WordPress vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
805 matching records
- Critical9.8The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.Patch nowKEVEPSS 0.44%Oct 16, 2026
- Unknownninjaforms ninja_forms Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.35%Oct 15, 2026
- Critical9.8The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.Patch nowKEVEPSS 0.29%Oct 15, 2026
- High7.1Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode AttributePatch nowKEVEPSS 0.15%Oct 15, 2026
- UnknownExternal Control of File Name or PathPatch nowKEVEPSS 0.37%Oct 15, 2026
- High8.1Improper AuthenticationPatch nowKEVEPSS 0.43%Oct 15, 2026
- Critical9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_valuePatch nowKEVEPSS 0.45%Oct 13, 2026
- Unknownwpusermanager wp_user_manager Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 2.73%Oct 13, 2026
- Unknownthimpress learnpress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.28%Oct 13, 2026
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.46%Oct 13, 2026
- UnknownThemeum tutor_lms Deserialization of Untrusted DataPatch nowKEVEPSS 1.07%Oct 13, 2026
- UnknownImproper Privilege ManagementPatch nowKEVEPSS 0.64%Oct 13, 2026
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 1.56%Oct 13, 2026
- UnknownMissing AuthorizationPatch nowKEVEPSS 0.39%Oct 13, 2026
- Unknownservmask all-in-one_wp_migration Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 1.43%Oct 13, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.96%Oct 13, 2026
- UnknownAuthorization Bypass Through User-Controlled KeyPatch nowKEVEPSS 0.60%Oct 13, 2026
- UnknownWPDeveloper essential_addons_for_elementor Improper Privilege ManagementPatch nowKEVEPSS 0.38%Oct 13, 2026
- Unknownw3eden download_manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.30%Oct 13, 2026
- Unknownweplugins wp_maps Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.53%Oct 13, 2026
- Unknownincsub forminator Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 6.14%Oct 13, 2026
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.29%Oct 13, 2026
- UnknownMissing AuthorizationPatch nowKEVEPSS 0.71%Oct 13, 2026
- UnknownMissing AuthorizationPatch nowKEVEPSS 0.30%Oct 13, 2026
- Unknownninjaforms ninja_forms_file_uploads Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.60%Oct 13, 2026
Page 1 of 33Next