WordPress Security Tracker

Counting vulnerabilities so you don't have to.

Last 30 Days Breakdown

• 760 plugin vulnerabilities
• 18 theme vulnerabilities
• 2 core vulnerabilities

Recent Critical & High Severity

• high Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field CVSS 8.8 · Pronamic Pay
• critical Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change CVSS 9.8 · Single Sign On For TNG
• high NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CVSS 8.1 · NEX-Forms – Ultimate Forms Plugin for WordPress
• high MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder <= 4.3.3 - Unauthenticated Stored Cross-Site Scripting via Form Field Values CVSS 7.2 · MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder
• high Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter CVSS 8.1 · Kali Forms — Contact Form & Drag-and-Drop Builder
• high AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match CVSS 8.8 · AI Engine – The Chatbot, AI Framework & MCP for WordPress
• critical FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter CVSS 9.1 · FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More
• high Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field CVSS 7.5 · Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
• high Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta CVSS 8.8 · Subscriptions for WooCommerce
• critical Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command CVSS 9.8 · Realtyna Organic IDX plugin + WPL Real Estate

Last updated: Aug 1, 2026, 06:52 AM