WordPress Vulnerability Database

Search 67,880+ known security issues across 16,100 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Hostgator · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Module Data · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Crazy Domains · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Bluehost Wordpress Plugin · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Web · Sep 8, 2026 · CVE-2026-80099 high YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user Yith Woocommerce Waiting List Premium · Sep 8, 2026 · CVE-2026-14359 high Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter Gdpr Cookie Consent · Sep 8, 2026 · CVE-2026-14989 medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Mycred · Sep 8, 2026 · CVE-2026-17149 medium Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption Wp Event Solution · Sep 8, 2026 · CVE-2026-15398 medium WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter Wp Product Feed Manager · Sep 8, 2026 · CVE-2026-19778 high PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant Capability Manager Enhanced · Sep 8, 2026 · CVE-2026-75927 medium Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Checkout Custom Fields Builder For Woocommerce · Sep 8, 2026 · CVE-2026-19802

Browse plugins

16,100 tracked
Yogo Booking 2 Yolink Search 1 Yoo Bar 1 Yoo Slider 10 Yookassa 4 Yop Poll 34 Yotpo Reviews For Woocommerce 1 Yotpo Social Reviews For Woocommerce 2 Yottie Lite 1 Yotuwp Easy Youtube Embed 5 You Shang 1 Youforms Free For Copecart 1 Yougler Blogger Profile Page 2 Youmax Channel Embeds For Youtube Businesses 4 Youneeq Panel 1 Your Lightbox 2 Your Simple Svg Support 2 Your Text Manager 1 Youram Youtube Embed 2 Yourchannel 10 Yourmembers 1 Yournewsapp 2 Yourplugins Wc Conditional Cart Notices 2 Yousaytoo Auto Publishing Plugin 2 Youtube Channel 4 Youtube Channel Gallery 4 Youtube Embed 8 Youtube Embed Plus 2 Youtube Feed Pro 1 Youtube Feeder 1 Youtube Playlist Player 4 Youtube Shortcode 1 Youtube Showcase 12 Youtube Simple Gallery 1 Youtube Simplegallery 1 Youtube Speedload 1 Youtube Video Inserter 1 Youtube Video Player 3 Youtube Widget Responsive 1 Youtubefreedown 1 Youzify 28 Youzify Moderation 2 Yphplista 4 Yr Activity Link 1 Yslider 1 Yt Cookie Nonsense 1 Yt Player 10 Yummly Rich Recipes 1 Yummy Recipes 1 Yumpu Epaper Publishing 2 Yurl Retwitt 2 Yuzo Related Post 1 Z Companion 2 Z Downloads 10 Z Inventory Manager 3 Z Url Preview 1 Zajax Ajax Navigation 1 Zalo Live Chat 2 Zalo Official Live Chat 1 Zalomeni 1

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free