WordPress Vulnerability Database

Search 67,880+ known security issues across 16,100 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Hostgator · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Module Data · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Crazy Domains · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Bluehost Wordpress Plugin · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Web · Sep 8, 2026 · CVE-2026-80099 high YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user Yith Woocommerce Waiting List Premium · Sep 8, 2026 · CVE-2026-14359 high Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter Gdpr Cookie Consent · Sep 8, 2026 · CVE-2026-14989 medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Mycred · Sep 8, 2026 · CVE-2026-17149 medium Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption Wp Event Solution · Sep 8, 2026 · CVE-2026-15398 medium WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter Wp Product Feed Manager · Sep 8, 2026 · CVE-2026-19778 high PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant Capability Manager Enhanced · Sep 8, 2026 · CVE-2026-75927 medium Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Checkout Custom Fields Builder For Woocommerce · Sep 8, 2026 · CVE-2026-19802

Browse plugins

16,100 tracked
Wp Term Order 1 Wp Terms Popup 2 Wp Tesseract 1 Wp Test Email 3 Wp Testimonial Widget 6 Wp Testimonial With Widget 3 Wp Testimonials 2 Wp Testing 2 Wp Text Expander 1 Wp Text Slider Widget 1 Wp Thumb 1 Wp Thumbnail 1 Wp Thumbtack Review Slider 1 Wp Ticket 18 Wp Ticket Ultra 1 Wp Ticketbai 6 Wp Tiktok Feed 1 Wp Tiles 3 Wp Time Capsule 9 Wp Time Machine 1 Wp Time Slots Booking Form 22 Wp Timed Popup 5 Wp Timelines 6 Wp Tithely 1 Wp Tmkm Amazon 2 Wp To Buffer 1 Wp To Hootsuite 2 Wp To Twitter 1 Wp Todo 14 Wp Tools Divi Blog Carousel 1 Wp Tools Divi Product Carousel 2 Wp Tools Gravity Forms Divi Module 2 Wp Tooltip 1 Wp Top News 2 Wp Topbar 4 Wp Total Branding 1 Wp Total Hacks 1 Wp Touch Slider 1 Wp Tournament Registration 1 Wp Tradingview 1 Wp Transactions 1 Wp Translate 2 Wp Translitera 1 Wp Travel 22 Wp Travel Blocks 5 Wp Travel Engine 38 Wp Travel Pro 1 Wp Trending Post Slider And Widget 5 Wp Triggers Lite 4 Wp Tripadvisor Review Slider 7 Wp Ttisbdir 1 Wp Tweet Walls 1 Wp Twilio Core 2 Wp Twitpic 1 Wp Twitter Button 1 Wp Twitter Feed 2 Wp Twitter Mega Fan Box 1 Wp Ulike 18 Wp Ulike Pro 1 Wp Ultimate Csv Importer 65

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free