Live Database

WordPress Vulnerability
Database

Real-time security intelligence for the entire WordPress ecosystem: track verified vulnerabilities across plugins, themes, and core.

Researchers

3,201

Security experts

Plugins

35,125

Vulnerabilities

Themes

2,501

Vulnerabilities

Core

372

Vulnerabilities

Threat Distribution

37,965 reports

Critical2,6217%

High7,44920%

Medium27,73973%

Low1560.4%

Filters

None active

Asset Type

Risk Level

Date Range (Last)

Vulnerability Records

37,965 records


2026-07-28 23:02	Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload in eco_save_settings Extra Checkout Options - addon for Extr… <= 2.3.2	`CVE-2026-14270`	8.8 High	bashu	Yes
2026-07-28 21:30	Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting Booking System Trafft <= 1.0.17	`CVE-2026-8791`	6.4 Medium	Hardik Patel	Yes
2026-07-28 21:25	Advanced Shipment Tracking for WooCommerce <= 3.9 - Authenticated (Shop Manager+) SQL Injection via 'tracking_provider' Parameter Advanced Shipment Tracking for WooComme… <= 3.9	`N/A`	7.2 High	Nguyen Truong (Roll)	Yes
2026-07-28 21:22	WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute WPC Badge Management for WooCommerce <= 3.1.6	`CVE-2026-7436`	6.4 Medium	zaim	Yes
2026-07-28 21:21	MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.14 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Attachment Deletion MasterStudy LMS WordPress Plugin <= 3.7.23	`CVE-2026-5060`	6.5 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-07-28 21:20	FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle FuseWP <= 1.1.24.2	`CVE-2026-5582`	4.3 Medium	Deadbee	No
2026-07-28 21:18	WP CTA <= 2.1.2 - Authenticated (Administrator+) Server-Side Request Forgery WP CTA 2.1.2	`CVE-2026-6089`	4.9 Medium	Nguyen Quang Truong	Yes
2026-07-28 21:17	Klubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update Klubraum Membership Request <= 1.1.0	`CVE-2026-4604`	5.3 Medium	Md. Moniruzzaman Prodhan (NomanProdhan)	Yes
2026-07-28 20:51	Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter Meta Box AIO <= 3.8.0	`CVE-2026-14488`	9.1 Critical	Austin Ginder	Yes
2026-07-28 20:41	Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter Cost Calculator Builder PRO <= 4.0.3	`CVE-2026-14900`	9.8 Critical	Nox Axter	Yes

Showing 1–10 of 37,965 reports

WordPress Vulnerability Database

Filters

Vulnerability Records

WordPress Vulnerability
Database