9,723 new vulnerabilities
WordPress Vulnerability
Database
13,027 known vulnerabilities across plugins, themes and core. Updated daily from multiple sources.
13,027
Total vulns
820
Critical
3,204
High
6,850
Medium
622
Low
12,750
Plugins
208
Themes
69
Core
26
Closed plugins
| Severity | Title | Type | Slug | CVE | Fixed in | Published |
|---|---|---|---|---|---|---|
| MEDIUM CVSS 5.3 |
EUVD-2026-116913 (CVE-2026-119745) — Sender plugin for WordPress before 2.11.3 contains a… |
plugin | |
CVE-2026-119745 | — | Nov 4, 2026 |
| HIGH CVSS 8.8 |
EUVD-2026-116885 (CVE-2026-104799) — The Mobile builder plugin for WordPress is vulnerabl… |
plugin | |
CVE-2026-104799 | — | Nov 4, 2026 |
| HIGH CVSS 7.2 |
EUVD-2026-116884 (CVE-2026-97397) — The Remove Google Fonts – Disable, Block, or Replace … |
plugin | |
CVE-2026-97397 | — | Nov 4, 2026 |
| HIGH CVSS 8.8 |
EUVD-2026-116806 (CVE-2026-120554) — The Import and export users and customers plugin for… |
plugin | |
CVE-2026-120554 | — | Nov 4, 2026 |
| HIGH CVSS 7.2 |
EUVD-2026-116807 (CVE-2026-115498) — The Slim Jetpack plugin for WordPress is vulnerable … |
plugin | |
CVE-2026-115498 | — | Nov 4, 2026 |
| MEDIUM CVSS 6.4 |
EUVD-2026-116805 (CVE-2026-93900) — The Simple CAPTCHA with Cloudflare Turnstile plugin f… |
plugin | |
CVE-2026-93900 | — | Nov 4, 2026 |
| UNKNOWN | VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks |
plugin | vikwidgetsloader |
CVE-2026-118983 | v1.12.3 | Nov 4, 2026 |
| UNKNOWN | All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute |
plugin | all-in-one-video-gallery |
CVE-2026-118783 | v5.0.0 | Nov 4, 2026 |
| UNKNOWN | Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Descriptio… |
plugin | simple-download-monitor |
CVE-2026-118637 | v4.1.3 | Nov 4, 2026 |
| UNKNOWN | EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Ove… |
plugin | eventprime |
CVE-2026-118523 | v4.3.6.1 | Nov 4, 2026 |
| UNKNOWN | Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via P… |
plugin | stape-conversion-tracking |
CVE-2026-118422 | v2.3.11 | Nov 4, 2026 |
| UNKNOWN | Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover |
plugin | premium-packages |
CVE-2026-118407 | v7.3.1 | Nov 4, 2026 |
| UNKNOWN | Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR |
plugin | premium-packages |
CVE-2026-118404 | v7.3.1 | Nov 4, 2026 |
| UNKNOWN | Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure |
plugin | premium-packages |
CVE-2026-118403 | v7.3.1 | Nov 4, 2026 |
| UNKNOWN | WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory S… |
plugin | wpvivid-backup-migration-staging |
CVE-2026-115426 | v0.9.138 | Nov 4, 2026 |
| UNKNOWN | Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore |
plugin | duplicator |
CVE-2026-115262 | v5.1.0 | Nov 4, 2026 |
| UNKNOWN | WP Roster < 2.36 - Unauthenticated Roster Data Modification |
plugin | wp-roster |
CVE-2026-115257 | v2.36 | Nov 4, 2026 |
| UNKNOWN | Text Typing < 2.2.2 - Contributor+ Stored XSS |
plugin | text-typing |
CVE-2026-115250 | v2.2.2 | Nov 4, 2026 |
| UNKNOWN | WPvivid Backup & Migration 0.9.117 - 0.9.136 - Admin+ Arbitrary File Upload via wpvivid_u… |
plugin | wpvivid-backup-migration-staging |
CVE-2026-115243 | v0.9.137 | Nov 4, 2026 |
| UNKNOWN | WPvivid Backup & Migration < 0.9.137 - Admin+ Path Traversal via Staging Site Path |
plugin | wpvivid-backup-migration-staging |
CVE-2026-115242 | v0.9.137 | Nov 4, 2026 |
| UNKNOWN | WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snaps… |
plugin | wpvivid-backup-migration-staging |
CVE-2026-115241 | v0.9.137 | Nov 4, 2026 |
| UNKNOWN | Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload |
plugin | enable-media-replace |
CVE-2026-114431 | v4.2.3 | Nov 4, 2026 |
| UNKNOWN | Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points |
plugin | duplicator |
CVE-2026-112244 | v5.1.0 | Nov 4, 2026 |
| UNKNOWN | Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter |
plugin | duplicator |
CVE-2026-112243 | v5.1.0 | Nov 4, 2026 |
| UNKNOWN | WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User … |
plugin | wp-remote-users-sync |
CVE-2026-111962 | v2.2.0 | Nov 4, 2026 |
| UNKNOWN | Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure |
plugin | post-duplicator |
CVE-2026-111740 | v3.0.17 | Nov 4, 2026 |
| UNKNOWN | Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via… |
plugin | essential-real-estate |
CVE-2026-110964 | v5.3.5 | Nov 4, 2026 |
| UNKNOWN | PowerPack Addons for Elementor 2.10.0 - 3.1.2 - Contributor+ SSRF via Charts Widget CSV I… |
plugin | powerpack-addons-for-elementor-widgets-form-styler-and-templates |
CVE-2026-110692 | v3.1.3 | Nov 4, 2026 |
| UNKNOWN | FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disc… |
plugin | fv-flowplayer-video-player |
CVE-2026-108068 | v7.5.56.7212 | Nov 4, 2026 |
| UNKNOWN | FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record D… |
plugin | fv-flowplayer-video-player |
CVE-2026-108067 | v7.5.56.7212 | Nov 4, 2026 |
| UNKNOWN | SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings |
plugin | seopress |
CVE-2026-108041 | v10.4 | Nov 4, 2026 |
| UNKNOWN | Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action |
plugin | kali-forms-contact-form-drag-and-drop-builder |
CVE-2026-106649 | v2.4.29 | Nov 4, 2026 |
| UNKNOWN | Booking Package < 1.7.34 - Unauthenticated Payment Bypass |
plugin | booking-package |
CVE-2026-106000 | v1.7.34 | Nov 4, 2026 |
| UNKNOWN | Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values |
plugin | form-maker-by-10web |
CVE-2026-105413 | v1.15.51 | Nov 4, 2026 |
| UNKNOWN | WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log |
plugin | erp-complete-hr-accounting-crm-suite-built-for-woocommerce |
CVE-2026-105191 | v1.17.11 | Nov 4, 2026 |
| UNKNOWN | CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts |
plugin | cookieyes |
CVE-2026-104719 | v3.5.8 | Nov 4, 2026 |
| UNKNOWN | Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase vi… |
plugin | mollie-payments-for-woocommerce |
CVE-2026-101166 | v8.2.0 | Nov 4, 2026 |
| UNKNOWN | Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via up… |
plugin | mollie-payments-for-woocommerce |
CVE-2026-101165 | v8.2.0 | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118983 — The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise … |
plugin | |
CVE-2026-118983 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118783 — The All-in-One Video Gallery WordPress plugin before 5.0.0 does not va… |
plugin | |
CVE-2026-118783 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118637 — The Simple Download Monitor WordPress plugin before 4.1.3 does not prop… |
plugin | |
CVE-2026-118637 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118523 — The EventPrime WordPress plugin before 4.3.6.1 does not keep the built… |
plugin | |
CVE-2026-118523 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118422 — The Stape Conversion Tracking WordPress plugin before 2.3.11 does not v… |
plugin | |
CVE-2026-118422 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118407 — The Premium Packages WordPress plugin before 7.3.1 does not verify tha… |
plugin | |
CVE-2026-118407 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118404 — The Premium Packages WordPress plugin before 7.3.1 does not verify own… |
plugin | |
CVE-2026-118404 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-118403 — The Premium Packages WordPress plugin before 7.3.1 does not verify tha… |
plugin | |
CVE-2026-118403 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-115426 — The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.1… |
plugin | |
CVE-2026-115426 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-115262 — The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress… |
plugin | |
CVE-2026-115262 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-115257 — The WP Roster WordPress plugin before 2.36 does not perform any capabil… |
plugin | |
CVE-2026-115257 | — | Nov 4, 2026 |
| UNKNOWN | CVE-2026-115250 — The Text Typing WordPress plugin before 2.2.2 does not properly saniti… |
plugin | |
CVE-2026-115250 | — | Nov 4, 2026 |
…