WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 76 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.1 Critical Beaver Builder Page Builder Plugin beaver-builder-lite-version Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output No login needed ≤ 2.11.0.5 CVE-2026-92084 Wordfence
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version SQL Injection Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter ≤ 2.11.0.5 CVE-2026-95865 Wordfence
5.4 Medium Orbit Fox Plugin Cross-Site Scripting Contributor+ Stored XSS via Beaver Builder Pricing Table Widget < 3.0.9 Fixed in 3.0.9 CVE-2026-85418 WPScan
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.10.3.1 CVE-2026-18021 Wordfence
6.1 Medium Beaver Builder Plugin (Pro Version) Plugin Cross-Site Scripting Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter No login needed ≤ 2.11.0.1 CVE-2026-18843 Wordfence
6.4 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Button Module 'button' Parameter ≤ 2.10.2.2 CVE-2026-17090 Wordfence
6.4 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization ≤ 3.9.2 CVE-2026-3897 Wordfence
8.5 High Beaver Builder Plugin beaver-builder-lite-version SQL Injection ≤ 2.10.1.2 Fixed in 2.10.1.5 CVE-2026-40744 Patchstack
6.4 Medium Beaver Builder Page Builder – Drag and Drop Website Builder Plugin beaver-builder-lite-version Cross-Site Scripting Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]' ≤ 2.10.1.1 CVE-2026-2481 Wordfence
5.3 Medium Xpro Addons For Beaver Builder – Lite Plugin xpro-addons-beaver-builder-elementor Broken Access Control Lite plugin <= 1.5.6 - Broken Access Control No login needed ≤ 1.5.6 Fixed in 1.5.7 CVE-2026-32395 Patchstack
6.4 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' and 'value' Shortcode Attributes ≤ 3.9.2 CVE-2026-2029 Wordfence
6.4 Medium Beaver Builder Page Builder – Drag and Drop Website Builder Plugin beaver-builder-lite-version Broken Access Control Drag and Drop Website Builder <= 2.10.0.5 - Authenticated (Custom+) Missing Authorization to Stored Cross-Site Scripting via Global Settings ≤ 2.10.0.5 CVE-2026-1231 Wordfence
7.5 High Beaver Builder Plugin beaver-builder-lite-version Remote Code Execution Arbitrary Code Execution ≤ 2.9.4.1 Fixed in 2.9.4.2 CVE-2025-69319 Patchstack
5.3 Medium Dashboard Welcome for Beaver Builder Plugin dashboard-welcome-for-beaver-builder Broken Access Control No login needed ≤ 1.0.8 CVE-2026-22488 Patchstack
6.5 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting ≤ 3.9.2 CVE-2025-62990 Patchstack
8.1 High Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update ≤ 2.9.4.1 CVE-2025-12934 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Information Disclosure WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure ≤ 2.9.4 CVE-2025-12558 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering ≤ 2.9.4 CVE-2025-12782 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification ≤ 2.9.4 CVE-2025-11726 Wordfence
6.4 Medium Beaver Builder Plugin (Starter Version) Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play' ≤ 2.9.2.1 CVE-2025-8427 Wordfence
6.1 Medium Beaver Builder Plugin (Lite Version) Plugin beaver-builder-lite-version Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 2.9.2.1 CVE-2025-8897 Wordfence
6.4 Medium Supreme Addons for Beaver Builder Plugin supreme-addons-for-beaver-builder-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via auto_qrcodesabb Shortcode ≤ 1.0.9 CVE-2025-3669 Wordfence
7.2 High Beaver Builder Plugin (Starter Version) Plugin Arbitrary File Upload Authenticated (Administrator+) Arbitrary File Upload ≤ 2.9.1 CVE-2025-4102 Wordfence
6.5 Medium Xpro Addons For Beaver Builder – Lite Plugin xpro-addons-beaver-builder-elementor Cross-Site Scripting Lite plugin <= 1.5.5 - Cross Site Scripting (XSS) ≤ 1.5.5 Fixed in 1.5.6 CVE-2025-48232 Patchstack
6.1 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting Reflected Cross-Site Scripting via Navigate Parameter No login needed ≤ 1.3.0.5 CVE-2024-12239 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin Cross-Site Scripting WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.4.4 CVE-2024-11832 Wordfence
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.8.4.3 Fixed in 2.8.4.4 CVE-2024-53797 Patchstack
6.5 Medium Beaver Builder Addons by WPZOOM Plugin wpzoom-addons-for-beaver-builder Cross-Site Scripting ≤ 1.3.4 Fixed in 1.3.5 CVE-2024-30424 Patchstack
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.8.3.7 Fixed in 2.8.3.9 CVE-2024-50430 Patchstack
6.5 Medium Sales Page Addon – Elementor & Beaver Builder Plugin sales-page-addon Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.4.5 CVE-2024-51585 Patchstack
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.4.2 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Widget ≤ 2.8.4.2 CVE-2024-9505 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module ≤ 2.8.3.6 CVE-2024-9049 Wordfence
6.4 Medium Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) Plugin graphicsly Cross-Site Scripting The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.2 CVE-2024-9069 Wordfence
7.1 High Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.8.3.2 Fixed in 2.8.3.4 CVE-2024-43926 Patchstack
6.4 Medium Beaver Builder (Lite Version) Plugin beaver-builder-lite-version Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via type Parameter ≤ 2.8.3.5 CVE-2024-7895 Wordfence
7.1 High PowerPack for Beaver Builder Plugin bbpowerpack Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed < 2.37.4 Fixed in 2.37.4 CVE-2024-43330 Patchstack
6.5 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) ≤ 1.5.9 Fixed in 1.5.10 CVE-2024-43151 Patchstack
8.8 High PowerPack for Beaver Builder Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.33.0 Fixed in 2.33.1 CVE-2024-39633 Patchstack
6.5 Medium Ninja Beaver Add-ons for Beaver Builder Plugin ninja-beaver-lite-addons-for-beaver-builder Cross-Site Scripting ≤ 2.4.5 CVE-2024-37244 Patchstack
5.9 Medium Cards for Beaver Builder Plugin bb-bootstrap-cards Cross-Site Scripting ≤ 1.1.4 Fixed in 1.1.5 CVE-2024-37278 Patchstack
5.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting ≤ 1.3.0.4 Fixed in 1.3.0.5 CVE-2024-37409 Patchstack
5.9 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting ≤ 3.6.1 Fixed in 3.7 CVE-2024-38784 Patchstack
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.8.2.2 Fixed in 2.8.3 CVE-2024-37500 Patchstack
5.9 Medium Timeline Module for Beaver Builder Plugin timeline-for-beaver-builder Cross-Site Scripting ≤ 1.1.3 CVE-2024-37919 Patchstack
4.9 Medium Beaver Builder Addons by WPZOOM Plugin wpzoom-addons-for-beaver-builder Local File Inclusion ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-37464 Patchstack
4.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Local File Inclusion ≤ 1.3.0.3 Fixed in 1.3.0.4 CVE-2024-37410 Patchstack
6.4 Medium Cards for Beaver Builder Plugin bb-bootstrap-cards Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget ≤ 1.1.3 CVE-2024-5663 Wordfence
6.4 Medium Ninja Beaver Add-ons for Beaver Builder Plugin ninja-beaver-lite-addons-for-beaver-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets ≤ 2.4.5 CVE-2024-2163 Wordfence
6.3 Medium Ultimate Addons for Beaver Builder Plugin ultimate-addons-for-beaver-builder-lite Path Traversal Limited Arbitrary File Download ≤ 1.35.13 Fixed in 1.35.14 CVE-2023-51401 Patchstack
8.8 High Ultimate Addons for Beaver Builder Plugin ultimate-addons-for-beaver-builder-lite Privilege Escalation ≤ 1.35.14 Fixed in 1.35.15 CVE-2023-51398 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only