WordPress Plugins

Browse known vulnerabilities affecting WordPress Plugins. Continuously updated with verified security disclosures, including severity, impact, and affected versions.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Filters

None active

Risk Level

Date Range (Last)

Vulnerability Records

37,160 records


2026-09-11 18:53	MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Path MPG <= 4.2.1	`CVE-2026-85198`	6.5 Medium	Nhien Pham (nhienit) (nhienit)	Yes
2026-09-11 18:52	GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion GEO my WP <= 4.5.5.3	`CVE-2026-85200`	7.5 High	yck	Yes
2026-09-11 18:49	Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution Tutor LMS <= 4.0.7	`CVE-2026-78175`	8.8 High	Chloe Chamberland	Yes
2026-09-11 18:48	DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions DT LMS <= 1.1	`CVE-2026-11355`	5.3 Medium	adhikara13	Yes
2026-09-11 18:44	rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter rtMedia for WordPress <= 4.7.11	`CVE-2026-16482`	7.5 High	Wordfence PRISM	Yes
2026-09-11 18:42	Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name Smart Marketing SMS and Newsletters… <= 5.1.24	`CVE-2026-77161`	6.5 Medium	Wordfence PRISM	Yes
2026-09-11 18:40	The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation The Events Calendar <= 6.17.3	`CVE-2026-78159`	9.8 Critical	Chloe Chamberland	Yes
2026-09-11 18:39	The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution The Events Calendar <= 6.17.4	`CVE-2026-78006`	9.8 Critical	Chloe Chamberland	Yes
2026-09-11 00:00	MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation MemberPress Corporate Accounts <= 1.5.39	`CVE-2026-15451`	8.8 High	andrea bocchetti	Yes
2026-09-11 00:00	Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter Royal Addons for Elementor <= 1.7.1066	`CVE-2026-17585`	5.3 Medium	TarPeg007	Yes

Showing 1–10 of 37,160 reports

All WordPress Plugins

Every plugins with a recorded vulnerability: 15,152 in total.Page 1 of 76.