WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–41 of 41 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	WPBakery Page Builder Plugin `js_composer`	Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter	`≤ 8.7.4`	Sep 1, 2026	`CVE-2026-15101`	Wordfence
6.1 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Cross-Site Scripting Contributor+ Stored XSS via ult_buttons Shortcode No login needed	`< 3.21.5` Fixed in `3.21.5`	Jul 31, 2026	`CVE-2026-14921`	WPScan
6.5 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Path Traversal Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts No login needed	`< 3.21.4` Fixed in `3.21.4`	Jul 30, 2026	`CVE-2026-15382`	WPScan
6.5 Medium	Livemesh Addons for WPBakery Page Builder Plugin `addons-for-visual-composer`	Cross-Site Scripting	`≤ 3.9.4`	Jul 2, 2026	`CVE-2026-57754`	Patchstack
6.5 Medium	WPBakery Page Builder Plugin `js_composer`	Broken Access Control	`≤ 8.7.2` Fixed in `8.7.3`	Jun 17, 2026	`CVE-2026-45436`	Patchstack
6.4 Medium	WPBakery Page Builder Addons by Livemesh Plugin `addons-for-visual-composer`	Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting	`≤ 3.9.4`	May 27, 2026	`CVE-2026-3895`	Wordfence
6.4 Medium	WPBakery Page Builder Addons by Livemesh Plugin `addons-for-visual-composer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 3.9.4`	May 27, 2026	`CVE-2026-2030`	Wordfence
6.5 Medium	Ultimate Addons for WPBakery Page Builder Plugin `ultimate_vc_addons`	Cross-Site Scripting	`< 3.21.4` Fixed in `3.21.4`	Apr 1, 2026	`CVE-2026-34889`	Patchstack
6.5 Medium	Ultimate Addons for WPBakery Page Builder Plugin `ultimate_vc_addons`	Broken Access Control	`≤ 3.21.1` Fixed in `3.21.2`	Mar 5, 2026	`CVE-2026-28038`	Patchstack
5.9 Medium	Livemesh Addons for WPBakery Page Builder Plugin `addons-for-visual-composer`	Cross-Site Scripting	`≤ 3.9.4`	Jan 23, 2026	`CVE-2026-24594`	Patchstack
6.4 Medium	App Landing Template Blocks for WPBakery Page Builder Plugin `app-template-blocks-for-wpbakery-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	`≤ 2.0.2`	Dec 12, 2025	`CVE-2025-14119`	Wordfence
6.5 Medium	Ultimate Addons for WPBakery Page Builder Plugin `ultimate_vc_addons`	Cross-Site Scripting	`≤ 3.21.1` Fixed in `3.21.1`	Oct 27, 2025	`CVE-2025-48088`	Patchstack
6.4 Medium	WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 8.6`	Oct 18, 2025	`CVE-2025-10006`	Wordfence
6.4 Medium	Ultimate Addons for WPBakery Page Builder Plugin `ultimate_vc_addons`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`< 3.21.1` Fixed in `3.21.1`	Oct 16, 2025	`CVE-2025-11814`	Wordfence
6.4 Medium	WPBakery Page Builder Plugin	Cross-Site Scripting Stored Cross-Site Scripting via vc_custom_heading Shortcode	`≤ 8.6.1`	Oct 15, 2025	`CVE-2025-11161`	Wordfence
6.4 Medium	WPBakery Page Builder Plugin	Cross-Site Scripting Stored Cross-Site Scripting via Custom JS Module	`≤ 8.6.1`	Oct 15, 2025	`CVE-2025-11160`	Wordfence
6.5 Medium	HT Mega – Absolute Addons for WPBakery Page Builder Plugin `ht-mega-for-wpbakery`	Cross-Site Scripting Absolute Addons for WPBakery Page Builder Plugin <= 1.0.9 - Cross Site Scripting (XSS)	`≤ 1.0.9` Fixed in `1.1.0`	Sep 22, 2025	`CVE-2025-53463`	Patchstack
5.9 Medium	OpenStreetMap for Gutenberg and WPBakery Page Builder Plugin	Cross-Site Scripting Contributor+ Stored XSS	`≤ 1.2.0`	Aug 8, 2025	`CVE-2025-6572`	WPScan
6.4 Medium	WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 8.5`	Aug 6, 2025	`CVE-2025-7502`	Wordfence
6.4 Medium	WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements	`≤ 8.4.1`	Jul 24, 2025	`CVE-2025-4968`	Wordfence
6.5 Medium	HT Mega – Absolute Addons for WPBakery Page Builder Plugin `ht-mega-for-wpbakery`	Cross-Site Scripting Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS)	`≤ 1.0.8` Fixed in `1.0.9`	Jun 27, 2025	`CVE-2025-53206`	Patchstack
6.4 Medium	WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Grid Builder	`≤ 8.4.1`	Jun 19, 2025	`CVE-2025-4965`	Wordfence
6.5 Medium	Image Hover Effects For WPBakery Page Builder Plugin `image-hover-effects-for-visual-composer`	Cross-Site Scripting	`≤ 2.0`	Apr 24, 2025	`CVE-2025-46484`	Patchstack
6.4 Medium	Amazing service box Addons For WPBakery Page Builder Plugin `amazing-service-box-visual-composer-addons`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload	`≤ 2.0.0`	Mar 26, 2025	`CVE-2025-2573`	Wordfence
6.4 Medium	Team Builder For WPBakery Page Builder(Formerly Visual Composer) Plugin `team-builder-for-wpbakery-page-builder`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 1.0`	Feb 19, 2025	`CVE-2024-13591`	Wordfence
6.4 Medium	Simple Pricing Tables For WPBakery Page Builder(Formerly Visual Composer) Plugin `simple-pricing-tables-vc-extension`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 1.0`	Feb 18, 2025	`CVE-2024-13582`	Wordfence
6.5 Medium	GMAPS for WPBakery Page Builder Free Plugin `gmaps-for-visual-composer-free`	Cross-Site Scripting	`≤ 1.2`	Jan 16, 2025	`CVE-2025-23775`	Patchstack
6.4 Medium	Pricing Tables For WPBakery Page Builder (formerly Visual Composer) Plugin `pricing-tables-for-visual-composer`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via wdo_pricing_tables Shortcode	`≤ 1.4`	Nov 27, 2024	`CVE-2024-10175`	Wordfence
6.5 Medium	Classic Addons – WPBakery Page Builder Plugin `classic-addons-wpbakery-page-builder-addons`	Cross-Site Scripting WPBakery Page Builder plugin <= 3.5 - Cross Site Scripting (XSS)	`≤ 3.5` Fixed in `3.6`	Aug 29, 2024	`CVE-2024-43953`	Patchstack
6.5 Medium	Livemesh Addons for WPBakery Page Builder Plugin `addons-for-visual-composer`	Cross-Site Scripting	`≤ 3.9` Fixed in `3.9.1`	Aug 18, 2024	`CVE-2024-43320`	Patchstack
6.5 Medium	Tabs For WPBakery Page Builder Plugin `tabs-for-visual-composer`	Cross-Site Scripting	`≤ 1.2`	Jul 20, 2024	`CVE-2024-37936`	Patchstack
6.4 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.19.20`	Jul 17, 2024	`CVE-2024-5251`	Wordfence
6.4 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.19.20`	Jul 17, 2024	`CVE-2024-5253`	Wordfence
6.4 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.19.20`	Jul 17, 2024	`CVE-2024-5252`	Wordfence
6.4 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.19.20`	Jul 17, 2024	`CVE-2024-5255`	Wordfence
6.4 Medium	Ultimate Addons for WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.19.20`	Jul 17, 2024	`CVE-2024-5254`	Wordfence
6.4 Medium	WPBakery Page Builder Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute	`≤ 7.6`	Jun 13, 2024	`CVE-2024-5265`	Wordfence
6.5 Medium	OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Plugin `stepbyteservice-openstreetmap`	Cross-Site Scripting	`≤ 1.1.1` Fixed in `1.1.2`	Mar 29, 2024	`CVE-2024-30450`	Patchstack
6.5 Medium	Carousel Anything For WPBakery Page Builder Plugin `carousel-anything`	Cross-Site Scripting	`≤ 2.1`	Mar 29, 2024	`CVE-2024-30520`	Patchstack
6.5 Medium	Livemesh Addons for WPBakery Page Builder Plugin `addons-for-visual-composer`	Cross-Site Scripting	`≤ 3.7` Fixed in `3.8`	Mar 27, 2024	`CVE-2024-30183`	Patchstack
6.4 Medium	WPBakery Page Builder Addons by Livemesh Plugin	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	`≤ 3.8.1`	Mar 13, 2024	`CVE-2024-2079`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.