WordPress Vulnerability Database

Search 67,830+ known security issues across 16,089 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field Profile Builder · Sep 6, 2026 · CVE-2026-6431 medium Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing Powerkit · Sep 6, 2026 · CVE-2026-2390 high HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator Hivepress Authentication · Sep 5, 2026 · CVE-2026-18056 critical Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier Acf Frontend Form Element · Sep 5, 2026 · CVE-2026-75816 critical MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter Memberdash · Sep 5, 2026 · CVE-2026-16310 critical Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection Post Grid · Sep 4, 2026 · CVE-2024-11080 medium Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute Pods · Sep 4, 2026 · CVE-2026-76573 medium Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute Foogallery · Sep 4, 2026 · CVE-2026-85414 high Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header Contact Form By Supsystic · Sep 4, 2026 · CVE-2026-83625 medium Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter Unlimited Elements For Elementor · Sep 4, 2026 · CVE-2026-75586 medium WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter Wp File Download · Sep 4, 2026 · CVE-2026-14975 medium Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter Divi · Sep 4, 2026 · CVE-2026-3853

Browse plugins

16,089 tracked
Social Login Bws 3 Social Login Lite For Woocommerce 1 Social Login Sharing Buttons With Analytics By Soclever 1 Social Login Wp 2 Social Media Auto Publish 1 Social Media Builder 1 Social Media Buttons Toolbar 1 Social Media Engine 1 Social Media Feather 2 Social Media Links 1 Social Media Sharing 1 Social Media Shortcodes 4 Social Media Widget 10 Social Metrics 1 Social Network Tabs 1 Social Networks Auto Poster Facebook Twitter G 36 Social Photo Feed Widget 3 Social Photo Gallery 1 Social Pixel 1 Social Polls By Opinionstage 14 Social Post Embed 1 Social Profilr Display Social Network Profile 1 Social Proof Testimonials Slider 2 Social Pug 22 Social Pug Author Box 1 Social Rocket 13 Social Share And Social Locker Arsocial 6 Social Share Boost 3 Social Share Button 5 Social Share Buttons By Supsystic 6 Social Share With Floating Bar 2 Social Sharing Toolkit 6 Social Slider 1 Social Stickers 1 Social Stream Design 1 Social Streams 1 Social Tape 2 Social Testimonials And Reviews Widget 10 Social Warfare 24 Social Web Suite 1 Social2Blog 1 Socialdriver 1 Socialdriver Framework 4 Socialgrid 1 Socialmark 3 Socialsnap 2 Sodahead Polls 1 Softdiscover Db File Manager 4 Softlab Core 1 Softtemplates For Elementor 2 Software Issue Manager 3 Software License Manager 4 Sogrid 3 Soisy Pagamento Rateale 1 Soj Soundslides 1 Sola Newsletters 1 Sola Support Tickets 2 Sola Testimonials 2 Solace Extra 14 Solar Wizard Lite 1

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free