zombify
Critical 10.0
2026-10-09All versions
CVE-2026-94503
WordPress Vulnerability Database
The most comprehensive open vulnerability database for WordPress plugins, themes, and server infrastructure.
17,062
plugins with known vulnerabilities
2,382
themes with known vulnerabilities
14,528
vulnerabilities without a fix
2,475
critical severity (score ≥ 9.0)
Official WordPress Plugin
WPVulnerability
Real-time vulnerability scanner for your WordPress dashboard. Monitors your core, plugins, themes, PHP, Apache, nginx, MariaDB, MySQL, ImageMagick, curl and more — all in one place.
10,000+Active installs
★★★★★20 reviews
5.1.6Latest version
7.1.3Tested with WP
Notable vulnerabilities — last 90 days
Newspapers X
Critical 10.0
2026-08-31All versions
CVE-2026-81779
Typehub
Critical 10.0
2026-08-06All versions
CVE-2026-66665
GiveWP – Donation Plugin and Fundraising Platform
Critical 10.0
2026-08-28All versions
CVE-2026-82222
The Grid
Critical 10.0
2026-10-16All versions
CVE-2026-94169
Hash Form – Drag & Drop Form Builder
Critical 10.0
2026-08-31All versions
CVE-2026-81780
Doctreat Core
Critical 10.0
2026-10-06All versions
CVE-2026-39773
MonsterInsights Pro
Critical 10.0
2026-08-06All versions
CVE-2026-11976
Revy
Critical 10.0
2024-12-06All versions
WordPress Revy plugin <= 1.18 - Unauthenticated Arbitrary File Upload vulnerability
SiteVault – Backup, Restore, Migration & Cloning
Critical 10.0
2026-10-10All versions
CVE-2026-42696
2026-09-30All versions
CVE-2026-96349
Link Factory
Critical 10.0
2026-08-13All versions
CVE-2026-15413
Latest Plugin Vulnerabilities
View all →2026-10-21< 2.2.0
CVE-2026-96901
2026-10-21< 1.23.4
CVE-2026-107788
Moloni
N/A
2026-10-21< 5.0.14
CVE-2026-106932
2026-10-21< 1.3.1
CVE-2026-105992
2026-10-21< 1.1.2
CVE-2026-100145
2026-10-21< 1.1.3
CVE-2026-92999
2026-10-21< 0.3.10
CVE-2026-87837
2026-10-21< 4.1.3
CVE-2026-111947
2026-10-21< 1.2.3
CVE-2026-111596
Duplicator Pro
High 8.8
2026-10-21< 5.0.0
CVE-2026-82814
2026-10-21< 5.0.0
CVE-2026-82814
2026-10-21< 4.1.1
CVE-2026-107790
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
Medium 6.4
2026-10-16< 4.0.4
CVE-2026-107748
2026-10-20< 1.0.8
CVE-2026-111843
2026-10-20< 5.15.3
CVE-2026-109700
DiviGear Carousel
Medium 6.4
2026-10-20< 5.2.2
CVE-2026-93878
BDM Digital Payment Gateway
Medium 5.3 Unfixed
2026-10-20≥ 1.2.7 and ≤ 1.3.12
WordPress BDM Digital Payment Gateway Plugin 1.2.7-1.3.12 is vulnerable to Broken Authentication
Coinbase Commerce Payment Gateway for WooCommerce
Medium 5.3 Unfixed
2026-10-20≤ 1.4.1
WordPress Coinbase Commerce Payment Gateway for WooCommerce Plugin <= 1.4.1 is vulnerable to Broken Authentication
EventON Subscriber
High 7.5 Unfixed
2026-10-20≤ 1.4.5
CVE-2026-93300
Bus Ticket Booking with Seat Reservation
Medium 5.3
2026-10-20< 5.9.8
CVE-2026-112824
Latest Theme Vulnerabilities
View all →
NativeChurch
High 7.5
2026-10-20< 1.6.2
CVE-2014-125133
ChurcHope
High 7.5
2026-10-20< 2.2
CVE-2014-125134
eStore
High 7.1
2026-10-18< 1.6.14
CVE-2026-108485
Houzez
High 7.1
2026-10-16< 4.4.1
CVE-2026-96339
XStore
High 7.1
2026-10-15< 9.7.9
CVE-2026-105065
Edge Decor
N/A Unfixed
2026-02-27≤ 2.9
Edge Decor <= 2.9 - Unauthenticated PHP Object Injection
Marcell
N/A Unfixed
2026-02-27≤ 1.2.14
Marcell - Personal Blog & Magazine WordPress Theme <= 1.2.14 - Unauthenticated PHP Object Injection
Filmax
N/A Unfixed
2026-02-27≤ 1.1.11
Filmax | Cinema & Movie News Magazine WordPress Theme <= 1.1.11 - Unauthenticated PHP Object Injection
Orpheus
N/A Unfixed
2026-05-27≤ 1.8
Orpheus <= 1.8 - Unauthenticated PHP Object Injection
Mission
N/A Unfixed
2026-05-26≤ 1.22
Mission <= 1.22 - Unauthenticated PHP Object Injection
Gamezone
N/A Unfixed
2026-02-27≤ 1.1.11
Gamezone <= 1.1.11 - Unauthenticated PHP Object Injection
Le Truffe
N/A Unfixed
2026-02-27≤ 1.1.7
Le Truffe <= 1.1.7 - Unauthenticated PHP Object Injection
Meals & Wheels
N/A Unfixed
2026-03-02≤ 1.1.13
Meals & Wheels <= 1.1.13 - Unauthenticated PHP Object Injection
Nuts
N/A Unfixed
2026-03-02≤ 1.12
Nuts <= 1.12 - Unauthenticated PHP Object Injection
Legal Stone
N/A Unfixed
2026-02-27≤ 1.2.11
Legal Stone | Lawyers & Attorneys WordPress Theme <= 1.2.11 - Unauthenticated PHP Object Injection
Good Homes
N/A Unfixed
2026-03-05≤ 1.3.13
Good Homes - Real Estate WordPress Theme <= 1.3.13 - Unauthenticated PHP Object Injection
Coinpress
N/A Unfixed
2026-03-02≤ 1.0.15
Coinpress <= 1.0.15 - Unauthenticated PHP Object Injection
Muzicon
N/A Unfixed
2026-02-26≤ 1.15
Muzicon - Music Festival & Concert WordPress Theme <= 1.15 - Unauthenticated PHP Object Injection
Gamic
N/A Unfixed
2026-05-27≤ 1.19
Gamic - Gaming Metaverse Game & Crypto WordPress Theme <= 1.19 - Unauthenticated PHP Object Injection
Gunslinger
N/A Unfixed
2026-05-27≤ 1.11
Gunslinger <= 1.11 - Unauthenticated PHP Object Injection
Latest WordPress Core Vulnerabilities
View all →
WordPress 5.8.2
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.8.1
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.8
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.7.4
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.7.3
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.7.2
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.7.1
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.7
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.6.6
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.6.5
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.6.4
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.6.3
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.6.2
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.6.1
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.6
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.5.7
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.5.6
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.5.5
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.5.4
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type
WordPress 5.5.3
High 7.1
2026-10-07All versions
WordPress Core 4.7.0 - 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type