# WordPress.org vulnerabilities Source: https://junglewise.ai/threats/vendors/wordpress-org Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/wordpress-org.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 52 vulnerabilities in WordPress.org: 7 in the last 7 days and 51 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-125844, was published on 11 November 2026. 20 vulnerabilities in the last four weeks, level on the four before (20). ## Counts - Last 7 days: 7 - Last 30 days: 23 - Last 90 days: 51 - All time: 52 (0 critical, 0 exploited in the wild) ## About WordPress.org Official WordPress project providing open-source website creation and content management software. ## Latest WordPress.org vulnerabilities - [CVE-2026-125844: WordPress vice theme CSRF vulnerability](https://junglewise.ai/threats/cve-2026-125844-cross-site-request-forgery-csrf-vulnerability-in-webriti-vice) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-119615: Reset Database plugin for WordPress privilege escalation](https://junglewise.ai/threats/cve-2026-119615-the-reset-database-plugin-for-wordpress-is-vulnerable-to) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-119097: Author Image plugin for WordPress stored XSS via display_name](https://junglewise.ai/threats/cve-2026-119097-the-author-image-plugin-for-wordpress-is-vulnerable-to-stored) (medium, CVSS 6.4, published 11 Nov 2026) - [CVE-2026-116537: Link Library WordPress plugin stored XSS in link_description](https://junglewise.ai/threats/cve-2026-116537-the-link-library-plugin-for-wordpress-is-vulnerable-to-stored) (high, CVSS 7.2, published 7 Nov 2026) - [CVE-2026-118204: WP Data Access stored cross-site scripting in image URL column](https://junglewise.ai/threats/cve-2026-118204-the-wp-data-access-app-builder-for-tables-forms-dashboards) (medium, CVSS 6.4, published 7 Nov 2026) - [CVE-2026-116545: All-in-One Video Gallery stored DOM-based XSS in track custom fields](https://junglewise.ai/threats/cve-2026-116545-the-all-in-one-video-gallery-video-player-galleries-for-youtube) (medium, CVSS 6.4, published 6 Nov 2026) - [CVE-2026-103908: AMP for WP arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-103908-the-the-amp-for-wp-accelerated-mobile-pages-plugin-for-wordpress) (medium, CVSS 5.4, published 6 Nov 2026) - [CVE-2026-16304: WP Event Manager arbitrary post takeover via post identifier validation](https://junglewise.ai/threats/cve-2026-16304-the-wp-event-manager-wordpress-plugin-before-3-4-2-does-not) (info, published 5 Nov 2026) - [CVE-2026-103898: WP Social Login and Register Social Counter authentication bypass](https://junglewise.ai/threats/cve-2026-103898-the-wp-social-login-and-register-social-counter-plugin-for) (high, CVSS 8.1, published 31 Oct 2026) - [CVE-2026-119162: User Submitted Posts plugin for WordPress stored DOM-based XSS](https://junglewise.ai/threats/cve-2026-119162-the-user-submitted-posts-enable-users-to-submit-posts-from-the) (high, CVSS 7.2, published 31 Oct 2026) - [CVE-2026-107765: The Discussion Board stored cross-site scripting in user profile](https://junglewise.ai/threats/cve-2026-107765-the-discussion-board-wordpress-forum-plugin-plugin-for-wordpress) (medium, CVSS 6.4, published 31 Oct 2026) - [CVE-2026-116851: eCommerce Product Catalog unauthenticated cross-site scripting](https://junglewise.ai/threats/cve-2026-116851-unauthenticated-cross-site-scripting-xss-in-ecommerce-product) (high, CVSS 7.1, published 30 Oct 2026) - [CVE-2026-104368: Export and Import Users and Customers plugin privilege escalation](https://junglewise.ai/threats/cve-2026-104368-the-export-and-import-users-and-customers-plugin-for-wordpress) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-93293: Password Protected WordPress plugin stored XSS in Freemius SDK](https://junglewise.ai/threats/cve-2026-93293-the-password-protected-plugin-for-wordpress-is-vulnerable-to) (medium, CVSS 6.4, published 29 Oct 2026) - [CVE-2026-116610: Clean Login WordPress plugin authorization bypass in shortcode handler](https://junglewise.ai/threats/cve-2026-116610-the-clean-login-plugin-for-wordpress-is-vulnerable-to-missing) (medium, CVSS 4.3, published 28 Oct 2026) - [CVE-2026-116609: WordPress WP Visitor Statistics SQL injection in shortcode](https://junglewise.ai/threats/cve-2026-116609-the-wp-visitor-statistics-real-time-traffic-plugin-for-wordpress) (medium, CVSS 6.5, published 28 Oct 2026) - [CVE-2026-115807: User Profile Builder privilege escalation via Gutenberg Register block](https://junglewise.ai/threats/cve-2026-115807-the-user-profile-builder-beautiful-user-registration-forms-user) (high, CVSS 7.1, published 24 Oct 2026) - [CVE-2026-112219: Download Monitor WordPress plugin incorrect authorization in multisite](https://junglewise.ai/threats/cve-2026-112219-the-download-monitor-wordpress-plugin-before-5-3-5-does-not) (info, published 23 Oct 2026) - [CVE-2026-105996: WordPress Booking Package weak token generation in booking cancellation](https://junglewise.ai/threats/cve-2026-105996-the-booking-package-wordpress-plugin-before-1-7-31-does-not) (info, published 21 Oct 2026) - [CVE-2012-20003: WordPress Custom Tables reflected XSS in iframe.php](https://junglewise.ai/threats/cve-2012-20003-custom-tables-plugin-for-wordpress-before-3-4-6-contains-a) (medium, CVSS 6.1, published 20 Oct 2026) - [CVE-2026-74922: Document Gallery WordPress plugin webhook signature bypass](https://junglewise.ai/threats/cve-2026-74922-the-document-gallery-wordpress-plugin-through-5-1-1-does-not) (medium, CVSS 5.3, published 19 Oct 2026) - [CVE-2026-104000: Simply Schedule Appointments plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-104000-the-simply-schedule-appointments-plugin-for-wordpress-is) (high, CVSS 7.2, published 16 Oct 2026) - [CVE-2026-109191: Image Hub WordPress plugin sensitive information exposure](https://junglewise.ai/threats/cve-2026-109191-the-image-hub-free-images-from-unsplash-pixabay-pexels-openverse) (medium, CVSS 4.3, published 16 Oct 2026) - [CVE-2026-103305: WordPress Prenotazioni plugin stored XSS in settings](https://junglewise.ai/threats/cve-2026-103305-the-prenotazioni-wordpress-plugin-through-1-7-5-does-not-have) (high, CVSS 8.8, published 11 Oct 2026) - [CVE-2026-103427: Simple Membership plugin stored XSS in country parameter](https://junglewise.ai/threats/cve-2026-103427-the-simple-membership-plugin-for-wordpress-is-vulnerable-to) (medium, CVSS 6.4, published 10 Oct 2026) ## Most severe WordPress.org vulnerabilities - [CVE-2026-16502: Live Composer PHP Object Injection via deserialization](https://junglewise.ai/threats/cve-2026-16502-live-composer-php-object-injection-via-deserialization) (high, CVSS 8.8, published 8 Sep 2026) - [CVE-2026-86583: Import and export users and customers plugin privilege escalation](https://junglewise.ai/threats/cve-2026-86583-the-import-and-export-users-and-customers-plugin-for-wordpress-is) (high, CVSS 8.8, published 23 Sep 2026) - [CVE-2026-103305: WordPress Prenotazioni plugin stored XSS in settings](https://junglewise.ai/threats/cve-2026-103305-the-prenotazioni-wordpress-plugin-through-1-7-5-does-not-have) (high, CVSS 8.8, published 11 Oct 2026) - [CVE-2026-125844: WordPress vice theme CSRF vulnerability](https://junglewise.ai/threats/cve-2026-125844-cross-site-request-forgery-csrf-vulnerability-in-webriti-vice) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-119615: Reset Database plugin for WordPress privilege escalation](https://junglewise.ai/threats/cve-2026-119615-the-reset-database-plugin-for-wordpress-is-vulnerable-to) (high, CVSS 8.8, published 11 Nov 2026) - [CVE-2026-104368: Export and Import Users and Customers plugin privilege escalation](https://junglewise.ai/threats/cve-2026-104368-the-export-and-import-users-and-customers-plugin-for-wordpress) (high, CVSS 8.8, published 30 Oct 2026) - [CVE-2026-66594: WordPress Persistent Login SQL injection in subscriber role](https://junglewise.ai/threats/cve-2026-66594-wordpress-persistent-login-sql-injection-in-subscriber-role) (high, CVSS 8.5, published 20 Aug 2026) - [CVE-2026-103898: WP Social Login and Register Social Counter authentication bypass](https://junglewise.ai/threats/cve-2026-103898-the-wp-social-login-and-register-social-counter-plugin-for) (high, CVSS 8.1, published 31 Oct 2026) - [CVE-2026-74020: Koji WordPress Theme broken access control](https://junglewise.ai/threats/cve-2026-74020-koji-wordpress-theme-broken-access-control) (high, CVSS 7.5, published 20 Aug 2026) - [CVE-2026-97337: Simple Membership WordPress plugin unauthorized account activation and credential disclosure](https://junglewise.ai/threats/cve-2026-97337-the-simple-membership-plugin-for-wordpress-is-vulnerable-to) (high, CVSS 7.5, published 3 Oct 2026) ## Vulnerabilities per week 20 vulnerabilities in the last four weeks, level on the four before (20). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 3 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 6 | 0 | 0 | | 28 Sep 2026 | 7 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 5 | 0 | 0 | | 26 Oct 2026 | 8 | 0 | 0 | | 2 Nov 2026 | 5 | 0 | 0 | | 9 Nov 2026 | 3 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "WordPress.org vulnerabilities", https://junglewise.ai/threats/vendors/wordpress-org, 13 November 2026.