WordPress vulnerabilities and fixes

CVEs that mention WordPress, ranked by priority. 95 tracked.

WordPress has 95 tracked vulnerabilities, 11 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 47. Most recent: 2026-10-24. Highest priority: CVE-2026-87902 (score 88/100).

• CVE-2026-87902 HIGH 8.1 EXPLOITED UPGRADE WordPress Core Remote File Inclusion Vulnerability
• CVE-2026-15748 CRITICAL 9.8 The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and in
• CVE-2023-2288 HIGH 8.8 UPGRADE The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing fi
• CVE-2026-8457 CRITICAL 9.8 The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up
• CVE-2026-109219 CRITICAL 9.8 The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_u
• CVE-2026-65553 CRITICAL 10.0 Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
• CVE-2026-115806 CRITICAL 9.8 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versi
• CVE-2023-28663 HIGH 8.8 UPGRADE The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnera
• CVE-2026-11801 HIGH 7.5 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions
• CVE-2026-14488 CRITICAL 9.1 The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatc
• CVE-2014-125134 HIGH 7.5 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated a
• CVE-2026-55826 HIGH 8.7 The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites
• CVE-2026-115497 HIGH 7.5 The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all version
• CVE-2026-59549 CRITICAL 9.3 Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
• CVE-2026-66447 CRITICAL 9.3 Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
• CVE-2025-48089 CRITICAL 9.3 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rainbow-
• CVE-2026-14270 HIGH 8.8 The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is
• CVE-2014-125133 HIGH 7.5 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthentica
• CVE-2026-110956 CRITICAL 9.8 The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor b
• CVE-2016-20100 HIGH 7.5 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allow
• CVE-2025-48090 HIGH 8.1 Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP
• CVE-2015-20124 HIGH 7.5 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows
• CVE-2016-20101 HIGH 8.1 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthen
• CVE-2026-82814 HIGH 8.8 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions
• CVE-2026-94267 CRITICAL 9.0 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
• CVE-2017-20287 HIGH 7.5 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated
• CVE-2022-51021 HIGH 8.2 NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability
• CVE-2026-59531 HIGH 7.5 Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions.
• CVE-2012-20002 HIGH 7.5 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allow
• CVE-2015-20123 HIGH 7.5 Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauth
• CVE-2015-20125 HIGH 7.5 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauth
• CVE-2017-20289 HIGH 7.5 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability t
• CVE-2016-20103 HIGH 7.5 Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated a
• CVE-2023-28665 MEDIUM 5.4 UPGRADE The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripti
• CVE-2026-65500 HIGH 7.5 Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <=
• CVE-2026-94268 HIGH 8.1 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
• CVE-2026-104068 HIGH 7.2 JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability th
• CVE-2026-109198 HIGH 7.2 The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cros
• CVE-2026-59551 HIGH 8.5 Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions.
• CVE-2026-75091 HIGH 7.2 The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Sto
• CVE-2026-94262 HIGH 8.1 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
• CVE-2026-14237 HIGH 7.2 The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target
• CVE-2026-45293 HIGH 8.6 WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding convention
• CVE-2023-28666 MEDIUM 5.4 UPGRADE The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vuln
• CVE-2026-110018 HIGH 8.8 The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin
• CVE-2026-27377 MEDIUM 6.7 Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 version
• CVE-2026-113499 HIGH 7.5 The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to styl
• CVE-2026-113500 HIGH 7.5 The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to styl
• CVE-2026-113673 HIGH 7.2 The GeoDirectory WordPress plugin before 2.8.194 does not properly escape administrator-defined text before w
• CVE-2026-115807 HIGH 7.1 The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for Word
• CVE-2026-65564 MEDIUM 5.3 Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.
• CVE-2026-87835 MEDIUM 6.5 The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may s
• CVE-2026-109936 HIGH 7.5 The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dyna
• CVE-2026-111982 HIGH 7.2 The User Profile Builder WordPress plugin before 4.0.5 does not verify that a user is authorized to edit the
• CVE-2026-16094 MEDIUM 4.9 The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to
• CVE-2026-65511 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress The
• CVE-2026-66705 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
• CVE-2026-73351 HIGH 7.1 Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.
• CVE-2026-112207 HIGH 7.1 The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to t
• CVE-2026-109933 MEDIUM 6.8 The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styl
• CVE-2026-111966 MEDIUM 6.8 The User Profile Builder WordPress plugin before 4.0.5 does not sanitise and escape one of its shortcode attr
• CVE-2026-94264 MEDIUM 6.8 The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO Wor
• CVE-2026-105199 MEDIUM 6.8 The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in on
• CVE-2026-109934 MEDIUM 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readab
• CVE-2026-113490 MEDIUM 5.3 The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when renderin
• CVE-2026-113492 MEDIUM 5.3 The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when l
• CVE-2026-113493 MEDIUM 6.8 The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attri
• CVE-2026-114429 MEDIUM 6.8 The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content
• CVE-2026-65522 MEDIUM 6.5 Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <
• CVE-2026-107907 MEDIUM 6.5 The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling
• CVE-2026-113491 MEDIUM 6.4 The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it
• CVE-2026-94263 MEDIUM 4.8 The Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO WordPress plugins from 0.9.2.4 t
• CVE-2026-96563 MEDIUM 6.4 The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Si
• CVE-2012-20003 MEDIUM 6.1 Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that a
• CVE-2012-20004 MEDIUM 6.1 K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows u
• CVE-2012-20005 MEDIUM 6.1 SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allo
• CVE-2014-125132 MEDIUM 6.1 Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that al
• CVE-2023-54413 MEDIUM 6.1 WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerabilit
• CVE-2026-109935 MEDIUM 5.3 The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a publis
• CVE-2022-45846 MEDIUM 5.4 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image
• CVE-2026-112219 MEDIUM 4.9 The Download Monitor WordPress plugin before 5.3.5 does not correctly restrict management of the list of files
• CVE-2026-111738 MEDIUM 5.5 The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an
• CVE-2026-111965 MEDIUM 4.3 The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all co
• CVE-2026-113472 MEDIUM 5.4 The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files
• CVE-2026-97353 MEDIUM 5.4 The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership chec
• CVE-2026-113674 LOW 3.7 The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by
• CVE-2026-107887 MEDIUM 5.4 The Advanced Twenty Seventeen WordPress plugin through 1.3.1 does not perform any capability or nonce check on
• CVE-2026-112230 LOW 3.7 The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup c
• CVE-2026-114570 MEDIUM 4.9 WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and includin
• CVE-2026-113489 MEDIUM 4.3 The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the
• CVE-2026-97352 MEDIUM 4.3 The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of
• CVE-2026-110537 LOW 3.8 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may ma
• CVE-2026-111737 LOW 3.5 The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before out
• CVE-2026-110510 LOW 3.5 The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of so
• CVE-2026-113501 LOW 3.1 The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dism

FAQ

How do I fix WordPress vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is WordPress being exploited right now?

Yes: 1 WordPress CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which WordPress CVE should I patch first?

CVE-2026-87902 currently ranks highest (88/100): WordPress Core Remote File Inclusion Vulnerability.

← Back to latest CVEs