WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 501–550 of 1,027 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 11 of 21
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Page Builder by SiteOrigin Plugin siteorigin-panels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter ≤ 2.31.0 CVE-2024-12240 Wordfence
6.4 Medium Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link ≤ 3.4.2 CVE-2024-12304 Wordfence
6.5 Medium Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail Plugin yeemail Cross-Site Scripting ≤ 2.1.4 Fixed in 2.1.5 CVE-2025-22802 Patchstack
6.5 Medium Content Blocks Builder Plugin content-blocks-builder Cross-Site Scripting ≤ 2.7.6 Fixed in 2.7.7 CVE-2025-22810 Patchstack
6.4 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Broken Access Control animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting ≤ 9.0.0 CVE-2024-6155 Wordfence
4.3 Medium Header Builder Plugin Cross-Site Request Forgery Cross-Site Request Forgery to Header Deletion No login needed ≤ 1.3.8 CVE-2024-12206 Wordfence
4.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 5.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting ≤ 5.1.0 CVE-2024-12045 Wordfence
6.4 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 3.8.8 CVE-2024-12112 Wordfence
5.3 Medium SureForms – Drag and Drop Form Builder Plugin sureforms Broken Access Control Drag and Drop Form Builder for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Protected Post Disclosure No login needed ≤ 1.2.2 CVE-2024-12713 Wordfence
5.3 Medium Saoshyant Page Builder Plugin saoshyant-page-builder Broken Access Control No login needed ≤ 3.8 CVE-2025-22560 Patchstack
6.1 Medium User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Plugin profile-builder Cross-Site Scripting Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting No login needed ≤ 3.12.9 CVE-2024-12738 Wordfence
6.5 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting ≤ 1.5.1 Fixed in 1.6 CVE-2024-56285 Patchstack
5.9 Medium Pretty Simple Popup Builder Plugin pretty-simple-popup-builder Cross-Site Scripting Stored Cross Site Scripting (XSS) ≤ 1.0.9 Fixed in 1.0.10 CVE-2024-56298 Patchstack
5.9 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting ≤ 1.5.1 Fixed in 1.6 CVE-2025-22316 Patchstack
6.4 Medium Formaloo Form Maker & Customer Analytics for WordPress & WooCommerce Plugin formaloo-form-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 2.1.3.2 CVE-2024-11934 Wordfence
6.4 Medium Taskbuilder – WordPress Project & Task Management Plugin taskbuilder Cross-Site Scripting WordPress Project & Task Management plugin <= 3.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via wppm_tasks Shortcode ≤ 3.0.6 CVE-2024-11930 Wordfence
5.4 Medium 10Web Map Builder for Google Maps Plugin wd-google-maps Broken Access Control Notice Dismissal ≤ 1.0.73 Fixed in 1.0.74 CVE-2023-45272 Patchstack
4.3 Medium ApplyOnline – Application Form Builder and Manager Plugin apply-online Broken Access Control Application Form Builder and Manager plugin <= 2.5.3 - Broken Access Control ≤ 2.5.3 Fixed in 2.5.4 CVE-2023-46080 Patchstack
6.5 Medium Kali Forms Plugin kali-forms Broken Access Control ≤ 2.3.28 Fixed in 2.3.29 CVE-2023-45275 Patchstack
6.4 Medium Contact Form, Survey & Form Builder – MightyForms Plugin mightyforms Broken Access Control MightyForms plugin <= 1.3.9 - Broken Access Control ≤ 1.3.9 Fixed in 1.3.10 CVE-2024-56002 Patchstack
6.5 Medium Themify Builder Plugin themify-builder Local File Inclusion ≤ 7.6.3 Fixed in 7.6.5 CVE-2024-56216 Patchstack
6.3 Medium Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Arbitrary Shortcode Execution The Contact Form Builder That Grows With You <= 3.8.22 - Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 3.8.22 CVE-2024-12238 Wordfence
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Admin+) SQL Injection ≤ 8.7.15 CVE-2024-10862 Wordfence
4.3 Medium Avada Builder Plugin Information Disclosure Authenticated (Contributor+) Protected Post Disclosure ≤ 3.11.12 CVE-2024-12335 Wordfence
4.3 Medium Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Broken Access Control Missing Authorization to Authenticated (Subscriber+) Form Submission Disclosure ≤ 2.17.3 CVE-2024-12190 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Page Title Widget ≤ 1.6.46 CVE-2024-11230 Wordfence
6.4 Medium Elementor Website Builder – More than Just a Page Builder Plugin elementor Cross-Site Scripting More than Just a Page Builder <= 3.25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typography Settings ≤ 3.25.9 CVE-2024-10453 Wordfence
6.5 Medium Fusion Plugin fusion Cross-Site Scripting ≤ 1.6.1 Fixed in 1.6.2 CVE-2024-37962 Patchstack
5.4 Medium Cost Calculator Builder Plugin cost-calculator-builder Cross-Site Request Forgery Settings update via CSRF No login needed < 3.2.43 Fixed in 3.2.43 CVE-2024-10892 WPScan
6.4 Medium Video Share VOD – Turnkey Video Site Builder Script Plugin video-share-vod Cross-Site Scripting Turnkey Video Site Builder Script <= 2.6.30 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.6.30 CVE-2024-12449 Wordfence
6.1 Medium Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS Plugin sikshya Cross-Site Scripting Sikshya LMS <= 0.0.21 - Reflected Cross-Site Scripting via page Parameter No login needed ≤ 0.0.21 CVE-2024-12127 Wordfence
6.1 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting Reflected Cross-Site Scripting via Navigate Parameter No login needed ≤ 1.3.0.5 CVE-2024-12239 Wordfence
4.9 Medium Bold Page Builder Plugin bold-page-builder Path Traversal ≤ 5.1.5 Fixed in 5.1.6 CVE-2024-54382 Patchstack
6.5 Medium Poll Builder Plugin poll-builder Cross-Site Scripting ≤ 1.3.5 CVE-2024-54276 Patchstack
5.4 Medium Cost Calculator Builder Plugin cost-calculator-builder Broken Access Control ≤ 3.1.42 Fixed in 3.1.43 CVE-2023-40011 Patchstack
5.3 Medium Gutenverse Plugin gutenverse Broken Access Control Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.8.5 - Broken Access Control No login needed ≤ 1.8.5 Fixed in 1.8.6 CVE-2023-35875 Patchstack
6.4 Medium Beaver Builder – WordPress Page Builder Plugin Cross-Site Scripting WordPress Page Builder <= 2.8.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.8.4.4 CVE-2024-11832 Wordfence
5.4 Medium Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder Plugin Cross-Site Scripting Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popups Builder <= 1.20.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.20.2 CVE-2024-10583 Wordfence
4.3 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Information Disclosure animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure ≤ 9.9.9.3 CVE-2024-11181 Wordfence
4.8 Medium Popup Builder Plugin popup-builder Cross-Site Scripting Admin+ Stored XSS < 4.3.5 Fixed in 4.3.5 CVE-2024-9428 WPScan
6.5 Medium SQL Chart Builder Plugin sql-chart-builder SQL Injection Authenticated (Contributor+) SQL Injection ≤ 2.3.6 CVE-2024-11430 Wordfence
5.3 Medium ARForms Form Builder Plugin arforms-form-builder Content Injection HTML Injection No login needed ≤ 1.7.1 Fixed in 1.7.2 CVE-2024-54223 Patchstack
5.3 Medium FormCraft Plugin formcraft-form-builder Broken Access Control Contact Form Builder for WordPress plugin <= 1.2.7 - Broken Access Control No login needed ≤ 1.2.7 Fixed in 1.2.8 CVE-2023-47823 Patchstack
5.3 Medium Void Elementor Post Grid Addon for Elementor Page builder Plugin void-elementor-post-grid-addon-for-elementor-page-builder Broken Access Control No login needed ≤ 2.1.10 Fixed in 2.2 CVE-2023-48750 Patchstack
5.3 Medium Button Generator – easily Button Builder Plugin button-generation Broken Access Control easily Button Builder plugin <= 2.3.8 - Broken Access Control No login needed ≤ 2.3.8 Fixed in 2.3.9 CVE-2023-49154 Patchstack
5.3 Medium Metform Plugin metform Broken Access Control No login needed ≤ 3.4.0 Fixed in 3.4.1 CVE-2023-50903 Patchstack
6.1 Medium Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! Plugin Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 1.4.19 CVE-2024-11436 Wordfence
6.4 Medium Depicter — Popup & Slider Builder Plugin depicter Cross-Site Scripting Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.2.1- Authenticated (Author+) Stored Cross-Site Scripting ≤ 3.2.1 CVE-2024-4633 Wordfence
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.8.4.3 Fixed in 2.8.4.4 CVE-2024-53797 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.2.1 Fixed in 5.2.2 CVE-2024-53801 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only