WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–29 of 29 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity Component Vulnerability Affected versions Published CVE Source
7.1 High Gutenberg Blocks by Kadence Blocks Plugin kadence-blocks Cross-Site Scripting No login needed ≤ 3.7.11.1 Fixed in 3.7.12 CVE-2026-103354 Patchstack
8.8 High Master Blocks Plugin ultimate-blocks-for-gutenberg Cross-Site Scripting Unauthenticated Stored XSS via White Label Settings No login needed 1.4.1 – < 1.5.0 Fixed in 1.5.0 CVE-2026-88824 WPScan
7.1 High Recipe Card Blocks for Gutenberg & Elementor Plugin recipe-card-blocks-by-wpzoom Cross-Site Scripting No login needed ≤ 3.4.18 Fixed in 3.4.19 CVE-2026-73361 Patchstack
8.8 High Templately Plugin templately Arbitrary File Upload Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename Mismatch ≤ 3.7.1 CVE-2026-18438 Wordfence
7.2 High Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Plugin essential-blocks Server-Side Request Forgery Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery No login needed ≤ 6.1.3 CVE-2026-10586 Wordfence
8.8 High Spectra Gutenberg Blocks Plugin ultimate-addons-for-gutenberg Remote Code Execution Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes ≤ 2.19.25 CVE-2026-7465 Wordfence
7.1 High Gutenberg Blocks Plugin unlimited-blocks Cross-Site Scripting Unlimited blocks For Gutenberg plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) No login needed ≤ 1.2.8 CVE-2026-25438 Patchstack
7.5 High Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Plugin ultimate-post Broken Access Control PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure No login needed ≤ 5.0.3 CVE-2025-12980 Wordfence
8.1 High WP Travel Gutenberg Blocks Plugin wp-travel-blocks Local File Inclusion No login needed ≤ 3.9.0 Fixed in 3.9.1 CVE-2025-53207 Patchstack
8.8 High Post Grid and Gutenberg Blocks Plugin post-grid PHP Object Injection ≤ 2.3.11 Fixed in 2.3.12 CVE-2025-54007 Patchstack
7.5 High Otter - Gutenberg Block Plugin otter-blocks Information Disclosure Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure No login needed ≤ 3.1.0 Fixed in 3.1.1 CVE-2025-55715 Patchstack
7.5 High Gutenberg Blocks Plugin advanced-gutenberg Local File Inclusion No login needed ≤ 3.3.1 Fixed in 3.3.2 CVE-2025-48332 Patchstack
8.8 High B Slider- Gutenberg Slider Block for WP Plugin b-slider Broken Access Control Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation ≤ 1.1.30 CVE-2025-8418 Wordfence
7.1 High Cool Flipbox – Shortcode & Gutenberg Block Plugin flip-boxes Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.8.3 Fixed in 1.9.0 CVE-2025-32521 Patchstack
7.1 High Photo Gallery Plugin gt3-photo-video-gallery Cross-Site Scripting GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.24 - Reflected Cross Site Scripting (XSS) No login needed ≤ 2.7.7.24 Fixed in 2.7.7.25 CVE-2025-24707 Patchstack
7.2 High Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg Plugin borderless Remote Code Execution Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.6.0 - Authenticated (Administrator+) Remote Code Execution ≤ 1.6.0 CVE-2024-11600 Wordfence
7.5 High Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Plugin post-grid-carousel-ultimate Local File Inclusion with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion ≤ 1.6.10 CVE-2024-13408 Wordfence
7.5 High Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Plugin post-grid-carousel-ultimate Local File Inclusion with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.10 - Authenticated (Contributor+) Local File Inclusion via post_type_ajax_handler() ≤ 1.6.10 CVE-2024-13409 Wordfence
7.3 High Uix Shortcodes – Compatible with Gutenberg Plugin uix-shortcodes Arbitrary Shortcode Execution Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 1.9.9 CVE-2024-9772 Wordfence
7.1 High EasyJobs Plugin easyjobs Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.4.14 Fixed in 2.4.15 CVE-2024-43997 Patchstack
7.1 High SKT Templates – Elementor & Gutenberg templates Plugin skt-templates Cross-Site Scripting Elementor & Gutenberg templates plugin <= 6.14 - Reflected Cross Site Scripting (XSS) No login needed ≤ 6.14 Fixed in 6.15 CVE-2024-44007 Patchstack
8.8 High Post Grid and Gutenberg Blocks Plugin post-grid Privilege Escalation Authenticated (Subscriber+) Privilege Escalation 2.2.87 – 2.2.90 CVE-2024-8253 Wordfence
8.8 High Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX Plugin ultimate-post Broken Access Control PostX <= 4.1.2 - Missing Authorization to Arbitrary Options Update ≤ 4.1.2 CVE-2024-5326 Wordfence
8.5 High Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin Server-Side Request Forgery Page Builder Features <= 3.1.26 - Authenticated(Contributor+) Server-Side Request Forgery (SSRF) ≤ 3.1.26 CVE-2023-6964 Wordfence
7.1 High Spectra Plugin ultimate-addons-for-gutenberg Server-Side Request Forgery ≤ 2.6.6 Fixed in 2.6.7 CVE-2023-36679 Patchstack
7.7 High Gutenberg Blocks by Kadence Blocks Plugin kadence-blocks Server-Side Request Forgery ≤ 3.2.19 Fixed in 3.2.20 CVE-2024-23500 Patchstack
8.8 High Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget Plugin post-grid-carousel-ultimate PHP Object Injection with Shortcode, Gutenberg Block & Elementor Widget <= 1.6.7 - Authenticated (Contributor+) PHP Object Injection in outpost_shortcode_metabox_markup ≤ 1.6.7 CVE-2024-2006 Wordfence
7.5 High Post Grid Combo – 36+ Gutenberg Blocks Plugin post-grid Information Disclosure Information Exposure via get_posts API Endpoint No login needed ≤ 2.2.68 CVE-2023-7072 Wordfence
8.7 High ProductX – WooCommerce Builder & Gutenberg WooCommerce Blocks Plugin product-blocks PHP Object Injection Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection No login needed ≤ 3.1.4 Fixed in 3.1.5 CVE-2024-23512 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only