Skip to content

Technology

WordPress vulnerabilities

WordPress core, plugins and themes. 44,626 published CVES affecting WordPress, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
44,626
Critical
3,732
High
13,190
Medium
27,095
Low
505
Unscored
104
CISA KEV
9
Atom feed of WordPress alerts

Latest WordPress CVEs

Newest publication first · page 20 of 40 · showing the latest 1,000

  2. CVE-2026-96565 WP-Members Membership Plugin <= 3.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field

    Published
    MediumCVSS 6.4 EPSS 0.34%

    The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Checkout Multicheckbox/Multiselect Field (scalar bypass of wpmem_sanitize_array) in all versions up to, and including, 3.5.7 due to insufficient input sanitization a...

  5. CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter

    Published
    CriticalCVSS 9.1 EPSS 2.3%

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::build_conditions_query() function in lib/mode...

  6. CVE-2026-118056 Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) <= 9.12.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'oxi_image_comparison_before_text' Par...

    Published
    MediumCVSS 4.9 EPSS 0.31%

    The Image Hover Effects Ultimate ( Image Gallery, Effects, Lightbox, Comparison & Magnifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rawdata.oxi_image_comparison_before_text' parameter in all versions up to, and including, 9.12.2 due to insuffi...

  7. CVE-2026-118047 Falang multilanguage for WordPress <= 1.4.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via falang_term[] via `falang_language_ordering` AJAX / `edit_term` hook

    Published
    MediumCVSS 6.4 EPSS 0.36%

    The Falang multilanguage for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'falang_term[<taxonomy>][<locale>][<field>] (via order[] driving wp_update_term)' parameter in all versions up to, and including, 1.4.6 due to insufficient input sanit...

  10. CVE-2026-102564 Dynific Addons for Elementor (formerly Anywhere Elementor) <= 1.3.0 - Unauthenticated Arbitrary Shortcode Execution via Comment Content via do_shortcode() over rendered template buffer

    Published
    MediumCVSS 6.5 EPSS 0.47%

    The The Dynific Addons for Elementor (formerly Anywhere Elementor) plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.3.0 This is due to the software allowing users to execute an action that does not properly validate a val...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.