WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 751–800 of 1,027 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 16 of 21
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium WooCommerce Checkout & Funnel Builder by CartFlows – Create High Converting Stores For WooCommerce Plugin cartflows Cross-Site Scripting Create High Converting Stores For WooCommerce <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.0.7 CVE-2024-4632 Wordfence
5.3 Medium Ibtana - WordPress Website Builder Plugin ibtana-visual-editor Broken Access Control WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update No login needed ≤ 1.2.3.3 CVE-2024-5541 Wordfence
4.3 Medium Infographic Maker iList Plugin infographic-and-list-builder-ilist Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update ≤ 4.7.4 CVE-2024-5858 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter ≤ 3.2.38 CVE-2024-4863 Wordfence
6.4 Medium EleSpare – News, Magazine and Blog Addons for Elementor Plugin elespare Cross-Site Scripting Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widget ≤ 3.1.2 CVE-2024-4615 Wordfence
6.4 Medium WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via VC Single Image link attribute ≤ 7.6 CVE-2024-5265 Wordfence
6.1 Medium Themify Builder Plugin themify-builder Open Redirect No login needed < 7.5.8 Fixed in 7.5.8 CVE-2024-3032 WPScan
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget ≤ 1.6.35 CVE-2024-5757 Wordfence
5.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Widget ≤ 1.13.3 CVE-2024-2092 Wordfence
6.5 Medium WordPress Header Builder Plugin – Pearl Plugin pearl-header-builder Broken Access Control Pearl <= 1.3.7 - Missing Authorization to Unauthenticated Arbitrary Site Options Deletion No login needed ≤ 1.3.7 CVE-2024-5468 Wordfence
6.4 Medium CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More Plugin woolementor Cross-Site Scripting Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 4.4.1 CVE-2024-4564 Wordfence
5.3 Medium Builder for WooCommerce reviews shortcodes – ReviewShort Plugin woo-product-reviews-shortcode Broken Access Control ReviewShort plugin <= 1.01.5 - Broken Access Control No login needed ≤ 1.01.5 Fixed in 1.01.6 CVE-2024-34763 Patchstack
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.23 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.23 CVE-2024-5189 Wordfence
4.3 Medium Elementor Website Builder Plugin elementor Broken Access Control ≤ 3.13.2 Fixed in 3.13.3 CVE-2023-33922 Patchstack
5.3 Medium MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Plugin metform Information Disclosure Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 3.8.8 - Unauthenticated Sensitive Information Exposure No login needed ≤ 3.8.8 CVE-2024-4266 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget ≤ 2.9.0 CVE-2024-5530 Wordfence
5.3 Medium Contact Form Builder, Contact Widget Plugin contact-forms-builder Other Bypass Vulnerability No login needed ≤ 2.1.7 CVE-2024-35747 Patchstack
5.3 Medium Vision Interactive Plugin vision Broken Access Control Image Map Builder plugin <= 1.7.1 - Broken Access Control No login needed ≤ 1.7.1 Fixed in 1.7.2 CVE-2024-32779 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.5.4 Fixed in 5.5.5 CVE-2024-35709 Patchstack
6.4 Medium Cards for Beaver Builder Plugin bb-bootstrap-cards Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Cards Widget ≤ 1.1.3 CVE-2024-5663 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_video_player Shortcode ≤ 1.0.276 CVE-2024-4451 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lightbox and Modal Widget ≤ 5.8.15 CVE-2024-5612 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.22 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.9.22 CVE-2024-5188 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 1.0.276 CVE-2024-5038 Wordfence
6.4 Medium SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster Plugin sellkit Cross-Site Scripting Funnel builder and checkout optimizer for WooCommerce to sell more, faster <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter ≤ 1.9.8 CVE-2024-4608 Wordfence
5.4 Medium Countdown, Coming Soon, Maintenance – Countdown & Clock Plugin countdown-builder Broken Access Control Countdown & Clock <= 2.7.8 - Missing Authorization to Authenticated (Subscriber+) PHP Object Injection ≤ 2.7.8 CVE-2024-2017 Wordfence
4.3 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Broken Access Control Missing Authorization to Page/Post Creation ≤ 1.3.5 CVE-2024-4788 Wordfence
6.4 Medium Boostify Header Footer Builder for Elementor Plugin boostify-header-footer-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via size Parameter ≤ 1.3.2 CVE-2024-5006 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality ≤ 2.4.43 CVE-2024-1164 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes ≤ 2.4.43 CVE-2024-1161 Wordfence
4.3 Medium RT Easy Builder – Advanced addons for Elementor Plugin rt-easy-builder-advanced-addons-for-elementor Broken Access Control ≤ 2.0 Fixed in 2.1 CVE-2024-30484 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.8.0 Fixed in 45.9.0 CVE-2024-35653 Patchstack
5.9 Medium Brave Plugin brave-popup-builder Cross-Site Scripting Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) ≤ 0.6.9 Fixed in 0.7.0 CVE-2024-35655 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Form Submission Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51544 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass IP Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51543 Patchstack
5.4 Medium ARI Stream Quiz Plugin ari-stream-quiz Content Injection WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection ≤ 1.3.2 Fixed in 1.3.3 CVE-2023-47513 Patchstack
6.4 Medium Popup Builder Plugin popup-builder Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS ≤ 4.2.7 CVE-2024-2506 Wordfence
6.4 Medium Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder Plugin supreme-modules-for-divi Cross-Site Scripting Divi Theme, Extra Theme and Divi Builder <= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.5.51 CVE-2024-5501 Wordfence
6.4 Medium Page Builder Gutenberg Blocks – CoBlocks Plugin coblocks Cross-Site Scripting CoBlocks <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles ≤ 3.1.9 CVE-2024-2933 Wordfence
6.4 Medium Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget ≤ 5.8.14 CVE-2024-5086 Wordfence
6.4 Medium Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation Plugin optinmonster Cross-Site Scripting WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.16.1 CVE-2024-4045 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.5.1 CVE-2024-4484 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.5.2 CVE-2024-4485 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box ≤ 5.5.4 CVE-2024-3718 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card ≤ 5.5.4 CVE-2024-2784 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.26 CVE-2024-2618 Wordfence
4.3 Medium Brizy – Page Builder Plugin brizy Broken Access Control Page Builder <= 2.4.43 - Missing Authorization ≤ 2.4.43 CVE-2024-3711 Wordfence
5.4 Medium Responsive Contact Form Builder & Lead Generation Plugin lead-form-builder Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 1.9.1 CVE-2024-4261 Wordfence
4.3 Medium ApplyOnline – Application Form Builder and Manager Plugin apply-online Broken Access Control Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposure ≤ 2.6.2 CVE-2024-2036 Wordfence
6.4 Medium Ninja Beaver Add-ons for Beaver Builder Plugin ninja-beaver-lite-addons-for-beaver-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets ≤ 2.4.5 CVE-2024-2163 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only