WordPress Vulnerability Database

Search 67,676+ known security issues across 16,066 plugins and 2,156 themes. Find a plugin to see its vulnerabilities and affected versions.

WordPress Core vulnerabilities →

Recently disclosed

medium Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function Easy Waveform Player · Sep 1, 2026 · CVE-2025-7963 high Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log Broken Link Checker · Sep 1, 2026 · CVE-2026-75528 medium Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter Divi · Sep 1, 2026 · CVE-2026-3850 critical SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field Sigmaforms Pro · Sep 1, 2026 · CVE-2026-78657 high DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter Devkit · Sep 1, 2026 · CVE-2026-14357 medium Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode Divi · Sep 1, 2026 · CVE-2026-3851 high WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter Wp File Download · Sep 1, 2026 · CVE-2026-14982 high Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion Gravityforms · Sep 1, 2026 · CVE-2026-19513 critical Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId' Ameliabooking · Sep 1, 2026 · CVE-2026-9055 critical Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter Nokri · Aug 31, 2026 · CVE-2026-18550 medium WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter Js Composer · Aug 31, 2026 · CVE-2026-15101 high Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter Usc E Shop · Aug 31, 2026 · CVE-2026-19914

Browse plugins

16,066 tracked
Epeken All Kurir 4 Epermissions 2 Epic Bootstrap Buttons 1 Epic Review 2 Epicwin Subscribers 1 Epoll Wp Voting 3 Eprolo Dropshipping 3 Eps 301 Redirects 8 Er Swiffy Insert 1 Ere Recently Viewed 1 Ergonet Varnish Cache 1 Eri File Library 2 Erident Custom Login And Dashboard 3 Erima Zarinpal Donate 2 Erocket 1 Eroom Zoom Meetings Webinar 20 Erp 49 Erp Pro 1 Err Our Team 1 Error Log Monitor 3 Error Log Viewer 12 Error Log Viewer Wp 2 Error Notification 1 Esb Testimonials 2 Eshipper Commerce 2 Eshop 13 Eshop Magic 1 Esign Genie For Wp 1 Esri Map View 1 Essay Wizard Wpcres 1 Esselinknu Settings 1 Essential Addons Elementor 5 Essential Addons For Elementor Lite 125 Essential Blocks 62 Essential Blocks Pro 4 Essential Breadcrumbs 2 Essential Chat Support 1 Essential Content Types 1 Essential Grid 5 Essential Real Estate 32 Essential Widgets 5 Essential Wp Real Estate 3 Estatebud Properties Listings 2 Estatik 9 Estatik Mortgage Calculator 5 Estonian Shipping Methods For Woocommerce 1 Esv Bible Shortcode For Wordpress 1 Et Core Plugin 23 Etemplates 1 Ether And Erc20 Tokens Woocommerce Payment Gateway 2 Ethereum Wallet 2 Ethereumico 3 Ethiopian Calendar 1 Ethpress 1 Etruel Del Post Copies 4 Etsy Importer 1 Etsy Shop 3 Eu Cookie Law 4 Eu Vat For Woocommerce 4 Eucookielaw 1

Is your site running a vulnerable version?

A free scan detects the plugins and themes installed on your WordPress site and flags the ones with known security issues.

Scan your site free