WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 451–500 of 1,414 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 10 of 29
Severity Component Vulnerability Affected versions Published CVE Source
4.3 Medium Elementor Website Builder Plugin elementor Broken Access Control ≤ 3.33.0 Fixed in 3.33.1 CVE-2025-67588 Patchstack
5.3 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control No login needed ≤ 3.8.20 Fixed in 3.8.21 CVE-2025-67577 Patchstack
4.3 Medium Chartify Plugin chart-builder Cross-Site Request Forgery No login needed ≤ 3.6.3 Fixed in 3.6.4 CVE-2025-66529 Patchstack
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Information Disclosure WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure ≤ 2.9.4 CVE-2025-12558 Wordfence
4.3 Medium Webcake – Landing Page Builder Plugin webcake Broken Access Control Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update ≤ 1.1 CVE-2025-12165 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering ≤ 2.9.4 CVE-2025-12782 Wordfence
4.3 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Broken Access Control WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification ≤ 2.9.4 CVE-2025-11726 Wordfence
5.3 Medium Zigaform Plugin zigaform-calculator-cost-estimation-form-builder-lite Information Disclosure Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint No login needed ≤ 7.6.5 CVE-2025-13696 Wordfence
4.3 Medium SurveyJS: Drag & Drop WordPress Form Builder Plugin surveyjs Cross-Site Request Forgery Cross-Site Request Forgery to Survey Deletion No login needed ≤ 1.12.20 CVE-2025-13140 Wordfence
6.4 Medium BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library Plugin blockart-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute ≤ 2.2.13 CVE-2025-13697 Wordfence
8.8 High Cost Calculator Builder Plugin cost-calculator-builder Arbitrary File Deletion Unauthenticated Arbitrary File Deletion No login needed ≤ 3.6.3 CVE-2025-12529 Wordfence
5.3 Medium Ace Post Type Builder Plugin ace-post-type-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter No login needed ≤ 1.9 CVE-2025-13405 Wordfence
6.5 Medium Funnel Builder by FunnelKit Plugin funnel-builder Cross-Site Scripting ≤ 3.13.1.2 Fixed in 3.13.1.3 CVE-2025-66067 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.5.2 Fixed in 5.5.3 CVE-2025-66057 Patchstack
7.1 High Flo Forms – Easy Drag & Drop Form Builder Plugin flo-forms Cross-Site Scripting Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload No login needed ≤ 1.0.43 CVE-2025-13159 Wordfence
6.4 Medium FunnelKit – Funnel Builder for WooCommerce Checkout Plugin funnel-builder Cross-Site Scripting Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode ≤ 3.13.1.2 CVE-2025-12878 Wordfence
6.4 Medium User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Plugin profile-builder Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.14.8 CVE-2025-13054 Wordfence
6.4 Medium Gutenify - Visual Site Builder Blocks & Site Templates Plugin gutenify Cross-Site Scripting Visual Site Builder Blocks & Site Templates <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up block ≤ 1.5.9 CVE-2025-8605 Wordfence
5.3 Medium JetFormBuilder Plugin jetformbuilder Broken Access Control No login needed ≤ 3.5.3 Fixed in 3.5.4 CVE-2025-64384 Patchstack
4.3 Medium WooCommerce PDF Invoice Builder Plugin woo-pdf-invoice-builder Broken Access Control ≤ 1.2.150 Fixed in 1.2.151 CVE-2025-64269 Patchstack
4.3 Medium Page Builder: Pagelayer – Drag and Drop website builder Plugin pagelayer Broken Access Control Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference ≤ 2.0.5 CVE-2025-12366 Wordfence
6.4 Medium Nonaki – Drag and Drop Email Template builder and Newsletter Plugin nonaki-email-template-customizer Cross-Site Scripting Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields ≤ 1.0.11 CVE-2025-12644 Wordfence
6.5 Medium Cost Calculator Builder Plugin cost-calculator-builder Broken Access Control No login needed ≤ 3.5.32 Fixed in 3.5.33 CVE-2025-62049 Patchstack
4.3 Medium Depicter — Popup & Slider Builder Plugin depicter Broken Access Control Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload ≤ 4.0.4 CVE-2025-11373 Wordfence
6.3 Medium FunnelKit Plugin funnel-builder Cross-Site Scripting Reflected XSS No login needed < 3.12.0.1 Fixed in 3.12.0.1 CVE-2025-10567 WPScan
6.4 Medium Reuse Builder Plugin reuse-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.7 CVE-2025-11812 Wordfence
6.4 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting animation and page builder blocks <= 12.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes ≤ 12.2.7 CVE-2025-11841 Wordfence
6.5 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting ≤ 3.21.1 Fixed in 3.21.1 CVE-2025-48088 Patchstack
6.5 Medium Builderall Builder Plugin builderall-cheetah-for-wp Cross-Site Scripting ≤ 3.0.1 CVE-2025-62987 Patchstack
5.3 Medium WP Popup Builder Plugin wp-popup-builder Information Disclosure Sensitive Data Exposure No login needed ≤ 1.3.8 Fixed in 1.3.9 CVE-2025-62902 Patchstack
7.1 High Pricing Table builder Plugin wpdevart-pricing-table Cross-Site Request Forgery No login needed ≤ 1.5.3 CVE-2025-62886 Patchstack
4.3 Medium WP VR – 360 Panorama and Free Virtual Tour Builder Plugin wpvr Broken Access Control Improper Authorization to Authenticated (Contributor+) Plugin Settings Update ≤ 8.5.41 CVE-2025-12005 Wordfence
2.7 Low ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution Plugin shopengine Broken Access Control All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update ≤ 4.8.4 CVE-2025-11888 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.2.4 CVE-2025-11823 Wordfence
7.5 High Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers Plugin popup-builder-block Server-Side Request Forgery Unauthenticated Server-Side Request Forgery No login needed ≤ 2.1.4 CVE-2025-10861 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter ≤ 5.4.5 CVE-2025-7730 Wordfence
6.4 Medium Beaver Builder Plugin (Starter Version) Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play' ≤ 2.9.2.1 CVE-2025-8427 Wordfence
5.9 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting ≤ 1.0.334 Fixed in 1.0.334 CVE-2025-59593 Patchstack
6.5 Medium Fusion Builder Plugin fusion-builder Cross-Site Scripting ≤ 3.13.2 Fixed in 3.13.3 CVE-2025-49940 Patchstack
6.5 Medium JetWooBuilder Plugin jet-woo-builder Cross-Site Scripting ≤ 2.1.20 Fixed in 2.1.20.1 CVE-2025-49928 Patchstack
6.5 Medium JetWooBuilder Plugin jet-woo-builder Cross-Site Scripting ≤ 2.1.20.1 CVE-2025-49927 Patchstack
6.4 Medium Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Plugin essential-blocks Cross-Site Scripting Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.7.1 CVE-2025-11270 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 8.6 CVE-2025-10006 Wordfence
9.8 Critical RegistrationMagic - Custom Registration Forms Plugin custom-registration-form-builder-with-submission-manager PHP Object Injection Custom Registration Forms <= 3.7.9.2 - PHP Object Injection No login needed < 3.7.9.3 Fixed in 3.7.9.3 CVE-2017-20208 Wordfence
7.2 High 10WebMapBuilder Plugin wd-google-maps Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via Plugin Settings Change No login needed < 1.0.64 Fixed in 1.0.64 CVE-2020-36853 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin ultimate_vc_addons Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting < 3.21.1 Fixed in 3.21.1 CVE-2025-11814 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Stored Cross-Site Scripting via vc_custom_heading Shortcode ≤ 8.6.1 CVE-2025-11161 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Stored Cross-Site Scripting via Custom JS Module ≤ 8.6.1 CVE-2025-11160 Wordfence
4.3 Medium SureForms – Drag and Drop Form Builder Plugin sureforms Broken Access Control Drag and Drop Form Builder for WordPress <= 1.12.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure ≤ 1.12.1 CVE-2025-10732 Wordfence
6.8 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Author+ Stored XSS < 6.3.16 Fixed in 6.3.16 CVE-2025-9698 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only