Known Vulnerabilities for WordPress by WordPress Foundation
Listed below are 10 of the newest known vulnerabilities associated with "WordPress" by "WordPress Foundation".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-42726 json | Missing Authorization vulnerability in Strategy11 Team AWP Classifieds another-wordpress-classifieds-plugin allows Exploiting... | Not Provided | 2026-05-27 | 2026-05-27 |
| CVE-2026-41471 json | The Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains an information disclosure vulnerability in ... | Not Provided | 2026-05-04 | 2026-05-26 |
| CVE-2026-40308 json | My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX end... | Not Provided | 2026-04-16 | 2026-04-17 |
| CVE-2026-39614 json | Missing Authorization vulnerability in ilGhera JW Player for WordPress jw-player-7-for-wp allows Exploiting Incorrectly Confi... | Not Provided | 2026-04-08 | 2026-04-29 |
| CVE-2026-39466 json | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMU DEV - Your All-in-... | Not Provided | 2026-04-08 | 2026-04-13 |
| CVE-2026-34424 json | Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a ... | Not Provided | 2026-04-09 | 2026-04-09 |
| CVE-2026-33559 json | WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affecte... | Not Provided | 2026-03-27 | 2026-03-27 |
| CVE-2026-33290 json | WPGraphQL provides a GraphQL API for WordPress sites. Prior to version 2.10.0, an authorization flaw in updateComment allows ... | Not Provided | 2026-03-24 | 2026-03-24 |
| CVE-2026-32834 json | Easy PayPal Events & Tickets plugin for WordPress before version 1.4 contains a hardcoded authentication bypass vulnerability... | Not Provided | 2026-05-04 | 2026-05-13 |
| CVE-2026-32448 json | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Teubert Podlove Po... | Not Provided | 2026-03-13 | 2026-04-01 |