WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 901–950 of 1,414 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 19 of 29
Severity Component Vulnerability Affected versions Published CVE Source
9.8 Critical Stacks Mobile App Builder Plugin stacks-mobile-app-builder Privilege Escalation Account Takeover No login needed ≤ 5.2.3 CVE-2024-50477 Patchstack
7.5 High Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Broken Access Control Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation ≤ 1.35.1 CVE-2024-10402 Wordfence
8.1 High App Builder – Create Native Android & iOS Apps On The Flight Plugin app-builder Privilege Escalation Create Native Android & iOS Apps On The Flight <= 5.3.7 - Privilege Escalation and Account Takeover via Weak OTP No login needed ≤ 5.3.7 CVE-2024-9302 Wordfence
6.1 Medium Extra Product Options Builder for WooCommerce Plugin additional-product-fields-for-woocommerce Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 1.2.133 CVE-2024-9214 Wordfence
4.3 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Information Disclosure Authenticated (Contributor+) Information Disclosure via Shortcode ≤ 1.6.43 CVE-2024-10050 Wordfence
4.3 Medium Photo Gallery Builder Plugin photo-gallery-builder Broken Access Control Broken Access Control to Notice Dismissal ≤ 3.0 CVE-2024-49325 Patchstack
9.8 Critical SiteBuilder Dynamic Components Plugin sitebuilder-dynamic-components PHP Object Injection No login needed ≤ 1.0 CVE-2024-49625 Patchstack
6.5 Medium Mighty Builder Plugin mighty-builder Cross-Site Scripting ≤ 1.0.2 CVE-2024-48049 Patchstack
6.5 Medium wpPricing Builder Plugin wppricing-builder-lite-responsive-pricing-table-builder Cross-Site Scripting ≤ 1.5.0 CVE-2024-49225 Patchstack
6.5 Medium WordPress Portfolio Builder – Portfolio Gallery Plugin uber-grid Cross-Site Scripting Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) ≤ 1.1.7 CVE-2024-49302 Patchstack
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation No login needed ≤ 1.35.1 CVE-2024-9351 Wordfence
4.3 Medium Forminator Forms – Contact Form, Payment Form & Custom Form Builder Plugin forminator Cross-Site Request Forgery Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation No login needed ≤ 1.35.1 CVE-2024-9352 Wordfence
5.3 Medium Formidable Form Builder Plugin Information Disclosure Unauthenticated Information Disclosure No login needed < 2.05.03 Fixed in 2.05.03 CVE-2017-20194 Wordfence
7.3 High WP Popup Builder – Popup Forms and Marketing Lead Generation Plugin wp-popup-builder Arbitrary Shortcode Execution Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add No login needed ≤ 1.3.5 CVE-2024-9061 Wordfence
8.3 High WP Lead Plus X Plugin free-sales-funnel-squeeze-pages-landing-page-builder-templates-make Cross-Site Request Forgery No login needed ≤ 0.99 CVE-2020-36839 Wordfence
8.3 High Formidable Form Builder Plugin formidable Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed < 2.05.03 Fixed in 2.05.03 CVE-2017-20192 Wordfence
4.3 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Information Disclosure Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections ≤ 1.13.8 CVE-2024-8902 Wordfence
5.3 Medium Stackable – Page Builder Gutenberg Blocks Plugin stackable-ultimate-gutenberg-blocks Content Injection Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection No login needed ≤ 3.13.6 CVE-2024-8760 Wordfence
6.4 Medium Mynx Page Builder Plugin mynx-page-builder Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 0.27.8 CVE-2024-9656 Wordfence
4.3 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Information Disclosure Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via content_template ≤ 5.6.11 CVE-2024-8913 Wordfence
4.9 Medium Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Path Traversal Authenticated (Administrator+) Improper Input Validation via iconUpload Function to Arbitrary File Read ≤ 2.15.2 CVE-2024-9507 Wordfence
6.1 Medium BlockMeister – Block Pattern Builder Plugin blockmeister Cross-Site Scripting Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting No login needed ≤ 3.1.10 CVE-2024-9616 Wordfence
6.4 Medium WP Builder Plugin cssjockey-add-ons Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 3.0.7 CVE-2024-9457 Wordfence
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.1.1 Fixed in 5.1.2 CVE-2024-47298 Patchstack
5.9 Medium Coming Soon Page, Under Construction & Maintenance Mode by SeedProd Plugin coming-soon Cross-Site Scripting ≤ 6.17.4 Fixed in 6.18.4 CVE-2024-47299 Patchstack
7.1 High Chartify Plugin chart-builder Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 2.7.6 Fixed in 2.7.7 CVE-2024-47347 Patchstack
6.5 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting ≤ 1.13.6 Fixed in 1.13.7 CVE-2024-47366 Patchstack
6.5 Medium XLTab – Accordions and Tabs for Elementor Page Builder Plugin xl-tab Cross-Site Scripting Accordions and Tabs for Elementor Page Builder plugin <= 1.3 - Cross Site Scripting (XSS) ≤ 1.3 Fixed in 1.4 CVE-2024-47375 Patchstack
5.9 Medium Depicter Slider Plugin depicter Cross-Site Scripting ≤ 3.2.2 Fixed in 3.5.0 CVE-2024-47381 Patchstack
7.1 High NEX-Forms Plugin nex-forms-express-wp-form-builder Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 8.7.3 Fixed in 8.7.4 CVE-2024-47389 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.1.1 Fixed in 5.1.1 CVE-2024-47391 Patchstack
6.5 Medium Enter Addons Plugin enteraddons Cross-Site Scripting Ultimate Template Builder for Elementor plugin <= 2.1.8 - Cross Site Scripting (XSS) ≤ 2.1.8 Fixed in 2.1.9 CVE-2024-47625 Patchstack
6.1 Medium Hash Form - Drag & Drop Form Builder Plugin hash-form Arbitrary File Upload Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload No login needed ≤ 1.1.9 CVE-2024-9417 Wordfence
4.9 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Form Manager+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-9528 Wordfence
6.1 Medium Themify Builder Plugin themify-builder Cross-Site Scripting Reflected Cross-Site Scripting No login needed ≤ 7.6.2 CVE-2024-9385 Wordfence
6.4 Medium Ibtana – WordPress Website Builder Plugin ibtana-visual-editor Cross-Site Scripting WordPress Website Builder <= 1.2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute ≤ 1.2.4.4 CVE-2024-8282 Wordfence
6.1 Medium Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid Plugin magazine-blocks Cross-Site Scripting Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid <= 1.3.14 - Reflected Cross-Site Scripting No login needed ≤ 1.3.14 CVE-2024-9218 Wordfence
6.4 Medium Elastik Page Builder Plugin elastik-page-builder Cross-Site Scripting Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 0.27.4 CVE-2024-9274 Wordfence
7.2 High Cost Calculator Builder Plugin cost-calculator-builder SQL Injection Admin+ SQL Injection < 3.2.29 Fixed in 3.2.29 CVE-2024-8379 WPScan
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.3.6 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Button Group Module ≤ 2.8.3.6 CVE-2024-9049 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 2.9.7 CVE-2024-8668 Wordfence
6.4 Medium Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) Plugin graphicsly Cross-Site Scripting The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload ≤ 1.0.2 CVE-2024-9069 Wordfence
5.9 Medium PageLayer Plugin pagelayer Cross-Site Scripting Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) ≤ 1.8.7 Fixed in 1.8.8 CVE-2024-43972 Patchstack
6.5 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting ≤ 9.3.7 Fixed in 9.4 CVE-2024-44005 Patchstack
6.5 Medium The Plus Addons for Elementor Page Builder Lite Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting ≤ 5.6.2 Fixed in 5.6.3 CVE-2024-43977 Patchstack
5.4 Medium Bricks Theme Cross-Site Scripting Authenticated (Bricks Page Builder Access+) Stored Cross-Site Scripting ≤ 1.10.1 CVE-2023-3410 Wordfence
6.4 Medium Avada | Website Builder For WordPress & eCommerce Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via fusion_button Shortcode ≤ 3.11.9 CVE-2024-5628 Wordfence
5.4 Medium Elementor Website Builder – More than Just a Page Builder Plugin elementor Cross-Site Scripting More than Just a Page Builder <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets ≤ 3.23.4 CVE-2024-5416 Wordfence
6.4 Medium Essential Addons for Elementor -- Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget ≤ 6.0.3 CVE-2024-8440 Wordfence
5.3 Medium Cost Calculator Builder PRO Plugin cost-calculator-builder Price Manipulation Unauthenticated Price Manipulation No login needed ≤ 3.2.1 CVE-2024-6010 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only