WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 1–50 of 1,407 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 29
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Kubio AI Page Builder Plugin kubio Cross-Site Scripting No login needed ≤ 2.9.3 CVE-2026-94167 Patchstack
7.1 High NEX-Forms Plugin nex-forms-express-wp-form-builder Cross-Site Scripting No login needed ≤ 9.3.1 Fixed in 9.3.2 CVE-2026-96607 Patchstack
7.1 High BlockStrap Page Builder - Bootstrap Blocks Plugin blockstrap-page-builder-blocks Cross-Site Scripting Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) No login needed ≤ 0.1.58 Fixed in 0.1.59 CVE-2026-94632 Patchstack
9.3 Critical tagDiv Opt-In Builder Plugin td-subscription SQL Injection No login needed ≤ 1.7.6 Fixed in 1.7.7 CVE-2026-96330 Patchstack
8.5 High tagDiv Opt-In Builder Plugin td-subscription SQL Injection ≤ 1.7.6 Fixed in 1.7.7 CVE-2026-96329 Patchstack
8.5 High Taskbuilder Plugin taskbuilder SQL Injection ≤ 6.0.5 Fixed in 6.0.6 CVE-2026-95599 Patchstack
7.1 High ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Cross-Site Scripting Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) No login needed ≤ 3.4.1 Fixed in 3.4.2 CVE-2026-95596 Patchstack
5.3 Medium Visual Composer Website Builder Plugin visualcomposer Broken Access Control No login needed ≤ 45.16.3 Fixed in 45.16.4 CVE-2026-106596 Patchstack
7.5 High Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included Plugin uncanny-automator PHP Object Injection AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion ≤ 7.6.1.1 CVE-2026-82627 Wordfence
7.5 High Nexi XPay Build Plugin Price Manipulation Unauthenticated Payment Bypass via NPG Notification Handler No login needed 7.2.2 – 7.6.2 CVE-2026-82212 WPScan
8.2 High Nexi XPay Build Plugin Information Disclosure Unauthenticated Payment Completion and Order Key Disclosure No login needed 7.0.0 – 7.6.2 CVE-2026-82211 WPScan
7.2 High Kirki – Freeform Page Builder, Website Builder & Customizer Plugin kirki Cross-Site Scripting Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata No login needed ≤ 6.3.1 CVE-2026-102173 Wordfence
5.3 Medium BuildKit – Product Builder for WooCommerce – Custom PC Builder Plugin woo-product-builder Other Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability No login needed ≤ 1.0.28 Fixed in 1.0.29 CVE-2026-97275 Patchstack
7.5 High Cost Calculator Builder Plugin cost-calculator-builder Information Disclosure Sensitive Data Exposure No login needed ≤ 4.0.17 Fixed in 4.0.18 CVE-2026-97307 Patchstack
9.1 Critical Beaver Builder Page Builder Plugin beaver-builder-lite-version Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output No login needed ≤ 2.11.0.5 CVE-2026-92084 Wordfence
8.8 High Kubio AI Page Builder Plugin kubio Cross-Site Scripting Unauthenticated Stored XSS via Comment Content No login needed < 2.9.3 Fixed in 2.9.3 CVE-2026-88783 WPScan
6.8 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Contributor+ Stored XSS via Image Gallery Item URL Attribute < 2.9.3 Fixed in 2.9.3 CVE-2026-88782 WPScan
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version SQL Injection Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter ≤ 2.11.0.5 CVE-2026-95865 Wordfence
7.2 High Smash Balloon Social Post Feed Plugin custom-facebook-feed Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview No login needed ≤ 4.13.0 CVE-2026-93756 Wordfence
7.2 High Kubio AI Page Builder Plugin kubio Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass) No login needed ≤ 2.9.2 CVE-2026-100107 Wordfence
7.2 High JetFormBuilder Plugin jetformbuilder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action No login needed ≤ 3.6.5.4 CVE-2026-97342 Wordfence
6.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder No login needed ≤ 13.2.0 CVE-2026-93880 Wordfence
6.2 Medium BuildKit Plugin woo-product-builder SQL Injection Contributor+ Stored SQLi via list_content Parameter < 1.0.29 Fixed in 1.0.29 CVE-2026-94298 WPScan
8.8 High Super Forms – Drag & Drop Form Builder Plugin Privilege Escalation Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login ≤ 6.3.316 CVE-2026-15897 Wordfence
6.1 Medium Avada | Website Builder For WordPress & WooCommerce Theme Cross-Site Scripting Reflected Cross-Site Scripting via 'lang' Parameter No login needed ≤ 7.16.1 CVE-2026-84925 Wordfence
8.5 High BuildKit – Product Builder for WooCommerce – Custom PC Builder Plugin woo-product-builder SQL Injection Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection ≤ 1.0.28 Fixed in 1.0.29 CVE-2026-102379 Patchstack
7.1 High JetFormBuilder Plugin jetformbuilder Cross-Site Scripting No login needed ≤ 3.6.5.4 Fixed in 3.6.6 CVE-2026-102391 Patchstack
7.1 High Post and Page Builder by BoldGrid Plugin post-and-page-builder Cross-Site Scripting No login needed ≤ 1.27.14 Fixed in 1.27.15 CVE-2026-100510 Patchstack
7.2 High Page Builder by SiteOrigin Plugin siteorigin-panels PHP Object Injection ≤ 2.36.0 Fixed in 2.36.1 CVE-2026-97256 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.16.2 Fixed in 45.16.3 CVE-2026-97262 Patchstack
8.8 High Themify Builder Plugin themify-builder PHP Object Injection ≤ 7.8.1 Fixed in 7.8.2 CVE-2026-96831 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 6.5.1 Fixed in 6.5.2 CVE-2026-96829 Patchstack
6.5 Medium Profile Builder Plugin profile-builder Cross-Site Scripting ≤ 4.0.2 Fixed in 4.0.3 CVE-2026-96338 Patchstack
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter ≤ 5.7.2 CVE-2026-6173 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute ≤ 5.7.2 CVE-2026-6171 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute ≤ 5.7.2 CVE-2026-6170 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title ≤ 5.7.2 CVE-2026-88037 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter ≤ 5.7.2 CVE-2026-6172 Wordfence
7.2 High HT Contact Form – Drag & Drop Form Builder Plugin ht-contactform Cross-Site Scripting Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field No login needed ≤ 2.10.2 CVE-2026-96326 Wordfence
7.2 High Themify Builder Plugin themify-builder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter No login needed ≤ 7.8.1 CVE-2026-95864 Wordfence
7.2 High User Profile Builder Plugin profile-builder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Avatar Field No login needed ≤ 4.0.2 CVE-2026-95866 Wordfence
6.4 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field ≤ 4.0.2 CVE-2026-93656 Wordfence
6.1 Medium JetFormBuilder Plugin jetformbuilder Cross-Site Scripting Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field No login needed ≤ 3.6.5.3 CVE-2026-92212 Wordfence
8.8 High Elementor Website Builder Plugin elementor Cross-Site Request Forgery No login needed ≤ 4.3.1 Fixed in 4.3.2 CVE-2026-62062 Patchstack
5.4 Medium Kirki – Freeform Page Builder, Website Builder & Customizer Plugin kirki Server-Side Request Forgery Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter No login needed ≤ 6.2.0 CVE-2026-18335 Wordfence
9.8 Critical Visual Composer Website Builder Plugin visualcomposer Local File Inclusion Unauthenticated Local File Inclusion via 'vcv-template' Parameter No login needed ≤ 45.16.0 CVE-2026-12227 Wordfence
8.6 High JetFormBuilder Stripe Gateway Plugin SQL Injection Unauthenticated Blind SQLi via Payment Token No login needed < 1.1.0 Fixed in 1.1.0 CVE-2022-4997 WPScan
6.5 Medium BM Content Builder Plugin Path Traversal Authenticated (Subscriber+) Arbitrary File Read < 3.17.1 Fixed in 3.17.1 CVE-2025-1280 Wordfence
7.1 High WP Table Builder Plugin wp-table-builder Broken Access Control Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter ≤ 2.2.1 CVE-2026-6922 Wordfence
8.8 High BM Content Builder Plugin Arbitrary File Deletion Authenticated (Subscriber+) Arbitrary File Deletion < 3.17.1 Fixed in 3.17.1 CVE-2025-1281 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only