Live Database

WordPress Vulnerability
Database

Real-time security intelligence for the entire WordPress ecosystem: track verified vulnerabilities across plugins, themes, and core.

Researchers

3,521

Security experts

Plugins

37,160

Vulnerabilities

Themes

2,571

Vulnerabilities

Core

381

Vulnerabilities

Threat Distribution

40,078 reports
Critical2,7657%
High8,09420%
Medium29,05973%
Low1600.4%

Filters

None active

Asset Type
Risk Level
Date Range (Last)

Vulnerability Records

40,078 records
2026-09-11 18:53
MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path
MPG
<= 4.2.1
CVE-2026-85198
6.5
Medium
Nhien Pham (nhienit) (nhienit)Yes
2026-09-11 18:52
GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
GEO my WP
<= 4.5.5.3
CVE-2026-85200
7.5
High
yckYes
2026-09-11 18:49
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Tutor LMS
<= 4.0.7
CVE-2026-78175
8.8
High
Chloe ChamberlandYes
2026-09-11 18:48
DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
DT LMS
<= 1.1
CVE-2026-11355
5.3
Medium
adhikara13Yes
2026-09-11 18:44
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter
rtMedia for WordPress
<= 4.7.11
CVE-2026-16482
7.5
High
Wordfence PRISMYes
2026-09-11 18:42
Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name
Smart Marketing SMS and Newsletters…
<= 5.1.24
CVE-2026-77161
6.5
Medium
Wordfence PRISMYes
2026-09-11 18:40
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
The Events Calendar
<= 6.17.3
CVE-2026-78159
9.8
Critical
Chloe ChamberlandYes
2026-09-11 18:39
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
The Events Calendar
<= 6.17.4
CVE-2026-78006
9.8
Critical
Chloe ChamberlandYes
2026-09-11 00:00
MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
MemberPress Corporate Accounts
<= 1.5.39
CVE-2026-15451
8.8
High
andrea bocchettiYes
2026-09-11 00:00
Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter
Royal Addons for Elementor
<= 1.7.1066
CVE-2026-17585
5.3
Medium
TarPeg007Yes
Showing 1–10 of 40,078 reports

What is the WordSec vulnerability database?

The WordSec vulnerability database is a public record of security issues disclosed in WordPress plugins, themes and core releases. Each entry states the CVE identifier where one has been assigned, the CVSS base score and severity band, the CWE weakness class, the affected version range, the version that fixed it, the disclosure date and the researcher credited with finding it. Affected ranges use half-open notation, so [4.0, 4.2) means every build from 4.0 up to but not including 4.2.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C