WordPress security vulnerabilities
WordPress core, plugin, and theme vulnerabilities with Wordfence, Patchstack, and WPScan coverage — plus KEV and EPSS prioritization.
Built for Website owners, agencies, and MSPs.
3,036 public records · 0 security-fix timeline events.
Version-specific security
High-intent pages for “WordPress {version} security vulnerabilities” queries.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 24
- High 126
- Medium 186
- Low 8
2026-07-21344 issues2026-10-18
WordPress source coverage
- Wordfence Intelligence
40 records
- Patchstack
14 records
- WPScan
6 records
Known exploited
View all known exploited- Critical9.3WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityPatch nowKEVEPSS 98.53%Apr 28, 2026
- Critical9.8ninjaforms ninja_forms_file_uploads Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 62.90%Apr 6, 2026
- Medium6.1wp-buy wp_content_copy_protection_\&_no_right_click URL Redirection to Untrusted Site ('Open Redirect')Patch nowKEVEPSS 53.00%May 15, 2025
- High7.5depicter depicter Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 45.75%May 5, 2025
- High8.1WordPress Core Remote File Inclusion VulnerabilityPatch nowKEVEPSS 39.98%Sep 22, 2026
- Critical9.8supsystic contact_form Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 32.78%Mar 30, 2026
- Critical9.8WPEverest user_registration_\&_membership Improper Privilege ManagementPatch nowKEVEPSS 27.99%Mar 2, 2026
- Critical9.8Unverified Password ChangePatch nowKEVEPSS 15.20%May 19, 2025
Recently published
Browse catalog- High7.1WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerabilityOpen the advisoryOct 17, 2026
- Medium5.4weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' ParameterCheck if you run itEPSS 0.28%Oct 16, 2026
- High7.2European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry HeaderCheck if you run itEPSS 0.27%Oct 16, 2026
- High7.2Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' ParameterCheck if you run itEPSS 0.28%Oct 16, 2026
- Medium6.4YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' ParameterCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium4.3Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' ParameterCheck if you run itEPSS 0.20%Oct 16, 2026
- Medium6.4xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterCheck if you run itEPSS 0.20%Oct 16, 2026
- Medium4.9Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' ParameterCheck if you run itEPSS 0.77%Oct 16, 2026
- High8.1User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart TagCheck if you run itEPSS 0.37%Oct 16, 2026
- Medium4.3User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Check if you run itEPSS 0.15%Oct 16, 2026