WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 1–50 of 1,023 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 21
Severity Component Vulnerability Affected versions Published CVE Source
5.3 Medium Visual Composer Website Builder Plugin visualcomposer Broken Access Control No login needed ≤ 45.16.3 Fixed in 45.16.4 CVE-2026-106596 Patchstack
5.3 Medium BuildKit – Product Builder for WooCommerce – Custom PC Builder Plugin woo-product-builder Other Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - Bypass Vulnerability No login needed ≤ 1.0.28 Fixed in 1.0.29 CVE-2026-97275 Patchstack
6.8 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Contributor+ Stored XSS via Image Gallery Item URL Attribute < 2.9.3 Fixed in 2.9.3 CVE-2026-88782 WPScan
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version SQL Injection Authenticated (Contributor+) SQL Injection via 'fields[][value]' Parameter ≤ 2.11.0.5 CVE-2026-95865 Wordfence
6.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder No login needed ≤ 13.2.0 CVE-2026-93880 Wordfence
6.2 Medium BuildKit Plugin woo-product-builder SQL Injection Contributor+ Stored SQLi via list_content Parameter < 1.0.29 Fixed in 1.0.29 CVE-2026-94298 WPScan
6.1 Medium Avada | Website Builder For WordPress & WooCommerce Theme Cross-Site Scripting Reflected Cross-Site Scripting via 'lang' Parameter No login needed ≤ 7.16.1 CVE-2026-84925 Wordfence
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.16.2 Fixed in 45.16.3 CVE-2026-97262 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 6.5.1 Fixed in 6.5.2 CVE-2026-96829 Patchstack
6.5 Medium Profile Builder Plugin profile-builder Cross-Site Scripting ≤ 4.0.2 Fixed in 4.0.3 CVE-2026-96338 Patchstack
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter ≤ 5.7.2 CVE-2026-6173 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute ≤ 5.7.2 CVE-2026-6171 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute ≤ 5.7.2 CVE-2026-6170 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title ≤ 5.7.2 CVE-2026-88037 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter ≤ 5.7.2 CVE-2026-6172 Wordfence
6.4 Medium User Profile Builder Plugin profile-builder Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field ≤ 4.0.2 CVE-2026-93656 Wordfence
6.1 Medium JetFormBuilder Plugin jetformbuilder Cross-Site Scripting Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field No login needed ≤ 3.6.5.3 CVE-2026-92212 Wordfence
5.4 Medium Kirki – Freeform Page Builder, Website Builder & Customizer Plugin kirki Server-Side Request Forgery Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Unauthenticated Blind Server-Side Request Forgery via 'kirki_data' Parameter No login needed ≤ 6.2.0 CVE-2026-18335 Wordfence
6.5 Medium BM Content Builder Plugin Path Traversal Authenticated (Subscriber+) Arbitrary File Read < 3.17.1 Fixed in 3.17.1 CVE-2025-1280 Wordfence
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content ≤ 2.1.21 CVE-2026-16778 Wordfence
6.4 Medium WP Composer Plugin page-builder-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode ≤ 1.0.5 CVE-2026-2422 Wordfence
4.3 Medium BlockSpare - Gutenberg Site Builder Blocks & Starter Sites Plugin blockspare Broken Access Control Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation ≤ 4.2.6 CVE-2026-1242 Wordfence
4.3 Medium PDF Builder for WooCommerce. Create invoices,packing slips and more Plugin woo-pdf-invoice-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler ≤ 2.0.11 CVE-2026-11899 Wordfence
5.5 Medium JetFormBuilder Plugin Arbitrary File Deletion Admin+ Arbitrary File Deletion via Server-Side Validation Callback 3.5.6.2 – < 3.6.5.3 Fixed in 3.6.5.3 CVE-2026-19860 WPScan
4.3 Medium Nimble Builder Plugin Information Disclosure Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins ≤ 3.3.8 CVE-2026-16557 WPScan
6.4 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content ≤ 2.8.4 CVE-2026-14472 Wordfence
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter ≤ 9.3.0 CVE-2026-75961 Wordfence
4.3 Medium Magazine Blocks Plugin magazine-blocks Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint ≤ 1.8.6 CVE-2026-75017 Wordfence
5.3 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control Unauthenticated Registration Policy Bypass via Login Form Type Confusion No login needed 4.0.0 – < 4.2.0 Fixed in 4.2.0 CVE-2026-85123 WPScan
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter ≤ 2.8.14 CVE-2026-2585 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter ≤ 5.9.6 CVE-2026-5920 Wordfence
6.4 Medium ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets Plugin shopengine Cross-Site Scripting All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter ≤ 4.9.5 CVE-2026-85575 Wordfence
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.16.1 Fixed in 45.16.2 CVE-2026-62138 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.9.9 Fixed in 5.9.10 CVE-2026-62110 Patchstack
5.3 Medium Nexi XPay Build Plugin Information Disclosure Unauthenticated Saved Payment Token Disclosure via IDOR No login needed 7.6.1 – 7.6.2 CVE-2026-82213 WPScan
6.8 Medium AI Builder Plugin Cross-Site Scripting Contributor+ Stored XSS via Post JavaScript 2.4.1 – < 2.7.8 Fixed in 2.7.8 CVE-2026-85678 WPScan
6.5 Medium Woo PDF Invoice Builder Plugin woo-pdf-invoice-builder Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure ≤ 2.0.8 CVE-2026-11496 Wordfence
6.1 Medium Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Plugin form-maker Cross-Site Scripting Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting No login needed ≤ 1.15.46 CVE-2026-85645 Wordfence
6.4 Medium Builderall Plugin builderall-cheetah-for-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting ≤ 3.0.2 CVE-2026-15820 Wordfence
4.3 Medium Builderall Plugin builderall-cheetah-for-wp Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter ≤ 3.0.2 CVE-2026-15823 Wordfence
6.4 Medium Builderall Plugin builderall-cheetah-for-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting ≤ 3.0.2 CVE-2026-15796 Wordfence
4.3 Medium Checkout Custom Fields Builder for WooCommerce Plugin checkout-custom-fields-builder-for-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter ≤ 1.1.5 CVE-2026-19802 Wordfence
5.4 Medium Orbit Fox Plugin Cross-Site Scripting Contributor+ Stored XSS via Beaver Builder Pricing Table Widget < 3.0.9 Fixed in 3.0.9 CVE-2026-85418 WPScan
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.10.3.1 CVE-2026-18021 Wordfence
4.8 Medium JetFormBuilder Plugin Content Injection Unauthenticated Email Header Injection via Send Email Action No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19862 WPScan
6.5 Medium JetFormBuilder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19859 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Slider Elements' additional_settings < 5.9.9 Fixed in 5.9.9 CVE-2026-84028 WPScan
6.1 Medium Beaver Builder Plugin (Pro Version) Plugin Cross-Site Scripting Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter No login needed ≤ 2.11.0.1 CVE-2026-18843 Wordfence
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Multiple Shortcode Element Attributes < 5.9.8 Fixed in 5.9.8 CVE-2026-84022 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL < 5.9.8 Fixed in 5.9.8 CVE-2026-84021 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only