WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 701–750 of 1,027 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 15 of 21
Severity Component Vulnerability Affected versions Published CVE Source
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6520 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6521 Wordfence
4.3 Medium FunnelKit – Funnel Builder for WooCommerce Checkout Plugin funnel-builder Broken Access Control Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update ≤ 3.4.6 CVE-2024-6836 Wordfence
6.5 Medium Elementor – Header, Footer & Blocks Template Plugin header-footer-elementor Cross-Site Scripting Contributor+ DOM-Based Cross Site Scripting (XSS) ≤ 1.6.35 Fixed in 1.6.36 CVE-2024-33933 Patchstack
6.5 Medium Page Builder Sandwich – Front-End Page Builder Plugin page-builder-sandwich Cross-Site Scripting ≤ 5.1.0 CVE-2024-37219 Patchstack
6.5 Medium Ninja Beaver Add-ons for Beaver Builder Plugin ninja-beaver-lite-addons-for-beaver-builder Cross-Site Scripting ≤ 2.4.5 CVE-2024-37244 Patchstack
6.5 Medium Enter Addons Plugin enteraddons Cross-Site Scripting Ultimate Template Builder for Elementor plugin <= 2.1.6 - Cross Site Scripting (XSS) ≤ 2.1.6 Fixed in 2.1.7 CVE-2024-37263 Patchstack
5.9 Medium Cards for Beaver Builder Plugin bb-bootstrap-cards Cross-Site Scripting ≤ 1.1.4 Fixed in 1.1.5 CVE-2024-37278 Patchstack
5.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting ≤ 1.3.0.4 Fixed in 1.3.0.5 CVE-2024-37409 Patchstack
5.9 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting ≤ 3.6.1 Fixed in 3.7 CVE-2024-38784 Patchstack
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.8.2.2 Fixed in 2.8.3 CVE-2024-37500 Patchstack
6.5 Medium NEX-Forms – Ultimate Form Builder Plugin nex-forms-express-wp-form-builder Cross-Site Scripting Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) ≤ 8.5.10 Fixed in 8.6.1 CVE-2024-37512 Patchstack
6.4 Medium Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin post-and-page-builder Cross-Site Scripting Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload ≤ 1.26.6 CVE-2024-6848 Wordfence
5.9 Medium Timeline Module for Beaver Builder Plugin timeline-for-beaver-builder Cross-Site Scripting ≤ 1.1.3 CVE-2024-37919 Patchstack
6.5 Medium Tabs For WPBakery Page Builder Plugin tabs-for-visual-composer Cross-Site Scripting ≤ 1.2 CVE-2024-37936 Patchstack
4.9 Medium WappPress Plugin wapppress-builds-android-app-for-website Server-Side Request Forgery Blind Server Side Request Forgery (SSRF) ≤ 6.0.4 CVE-2024-38758 Patchstack
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5251 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5253 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5252 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5255 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5254 Wordfence
4.3 Medium Web and WooCommerce Addons for WPBakery Builder Plugin vc-addons-by-bit14 Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification ≤ 1.4.5 CVE-2024-6579 Wordfence
5.3 Medium AForms Plugin aforms-form-builder-for-price-calculator-cost-estimation Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 2.2.6 CVE-2024-6565 Wordfence
5.3 Medium WP Popups – WordPress Popup builder Plugin wp-popups-lite Information Disclosure WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure No login needed ≤ 2.2.0.1 CVE-2024-6555 Wordfence
6.4 Medium UltraAddons for Elementor Plugin ultraaddons-elementor-lite Cross-Site Scripting Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.1.6 CVE-2024-4866 Wordfence
6.5 Medium ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Local File Inclusion Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion ≤ 2.1.12 Fixed in 2.1.13 CVE-2024-37520 Patchstack
4.9 Medium Beaver Builder Addons by WPZOOM Plugin wpzoom-addons-for-beaver-builder Local File Inclusion ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-37464 Patchstack
6.4 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.5 CVE-2024-4862 Wordfence
5.5 Medium Elementor Website Builder Plugin elementor Cross-Site Scripting Arbitrary SVG File Download ≤ 3.22.1 Fixed in 3.22.2 CVE-2024-37437 Patchstack
4.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Local File Inclusion ≤ 1.3.0.3 Fixed in 1.3.0.4 CVE-2024-37410 Patchstack
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget ≤ 5.6.1 CVE-2024-4482 Wordfence
4.3 Medium Cost Calculator Builder Plugin cost-calculator-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation ≤ 3.2.12 CVE-2024-6012 Wordfence
4.4 Medium Cost Calculator Builder Plugin cost-calculator-builder Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 3.2.12 CVE-2024-6011 Wordfence
6.4 Medium Void Contact Form 7 Widget For Elementor Page Builder Plugin cf7-widget-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute ≤ 2.4 CVE-2024-5419 Wordfence
6.4 Medium Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes ≤ 3.2.45 CVE-2024-5819 Wordfence
6.4 Medium FunnelKit – Funnel Builder for WooCommerce Checkout Plugin funnel-builder Cross-Site Scripting Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.3.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload ≤ 3.3.1 CVE-2024-5192 Wordfence
6.4 Medium Stackable – Page Builder Gutenberg Blocks Plugin stackable-ultimate-gutenberg-blocks Cross-Site Scripting Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 3.13.1 CVE-2024-6296 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.0- Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.6.0 CVE-2024-4983 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.5 CVE-2024-4570 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.5 CVE-2024-4569 Wordfence
6.4 Medium Gutenberg Blocks with AI by Kadence WP – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget ≤ 3.2.42 CVE-2024-5289 Wordfence
6.4 Medium The7 — Website and eCommerce Builder Theme Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via url Attribute ≤ 11.13.0 CVE-2024-5451 Wordfence
4.3 Medium Bricks Builder Plugin Broken Access Control Insecure Direct Object Reference ≤ 1.9.8 CVE-2024-4874 Wordfence
6.5 Medium WordPress Form Builder Plugin – Gutenberg Forms Plugin forms-gutenberg Broken Access Control Auth. Broken Access Control ≤ 2.2.8.3 Fixed in 2.2.9 CVE-2022-45803 Patchstack
5.9 Medium Page Builder: Live Composer Plugin live-composer-page-builder Cross-Site Scripting ≤ 2.1.22 CVE-2024-35768 Patchstack
6.5 Medium Page Builder: Live Composer Plugin live-composer-page-builder Cross-Site Scripting Contributor+ Shortcode Cross Site Scripting (XSS) ≤ 1.5.42 CVE-2024-35779 Patchstack
6.1 Medium The Plus Addons for Elementor Page Builder Plugin Cross-Site Scripting Reflected Cross-Site Scripting via WP Login and Register Widget No login needed ≤ 5.5.6 CVE-2024-5344 Wordfence
4.3 Medium Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer Plugin promolayer-popup-builder Broken Access Control Promolayer <= 1.1.0 - Missing Authorization ≤ 1.1.0 CVE-2024-3602 Wordfence
5.4 Medium Fusion Builder Plugin Broken Access Control Authenticated Broken Access Control ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39310 Patchstack
6.5 Medium Greenshift – animation and page builder blocks Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting animation and page builder blocks plugin <= 8.8.9.1 - Cross Site Scripting (XSS) ≤ 8.8.9.1 Fixed in 8.9.4 CVE-2024-35765 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only