeptember 11, 2026
• wordpress WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: Imagick and Ghostscript in use on the server A m… CVE-2026-65640 Public exploitFix available 8.8 HighAugust 17, 2026
• wordpress WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escala… CVE-2026-64638 Public exploitFix available 8.9 HighAugust 7, 2026
• unknown buddypress BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR CVE-2026-8155 5.4 MediumJuly 31, 2026
• buddypress BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data CVE-2026-1360 7.5 HighJuly 30, 2026
• wordpress wordpress-coding-standards WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerability CVE-2026-45293 Fix available 8.6 HighJuly 28, 2026
• wordpress, wordpress core +1 more WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution CVE-2026-63030 In KEVPublic exploitFix available EPSS 10.6% 9.8 CriticalJuly 17, 2026
• wordpress, wordpress core +1 more WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query CVE-2026-60137 In KEVPublic exploitFix available 5.9 MediumJuly 17, 2026
• buddypress BuddyPress 14.4.0 Friends List IDOR via REST API CVE-2026-53675 5.3 MediumJune 9, 2026
• buddypress BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution CVE-2026-53674 7.1 HighJune 9, 2026
• buddypress BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter CVE-2026-53673 Fix available 8.6 HighJune 9, 2026
• wordpress buddypress WordPress Plugin Buddypress 6.2.0 Persistent Cross-Site Scripting CVE-2020-37233 5.1 MediumMay 16, 2026
• buddypress BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution CVE-2024-11976 7.3 HighJanuary 23, 2026
• wordpress social-share-buttons Social-Share-Buttons 2.2.3 - SQL Injection via project_id Parameter CVE-2023-54333 8.8 HighJanuary 13, 2026
• buddypress WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability CVE-2025-62022 7.5 HighOctober 22, 2025
• wordpress WordPress <= 6.8.2 - (Author+) Cross Site Scripting (XSS) Vulnerability CVE-2025-58674 Fix available 5.9 MediumSeptember 23, 2025
• wordpress WordPress <= 6.8.2 - (Contributor+) Sensitive Data Exposure Vulnerability CVE-2025-58246 Fix available 4.3 MediumSeptember 23, 2025
• wordpress WordPress 3.5 through 6.8.2 allows remote attackers to guess titles of private and draft posts... CVE-2025-54352 Public exploit 3.7 LowJuly 21, 2025
• nate reist protected posts logout button, wordpress nate reist protected posts logout button +1 more WordPress Protected Posts Logout Button plugin <= 1.4.5 - Broken Access Control vulnerability CVE-2023-25454 6.5 MediumDecember 9, 2024
• nimeshrmr wp private content plus, wordpress wp private content plus plugin +1 more WP Private Content Plus <= 3.6.1 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure CVE-2024-11292 5.3 MediumDecember 6, 2024
• india-web-developer login with otp, wordpress login with otp plugin +1 more Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP CVE-2024-11178 8.1 HighDecember 6, 2024
• cmorillas1 external database based actions External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass CVE-2024-10311 7.5 HighNovember 15, 2024
• buddypress BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal CVE-2024-10011 8.1 HighOctober 25, 2024
• wordpress woocommerce order proposal WooCommerce Order Proposal <= 2.0.5 - Authenticated (Shop Manager+) Privilege Escalation via Order Proposal CVE-2024-9927 7.2 HighOctober 23, 2024
• wordpress WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); function CVE-2022-4973 Fix available 4.9 MediumOctober 16, 2024
• haibasoft thanh toán quét mã qr code tự động – momo, viettelpay, vnpay và 40 ngân hàng việt nam, wordpress thanh toan quet ma qr code tu dong +1 more Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting CVE-2024-8914 7.2 HighSeptember 24, 2024
• creativform geo controller Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution CVE-2024-7381 5.3 MediumSeptember 5, 2024
• unknown paypal pay now, buy now, donation and cart buttons shortcode, mohsinrasool paypal pay now\, buy now\, donation and cart buttons shortcode, wordpress paypal buy now button +3 more +5 more PayPal Pay Now, Buy Now, Donation and Cart Buttons Shortcode <= 1.7 - Contributor+ Stored XSS CVE-2024-5448 5.4 MediumJune 21, 2024
• posimyth the plus addons for elementor, posimyththemes the plus addons for elementor page builder pro, wordpress plus addon for elementor page builder +2 more The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.6 - Authenticated (Contributor+) Local File Inclusion CVE-2024-5455 8.8 HighJune 21, 2024
• buddypress BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-4892 6.4 MediumJune 12, 2024
• asghar hatampoor buddypress cover, buddypress cover project cover +1 more WordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerability CVE-2024-35746 10.0 CriticalJune 10, 2024
• master-addons master addons, litonice13 master addons for elementor – widgets, extensions, theme builder, popup builder & template kits, wordpress free widgets for elementor plugin +2 more Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor <= 2.0.6.1 - Missing Authorization to MA Template Creation or Modification CVE-2024-5382 6.5 MediumJune 7, 2024
• buddypress BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2024-3974 6.4 MediumMay 9, 2024
• ollybach wppizza WordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerability CVE-2024-33576 6.5 MediumMay 6, 2024
• quomodosoft elementsready, elementsready addons for elementor +1 more WordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-34374 6.5 MediumMay 6, 2024
• popup box team box, unknown popup box +1 more WordPress Popup Box plugin <= 4.1.2 - CSRF to XSS vulnerability CVE-2024-34367 7.1 HighMay 6, 2024
• wordpress directorist WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability CVE-2024-33929 5.3 MediumMay 3, 2024
• kailey lampert mini loops WordPress Mini Loops plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability CVE-2024-33934 6.5 MediumMay 3, 2024
• wordpress WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar... CVE-2024-4439 Public exploitFix available EPSS 71.0% 7.2 HighMay 3, 2024
• cmoreira interactive world maps Interactive World Maps <= 2.4.14 - Reflected Cross-Site Scripting CVE-2024-3681 6.1 MediumMay 2, 2024
• techlabpro1 the post grid – shortcode, gutenberg blocks and elementor addon for post grid, wordpress post grid shortcode gutenberg blocks elementor +1 more The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization CVE-2024-3936 4.3 MediumMay 2, 2024
• svs-websoft svs pricing tables SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion CVE-2024-2960 4.3 MediumMay 2, 2024
• wordpress video lightbox, wptipsntricks wp video lightbox +1 more WP Video Lightbox <= 1.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter CVE-2024-4324 6.4 MediumMay 2, 2024
• themehunk lead form builder & contact form, wordpress responsive contact form builder lead generation +1 more Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgery CVE-2024-1415 4.3 MediumMay 2, 2024
• devowl real media library: media library folder & file manager, real media library +1 more Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting CVE-2024-2328 6.4 MediumMay 2, 2024
• dynamiapps frontend admin, shabti frontend admin by dynamiapps +1 more Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation CVE-2024-3729 9.8 CriticalMay 2, 2024
• smub wpforms – easy form builder for wordpress – contact forms, payment forms, surveys, & more, wordpress contact form drag and drop form builder +1 more Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation CVE-2024-3649 5.3 MediumMay 2, 2024
• Show olderLoading…