WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,168 High 9,010 Medium 17,704 Low 329

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.

Showing 1–50 of 246 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 1 of 1
Severity	Component	Vulnerability	Affected versions	Published	CVE	Source
6.4 Medium	Gutenberg Essential Blocks Plugin `essential-blocks`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute	`≤ 6.4.5`	Oct 1, 2026	`CVE-2026-96256`	Wordfence
4.3 Medium	Spectra Legacy – Gutenberg Blocks Plugin `ultimate-addons-for-gutenberg`	Information Disclosure Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure	`≤ 2.20.0`	Sep 24, 2026	`CVE-2026-16302`	Wordfence
6.5 Medium	Premium Blocks – Gutenberg Blocks Plugin `premium-blocks-for-gutenberg`	Cross-Site Scripting Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS)	`≤ 2.3.17` Fixed in `2.3.18`	Sep 23, 2026	`CVE-2026-94118`	Patchstack
4.3 Medium	BlockSpare - Gutenberg Site Builder Blocks & Starter Sites Plugin `blockspare`	Broken Access Control Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation	`≤ 4.2.6`	Sep 19, 2026	`CVE-2026-1242`	Wordfence
6.8 Medium	VikWidgetsLoader Plugin `vikwidgetsloader`	Cross-Site Scripting Contributor+ Stored XSS via Gutenberg Block class_suffix	`1.11.0 – < 1.12.0` Fixed in `1.12.0`	Sep 5, 2026	`CVE-2026-84899`	WPScan
6.5 Medium	WPZOOM Forms – Contact Form Plugin for Gutenberg Plugin `wpzoom-forms`	Cross-Site Scripting Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS)	`≤ 2.0.4`	Aug 18, 2026	`CVE-2026-66639`	Patchstack
4.3 Medium	Gutenberg Blocks by Kadence Blocks Plugin `kadence-blocks`	Information Disclosure Sensitive Data Exposure	`≤ 3.7.8` Fixed in `3.7.8.1`	Aug 6, 2026	`CVE-2026-66696`	Patchstack
6.5 Medium	RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg Plugin `rt-mega-menu`	Broken Access Control Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control	`≤ 1.5.1` Fixed in `1.5.2`	Jul 27, 2026	`CVE-2026-65433`	Patchstack
6.5 Medium	RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg Plugin `rt-mega-menu`	Cross-Site Scripting Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS)	`≤ 1.5.1` Fixed in `1.5.2`	Jul 27, 2026	`CVE-2026-59559`	Patchstack
6.4 Medium	Post Grid Gutenberg Blocks Plugin `ultimate-post`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute	`≤ 5.0.32`	Jul 24, 2026	`CVE-2026-15100`	Wordfence
6.5 Medium	Ninja Forms Plugin `ninja-forms`	Broken Access Control Ninja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors	`< 3.14.9` Fixed in `3.14.9`	Jul 21, 2026	`CVE-2026-65050`	VulnCheck
6.4 Medium	Spectra Gutenberg Blocks Plugin `ultimate-addons-for-gutenberg`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block	`≤ 2.19.28`	Jul 20, 2026	`CVE-2026-12900`	Wordfence
4.3 Medium	Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin `kadence-blocks`	Broken Access Control Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication	`≤ 3.5.32`	Jul 10, 2026	`CVE-2026-15286`	Wordfence
6.4 Medium	Post Grid Gutenberg Blocks for News, Magazines, Blog Websites Plugin `ultimate-post`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'moreResultsText' Block Attribute	`≤ 5.0.31`	Jul 9, 2026	`CVE-2026-13253`	Wordfence
6.4 Medium	Advanced iFrame Plugin `advanced-iframe`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute	`≤ 2026.1`	Jul 8, 2026	`CVE-2026-6742`	Wordfence
6.4 Medium	Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns Plugin `essential-blocks`	Cross-Site Scripting Page Builder for Gutenberg Blocks & Patterns <= 6.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'configurablePrefix' Block Attribute	`≤ 6.1.4`	Jun 25, 2026	`CVE-2026-10833`	Wordfence
5.4 Medium	ShopLentor - WooCommerce Builder for Elementor & Gutenberg Plugin `woolentor-addons`	Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Product Grid 'blockUniqId' Block Attribute	`≤ 3.3.8`	May 27, 2026	`CVE-2026-6287`	Wordfence
6.4 Medium	Gutenberg Essential Blocks Plugin `essential-blocks`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes	`≤ 6.0.4`	May 2, 2026	`CVE-2026-4658`	Wordfence
4.3 Medium	Spectra Plugin `ultimate-addons-for-gutenberg`	Broken Access Control	`≤ 2.19.22` Fixed in `2.19.23`	Apr 29, 2026	`CVE-2026-42648`	Patchstack
6.4 Medium	Timeline Blocks for Gutenberg Plugin `timeline-blocks`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute	`≤ 1.1.10`	Apr 28, 2026	`CVE-2026-6551`	Wordfence
5.4 Medium	Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor Plugin `gutentor`	Cross-Site Scripting Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML	`≤ 3.5.5`	Apr 23, 2026	`CVE-2026-2951`	Wordfence
6.4 Medium	Page Builder Gutenberg Blocks Plugin `coblocks`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via External iCal Feed Data	`≤ 3.1.16`	Apr 18, 2026	`CVE-2026-4801`	Wordfence
5.3 Medium	Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX Plugin	Broken Access Control PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification No login needed	`≤ 5.0.5`	Apr 16, 2026	`CVE-2026-0718`	Wordfence
4.3 Medium	Kadence Blocks — Page Builder Toolkit for Gutenberg Editor Plugin `kadence-blocks`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Media Upload	`≤ 3.6.3`	Apr 4, 2026	`CVE-2026-2826`	Wordfence
6.4 Medium	WPFAQBlock– FAQ & Accordion Plugin For Gutenberg Plugin `wpfaqblock`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Attribute	`≤ 1.1`	Mar 21, 2026	`CVE-2026-1093`	Wordfence
6.4 Medium	Rise Blocks – A Complete Gutenberg Page Builder Plugin `rise-blocks`	Cross-Site Scripting A Complete Gutenberg Page Builder <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Identity Block Attributes	`≤ 3.7`	Feb 25, 2026	`CVE-2026-1614`	Wordfence
6.5 Medium	Cartify - WooCommerce Gutenberg Theme `cartify`	Broken Access Control WooCommerce Gutenberg WordPress Theme theme <= 1.3 - Arbitrary Content Deletion	`≤ 1.3`	Feb 20, 2026	`CVE-2025-69385`	Patchstack
6.4 Medium	Dealia Plugin `dealia-request-a-quote`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block Attributes	`≤ 1.0.8`	Feb 19, 2026	`CVE-2026-2718`	Wordfence
4.3 Medium	Gutenberg Blocks with AI by Kadence WP Plugin `kadence-blocks`	Broken Access Control Missing Authorization to Authenticated (Contributor+) Unauthorized Media Upload	`≤ 3.6.1`	Feb 18, 2026	`CVE-2026-2633`	Wordfence
4.3 Medium	Gutenberg Blocks with AI by Kadence WP Plugin `kadence-blocks`	Server-Side Request Forgery Authenticated (Contributor+) Server-Side Request Forgery via 'endpoint' Parameter	`≤ 3.6.1`	Feb 18, 2026	`CVE-2026-1857`	Wordfence
4.3 Medium	Gutenberg Blocks by Kadence Blocks Plugin `kadence-blocks`	Broken Access Control Missing Authorization	`≤ 3.5.32`	Feb 17, 2026	`CVE-2026-2608`	Wordfence
5.3 Medium	Spectra Plugin `ultimate-addons-for-gutenberg`	Broken Access Control No login needed	`≤ 2.19.17` Fixed in `2.19.18`	Feb 3, 2026	`CVE-2026-24982`	Patchstack
5.3 Medium	Spectra Gutenberg Blocks Plugin `ultimate-addons-for-gutenberg`	Information Disclosure Unauthenticated Information Disclosure in Sensitive Data No login needed	`≤ 2.19.17`	Feb 3, 2026	`CVE-2026-0950`	Wordfence
6.4 Medium	BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library Plugin `blockart-blocks`	Cross-Site Scripting Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 2.2.14`	Jan 28, 2026	`CVE-2025-14283`	Wordfence
5.9 Medium	Stackable Plugin `stackable-ultimate-gutenberg-blocks`	Cross-Site Scripting	`≤ 3.19.5` Fixed in `3.19.6`	Jan 22, 2026	`CVE-2025-47500`	Patchstack
6.5 Medium	Gutenberg Thim Blocks Plugin `thim-blocks`	Path Traversal Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter	`≤ 1.0.1`	Jan 17, 2026	`CVE-2025-13725`	Wordfence
5.3 Medium	LottieFiles – Lottie block for Gutenberg Plugin `lottiefiles`	Information Disclosure Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure No login needed	`≤ 3.0.0`	Jan 14, 2026	`CVE-2026-0717`	Wordfence
5.4 Medium	aBlocks – WordPress Gutenberg Blocks Plugin `ablocks`	Broken Access Control WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification	`≤ 2.4.0`	Jan 7, 2026	`CVE-2025-12449`	Wordfence
6.5 Medium	Post Grid and Gutenberg Blocks Plugin `post-grid`	Cross-Site Scripting	`≤ 2.3.23`	Dec 24, 2025	`CVE-2025-68605`	Patchstack
5.3 Medium	Post Grid and Gutenberg Blocks Plugin `post-grid`	Broken Access Control Insecure Direct Object References (IDOR) No login needed	`≤ 2.3.23`	Dec 18, 2025	`CVE-2025-63043`	Patchstack
6.5 Medium	Post Grid and Gutenberg Blocks Plugin `post-grid`	Broken Access Control	`≤ 2.3.17` Fixed in `2.3.18`	Dec 18, 2025	`CVE-2025-66058`	Patchstack
5.4 Medium	Lottier Plugin `lottier-gutenberg`	Broken Access Control	`≤ 1.1.1`	Dec 16, 2025	`CVE-2025-66167`	Patchstack
5.4 Medium	Spectra Plugin `ultimate-addons-for-gutenberg`	Broken Access Control WordPress Gutenberg Blocks plugin <= 2.3.0 - Contributor+ reCAPTCHA Settings Change	`≤ 2.3.0` Fixed in `2.3.1`	Dec 9, 2025	`CVE-2023-23729`	Patchstack
6.5 Medium	Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons Plugin `gutenverse-news`	Broken Access Control Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control	`≤ 3.0.2` Fixed in `3.1.0`	Dec 9, 2025	`CVE-2025-62090`	Patchstack
6.4 Medium	BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library Plugin `blockart-blocks`	Cross-Site Scripting Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute	`≤ 2.2.13`	Dec 2, 2025	`CVE-2025-13697`	Wordfence
5.4 Medium	Progress Bar Blocks for Gutenberg Plugin `progressmatify-blocks`	Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG	`≤ 1.0.0`	Nov 11, 2025	`CVE-2025-12880`	Wordfence
6.4 Medium	Spectra Plugin `ultimate-addons-for-gutenberg`	Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS	`≤ 2.19.14`	Nov 5, 2025	`CVE-2025-11162`	Wordfence
6.5 Medium	Gutenberg Plugin `gutenberg`	Cross-Site Scripting	`≤ 21.8.2` Fixed in `21.9.0`	Oct 31, 2025	`CVE-2025-64354`	Patchstack
6.5 Medium	Post Grid and Gutenberg Blocks Plugin `post-grid`	Broken Access Control	`≤ 2.3.17` Fixed in `2.3.18`	Oct 27, 2025	`CVE-2025-62924`	Patchstack
6.4 Medium	Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks Plugin `advanced-gutenberg`	Cross-Site Scripting PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting	`≤ 3.3.4`	Oct 25, 2025	`CVE-2025-8588`	Wordfence

About this data

Where it comes from: Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included: CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity: The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions: The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates: Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.