Live Database

WordPress Vulnerability
Database

Real-time security intelligence for the entire WordPress ecosystem: track verified vulnerabilities across plugins, themes, and core.

Researchers

3,873

Security experts

Plugins

39,749

Vulnerabilities

Themes

2,735

Vulnerabilities

Core

400

Vulnerabilities

Threat Distribution

42,850 reports

Critical2,8817%

High8,92721%

Medium30,85772%

Low1850.4%

Filters

None active

Asset Type

Risk Level

Date Range (Last)

Vulnerability Records

42,850 records


2026-10-27 11:37	Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter Jupiter X Core <= 4.61.0	`CVE-2026-106013`	9.8 Critical	daroo	Yes
2026-10-26 21:41	Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content Advanced Views <= 3.9.6	`CVE-2026-109995`	7.2 High	nguyen viet tin	Yes
2026-10-26 21:31	Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field Advanced Custom Fields <= 0.9.2.6	`CVE-2026-10752`	4.8 Medium	normaandersonfrank	Yes
2026-10-26 20:13	Qode Membership <= 2.0.6.2 - Authentication Bypass via Social Login Qode Membership <= 2.0.6.2	`CVE-2026-92885`	9.8 Critical	0xwackydawg	Yes
2026-10-26 19:41	Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter Jupiter X Core <= 4.61.0	`CVE-2026-10511`	6.4 Medium	theviper17y	Yes
2026-10-26 18:03	Kirki <= 6.2.5 - Authenticated (Subscriber+) PHP Object Injection to Administrator Account Takeover via 'get-single-symbol' AJAX Endpoint Kirki <= 6.2.5	`CVE-2026-75891`	8.8 High	daroo	Yes
2026-10-26 16:34	Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title Analytics Insights <= 6.3.12	`CVE-2026-111820`	7.2 High	hei	Yes
2026-10-23 21:31	aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute aBlocks <= 2.17.0	`CVE-2026-110018`	8.8 High	Wordfence PRISM	Yes
2026-10-23 00:00	Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE < 3.2.8 - Missing Authorization Otter Blocks < 3.2.8	`CVE-2026-109935`	5.3 Medium	Karthik Ramakrishnan	Yes
2026-10-23 00:00	Depicter — Popup & Slider Builder 4.0.5 - 4.8.1 - Authenticated (Editor+) Arbitrary File Upload Depicter 4.0.5 – 4.8.1	`CVE-2026-113472`	7.2 High	Karthik Ramakrishnan	Yes

Showing 1–10 of 42,850 reports

What is the WordSec vulnerability database?

The WordSec vulnerability database is a public record of security issues disclosed in WordPress plugins, themes and core releases. Each entry states the CVE identifier where one has been assigned, the CVSS base score and severity band, the CWE weakness class, the affected version range, the version that fixed it, the disclosure date and the researcher credited with finding it. Affected ranges use half-open notation, so [4.0, 4.2) means every build from 4.0 up to but not including 4.2.

WordPress Vulnerability Database

Filters

Vulnerability Records

What is the WordSec vulnerability database?

WordPress Vulnerability
Database