WordPress Vulnerability Database

Search 67,880+ known security issues across 16,100 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Hostgator · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Module Data · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Crazy Domains · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Bluehost Wordpress Plugin · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Web · Sep 8, 2026 · CVE-2026-80099 high YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user Yith Woocommerce Waiting List Premium · Sep 8, 2026 · CVE-2026-14359 high Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter Gdpr Cookie Consent · Sep 8, 2026 · CVE-2026-14989 medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Mycred · Sep 8, 2026 · CVE-2026-17149 medium Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption Wp Event Solution · Sep 8, 2026 · CVE-2026-15398 medium WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter Wp Product Feed Manager · Sep 8, 2026 · CVE-2026-19778 high PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant Capability Manager Enhanced · Sep 8, 2026 · CVE-2026-75927 medium Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Checkout Custom Fields Builder For Woocommerce · Sep 8, 2026 · CVE-2026-19802

Browse plugins

16,100 tracked
Wp Ultimate Email Marketer 3 Wp Ultimate Exporter 22 Wp Ultimate Map 1 Wp Ultimate Post Grid 4 Wp Ultimate Recipe 1 Wp Ultimate Review 17 Wp Ultimate Reviews Free 1 Wp Ultimate Search 1 Wp Ultra Simple Paypal Shopping Cart 1 Wp Unique Article Header Image 1 Wp Update Mail Notification 1 Wp Upg 3 Wp Upload Files Anywhere 2 Wp Upload Restriction 6 Wp Url Shortener 2 Wp User 3 Wp User Avatar 92 Wp User Control 1 Wp User Extra Fields 16 Wp User Frontend 47 Wp User Frontend Pro 2 Wp User Groups 1 Wp User Manager 15 Wp User Merger 3 Wp User Profile Avatar 5 Wp User Profiles 2 Wp User Stylesheet Switcher 1 Wp User Switch 2 Wp Useronline 4 Wp Users Disable 1 Wp Users Exporter 1 Wp Users Masquerade 1 Wp Users Media 4 Wp Vault 1 Wp Vertical Gallery 1 Wp Vertical Image Slider 4 Wp Video Gallery Free 1 Wp Video Lightbox 18 Wp Video Playlist 2 Wp Video Posts 4 Wp Video Robot 6 Wp Viewstl 2 Wp Vipergb 6 Wp Visited Countries Reloaded 1 Wp Visual Adverts 1 Wp Visual Sitemap 1 Wp Visual Slidebox Builder 1 Wp Vk 4 Wp Voting 1 Wp Voting Contest 6 Wp Vr View 1 Wp W3All Phpbb Integration 4 Wp Wall 1 Wp Walla 1 Wp Wallcreeper 1 Wp Wc Affiliate Program 1 Wp Webauthn 6 Wp Webcam Widget Shortcode 1 Wp Webhooks 3 Wp Webinarsystem 20

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free