WordPress Vulnerability Database

Search 67,843+ known security issues across 16,091 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high WP Fusion (Pro) <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter Wp Fusion · Sep 7, 2026 · CVE-2026-14444 medium Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field Email Subscribers · Sep 7, 2026 · CVE-2026-12757 medium LearnPress <= 4.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'layout_custom_css' Learnpress · Sep 7, 2026 · CVE-2026-12230 high Event Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update Event Tickets · Sep 7, 2026 · CVE-2026-3174 medium WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’ Sitepress Multilingual Cms · Sep 7, 2026 · CVE-2026-17509 high EDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter Edd Products Feed Pro · Sep 7, 2026 · CVE-2026-9331 medium Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter Zephyr Project Manager · Sep 7, 2026 · CVE-2026-76931 high Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode Live Composer Page Builder · Sep 7, 2026 · CVE-2026-16502 medium Beaver Builder Page Builder <= 2.10.3.1 - Unauthenticated Arbitrary Shortcode Execution Beaver Builder Lite Version · Sep 7, 2026 · CVE-2026-18021 medium Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update Bookly Responsive Appointment Booking Tool · Sep 7, 2026 · CVE-2026-2520 medium Otter Blocks <= 3.1.7 - Missing Authorization to Unauthenticated Purchase Verification Bypass Otter Blocks · Sep 6, 2026 · CVE-2026-4945 high User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field Profile Builder · Sep 6, 2026 · CVE-2026-6431

Browse plugins

16,091 tracked
Woo Extra Cost 1 Woo Extra Flat Rate 2 Woo Fattureincloud 2 Woo File Dropzone 1 Woo Fiscalita Italiana 2 Woo Floating Cart Lite 3 Woo Gerencianet Official 3 Woo Gift Cards Lite 14 Woo Gift Product 2 Woo Giftcards 1 Woo Gutenberg Products Block 10 Woo Idpay Gateway 1 Woo Inpost 1 Woo Inquiry 2 Woo Jtl Connector 1 Woo Line Notify 1 Woo Login Redirect 2 Woo Lucky Wheel 2 Woo Mailerlite 8 Woo Manage Fraud Orders 2 Woo Merchantx 3 Woo Min Max Quantity Step Control Single 1 Woo Mini Cart Drawer 1 Woo Moneybird 1 Woo Mstoreapp Mobile App 1 Woo Multi Currency 7 Woo Myghpay Payment Gateway 1 Woo Nmi Three Step 1 Woo One Click Upsell Funnel 1 Woo Order Export Lite 19 Woo Order Notes 2 Woo Order Splitter 4 Woo Orders Tracking 3 Woo Oscommerce Sync 3 Woo Parcel Pro 3 Woo Paylate 1 Woo Payment Bkash 1 Woo Payment Gateway 1 Woo Payment Gateway For Piraeus Bank 3 Woo Payment Gateway Paysera 2 Woo Paypal Gateway 3 Woo Payrexx Gateway 1 Woo Pdf Invoice Builder 22 Woo Pdf Invoices Bulk Download 2 Woo Pensopay 1 Woo Permalink Manager 3 Woo Point Of Sale 2 Woo Point Of Salepos 1 Woo Poly Integration 1 Woo Popup 1 Woo Preview Emails 4 Woo Pricing Table 2 Woo Product Attachment 3 Woo Product Bundle 3 Woo Product Carousel Slider And Grid Ultimate 13 Woo Product Category Discount 2 Woo Product Design 3 Woo Product Enquiry 1 Woo Product Excel Importer 1 Woo Product Feed Pro 9

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free