Vulnocalypse
Back to feed

WordPress vulnerabilities

Every WordPress vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for WordPress alerts.

WordPress RSS feed

  1. 70impact

    Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Upload via 'temporaryFileUploads' Parameter

    WordPress CVE-2026-85097
    Exploited in the wild0 news outlets1 CERTs0 researchersCVSS 9.8
  2. 36impact

    WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-42711
    0 news outlets0 CERTs0 researchersCVSS 7.1
  3. 40impact

    WordPress Boutique theme <= 2.3.3 - Local File Inclusion vulnerability

    WordPress CVE-2026-62099
    0 news outlets0 CERTs0 researchersCVSS 8.1
  4. 46impact

    WordPress Booster for WooCommerce plugin <= 8.4.0 - PHP Object Injection vulnerability

    WordPress CVE-2026-42718
    0 news outlets0 CERTs0 researchersCVSS 9.8
  5. 38impact

    WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability

    WordPress CVE-2026-42705
    0 news outlets0 CERTs0 researchersCVSS 7.5
  6. 31impact

    WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-94668
    0 news outlets0 CERTs0 researchersCVSS 7.1
  7. 38impact

    Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

    WordPress CVE-2026-96667
    0 news outlets0 CERTs0 researchersCVSS 7.2
  8. 41impact

    WordPress Cardea theme <= 2.3 - Local File Inclusion vulnerability

    WordPress CVE-2026-62065
    0 news outlets0 CERTs0 researchersCVSS 8.1
  9. 39impact

    WordPress Salevo plugin <= 1.3.0 - Content Injection vulnerability

    WordPress CVE-2026-103081
    0 news outlets0 CERTs0 researchersCVSS 7.5
  10. 31impact

    WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-96339
    0 news outlets0 CERTs0 researchersCVSS 7.1
  11. 31impact

    WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

    WordPress CVE-2026-105883
    0 news outlets0 CERTs0 researchersCVSS 7.1
  12. 44impact

    click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update

    WordPress CVE-2026-84251
    0 news outlets0 CERTs0 researchersCVSS 9.8
  13. 46impact

    WordPress Invetex theme <= 2.18 - PHP Object Injection vulnerability

    WordPress CVE-2026-62123
    0 news outlets0 CERTs0 researchersCVSS 9.8
  14. 40impact

    Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters

    WordPress CVE-2026-103366
    0 news outlets0 CERTs0 researchersCVSS 7.5
  15. 31impact

    WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-107867
    0 news outlets0 CERTs0 researchersCVSS 7.1
  16. 45impact

    ShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter

    WordPress CVE-2026-103367
    0 news outlets0 CERTs0 researchersCVSS 8.1
  17. 40impact

    WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    WordPress CVE-2026-96341
    0 news outlets0 CERTs0 researchersCVSS 8.2
  18. 36impact

    WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-42699
    0 news outlets0 CERTs0 researchersCVSS 7.1
  19. 46impact

    WordPress ShiftCV theme <= 3.0.14 - PHP Object Injection vulnerability

    WordPress CVE-2026-66564
    0 news outlets0 CERTs0 researchersCVSS 9.8
  20. 44impact

    Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup

    WordPress CVE-2026-86717
    0 news outlets0 CERTs0 researchersCVSS 9.1
  21. 18impact

    Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions

    WordPress CVE-2026-110191
    0 news outlets0 CERTs0 researchersCVSS 2.7
  22. 43impact

    click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications

    WordPress CVE-2026-84261
    0 news outlets0 CERTs0 researchersCVSS 8.8
  23. 31impact

    WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-94059
    0 news outlets0 CERTs0 researchersCVSS 7.1
  24. 42impact

    LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter

    WordPress CVE-2026-87781
    0 news outlets0 CERTs0 researchersCVSS 8.6
  25. 31impact

    WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-94632
    0 news outlets0 CERTs0 researchersCVSS 7.1
  26. 43impact

    Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

    WordPress CVE-2026-104745
    0 news outlets0 CERTs0 researchersCVSS 8.1
  27. 36impact

    WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-62100
    0 news outlets0 CERTs0 researchersCVSS 7.1
  28. 48impact

    WordPress Dynamic User Directory plugin <= 2.4 - PHP Object Injection vulnerability

    WordPress CVE-2026-42719
    0 news outlets0 CERTs0 researchersCVSS 9.8
  29. 37impact

    PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' Parameter

    WordPress CVE-2026-3712
    0 news outlets0 CERTs0 researchersCVSS 7.3
  30. 43impact

    Fundiin <= 3.4.0 - Unauthenticated Payment Gateway Settings Update and Credential Disclosure

    WordPress CVE-2026-81649
    0 news outlets0 CERTs0 researchersCVSS 9.1
  31. 36impact

    WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-62027
    0 news outlets0 CERTs0 researchersCVSS 7.1
  32. 38impact

    Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

    WordPress CVE-2026-96570
    0 news outlets0 CERTs0 researchersCVSS 7.2
  33. 46impact

    WordPress Law Office theme <= 3.20 - PHP Object Injection vulnerability

    WordPress CVE-2026-62120
    0 news outlets0 CERTs0 researchersCVSS 9.8
  34. 47impact

    WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

    WordPress CVE-2026-104803
    0 news outlets0 CERTs0 researchersCVSS 9.8
  35. 42impact

    Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook

    WordPress CVE-2026-88903
    0 news outlets0 CERTs0 researchersCVSS 8.8
  36. 31impact

    WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-94170
    0 news outlets0 CERTs0 researchersCVSS 7.1
  37. 44impact

    WordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability

    WordPress CVE-2026-62031
    0 news outlets0 CERTs0 researchersCVSS 9.3
  38. 42impact

    Loja Automática <= 1.0.0 - Unauthenticated SQLi via 'id' Parameter

    WordPress CVE-2026-89297
    0 news outlets0 CERTs0 researchersCVSS 8.6
  39. 47impact

    MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter

    WordPress CVE-2026-109515
    0 news outlets0 CERTs0 researchersCVSS 9.8
  40. 38impact

    WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

    WordPress CVE-2026-96336
    0 news outlets0 CERTs0 researchersCVSS 7.5
  41. 38impact

    Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter

    WordPress CVE-2026-107751
    0 news outlets0 CERTs0 researchersCVSS 7.2
  42. 46impact

    WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

    WordPress CVE-2026-93942
    0 news outlets0 CERTs0 researchersCVSS 9.8
  43. 48impact

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

    WordPress CVE-2026-103768
    0 news outlets0 CERTs0 researchersCVSS 9.8
  44. 34impact

    WordPress Leyka plugin <= 3.32.3 - SQL Injection vulnerability

    WordPress CVE-2026-42717
    0 news outlets0 CERTs0 researchersCVSS 7.6
  45. 36impact

    Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter

    WordPress CVE-2026-91829
    0 news outlets0 CERTs0 researchersCVSS 7.1
  46. 31impact

    WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-96332
    0 news outlets0 CERTs0 researchersCVSS 7.1
  47. 42impact

    BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message

    WordPress CVE-2026-87764
    0 news outlets0 CERTs0 researchersCVSS 8.8
  48. 43impact

    WordPress Traveler theme <= 3.2.9 - SQL Injection vulnerability

    WordPress CVE-2026-93947
    0 news outlets0 CERTs0 researchersCVSS 9.3
  49. 31impact

    WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-105065
    0 news outlets0 CERTs0 researchersCVSS 7.1
  50. 46impact

    WordPress Equadio theme <= 1.1.4 - PHP Object Injection vulnerability

    WordPress CVE-2026-62087
    0 news outlets0 CERTs0 researchersCVSS 9.8
  51. 42impact

    WP-Partner <= 1.2.1 - Unauthenticated SQLi via 'id' Parameter

    WordPress CVE-2026-89234
    0 news outlets0 CERTs0 researchersCVSS 8.6
  52. 31impact

    WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-96761
    0 news outlets0 CERTs0 researchersCVSS 7.1
  53. 43impact

    WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

    WordPress CVE-2026-96331
    0 news outlets0 CERTs0 researchersCVSS 9.3
  54. 39impact

    WordPress SureCart plugin <= 4.9.3 - PHP Object Injection vulnerability

    WordPress CVE-2026-106599
    0 news outlets0 CERTs0 researchersCVSS 8.8
  55. 36impact

    WordPress PeepSo plugin <= 9.0.5.4 - Arbitrary File Deletion vulnerability

    WordPress CVE-2026-40805
    0 news outlets0 CERTs0 researchersCVSS 7.7
  56. 48impact

    File Upload to Order < 1.1.4 - Unauthenticated Arbitrary File Deletion

    WordPress CVE-2026-107594
    0 news outlets0 CERTs0 researchersCVSS 10.0
  57. 38impact

    WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

    WordPress CVE-2026-107426
    0 news outlets0 CERTs0 researchersCVSS 7.3
  58. 31impact

    WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-108483
    0 news outlets0 CERTs0 researchersCVSS 7.1
  59. 46impact

    Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

    WordPress CVE-2026-84737
    0 news outlets0 CERTs0 researchersCVSS 9.8
  60. 34impact

    WordPress Polylang plugin <= 3.8.9 - PHP Object Injection vulnerability

    WordPress CVE-2026-97278
    0 news outlets0 CERTs0 researchersCVSS 7.2
  61. 45impact

    WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - SQL Injection vulnerability

    WordPress CVE-2026-40800
    0 news outlets0 CERTs0 researchersCVSS 9.3
  62. 46impact

    WordPress Zombify plugin <= 1.7.7 - Arbitrary File Upload vulnerability

    WordPress CVE-2026-94503
    0 news outlets0 CERTs0 researchersCVSS 10.0
  63. 46impact

    WordPress Drone Media theme <= 2.2.0 - PHP Object Injection vulnerability

    WordPress CVE-2026-66482
    0 news outlets0 CERTs0 researchersCVSS 9.8
  64. 37impact

    Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

    WordPress CVE-2026-100161
    0 news outlets0 CERTs0 researchersCVSS 7.2
  65. 37impact

    Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

    WordPress CVE-2026-96840
    0 news outlets0 CERTs0 researchersCVSS 7.2
  66. 36impact

    WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability

    WordPress CVE-2026-40777
    0 news outlets0 CERTs0 researchersCVSS 8.1
  67. 46impact

    WordPress WineShop theme <= 3.20 - PHP Object Injection vulnerability

    WordPress CVE-2026-62090
    0 news outlets0 CERTs0 researchersCVSS 9.8
  68. 37impact

    WordPress Qode Tours plugin <= 3.1.3.2 - SQL Injection vulnerability

    WordPress CVE-2026-42712
    0 news outlets0 CERTs0 researchersCVSS 8.5
  69. 31impact

    WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-95608
    0 news outlets0 CERTs0 researchersCVSS 7.1
  70. 37impact

    WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

    WordPress CVE-2026-94064
    0 news outlets0 CERTs0 researchersCVSS 8.8
  71. 38impact

    Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values

    WordPress CVE-2026-83592
    0 news outlets0 CERTs0 researchersCVSS 7.2
  72. 50impact

    Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter

    WordPress CVE-2026-110002
    0 news outlets0 CERTs0 researchersCVSS 9.8
  73. 46impact

    WordPress Original theme <= 1.9.0 - PHP Object Injection vulnerability

    WordPress CVE-2026-66568
    0 news outlets0 CERTs0 researchersCVSS 9.8
  74. 47impact

    PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

    WordPress CVE-2026-104801
    0 news outlets0 CERTs0 researchersCVSS 9.1
  75. 39impact

    FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter

    WordPress CVE-2026-107746
    0 news outlets0 CERTs0 researchersCVSS 7.5
  76. 34impact

    WordPress WP Ultimate CSV Importer plugin <= 9.2 - SQL Injection vulnerability

    WordPress CVE-2026-45440
    0 news outlets0 CERTs0 researchersCVSS 7.6
  77. 40impact

    FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

    WordPress CVE-2026-103525
    0 news outlets0 CERTs0 researchersCVSS 7.5
  78. 36impact

    WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-42631
    0 news outlets0 CERTs0 researchersCVSS 7.1
  79. 42impact

    RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter

    WordPress CVE-2026-89232
    0 news outlets0 CERTs0 researchersCVSS 8.6
  80. 31impact

    WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-95596
    0 news outlets0 CERTs0 researchersCVSS 7.1
  81. 46impact

    WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability

    WordPress CVE-2026-104398
    0 news outlets0 CERTs0 researchersCVSS 9.8
  82. 43impact

    click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications

    WordPress CVE-2026-84260
    0 news outlets0 CERTs0 researchersCVSS 8.8
  83. 31impact

    WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-94058
    0 news outlets0 CERTs0 researchersCVSS 7.1
  84. 31impact

    WordPress UpSolution Core plugin <= 8.44 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-94166
    0 news outlets0 CERTs0 researchersCVSS 7.1
  85. 38impact

    TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

    WordPress CVE-2026-107768
    0 news outlets0 CERTs0 researchersCVSS 7.2
  86. 46impact

    WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

    WordPress CVE-2026-93943
    0 news outlets0 CERTs0 researchersCVSS 9.8
  87. 46impact

    WordPress Wine House theme <= 3.20 - PHP Object Injection vulnerability

    WordPress CVE-2026-62053
    0 news outlets0 CERTs0 researchersCVSS 9.8
  88. 44impact

    WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability

    WordPress CVE-2026-109698
    0 news outlets0 CERTs0 researchersCVSS 9.3
  89. 31impact

    WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-94060
    0 news outlets0 CERTs0 researchersCVSS 7.1
  90. 46impact

    WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

    WordPress CVE-2026-93933
    0 news outlets0 CERTs0 researchersCVSS 9.8
  91. 44impact

    click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update

    WordPress CVE-2026-84252
    0 news outlets0 CERTs0 researchersCVSS 9.8
  92. 41impact

    WordPress Backhoe theme <= 2.0 - Local File Inclusion vulnerability

    WordPress CVE-2026-62075
    0 news outlets0 CERTs0 researchersCVSS 8.1
  93. 34impact

    Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting

    WordPress CVE-2026-104021
    0 news outlets0 CERTs0 researchersCVSS 7.2
  94. 41impact

    WordPress Fabius theme <= 1.0 - Local File Inclusion vulnerability

    WordPress CVE-2026-62069
    0 news outlets0 CERTs0 researchersCVSS 8.1
  95. 40impact

    10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

    WordPress CVE-2026-103896
    0 news outlets0 CERTs0 researchersCVSS 7.5
  96. 45impact

    WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability

    WordPress CVE-2026-109694
    0 news outlets0 CERTs0 researchersCVSS 9.8
  97. 38impact

    WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability

    WordPress CVE-2026-42706
    0 news outlets0 CERTs0 researchersCVSS 7.5
  98. 36impact

    WordPress ProfileGrid plugin <= 6.0.0.2 - SQL Injection vulnerability

    WordPress CVE-2026-94663
    0 news outlets0 CERTs0 researchersCVSS 8.5
  99. 33impact

    WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability

    WordPress CVE-2026-105872
    0 news outlets0 CERTs0 researchersCVSS 7.2
  100. 31impact

    WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability

    WordPress CVE-2026-105318
    0 news outlets0 CERTs0 researchersCVSS 7.1