WordPress Vulnerability Database

Search 67,880+ known security issues across 16,100 plugins and 2,157 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Hostgator · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Module Data · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Crazy Domains · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Bluehost Wordpress Plugin · Sep 8, 2026 · CVE-2026-80099 high Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret Wp Plugin Web · Sep 8, 2026 · CVE-2026-80099 high YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user Yith Woocommerce Waiting List Premium · Sep 8, 2026 · CVE-2026-14359 high Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter Gdpr Cookie Consent · Sep 8, 2026 · CVE-2026-14989 medium myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute Mycred · Sep 8, 2026 · CVE-2026-17149 medium Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.22 - Authenticated (Subscriber+) Missing Authorization to Order Completion / Free Ticket Redemption Wp Event Solution · Sep 8, 2026 · CVE-2026-15398 medium WPMR Google Feed Manager for WooCommerce <= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter Wp Product Feed Manager · Sep 8, 2026 · CVE-2026-19778 high PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant Capability Manager Enhanced · Sep 8, 2026 · CVE-2026-75927 medium Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter Checkout Custom Fields Builder For Woocommerce · Sep 8, 2026 · CVE-2026-19802

Browse plugins

16,100 tracked
Zapier 2 Zara 4 1 Zarinpal Paid Downloads 3 Zarinpal Woocommerce Payment Gateway 2 Zartis Job Plugin 1 Zarzadzanie Kontem 1 Zawgyi Embed 1 Zd Scribd Ipaper 1 Zd Youtube Flv Player 1 Zdstats 1 Zedity 1 Zeenshare 1 Zegen Core 2 Zelist Directory 1 Zem Stl Viewer 1 Zemanta 1 Zen Mobile App Native 2 Zen Social Sticky 1 Zendesk 2 Zendesk Help Center 1 Zendrop Dropshipping And Fulfillment 4 Zengo Custom Thumbnail Image 1 Zeno Font Resizer 1 Zenost Shortcodes 1 Zenphotopress 1 Zephyr Modern Admin Theme 1 Zephyr Project Manager 46 Zero Bs Accounting 1 Zero Bs Crm 18 Zero Spam 16 Zerobounce 1 Zhina Twitter Widget 1 Zielke Design Project Gallery 1 Zigaform Calculator Cost Estimation Form Builder Lite 6 Zigaform Form Builder Lite 2 Ziggeo 2 Ziina 1 Zij Kart 1 Zikzag Core 1 Zingaya Click To Call 1 Zingiri Forum 1 Zingiri Tickets 1 Zingiri Web Shop 2 Zionbuilder 2 Zip Attachments 3 Zip Code Based Content Protection 3 Zip Codes Redirect 2 Zip Recipes 11 Ziplist Recipe Plugin 1 Zippy 10 Zita Site Library 4 Ziteboard Online Whiteboard 1 Zlick Paywall 1 Zm Ajax Login Register 3 Zm Gallery 1 Zmseo 1 Znajdz Prace Z Pracapl 1 Zoho Campaigns 4 Zoho Crm Forms 13 Zoho Flow 6

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free