MediumCVSS 6.5
EPSS 0.36%
Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.
Technology
WordPress vulnerabilities
WordPress core, plugins and themes. 44,638 published CVES affecting WordPress, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 44,638
- Critical
- 3,732
- High
- 13,190
- Medium
- 27,095
- Low
- 505
- Unscored
- 116
- CISA KEV
- 9
Latest WordPress CVEs
Newest publication first · page 40 of 40 · showing the latest 1,000
-
-
HighCVSS 7.1 EPSS 0.23%
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
-
HighCVSS 7.1 EPSS 0.23%
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
-
HighCVSS 7.5 EPSS 0.46%
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
-
CriticalCVSS 9.8 EPSS 0.41%
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.
-
CriticalCVSS 9.3 EPSS 0.32%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in INTINITUM FORM Transliterator serbian-transliteration allows Blind SQL Injection.This issue affects Transliterator: from n/a through 2.5.13.
-
CVE-2026-28160 WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability
PublishedHighCVSS 7.1 EPSS 0.23%Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.
-
MediumCVSS 6.5 EPSS 0.24%
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
-
CriticalCVSS 9.8 EPSS 0.41%
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
-
MediumCVSS 5.3 EPSS 0.27%
Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.
-
MediumCVSS 4.3 EPSS 0.25%
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Unlimited Elements For Elemento...
-
MediumCVSS 4.3 EPSS 0.26%
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.
-
MediumCVSS 4.3 EPSS 0.25%
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
-
CVE-2026-62047 WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability
PublishedMediumCVSS 4.3 EPSS 0.26%Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
-
MediumCVSS 6.5 EPSS 0.20%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5.
-
MediumCVSS 5.3 EPSS 0.30%
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5.
-
CVE-2026-62057 WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability
PublishedMediumCVSS 5.3 EPSS 0.30%Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.
-
MediumCVSS 6.5 EPSS 0.41%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows PHP Local File Inclusion.This iss...
-
MediumCVSS 5.3 EPSS 0.27%
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
-
HighCVSS 7.5 EPSS 0.83%
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint com...
-
MediumCVSS 6.4 EPSS 0.37%
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization...
-
MediumCVSS 5.4 EPSS 0.40%
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated at...
-
MediumCVSS 6.4 EPSS 0.30%
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations pos...
-
HighCVSS 8.8 EPSS 0.32%
The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation in all versions up to, and including, 2.9.8. This is due to missing capability checks in the ajax_refresh_nonce and ak_admin_ajax handlers b...
-
HighCVSS 8.1 EPSS 0.66%
The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 7.16.2 via the convert_palette_images_to_truecolor() function. This is due to insufficient file type validation before processing u...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.