WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 901–950 of 1,023 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 19 of 21
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.263 CVE-2024-2839 Wordfence
6.4 Medium Metform Elementor Contact Form Builder Plugin metform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets ≤ 3.8.5 CVE-2024-2791 Wordfence
5.4 Medium Page Builder Gutenberg Blocks Plugin coblocks Cross-Site Scripting Contributor+ Stored XSS < 3.1.7 Fixed in 3.1.7 CVE-2024-2369 WPScan
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget ≤ 1.5.7 CVE-2024-2140 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget ≤ 1.5.7 CVE-2024-2142 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget ≤ 1.5.7 CVE-2024-2141 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget ≤ 1.5.7 CVE-2024-2144 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget ≤ 1.5.7 CVE-2024-2143 Wordfence
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 4.8.0 Fixed in 4.8.1 CVE-2024-30442 Patchstack
5.9 Medium WordPress Page Builder – Zion Builder Plugin zionbuilder Cross-Site Scripting Zion Builder plugin <= 3.6.9 - Cross Site Scripting (XSS) ≤ 3.6.9 Fixed in 3.6.10 CVE-2024-30444 Patchstack
6.5 Medium OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Plugin stepbyteservice-openstreetmap Cross-Site Scripting ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-30450 Patchstack
5.9 Medium Landing Page Builder Plugin page-builder-add Cross-Site Scripting ≤ 1.5.1.7 Fixed in 1.5.1.8 CVE-2024-30452 Patchstack
5.4 Medium Brave Popup Builder Plugin brave-popup-builder Server-Side Request Forgery No login needed ≤ 0.6.5 Fixed in 0.6.6 CVE-2024-30453 Patchstack
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.7.4.4 Fixed in 2.7.4.5 CVE-2024-30425 Patchstack
6.5 Medium Carousel Anything For WPBakery Page Builder Plugin carousel-anything Cross-Site Scripting ≤ 2.1 CVE-2024-30520 Patchstack
4.6 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Scripting The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 3.8.0 CVE-2024-2108 Wordfence
4.3 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Request Forgery The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export No login needed ≤ 3.8.0 CVE-2024-2113 Wordfence
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.6.5 CVE-2024-2841 Wordfence
6.5 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting ≤ 1.13.1 Fixed in 1.13.2 CVE-2024-30422 Patchstack
5.4 Medium Colibri Page Builder Plugin colibri-page-builder Broken Access Control ≤ 1.0.248 Fixed in 1.0.249 CVE-2024-28004 Patchstack
5.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.2 CVE-2024-2091 Wordfence
5.9 Medium Funnel Builder by CartFlows Plugin cartflows Cross-Site Scripting ≤ 2.0.1 Fixed in 2.0.2 CVE-2024-29813 Patchstack
6.5 Medium Popup Builder Plugin popup-builder Cross-Site Scripting ≤ 4.2.6 Fixed in 4.2.7 CVE-2024-30184 Patchstack
6.5 Medium Livemesh Addons for WPBakery Page Builder Plugin addons-for-visual-composer Cross-Site Scripting ≤ 3.7 Fixed in 3.8 CVE-2024-30183 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 4.7.6 Fixed in 4.7.7 CVE-2024-30179 Patchstack
6.5 Medium WC Builder Plugin wc-builder Cross-Site Scripting ≤ 1.0.18 Fixed in 1.0.19 CVE-2024-29926 Patchstack
6.5 Medium PDF Builder for WPForms Plugin pdf-builder-for-wpforms Cross-Site Scripting ≤ 1.2.88 Fixed in 1.2.89 CVE-2024-29820 Patchstack
5.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation ≤ 3.20.1 CVE-2024-2120 Wordfence
6.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload ≤ 3.20.1 CVE-2024-1521 Wordfence
6.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag ≤ 3.20.1 CVE-2024-2781 Wordfence
5.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.20.1 CVE-2024-2121 Wordfence
6.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authententicated (Contributor+) Stored Cross-Site Scripting ≤ 3.20.1 CVE-2024-1364 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Clients Widget ≤ 5.4.1 CVE-2024-2203 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Team Member Listing ≤ 5.4.1 CVE-2024-2210 Wordfence
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery No login needed ≤ 5.3.0.0 Fixed in 5.3.1.0 CVE-2024-2951 Patchstack
4.3 Medium Void Contact Form 7 Widget For Elementor Page Builder Plugin cf7-widget-elementor Broken Access Control ≤ 2.3 Fixed in 2.4 CVE-2023-52214 Patchstack
6.5 Medium Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin post-and-page-builder Cross-Site Scripting ≤ 1.26.2 Fixed in 1.26.3 CVE-2024-2888 Patchstack
6.4 Medium Page Builder Gutenberg Blocks – CoBlocks Plugin coblocks Cross-Site Scripting CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.1.6 CVE-2024-1049 Wordfence
6.4 Medium Page Builder by SiteOrigin Plugin siteorigin-panels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget ≤ 2.29.6 CVE-2024-2202 Wordfence
4.3 Medium AJAX Thumbnail Rebuild Plugin ajax-thumbnail-rebuild Broken Access Control ≤ 1.13 Fixed in 1.14 CVE-2022-47604 Patchstack
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control ≤ 5.2.5.9 Fixed in 5.2.6.0 CVE-2024-25935 Patchstack
6.4 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4 CVE-2024-2129 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.3 CVE-2024-2255 Wordfence
5.9 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.6.0 Fixed in 45.7.0 CVE-2024-27997 Patchstack
4.3 Medium Builder for WooCommerce reviews shortcodes – ReviewShort Plugin woo-product-reviews-shortcode Cross-Site Request Forgery ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.01.3 Fixed in 1.01.4 CVE-2024-29093 Patchstack
5.9 Medium WP Popups Plugin wp-popups-lite Cross-Site Scripting WordPress Popup builder plugin <= 2.1.5.5 - Cross Site Scripting (XSS) ≤ 2.1.5.5 Fixed in 2.1.5.6 CVE-2024-29105 Patchstack
6.5 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting ≤ 1.12.10 Fixed in 1.12.11 CVE-2024-29107 Patchstack
5.4 Medium WooCommerce PDF Invoice Builder Plugin woo-pdf-invoice-builder Cross-Site Request Forgery No login needed ≤ 1.2.101 Fixed in 1.2.102 CVE-2023-51486 Patchstack
5.4 Medium ARI Stream Quiz Plugin ari-stream-quiz Cross-Site Request Forgery WordPress Quizzes Builder plugin <= 1.2.32 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.2.32 Fixed in 1.3.0 CVE-2023-51487 Patchstack
6.5 Medium NEX-Forms – Ultimate Form Builder Plugin nex-forms-express-wp-form-builder Cross-Site Scripting ≤ 8.5.5 Fixed in 8.5.6 CVE-2024-25593 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only