WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,070 vulnerabilities, 1,395 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,150 High 8,917 Medium 17,674 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 6, 2026.

Showing 1–38 of 38 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Divi Membership Plugin Privilege Escalation Unauthenticated Privilege Escalation via 'form_id' Parameter No login needed ≤ 2.2.0 CVE-2026-19652 Wordfence
9.8 Critical Divi Membership Plugin Authentication Bypass Unauthenticated Authentication Bypass via 'paypal_param' Parameter No login needed ≤ 2.3.0 CVE-2026-19660 Wordfence
5.9 Medium Supreme Modules Lite Plugin supreme-modules-for-divi Cross-Site Scripting ≤ 2.5.63 Fixed in 2.5.64 CVE-2026-102384 Patchstack
8.2 High Divi Dash Plugin Denial of Service Unauthenticated Denial of Service via IP Address Spoofing No login needed < 1.0.7 Fixed in 1.0.7 CVE-2026-14321 WPScan
6.5 Medium Divi Essentials Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action ≤ 5.8.1 CVE-2026-15760 Wordfence
5.3 Medium Divi Theme Broken Access Control Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint No login needed ≤ 5.11.1 CVE-2026-91707 Wordfence
5.0 Medium Divi Theme Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter ≤ 4.27.6 CVE-2026-4361 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter ≤ 4.27.6 CVE-2026-3853 Wordfence
9.8 Critical Divi Ajax Filter Plugin Local File Inclusion Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter No login needed ≤ 5.1.2 CVE-2026-11613 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter ≤ 4.27.6 CVE-2026-3852 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter ≤ 4.27.5 CVE-2026-3850 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode ≤ 4.27.6 CVE-2026-3851 Wordfence
6.8 Medium SOGO Add Script to Individual Pages Header Footer Plugin Cross-Site Scripting Contributor+ Stored XSS via Post Metabox ≤ 3.9 CVE-2026-14835 WPScan
5.4 Medium Divi Theme Cross-Site Scripting Contributor+ Stored XSS via Social Media Follow Skype URL 5.0 – < 5.9.0 Fixed in 5.9.0 CVE-2026-13712 WPScan
7.1 High FunnelKit Plugin funnel-builder Cross-Site Scripting Reflected XSS via Divi Optin Form No login needed < 3.15.0.6 Fixed in 3.15.0.6 CVE-2026-12978 WPScan
6.5 Medium Author Box WP Lens Plugin author-box-for-divi Cross-Site Scripting ≤ 2.1.5 Fixed in 2.1.6 CVE-2026-57420 Patchstack
8.8 High Divi Torque Lite Plugin addons-for-divi Cross-Site Request Forgery Cross-Site Request Forgery to Arbitrary Plugin Installation via 'install_plugin' REST Endpoint No login needed ≤ 4.2.3 CVE-2026-4275 Wordfence
8.8 High Divi Form Builder Plugin Broken Access Control Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via User Profile Update Form ≤ 5.1.8 CVE-2026-5523 Wordfence
9.8 Critical Divi Form Builder Plugin Arbitrary File Upload Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter No login needed ≤ 5.1.8 CVE-2026-5524 Wordfence
8.6 High Contact Form Extender for Divi – Save Entries, File Upload & Country Code Field Plugin contact-form-extender-for-divi-builder Arbitrary File Upload Save Entries, File Upload & Country Code Field plugin <= 1.0.6 - Arbitrary File Deletion No login needed ≤ 1.0.6 Fixed in 1.0.7 CVE-2026-40769 Patchstack
8.8 High Content Visibility for Divi Builder Plugin content-visibility-for-divi-builder Remote Code Execution Authenticated (Contributor+) Remote Code Execution ≤ 4.02 CVE-2026-1829 Wordfence
6.4 Medium Simple Divi Shortcode Plugin simple-divi-shortcode Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute ≤ 1.2 CVE-2026-9714 Wordfence
9.8 Critical Divi Form Builder Plugin Privilege Escalation Unauthenticated Privilege Escalation via 'role' No login needed ≤ 5.1.2 CVE-2026-5118 Wordfence
8.1 High Divi Booster Plugin PHP Object Injection Unauthenticated PHP Object Injection No login needed < 5.0.2 Fixed in 5.0.2 CVE-2026-2626 WPScan
8.8 High Supreme Modules Lite Plugin supreme-modules-for-divi Arbitrary File Upload Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass ≤ 2.5.62 CVE-2025-13062 Wordfence
6.3 Medium Schema Plugin For Divi, Gutenberg & Shortcodes Plugin wp-structured-data-schema PHP Object Injection Authenticated (Contributor+) Object Instantiation ≤ 4.3.2 CVE-2025-7825 Wordfence
4.3 Medium ACME Divi Modules Plugin acme-divi-modules Broken Access Control ≤ 1.3.5 CVE-2025-31540 Patchstack
5.8 Medium Give – Divi Donation Modules Plugin give-donation-modules-for-divi Information Disclosure Divi Donation Modules plugin <= 2.0.0 - Sensitive Data Exposure No login needed ≤ 2.0.0 Fixed in 2.0.1 CVE-2025-22633 Patchstack
6.4 Medium Divi Torque Lite Plugin addons-for-divi Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 4.1.0 CVE-2025-0353 Wordfence
6.4 Medium Divi Carousel Lite Plugin wow-carousel-for-divi-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets ≤ 2.0.4 CVE-2025-0350 Wordfence
4.3 Medium Disable Admin Notices individually Plugin disable-admin-notices Cross-Site Request Forgery No login needed ≤ 1.4.0 Fixed in 1.4.1 CVE-2024-52420 Patchstack
6.4 Medium Exclusive Divi – Divi Preloader, Modules for Divi & Extra Plugin exclusive-divi Cross-Site Scripting Divi Preloader, Modules for Divi & Extra Theme <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.4 CVE-2024-9386 Wordfence
6.4 Medium Divi Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.25.1 CVE-2024-5533 Wordfence
6.4 Medium Divi Torque Lite – Divi Theme and Extra Plugin addons-for-divi Cross-Site Scripting Divi Theme and Extra Theme <= 3.6.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload ≤ 3.6.6 CVE-2024-5892 Wordfence
6.4 Medium Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder Plugin supreme-modules-for-divi Cross-Site Scripting Divi Theme, Extra Theme and Divi Builder <= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.5.51 CVE-2024-5501 Wordfence
6.4 Medium Premium Addons for Elementor Plugin premium-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Menu and Shape Divider ≤ 4.10.31 CVE-2024-4378 Wordfence
6.4 Medium Elegant Themes Divi Theme, Extra Theme, Divi Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 4.25.0 CVE-2024-4490 Wordfence
6.4 Medium Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder Plugin supreme-modules-for-divi Cross-Site Scripting Divi Theme, Extra Theme and Divi Builder <= 2.5.3 - Authenticated (Contributor+) DOM-Based Cross-Site Scripting ≤ 2.5.3 CVE-2024-4334 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only