CVEs we hold for Wordpress
Records whose assigning authority named Wordpress as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-74013WordPress eShipper Commerce plugin <= 2.16.13 - SQL Injection vulnerabilityWordPress.com eShipper Commerce
CVE-2026-6320Salon Booking System – Free Version <= 10.30.25 - Unauthenticated Arbitrary File Read via Booking File Field Path…wordpresschef Salon Booking System – Free Version
CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionWordPress
CVE-2026-56040WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerabilityWordPress.com Gutenverse Form
CVE-2026-56039WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress.com Quick Interest Slider
CVE-2026-45293WordPress Coding Standards (WordPressCS) contains an arbitrary code execution vulnerabilityWordPress-Coding-Standards
CVE-2026-3906WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST APIWordPress
CVE-2026-25334WordPress Salon Booking System Pro plugin < 10.30.12 - Account Takeover vulnerabilitywordpresschef Salon Booking System Pro
CVE-2026-15070Salon Booking System <= 10.30.32 - Cross-Site Request Forgery to Remote Code Execution via 'value' Parameterwordpresschef Salon Booking System – Free Version
CVE-2025-8492Salon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Executionwordpresschef Salon Booking System – Free Version
CVE-2025-64253WordPress Health Check & Troubleshooting plugin <= 1.7.1 - Path Traversal vulnerabilityWordPress.org Health Check & Troubleshooting
CVE-2025-32295WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerabilitywordpresschef Salon Booking Pro
CVE-2025-0627AI Autotagger < 3.30.0 - Admin+ Stored XSSUnknown WordPress Tag, Category, and Taxonomy Manager
CVE-2024-8968MaxButtons < 9.8.1 - Admin+ Stored XSS via Text ColorUnknown WordPress Button Plugin MaxButtons
CVE-2024-8243Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRFUnknown WordPress/Plugin Upgrade Time Out Plugin
CVE-2024-6494WordPress File Upload < 4.24.8 - Unauthenticated Stored XSSUnknown WordPress File Upload
CVE-2024-6307WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML APIWordPress
CVE-2024-56022WordPress Preloader by WordPress Monsters plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress Monsters
CVE-2024-4468Salon booking system <= 9.9 - Missing Authorizationwordpresschef Salon Booking System – Free Version
CVE-2024-4442Salon booking system <= 9.9 - Unauthenticated Arbitrary File Deletionwordpresschef Salon Booking System – Free Version
CVE-2024-3978WordPress Jitsi Shortcode <= 0.1 - Contributor+ Stored XSS via ShortcodeUnknown WordPress Jitsi Shortcode
CVE-2024-37218WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerabilityWordPress Page Builder Sandwich Team Page Builder Sandwich…
CVE-2024-3229Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Uploadwordpresschef Salon Booking System – Free Version
CVE-2024-3026WordPress Button Plugin MaxButtons < 9.7.8 - Editor+ Stored XSSUnknown WordPress Button Plugin MaxButtons
CVE-2024-13889WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injectionwordpressdotorg WordPress Importer
CVE-2024-13220Google Map Professional <= 1.0 - Reflected XSSUnknown WordPress Google Map Professional (Map In Your…
CVE-2024-10555MaxButtons < 9.8.1 - Admin+ Stored XSS via Button WidthUnknown WordPress Button Plugin MaxButtons
CVE-2023-6385WordPress Ping Optimizer <= 2.35.1.3.0 - Log Clearing via CSRFUnknown WordPress Ping Optimizer
CVE-2023-5738WordPress Backup & Migration < 1.4.5 - Subscriber+ Stored XSSUnknown WordPress Backup & Migration
CVE-2023-5737WordPress Backup & Migration < 1.4.4 - Subscriber+ Plugin Settings UpdateUnknown WordPress Backup & Migration
CVE-2023-5692WordPress Core <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalinkWordPress
CVE-2023-54333Social-Share-Buttons 2.2.3 - SQL Injection via project_id ParameterWordpress Social-Share-Buttons
CVE-2023-5209Bookly < 22.5 - Admin+ Stored XSSUnknown WordPress Online Booking and Scheduling Plugin
CVE-2023-4836WordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDORUnknown WordPress File Sharing Plugin
CVE-2023-4811WordPress File Upload < 4.23.3 - Author+ Stored Cross-Site ScriptingUnknown WordPress File Upload
CVE-2023-38000Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links BlockWordPress.org WordPress; Gutenberg Team Gutenberg
CVE-2023-3427Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via…wordpresschef Salon Booking System – Free Version
CVE-2023-3211WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL InjectionUnknown WordPress Database Administrator
CVE-2023-3155NextGEN Gallery < 3.39 - Admin+ Arbitrary File Read and DeleteUnknown WordPress Gallery Plugin
CVE-2023-22713WordPress Gutenberg Blocks by WordPress Download Manager Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)WordPress Download Manager
CVE-2023-1425Groundhogg Contacts < 2.7.9.4 - Admin+ SQLiUnknown WordPress CRM, Email & Marketing Automation for…
CVE-2023-0911Shortcodes Ultimate < 5.12.8 - Subscriber+ User Meta DisclosureUnknown WordPress Shortcodes Plugin — Shortcodes Ultimate
CVE-2023-0890Shortcodes Ultimate < 5.12.8 - Subscriber+ Arbitrary Post AccessUnknown WordPress Shortcodes Plugin — Shortcodes Ultimate
CVE-2022-4973WordPress Core < 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via use of the_meta(); functionWordPress
CVE-2022-47174WordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)WordPress Performance Team Performance Lab
CVE-2022-4672WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via ShortcodeUnknown WordPress Simple Shopping Cart
CVE-2022-4466WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSSUnknown WordPress Infinite Scroll
CVE-2022-4320WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSSUnknown WordPress Events Calendar Plugin
CVE-2022-4142WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSSUnknown WordPress Filter Gallery Plugin
CVE-2022-3254AWP Classifieds Plugin < 4.3 - Unauthenticated SQLiUnknown WordPress Classifieds Plugin – Ad Directory &…
CVE-2022-2398WP Comments Fields < 4.1 - Admin+ Stored Cross-Site ScriptingUnknown WordPress Comments Fields
CVE-2022-1591WordPress Ping Optimizer < 2.35.1.3.0 - Arbitrary Settings Update via CSRFUnknown WordPress Ping Optimizer
CVE-2022-1585Project Source Code Download <= 1.0.0 - Unauthenticated Backup DownloadUnknown WordPress project source code download
CVE-2022-1028WordPress Security < 4.2.1 - Admin+ Stored Cross-Site ScriptingUnknown WordPress Security – Firewall, Malware Scanner…
CVE-2022-0503Multisite Content Copier/Updater < 2.1.2 - Reflected Cross-Site ScriptingUnknown WordPress Multisite Content Copier/Updater
CVE-2022-0445WordPress Real Cookie Banner < 2.14.2 - Settings Reset via CSRFUnknown WordPress Real Cookie Banner: GDPR (DSGVO) &…
CVE-2022-0220WordPress GDPR & CCPA < 1.9.27 - Unauthenticated Reflected Cross-Site ScriptingUnknown WordPress GDPR
CVE-2021-42362WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File UploadWordPress Popular Posts
CVE-2021-39203Private data disclosure/privilege escalation through the block editor in Wordpresswordpress-develop
CVE-2021-39202WordPress 5.8 beta: Stored Cross-Site Scripting (XSS) vulnerability in widgetwordpress-develop
CVE-2021-38359WordPress InviteBox Plugin <= 1.4.1 Reflected Cross-Site ScriptingWordPress InviteBox Plugin
CVE-2021-29450WordPress Authenticated disclosure of password-protected posts and pageswordpress-develop
CVE-2021-29447WordPress Authenticated XXE attack when installation is running PHP 8wordpress-develop
CVE-2021-25039Multisite Content Copier/Updater < 2.1.0 - Reflected Cross-Site ScriptingUnknown WordPress Multisite Content Copier/Updater
CVE-2021-25038Multisite User Sync/Unsync < 2.1.2 - Reflected Cross-Site ScriptingUnknown WordPress Multisite User Sync/Unsync
CVE-2021-24969Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site ScriptingUnknown WordPress Download Manager
CVE-2021-24962WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCEUnknown WordPress File Upload Pro
CVE-2021-24961WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeUnknown wordpress-file-upload-pro
CVE-2021-24960WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVGUnknown wordpress-file-upload-pro
CVE-2021-24930Bookly < 20.3.1 - Staff Member Stored Cross-Site ScriptingUnknown WordPress Online Booking and Scheduling Plugin –…
CVE-2021-24773WordPress Download Manager < 3.2.16 - Admin+ Stored Cross-Site ScriptingUnknown WordPress Download Manager
CVE-2021-24744WordPress Contact Forms by Cimatti < 1.4.12 - Admin+ Stored Cross-Site ScriptingUnknown WordPress Contact Forms by Cimatti
CVE-2021-24684PDF Light Viewer < 1.4.12 - Authenticated Command InjectionUnknown WordPress PDF Light Viewer Plugin
CVE-2021-24640Gutenslider < 5.2.0 - Contributor+ Stored XSSUnknown WordPress Slider Block Gutenslider
CVE-2021-24623WordPress Advanced Ticket System < 1.0.64 - Authenticated Stored Cross-Site Scripting (XSS)Unknown WordPress Advanced Ticket System, Elite Support…
CVE-2021-24620Simple eCommerce <= 2.2.5 - Arbitrary File UploadUnknown WordPress Simple Ecommerce Shopping Cart Plugin-…
CVE-2021-24525Shortcodes Ultimate < 5.10.2 - Contributor+ Stored XSSUnknown WordPress Shortcodes Plugin — Shortcodes Ultimate
CVE-2021-24403WordPress Page Contact <= 1.0 - Authenticated (editor+) SQL InjectionUnknown WordPress Page Contact
CVE-2021-24392WordPress Membership SwiftCloud.io <= 1.0 - Authenticated SQL InjectionUnknown WordPress Membership SwiftCloud.io
CVE-2021-24390Alipay <= 3.7.2 - Authenticated SQL InjectionUnknown WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件
CVE-2021-24211WordPress Related Posts <= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS)Unknown WordPress Related Posts
CVE-2021-24155Backup Guard < 1.6.0 - Authenticated Arbitrary File UploadUnknown WordPress Backup and Migrate Plugin – Backup Guard
CVE-2020-4050set-screen-option filter misuse by plugins leading to privilege escalation in WordPresswordpress-develop
146 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.