CVE-2026-48888WordPress WooCommerce plugin < 11.1.0 - Denial of Service Attack vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Published 09/08/2026 Severity High CVE-2026-57777WordPress WooCommerce plugin < 11.0 - SQL Injection vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Published 09/04/2026 Severity High CVE-2026-73562Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter) Exploitation status Not known exploited Fix Affected product M mongoose Published 08/13/2026 Severity Medium CVE-2026-42334Mongoose: Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection Exploitation status Not known exploited Fix Affected product M mongoose Published 05/14/2026 Severity High CVE-2026-39660Exploitation status Not confirmed Fix Not confirmed Affected product Not confirmed Published 04/08/2026 Severity Unknown CVE-2026-4338ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure Exploitation status Public exploit Fix Affected product A ActivityPub Published 04/08/2026 Severity High CVE-2026-3589WooCommerce < 10.5.3 - Arbitrary Admin User Creation via CSRF Exploitation status Public exploit Fix Affected product W WooCommerce Published 03/06/2026 Severity High CVE-2026-22356WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerability Exploitation status Not known exploited Fix Affected product J Jetpack CRM Published 02/20/2026 Severity High CVE-2026-25404WordPress WP Job Manager plugin <= 2.4.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP Job Manager Published 02/19/2026 Severity Medium CVE-2023-54332Jetpack 11.4 - Cross Site Scripting (XSS) Exploitation status Public exploit Fix Not confirmed Affected product J Jetpack Published 01/13/2026 Severity Medium CVE-2023-52212WordPress WP Job Manager plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product W WP Job Manager Published 01/05/2026 Severity Medium CVE-2025-69015WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product C Crowdsignal Forms Published 12/30/2025 Severity Low CVE-2025-15033WooCommerce - Subscriber/Customer+ Order Data Disclosure Exploitation status Public exploit Fix Affected product W WooCommerce Published 12/22/2025 Severity Medium CVE-2023-7320WooCommerce <= 7.8.2 - Sensitive Information Exposure Exploitation status Not known exploited Fix Affected product W WooCommerce Published 10/29/2025 Severity Medium CVE-2025-49042WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Published 10/29/2025 Severity Medium CVE-2025-57924WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability Exploitation status Not known exploited Fix Affected product D Developer Published 09/22/2025 Severity Medium CVE-2025-49325WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Newsletters Published 06/06/2025 Severity Medium CVE-2025-5062WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting Exploitation status Not known exploited Fix Affected product W WooCommerce Published 05/22/2025 Severity Medium CVE-2024-8009Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure Exploitation status Public exploit Fix Affected product S Sensei LMS Published 05/15/2025 Severity Medium CVE-2024-6584Jetpack Boost < 3.4.7 - Admin+ SSRF Exploitation status Public exploit Fix Affected product J Jetpack Boost Published 05/15/2025 Severity Critical CVE-2024-12743MailPoet < 5.5.2 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product M MailPoet Published 05/15/2025 Severity Medium CVE-2024-10076Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product J Jetpack Published 05/15/2025 Severity Medium CVE-2024-10075Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution Exploitation status Public exploit Fix Affected product J Jetpack Published 05/15/2025 Severity Medium CVE-2024-51666WordPress Tours plugin <= 1.0.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product T Tours Published 05/15/2025 Severity Medium CVE-2024-56006WordPress Jetpack Debug Tools plugin < 2.0.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product J Jetpack Debug Tools Published 05/15/2025 Severity Medium CVE-2025-22740WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Sensei LMS Published 03/27/2025 Severity Medium CVE-2025-26762WordPress WooCommerce plugin <= 9.7.0 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Published 03/27/2025 Severity Medium CVE-2025-0466Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure Exploitation status Public exploit Fix Affected product S Sensei LMS Published 02/04/2025 Severity Medium CVE-2024-37241WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product W WP Job Manager - Resume Manager Published 01/02/2025 Severity Medium CVE-2024-37242WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Newsletters Published 01/02/2025 Severity Medium CVE-2024-10858Jetpack 13.0-14.0 - Unauthenticated DOM-XSS Exploitation status Public exploit Fix Affected product J Jetpack Published 12/25/2024 Severity Medium CVE-2024-43338WordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product C Crowdsignal Dashboard – Polls, Surveys & more Published 11/19/2024 Severity Medium CVE-2024-10103MailPoet < 5.3.2 - Admin+ Stored XSS Exploitation status Public exploit Fix Affected product M MailPoet Published 11/19/2024 Severity Medium CVE-2024-10486Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File Exploitation status Not known exploited Fix Affected product G Google for WooCommerce Published 11/18/2024 Severity Medium CVE-2024-9926Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access Exploitation status Public exploit Fix Affected product J Jetpack Published 11/07/2024 Severity Medium CVE-2024-37423WordPress Newspack Blocks plugin <= 3.0.8 - Contributor+ Arbitrary Directory Deletion vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Blocks Published 11/01/2024 Severity High CVE-2024-37425WordPress Newspack Blocks plugin <= 3.0.8 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Blocks Published 11/01/2024 Severity Medium CVE-2024-37443WordPress WP Job Manager plugin <= 2.1.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP Job Manager - Resume Manager Published 11/01/2024 Severity Medium CVE-2024-37475WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Newsletters Published 11/01/2024 Severity Medium CVE-2024-37477WordPress Newspack Content Converter plugin <= 0.1.5 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Content Converter Published 11/01/2024 Severity Medium CVE-2024-43968WordPress Newspack plugin < 3.8.7 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Published 11/01/2024 Severity Medium CVE-2024-9944WooCommerce <= 9.0.2 - Unauthenticated HTML Injection Exploitation status Not known exploited Fix Affected product W WooCommerce Published 10/15/2024 Severity Medium CVE-2024-7786Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak Exploitation status Public exploit Fix Affected product S Sensei LMS Published 09/04/2024 Severity High CVE-2024-43949WordPress GHActivity plugin <= 2.0.0-alpha - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product G GHActivity Published 08/29/2024 Severity Medium CVE-2024-35686WordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product S Sensei LMS Published 08/18/2024 Severity Medium CVE-2024-39666WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Published 08/18/2024 Severity Medium CVE-2024-37115WordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Blocks Published 07/10/2024 Severity High CVE-2024-37424WordPress Newspack Blocks plugin <= 3.0.8 - Arbitrary File Upload vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Blocks Published 07/09/2024 Severity Critical CVE-2024-35777WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Published 07/09/2024 Severity Low CVE-2024-37474WordPress Newspack Ads plugin <= 1.47.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Ads Published 07/04/2024 Severity Medium CVE-2024-37476WordPress Newspack Campaigns plugin <= 2.31.1 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product N Newspack Campaigns Published 07/04/2024 Severity Medium CVE-2024-32111WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability Exploitation status Not known exploited Fix Affected product W WordPress Published 06/25/2024 Severity Medium CVE-2024-31111WordPress Core < 6.5.5 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product W WordPress Published 06/25/2024 Severity Medium CVE-2023-47788WordPress Jetpack plugin < 12.7 - Contributor+ Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product J Jetpack Published 06/19/2024 Severity Medium CVE-2024-34766WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerability Exploitation status Not known exploited Fix Affected product C ChaosTheory Published 06/03/2024 Severity Medium CVE-2024-4392Jetpack – WP Security, Backup, Speed, & Growth <= 13.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpvideo Shortcode Exploitation status Not known exploited Fix Affected product J Jetpack – WP Security, Backup, Speed, & Growth Published 05/14/2024 Severity Medium CVE-2024-34549WordPress WP Job Manager plugin <= 2.2.2 - Sensitive Data Exposure vulnerability Exploitation status Not known exploited Fix Affected product W WP Job Manager Published 05/09/2024 Severity Medium CVE-2023-47774WordPress Jetpack plugin < 12.7 - Auth. Iframe Injection vulnerability Exploitation status Not known exploited Fix Affected product J Jetpack Published 04/24/2024 Severity Medium CVE-2024-1310WooCommerce < 8.6 - Contributor+ Private/Draft Products Access Exploitation status Public exploit Fix Affected product W WooCommerce Published 04/15/2024 Severity Medium CVE-2023-52211WordPress WP Job Manager plugin <= 2.0.0 - Broken Access Control vulnerability Exploitation status Not known exploited Fix Affected product W WP Job Manager Published 04/12/2024 Severity Medium CVE-2024-22155WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product W WooCommerce Published 04/07/2024 Severity Medium CVE-2023-51489WordPress Crowdsignal Polls & Ratings plugin <= 3.0.11 - Cross Site Request Forgery (CSRF) vulnerability Exploitation status Not known exploited Fix Affected product C Crowdsignal Dashboard – Polls, Surveys & more Published 03/16/2024 Severity Medium CVE-2023-50875WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product S Sensei LMS – Online Courses, Quizzes, & Learning Published 02/12/2024 Severity Medium CVE-2023-51488WordPress Crowdsignal Dashboard – Polls, Surveys & more Plugin <= 3.0.11 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product C Crowdsignal Dashboard – Polls, Surveys & more Published 02/10/2024 Severity High CVE-2023-52222WordPress WooCommerce Plugin <= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce Published 01/08/2024 Severity Medium CVE-2023-51502WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not known exploited Fix Affected product W WooCommerce Stripe Payment Gateway Published 01/05/2024 Severity High CVE-2023-51503WordPress WooCommerce Payments Plugin <= 6.6.2 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not known exploited Fix Affected product W WooPayments – Fully Integrated Solution Built and Supported by Woo Published 12/31/2023 Severity Medium CVE-2023-50879WordPress WordPress.com Editing Toolkit Plugin <= 3.78784 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product W WordPress.com Editing Toolkit Published 12/29/2023 Severity Medium CVE-2023-32747WordPress WooCommerce Bookings Plugin <= 1.15.78 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not known exploited Fix Affected product W WooCommerce Bookings Published 12/21/2023 Severity Medium CVE-2023-35914WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product W Woo Subscriptions Published 12/20/2023 Severity High CVE-2023-35915WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection Exploitation status Not confirmed Fix Affected product W WooPayments – Fully Integrated Solution Built and Supported by Woo Published 12/20/2023 Severity High CVE-2023-35916WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product W WooPayments – Fully Integrated Solution Built and Supported by Woo Published 12/20/2023 Severity High CVE-2023-35876WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product W WooCommerce Square Published 12/20/2023 Severity High CVE-2023-37871WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) Exploitation status Not confirmed Fix Affected product G GoCardless Published 12/20/2023 Severity High CVE-2023-47789WordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not confirmed Fix Affected product C Canada Post Shipping Method Published 12/18/2023 Severity Medium CVE-2023-47787WordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF) Exploitation status Not known exploited Fix Affected product W WooCommerce Bookings Published 12/18/2023 Severity Medium CVE-2023-49828WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not confirmed Fix Affected product W WooPayments – Fully Integrated Solution Built and Supported by Woo Published 12/14/2023 Severity Medium CVE-2023-45050WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product J Jetpack – WP Security, Backup, Speed, & Growth Published 11/30/2023 Severity Medium CVE-2023-47777WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability Exploitation status Not confirmed Fix Affected product W WooCommerce Published 11/30/2023 Severity Medium CVE-2022-3342Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization Exploitation status Not known exploited Fix Affected product J Jetpack CRM – Clients, Leads, Invoices, Billing, Email Marketing, & Automation Published 10/20/2023 Severity High CVE-2023-3706ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure Exploitation status Public exploit Fix Affected product A ActivityPub Published 10/16/2023 Severity Medium CVE-2023-3746ActivityPub for WordPress < 1.0.1 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product A ActivityPub Published 10/16/2023 Severity Medium CVE-2023-5057ActivityPub for WordPress < 1.0.0 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product A ActivityPub Published 10/16/2023 Severity Unknown CVE-2023-3707ActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure Exploitation status Public exploit Fix Affected product A ActivityPub Published 10/16/2023 Severity Medium CVE-2023-3696Prototype Pollution in automattic/mongoose Exploitation status Public exploit Fix Affected product A automattic/mongoose Published 07/17/2023 Severity Critical CVE-2023-2996Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API Exploitation status Public exploit Fix Affected product J Jetpack Published 06/27/2023 Severity Unknown CVE-2023-27429WordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS) Exploitation status Not known exploited Fix Affected product J Jetpack CRM Published 06/21/2023 Severity Medium CVE-2014-125104VaultPress Plugin MailPoet Plugin class.vaultpress-hotfixes.php protect_aioseo_ajax unrestricted upload Exploitation status Not known exploited Fix Affected product V VaultPress Plugin Published 06/01/2023 Severity Medium CVE-2023-28121Exploitation status Not confirmed Fix Not confirmed Affected product W WooCommerce Payments WordPress Plugin Published 04/12/2023 Severity Unknown CVE-2023-1912Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting Exploitation status Not known exploited Fix Affected product L Limit Login Attempts Published 04/06/2023 Severity High CVE-2022-4497Jetpack CRM < 5.5 - Contributor+ Stored XSS Exploitation status Public exploit Fix Affected product J Jetpack CRM Published 01/09/2023 Severity Medium CVE-2022-3919Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting Exploitation status Public exploit Fix Affected product J Jetpack CRM Published 12/12/2022 Severity Medium CVE-2022-45069WordPress Crowdsignal Dashboard plugin <= 3.0.9 - Privilege Escalation vulnerability Exploitation status Not known exploited Fix Affected product C Crowdsignal Dashboard – Polls, Surveys & more (WordPress plugin) Published 11/17/2022 Severity Medium CVE-2022-2080Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR Exploitation status Not confirmed Fix Affected product S Sensei LMS – Online Courses, Quizzes, & Learning Published 08/29/2022 Severity Unknown CVE-2022-2034Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API Exploitation status Public exploit Fix Affected product S Sensei LMS Published 08/29/2022 Severity Unknown CVE-2022-2386Crowdsignal Polls & Ratings < 3.0.8 - Reflected Cross-Site Scripting Exploitation status Not confirmed Fix Affected product C Crowdsignal Dashboard – Polls, Surveys & more Published 08/08/2022 Severity Unknown CVE-2022-2564Prototype Pollution in automattic/mongoose Exploitation status Public exploit Fix Affected product A automattic/mongoose Published 07/28/2022 Severity High CVE-2017-20086VaultPress Plugin code injection Exploitation status Public exploit Fix Not confirmed Affected product V VaultPress Plugin Published 06/23/2022 Severity Medium CVE-2021-32789Arbitrary SQL (SQL injection) possible via the Store API component. Exploitation status Not confirmed Fix Not confirmed Affected product W woocommerce-gutenberg-products-block Published 07/26/2021 Severity High CVE-2021-24374Jetpack < 9.8 - Carousel Module Non-Published Page/Post Attachment Comment Leak Exploitation status Not confirmed Fix Affected product J Jetpack – WP Security, Backup, Speed, & Growth Published 06/21/2021 Severity Unknown 
.svg){kind=icon}
