WordPress Vulnerability Database

Search 67,880+ known security issues across 16,100 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Hostgator · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Module Data · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Crazy Domains · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Bluehost Wordpress Plugin · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Web · Sep 8, 2026 · CVE-2026-80099 high YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user Yith Woocommerce Waiting List Premium · Sep 8, 2026 · CVE-2026-14359 high Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter Gdpr Cookie Consent · Sep 8, 2026 · CVE-2026-14989 medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Mycred · Sep 8, 2026 · CVE-2026-17149 medium Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption Wp Event Solution · Sep 8, 2026 · CVE-2026-15398 medium WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter Wp Product Feed Manager · Sep 8, 2026 · CVE-2026-19778 high PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant Capability Manager Enhanced · Sep 8, 2026 · CVE-2026-75927 medium Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Checkout Custom Fields Builder For Woocommerce · Sep 8, 2026 · CVE-2026-19802

Browse plugins

16,100 tracked
Wp Website Creator 1 Wp Weixin Robot 1 Wp Whatsapp 12 Wp Whatsapp Chat 2 Wp Whois Domain 1 Wp Whydonate 3 Wp Widget Bundle 3 Wp Widget Changer 1 Wp Widgets Shortcode 1 Wp Wiki Tooltip 1 Wp With Spritz 1 Wp Wizard Cloak 2 Wp Woo Commerce Sync For G Sheet 1 Wp Woocommerce Quickbooks 3 Wp Word Count 2 Wp Worthy 1 Wp Xintaoke 1 Wp Yadisk Files 2 Wp Yandex Metrika 1 Wp Yasslideshow 1 Wp Yelp Review Slider 2 Wp Youtube Gallery 2 Wp Youtube Live 6 Wp Youtube Lyte 5 Wp Youtube Video Gallery 1 Wp Youtube Video Optimizer 1 Wp Zillow Review Slider 1 Wp01 1 Wp125 2 Wp24 Domain Check 6 Wp2Android Turn Wp Site Into Android App 1 Wp2Appir 1 Wp2Html 1 Wp2Leads 12 Wp2Speed 4 Wp2Syslog 2 Wp2Wb 1 Wp3D Model Import Block 2 Wpa Seo Auto Linker 1 Wpachievements Free 1 Wpadcenter 10 Wpadverts 21 Wpagecontact 1 Wpantiddos 1 Wpappninja 19 Wpaudio Mp3 Player 1 Wpavatar 2 Wpb Advanced Faq 1 Wpb Elementor Addons 8 Wpb Floating Menu Or Categories 1 Wpb Image Widget 1 Wpb Popup For Contact Form 7 1 Wpb Show Core 6 Wpb Woocommerce Category Slider 2 Wpbenchmark 1 Wpbits Addons For Elementor 23 Wpblast 1 Wpblogsync 2 Wpbook 1 Wpbookit 27

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free