WordPress Vulnerability Database

Search 67,880+ known security issues across 16,100 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Hostgator · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Module Data · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Crazy Domains · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Bluehost Wordpress Plugin · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Web · Sep 8, 2026 · CVE-2026-80099 high YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user Yith Woocommerce Waiting List Premium · Sep 8, 2026 · CVE-2026-14359 high Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter Gdpr Cookie Consent · Sep 8, 2026 · CVE-2026-14989 medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Mycred · Sep 8, 2026 · CVE-2026-17149 medium Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption Wp Event Solution · Sep 8, 2026 · CVE-2026-15398 medium WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter Wp Product Feed Manager · Sep 8, 2026 · CVE-2026-19778 high PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant Capability Manager Enhanced · Sep 8, 2026 · CVE-2026-75927 medium Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Checkout Custom Fields Builder For Woocommerce · Sep 8, 2026 · CVE-2026-19802

Browse plugins

16,100 tracked
Wp Sri 1 Wp Stacker 1 Wp Staging 14 Wp Staging Pro 10 Wp Stateless 2 Wp Statistics 130 Wp Stats 3 Wp Stats Dashboard 1 Wp Stats Manager 28 Wp Sticky Side Buttons 1 Wp Sticky Social 1 Wp Store Locator 2 Wp Store Locator Extenders 1 Wp Storymap 4 Wp Strava 1 Wp Stripe Checkout 3 Wp Stripe Donation 12 Wp Stripe Express 1 Wp Structured Data Schema 3 Wp Structuring Markup 1 Wp Subscribe 2 Wp Subscription Forms 6 Wp Subscription Forms Pro 1 Wp Subtitle 4 Wp Super Cache 34 Wp Super Edit 2 Wp Super Minify 1 Wp Super Popup 2 Wp Superb Slideshow 1 Wp Supersized 1 Wp Support Plus Responsive Ticket System 34 Wp Survey And Poll 4 Wp Survey And Quiz Tool 2 Wp Survey Plus 1 Wp Svg 1 Wp Svg Images 2 Wp Svg Upload 1 Wp Swimteam 1 Wp Symposium 32 Wp Symposium Pro 2 Wp Sync For Notion 1 Wp Syntax 2 Wp System 2 Wp System Info 1 Wp System Log 1 Wp T Wap 1 Wp Tab Widget 1 Wp Tabber Widget 4 Wp Table 4 Wp Table Builder 28 Wp Table Editor 2 Wp Table Manager 6 Wp Table Reloaded 2 Wp Tactical Popup 1 Wp Tao 1 Wp Tarteaucitron Js Self Hosted 1 Wp Taxonomy Import 1 Wp Team Manager 7 Wp Team Showcase And Slider 3 Wp Tell A Friend Popup Form 4

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free