WordPress Plugins

Browse known vulnerabilities affecting WordPress Plugins. Continuously updated with verified security disclosures, including severity, impact, and affected versions.

2017201820192020202120222023202420252026

Critical

High

Medium

Low

Filters

None active

Risk Level

Date Range (Last)

Vulnerability Records

40,035 records


2026-10-29 18:46	Formidable Forms <= 6.35 - Authenticated (Subscriber+) Arbitrary Plugin Installation via 'file_url' Parameter Formidable Forms <= 6.35	`CVE-2026-89435`	8.8 High	Supakiad S. (m3ez)	Yes
2026-10-29 18:36	Gravity Forms <= 3.1.1 - Unauthenticated Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragraph Field Values Gravity Forms <= 3.1.1	`CVE-2026-90437`	7.2 High	daroo	Yes
2026-10-29 18:29	Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field Gravity Forms <= 3.1.2	`CVE-2026-103039`	9.8 Critical	Tin Pham (TF1T)	Yes
2026-10-29 18:25	Gravity Forms <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting via List Field Gravity Forms <= 3.1.2	`CVE-2026-97645`	7.2 High	Supakiad S. (m3ez)	Yes
2026-10-29 18:06	Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie Food Store <= 1.5.5	`CVE-2026-116622`	7.2 High	GivMeInJ	No
2026-10-29 18:00	AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration AI Engine <= 3.8.6	`CVE-2026-110732`	7.5 High	satoshigpt2021-sketch	Yes
2026-10-29 17:04	Page and Post Restriction <= 1.6.1 - Unauthenticated Authentication Bypass via REST API Nonce Bypass via Cookie Re-Authentication Page and Post Restriction <= 1.6.1	`CVE-2026-118194`	6.5 Medium	Wordfence PRISM	Yes
2026-10-29 17:03	Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter Content Egg <= 12.0.0	`CVE-2026-119087`	4.3 Medium	Wordfence PRISM	Yes
2026-10-29 17:03	Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter Cool FormKit Lite <= 2.7.9	`CVE-2026-118500`	6.4 Medium	Wordfence PRISM	Yes
2026-10-29 17:02	Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action Content Egg <= 12.0.0	`CVE-2026-119059`	4.3 Medium	Wordfence PRISM	Yes

Showing 1–10 of 40,035 reports

All WordPress Plugins

Every plugins with a recorded vulnerability: 15,553 in total.Page 1 of 78.