WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 92 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
6.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder No login needed ≤ 13.2.0 CVE-2026-93880 Wordfence
6.8 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Contributor+ Stored XSS via Block Animation customProps Attribute < 13.2.0 Fixed in 13.2.0 CVE-2026-83544 WPScan
4.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Server-Side Request Forgery Contributor+ SSRF via get-csv-to-json REST Endpoint < 13.2.0 Fixed in 13.2.0 CVE-2026-83543 WPScan
6.4 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI ≤ 12.8.9 CVE-2026-5092 Wordfence
4.3 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Broken Access Control Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' ≤ 12.8.9 CVE-2026-5093 Wordfence
7.2 High Animation Addons for Elementor Plugin animation-addons-for-elementor Server-Side Request Forgery Unauthenticated Server-Side Request Forgery No login needed < 2.7.2 Fixed in 2.7.2 CVE-2026-17565 WPScan
6.5 Medium Typing Effect Plugin animated-typing-effect Cross-Site Scripting ≤ 1.3.7 CVE-2026-66644 Patchstack
4.9 Medium Slider Hero with Video Background, Animation Plugin slider-hero SQL Injection Authenticated (Administrator+) SQL Injection via 'description' Slide Field (Second-Order via Duplicate) ≤ 9.1.7 CVE-2026-17582 Wordfence
6.1 Medium Animation Addons for Elementor Plugin animation-addons-for-elementor Cross-Site Scripting Author+ Stored XSS via SVG Upload No login needed < 2.7.0 Fixed in 2.7.0 CVE-2026-13330 WPScan
6.4 Medium Animation Addons for Elementor Plugin animation-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Weather Widget ≤ 2.6.3 CVE-2026-15299 Wordfence
6.4 Medium JetWidgets For Elementor Plugin jetwidgets-for-elementor Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via Animated Box 'animation_effect' Setting ≤ 1.0.21 CVE-2026-11380 Wordfence
6.4 Medium Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates Plugin animation-addons-for-elementor Cross-Site Scripting GSAP Powered Elementor Addons & Website Templates <= 2.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters ≤ 2.6.7 CVE-2025-8444 Wordfence
6.4 Medium Animate Your Content Plugin animate-your-content Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes ≤ 1.0.0 CVE-2026-8872 Wordfence
6.4 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via disablelazy Attribute ≤ 12.8.9 CVE-2026-4895 Wordfence
6.5 Medium Animation Addons for Elementor Plugin animation-addons-for-elementor Cross-Site Scripting ≤ 2.6.1 CVE-2026-39702 Patchstack
5.3 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Broken Access Control Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load' No login needed ≤ 12.8.3 CVE-2026-2371 Wordfence
5.3 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Information Disclosure animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup No login needed ≤ 12.8.3 CVE-2026-2589 Wordfence
6.4 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting animation and page builder blocks <= 12.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 12.8.5 CVE-2026-2593 Wordfence
4.3 Medium TITLE ANIMATOR Plugin title-animator Cross-Site Request Forgery Cross-Site Request Forgery to Settings Update No login needed ≤ 1.0 CVE-2026-1082 Wordfence
5.4 Medium GreenShift - Animation and Page Builder Blocks Plugin greenshift-animation-and-page-builder-blocks Broken Access Control Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css ≤ 12.6 CVE-2026-1927 Wordfence
6.4 Medium ConvertForce Popup Builder Plugin convertforce-popup-builder Cross-Site Scripting Stored Cross-Site Scripting via entrance_animation ≤ 0.0.7 CVE-2025-14506 Wordfence
7.1 High Tumult Hype Animations Plugin tumult-hype-animations Cross-Site Request Forgery CSRF to XSS No login needed ≤ 1.9.11 Fixed in 1.9.12 CVE-2024-30461 Patchstack
4.3 Medium Animated Pixel Marquee Creator Plugin animated-pixel-marquee-creator Cross-Site Request Forgery Cross-Site Request Forgery via 'marquee' Parameter No login needed ≤ 1.0.0 CVE-2025-14062 Wordfence
6.5 Medium Animation Addons for Elementor Plugin animation-addons-for-elementor Broken Access Control Arbitrary Content Deletion ≤ 2.4.5 Fixed in 2.4.6 CVE-2025-67540 Patchstack
6.4 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes ≤ 12.2.7 CVE-2025-11841 Wordfence
6.4 Medium Ultra Addons Lite for Elementor Plugin ut-elementor-addons-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field ≤ 1.1.9 CVE-2025-9077 Wordfence
4.3 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Broken Access Control ≤ 12.1.1 Fixed in 12.1.2 CVE-2025-57884 Patchstack
6.4 Medium Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Plugin master-addons Cross-Site Scripting Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox ≤ 2.0.9.0 CVE-2025-8874 Wordfence
6.4 Medium Gutenverse Plugin gutenverse Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks ≤ 3.1.0 CVE-2025-7727 Wordfence
4.3 Medium Animator Plugin scroll-triggered-animations Cross-Site Request Forgery No login needed ≤ 3.0.16 Fixed in 3.0.17 CVE-2025-54039 Patchstack
6.4 Medium Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations Plugin master-addons Cross-Site Scripting Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.8.2 CVE-2025-5284 Wordfence
6.5 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting ≤ 11.5.5 Fixed in 11.5.7 CVE-2025-49301 Patchstack
6.4 Medium Animated Buttons Plugin animated-buttons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.0 CVE-2025-4221 Wordfence
4.9 Medium Animate Plugin animate Server-Side Request Forgery ≤ 0.5 CVE-2025-46443 Patchstack
8.8 High Greenshift Plugin greenshift-animation-and-page-builder-blocks Arbitrary File Upload Authenticated (Subscriber+) Arbitrary File Upload 11.4 – 11.4.5 CVE-2025-3616 Wordfence
6.5 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting ≤ 11.0.2 Fixed in 11.1 CVE-2025-30873 Patchstack
8.8 High Animation Addons for Elementor Pro Plugin Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation ≤ 1.6 CVE-2025-1639 Wordfence
6.4 Medium Exclusive Addons for Elementor Plugin exclusive-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Image Comparison Widgets ≤ 2.7.6 CVE-2025-1571 Wordfence
6.5 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting ≤ 10.8 Fixed in 10.9 CVE-2025-26884 Patchstack
6.5 Medium Animated Text Block Plugin animated-text-block Broken Access Control ≤ 1.0.7 Fixed in 1.0.8 CVE-2025-26883 Patchstack
6.4 Medium Typed JS: A typewriter style animation Plugin mrlegend-typedjs Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter ≤ 1.2.0 CVE-2025-1328 Wordfence
5.3 Medium AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations Plugin animategl Broken Access Control Elementor & Gutenberg Blocks Animations <= 1.4.23 - Missing Authorization to Unauthenticated Settings Update No login needed ≤ 1.4.23 CVE-2024-12620 Wordfence
8.1 High Background animation blocks Plugin background-animation-blocks Local File Inclusion No login needed ≤ 2.1.5 CVE-2025-23948 Patchstack
6.4 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Broken Access Control animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting ≤ 9.0.0 CVE-2024-6155 Wordfence
6.4 Medium Master Addons -- Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor Plugin master-addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Tooltip Module ≤ 2.0.6.7 CVE-2024-9502 Wordfence
4.3 Medium Animated Rotating Words Plugin css3-rotating-words Cross-Site Request Forgery No login needed ≤ 5.6 Fixed in 5.7 CVE-2024-38753 Patchstack
6.5 Medium Animator Plugin scroll-triggered-animations Broken Access Control Unauthenticated Plugin Settings Change No login needed ≤ 3.0.10 Fixed in 3.0.11 CVE-2023-47689 Patchstack
5.4 Medium Animated Rotating Words Plugin css3-rotating-words Broken Access Control ≤ 5.4 Fixed in 5.5 CVE-2023-47187 Patchstack
4.3 Medium Maintenance & Coming Soon Redirect Animation Plugin maintenance-coming-soon-redirect-animation Broken Access Control Missing Authorization to Settings Update ≤ 2.1.3 CVE-2024-9503 Wordfence
4.3 Medium Animation Addons for Elementor Plugin animation-addons-for-elementor Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via Content Slider and Tabs Widget Elementor Template ≤ 1.1.6 CVE-2024-12340 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only