WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 86 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Export & Import WPBakery Page Builder Plugin Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 1.0.2 CVE-2026-81429 WPScan
6.4 Medium WPBakery Page Builder Plugin js_composer Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter ≤ 8.7.4 CVE-2026-15101 Wordfence
6.5 Medium Layouts for WPBakery Plugin layouts-for-wpbakery Broken Access Control Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action No login needed ≤ 1.1.3 CVE-2026-7726 Wordfence
6.1 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Contributor+ Stored XSS via ult_buttons Shortcode No login needed < 3.21.5 Fixed in 3.21.5 CVE-2026-14921 WPScan
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin Path Traversal Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts No login needed < 3.21.4 Fixed in 3.21.4 CVE-2026-15382 WPScan
6.5 Medium Livemesh Addons for WPBakery Page Builder Plugin addons-for-visual-composer Cross-Site Scripting ≤ 3.9.4 CVE-2026-57754 Patchstack
6.5 Medium WPBakery Page Builder Plugin js_composer Broken Access Control ≤ 8.7.2 Fixed in 8.7.3 CVE-2026-45436 Patchstack
6.4 Medium WPBakery Page Builder Addons by Livemesh Plugin addons-for-visual-composer Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 3.9.4 CVE-2026-3895 Wordfence
6.4 Medium WPBakery Page Builder Addons by Livemesh Plugin addons-for-visual-composer Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 3.9.4 CVE-2026-2030 Wordfence
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting < 3.21.4 Fixed in 3.21.4 CVE-2026-34889 Patchstack
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Broken Access Control ≤ 3.21.1 Fixed in 3.21.2 CVE-2026-28038 Patchstack
7.1 High Business Template Blocks for WPBakery (Visual Composer) Page Builder Plugin templates-and-addons-for-wpbakery-page-builder Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.3.2 CVE-2025-69390 Patchstack
8.8 High ModelTheme Addons for WPBakery and Elementor Plugin modeltheme-addons-for-wpbakery PHP Object Injection ≤ 1.5.6 Fixed in 1.5.6 CVE-2025-68531 Patchstack
8.1 High Extensive VC Addons for WPBakery page builder Plugin extensive-vc-addon Local File Inclusion No login needed ≤ 1.9.1 CVE-2025-60087 Patchstack
5.9 Medium Livemesh Addons for WPBakery Page Builder Plugin addons-for-visual-composer Cross-Site Scripting ≤ 3.9.4 CVE-2026-24594 Patchstack
6.5 Medium TheGem Theme Elements (for WPBakery) Plugin thegem-elements Cross-Site Scripting ≤ 5.11.0 Fixed in 5.11.1 CVE-2025-69360 Patchstack
8.5 High Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) Plugin azon-addon-js-composer SQL Injection ≤ 1.2 CVE-2025-30628 Patchstack
5.4 Medium Worker for WPBakery Plugin worker-wpbakery Broken Access Control ≤ 1.1.1 CVE-2025-66145 Patchstack
6.5 Medium Web and WooCommerce Addons for WPBakery Builder Plugin vc-addons-by-bit14 Cross-Site Scripting ≤ 1.5 CVE-2025-62748 Patchstack
5.9 Medium WPBakery Visual Composer WHMCS Elements Plugin void-visual-whmcs-element Cross-Site Scripting ≤ 1.0.4.3 CVE-2025-68574 Patchstack
6.5 Medium ModelTheme Addons for WPBakery and Elementor Plugin modeltheme-addons-for-wpbakery Cross-Site Scripting ≤ 1.5.6 Fixed in 1.5.6 CVE-2025-68532 Patchstack
5.4 Medium Lottier for WPBakery Plugin lottier-wpbakery Broken Access Control ≤ 1.1.7 CVE-2025-66165 Patchstack
8.1 High Extensive VC Addons for WPBakery page builder Plugin extensive-vc-addon Local File Inclusion Unauthenticated Local File Inclusion via 'shortcode_name' Parameter No login needed ≤ 1.9.1 CVE-2025-14475 Wordfence
6.4 Medium App Landing Template Blocks for WPBakery Page Builder Plugin app-template-blocks-for-wpbakery-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 2.0.2 CVE-2025-14119 Wordfence
6.5 Medium TheGem Demo Import (for WPBakery) Plugin thegem-importer Broken Access Control Arbitrary Content Deletion ≤ 5.10.5 Fixed in 5.10.5.2 CVE-2025-62046 Patchstack
8.1 High TheGem Theme Elements (for WPBakery) Plugin thegem-elements Local File Inclusion No login needed ≤ 5.10.5.1 Fixed in 5.10.5.2 CVE-2025-62045 Patchstack
6.5 Medium TheGem Theme Elements (for WPBakery) Plugin thegem-elements Cross-Site Scripting ≤ 5.10.5.1 Fixed in 5.10.5.2 CVE-2025-62044 Patchstack
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting ≤ 3.21.1 Fixed in 3.21.1 CVE-2025-48088 Patchstack
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.6 CVE-2025-10006 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting < 3.21.1 Fixed in 3.21.1 CVE-2025-11814 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Stored Cross-Site Scripting via vc_custom_heading Shortcode ≤ 8.6.1 CVE-2025-11161 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Stored Cross-Site Scripting via Custom JS Module ≤ 8.6.1 CVE-2025-11160 Wordfence
6.5 Medium HT Mega – Absolute Addons for WPBakery Page Builder Plugin ht-mega-for-wpbakery Cross-Site Scripting Absolute Addons for WPBakery Page Builder Plugin <= 1.0.9 - Cross Site Scripting (XSS) ≤ 1.0.9 Fixed in 1.1.0 CVE-2025-53463 Patchstack
6.5 Medium Card Elements for WPBakery Plugin card-elements-for-wpbakery Cross-Site Scripting ≤ 1.0.8 CVE-2025-58220 Patchstack
7.1 High Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin lbg_vp_youtube_vimeo_addon_visual_composer Cross-Site Scripting No login needed ≤ 2.1 Fixed in 2.2 CVE-2025-48154 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-48170 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg-universal-video-player-addon-visual-composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53559 Patchstack
7.1 High Universal Video Player - Addon for WPBakery Page Builder Plugin lbg_universal_video_player_addon_visual_composer Cross-Site Scripting Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) No login needed ≤ 3.2.1 Fixed in 3.2.2.0 CVE-2025-53562 Patchstack
7.1 High HTML5 Radio Player - WPBakery Page Builder Addon Plugin lbg_radio_player_addon_visual_composer Cross-Site Scripting WPBakery Page Builder Addon <= 2.5 - Cross Site Scripting (XSS) No login needed ≤ 2.5 Fixed in 2.5.2 CVE-2025-53564 Patchstack
7.1 High Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin lbg_vp_youtube_vimeo_addon_visual_composer Cross-Site Scripting No login needed ≤ 2.1 CVE-2025-30626 Patchstack
5.9 Medium OpenStreetMap for Gutenberg and WPBakery Page Builder Plugin Cross-Site Scripting Contributor+ Stored XSS ≤ 1.2.0 CVE-2025-6572 WPScan
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.5 CVE-2025-7502 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements ≤ 8.4.1 CVE-2025-4968 Wordfence
7.5 High HTML5 Radio Player - WPBakery Page Builder Addon Plugin lbg-cleverbakery Path Traversal WPBakery Page Builder Addon plugin <= 2.5 - Arbitrary File Download No login needed ≤ 2.5 Fixed in 2.5.3 CVE-2025-31070 Patchstack
6.5 Medium HT Mega – Absolute Addons for WPBakery Page Builder Plugin ht-mega-for-wpbakery Cross-Site Scripting Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) ≤ 1.0.8 Fixed in 1.0.9 CVE-2025-53206 Patchstack
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder ≤ 8.4.1 CVE-2025-4965 Wordfence
9.8 Critical Smart Sections Theme Builder - WPBakery Page Builder Addon Plugin visucom-smart-sections PHP Object Injection WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection No login needed ≤ 1.7.8 CVE-2025-39410 Patchstack
6.5 Medium WPBakery Visual Composer WHMCS Elements Plugin void-visual-whmcs-element Cross-Site Scripting ≤ 1.0.4.3 CVE-2025-47659 Patchstack
6.5 Medium Image Hover Effects For WPBakery Page Builder Plugin image-hover-effects-for-visual-composer Cross-Site Scripting ≤ 2.0 CVE-2025-46484 Patchstack
6.4 Medium Amazing service box Addons For WPBakery Page Builder Plugin amazing-service-box-visual-composer-addons Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 2.0.0 CVE-2025-2573 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only