CVE Tools
Track your stack

WordPress plugins

4,057 CVEs tracked. 3 of them are in CISA KEV.

This hub aggregates every CVE we track for WordPress plugins, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

WordPress plugins CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
WordPress plugins CVEs per month
MonthCVEs
2024-1263
2025-01123
2025-0264
2025-0369
2025-0474
2025-0579
2025-0660
2025-0743
2025-0854
2025-0975
2025-1065
2025-1153
2025-12195
2026-01114
2026-0279
2026-03172
2026-0449
2026-0570
2026-0675
2026-0767
2026-0860
2026-0961
2026-10171
2026-1127

Severity

How the 4,057 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical2837%
  • High1,15229%
  • Medium2,52863%
  • Low782%

Latest CVEs

The 15 most recently published vulnerabilities affecting WordPress plugins.

  1. CVE-2026-120531Subscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter7.2
  2. CVE-2026-123860WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability5.3
  3. CVE-2026-123483WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability5.3
  4. CVE-2026-123477WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability6.5
  5. CVE-2026-121765WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability7.1
  6. CVE-2026-121976Modula Image Gallery <= 3.0.17 - Authenticated (Author+) Stored Cross-Site Scripting via 'items' Parameter6.4
  7. CVE-2026-104746Motors <= 1.4.125 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_user_avatar_path' User Meta8.1
  8. CVE-2026-104760weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'modalPlaceholder' Block Attribute6.4
  9. CVE-2026-119501WordPress Element Pack Elementor Addons plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability6.5
  10. CVE-2026-119500WordPress Flash & HTML5 Video plugin <= 2.14.1 - Cross Site Scripting (XSS) vulnerability6.5
  11. CVE-2026-119473WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability4.3
  12. CVE-2026-119502WordPress Ultimate Store Kit Elementor Addons plugin <= 4.0.1 - Broken Access Control vulnerability5.3
  13. CVE-2026-120853WordPress CartFlows plugin <= 3.3.0 - Broken Access Control vulnerability5.3
  14. CVE-2026-120852WordPress CartFlows plugin <= 3.3.0 - Content Injection vulnerability5.3
  15. CVE-2026-121767WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability5.3

Product grouping is registry-driven, with AI assist and human review. How it works