WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 51–100 of 1,407 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 29
Severity Component Vulnerability Affected versions Published CVE Source
6.4 Medium Live Composer Plugin live-composer-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content ≤ 2.1.21 CVE-2026-16778 Wordfence
7.2 High Ninja Forms – The Contact Form Builder That Grows With You Plugin ninja-forms Cross-Site Scripting The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting No login needed ≤ 3.15.3 CVE-2026-94504 Wordfence
6.4 Medium WP Composer Plugin page-builder-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode ≤ 1.0.5 CVE-2026-2422 Wordfence
4.3 Medium BlockSpare - Gutenberg Site Builder Blocks & Starter Sites Plugin blockspare Broken Access Control Gutenberg Site Builder Blocks & Starter Sites <= 4.2.6 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Creation ≤ 4.2.6 CVE-2026-1242 Wordfence
4.3 Medium PDF Builder for WooCommerce. Create invoices,packing slips and more Plugin woo-pdf-invoice-builder Broken Access Control Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler ≤ 2.0.11 CVE-2026-11899 Wordfence
9.8 Critical Botiga Pro Plugin Privilege Escalation Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route No login needed < 1.6.5 Fixed in 1.6.5 CVE-2026-86591 WPScan
5.5 Medium JetFormBuilder Plugin Arbitrary File Deletion Admin+ Arbitrary File Deletion via Server-Side Validation Callback 3.5.6.2 – < 3.6.5.3 Fixed in 3.6.5.3 CVE-2026-19860 WPScan
4.3 Medium Nimble Builder Plugin Information Disclosure Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins ≤ 3.3.8 CVE-2026-16557 WPScan
6.4 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content ≤ 2.8.4 CVE-2026-14472 Wordfence
4.9 Medium NEX-Forms Plugin nex-forms-express-wp-form-builder SQL Injection Authenticated (Administrator+) SQL Injection via 'operator' Key of the 'additional_params' Parameter ≤ 9.3.0 CVE-2026-75961 Wordfence
4.3 Medium Magazine Blocks Plugin magazine-blocks Broken Access Control Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint ≤ 1.8.6 CVE-2026-75017 Wordfence
5.3 Medium Easy Form Builder Plugin easy-form-builder Broken Access Control Unauthenticated Registration Policy Bypass via Login Form Type Confusion No login needed 4.0.0 – < 4.2.0 Fixed in 4.2.0 CVE-2026-85123 WPScan
8.8 High Easy Form Builder Plugin easy-form-builder Cross-Site Scripting Unauthenticated Stored XSS via Form Type Confusion No login needed 4.0.0 – < 4.2.0 Fixed in 4.2.0 CVE-2026-85122 WPScan
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter ≤ 2.8.14 CVE-2026-2585 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter ≤ 5.9.6 CVE-2026-5920 Wordfence
9.8 Critical JetFormBuilder Plugin jetformbuilder Privilege Escalation Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter No login needed ≤ 3.6.2 CVE-2026-12793 Wordfence
6.4 Medium ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets Plugin shopengine Cross-Site Scripting All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter ≤ 4.9.5 CVE-2026-85575 Wordfence
7.1 High Export & Import WPBakery Page Builder Plugin Cross-Site Scripting Stored XSS via CSRF No login needed ≤ 1.0.2 CVE-2026-81429 WPScan
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.16.1 Fixed in 45.16.2 CVE-2026-62138 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 5.9.9 Fixed in 5.9.10 CVE-2026-62110 Patchstack
5.3 Medium Nexi XPay Build Plugin Information Disclosure Unauthenticated Saved Payment Token Disclosure via IDOR No login needed 7.6.1 – 7.6.2 CVE-2026-82213 WPScan
6.8 Medium AI Builder Plugin Cross-Site Scripting Contributor+ Stored XSS via Post JavaScript 2.4.1 – < 2.7.8 Fixed in 2.7.8 CVE-2026-85678 WPScan
6.5 Medium Woo PDF Invoice Builder Plugin woo-pdf-invoice-builder Broken Access Control Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure ≤ 2.0.8 CVE-2026-11496 Wordfence
6.1 Medium Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder Plugin form-maker Cross-Site Scripting Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting No login needed ≤ 1.15.46 CVE-2026-85645 Wordfence
6.4 Medium Builderall Plugin builderall-cheetah-for-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting ≤ 3.0.2 CVE-2026-15820 Wordfence
4.3 Medium Builderall Plugin builderall-cheetah-for-wp Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter ≤ 3.0.2 CVE-2026-15823 Wordfence
6.4 Medium Builderall Plugin builderall-cheetah-for-wp Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting ≤ 3.0.2 CVE-2026-15796 Wordfence
4.3 Medium Checkout Custom Fields Builder for WooCommerce Plugin checkout-custom-fields-builder-for-woocommerce Broken Access Control Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter ≤ 1.1.5 CVE-2026-19802 Wordfence
5.4 Medium Orbit Fox Plugin Cross-Site Scripting Contributor+ Stored XSS via Beaver Builder Pricing Table Widget < 3.0.9 Fixed in 3.0.9 CVE-2026-85418 WPScan
6.5 Medium Beaver Builder Page Builder Plugin beaver-builder-lite-version Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution No login needed ≤ 2.10.3.1 CVE-2026-18021 Wordfence
8.8 High Live Composer Plugin live-composer-page-builder PHP Object Injection Authenticated (Contributor+) PHP Object Injection via Shortcode ≤ 2.1.18 CVE-2026-16502 Wordfence
7.1 High JetFormBuilder Plugin jetformbuilder Cross-Site Scripting No login needed ≤ 3.6.5.1 Fixed in 3.6.5.2 CVE-2026-84817 Patchstack
7.2 High User Profile Builder Plugin profile-builder Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field No login needed ≤ 3.15.7 CVE-2026-6431 Wordfence
4.8 Medium JetFormBuilder Plugin Content Injection Unauthenticated Email Header Injection via Send Email Action No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19862 WPScan
6.5 Medium JetFormBuilder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19859 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Slider Elements' additional_settings < 5.9.9 Fixed in 5.9.9 CVE-2026-84028 WPScan
6.1 Medium Beaver Builder Plugin (Pro Version) Plugin Cross-Site Scripting Reflected Cross-Site Scripting via 'no_results_message' node_preview Parameter No login needed ≤ 2.11.0.1 CVE-2026-18843 Wordfence
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via Multiple Shortcode Element Attributes < 5.9.8 Fixed in 5.9.8 CVE-2026-84022 WPScan
6.8 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URL < 5.9.8 Fixed in 5.9.8 CVE-2026-84021 WPScan
6.8 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Cross-Site Scripting Contributor+ Stored XSS via Block Animation customProps Attribute < 13.2.0 Fixed in 13.2.0 CVE-2026-83544 WPScan
4.1 Medium Greenshift Plugin greenshift-animation-and-page-builder-blocks Server-Side Request Forgery Contributor+ SSRF via get-csv-to-json REST Endpoint < 13.2.0 Fixed in 13.2.0 CVE-2026-83543 WPScan
8.8 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation No login needed 5.0.1.8 – < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77826 WPScan
4.7 Medium JetFormBuilder Plugin Cross-Site Scripting Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19861 WPScan
7.5 High JetFormBuilder Plugin Information Disclosure Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset No login needed < 3.6.5.2 Fixed in 3.6.5.2 CVE-2026-19858 WPScan
9.8 Critical AI Website Builder (GitHub build) Plugin Remote Code Execution Unauthenticated RCE via Unprotected REST Routes No login needed 1.0.0 – 1.0.0 CVE-2026-82923 WPScan
4.8 Medium Brave Popup Builder Plugin Arbitrary Shortcode Execution Unauthenticated Arbitrary Shortcode Execution via UTM Parameter No login needed < 0.8.8 Fixed in 0.8.8 CVE-2026-81571 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Zero Quantity No login needed 6.0.0.0 – < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77794 WPScan
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Price Manipulation Unauthenticated Payment Bypass via Omitted Price Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77793 WPScan
8.8 High FAQ Builder AYS Plugin faq-builder-ays Cross-Site Scripting Unauthenticated Stored XSS via ays_get_user_information No login needed 1.6.3 – < 1.8.5 Fixed in 1.8.5 CVE-2026-81737 WPScan
7.5 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Unauthenticated Stored XSS via Rating Field No login needed < 6.0.9.9 Fixed in 6.0.9.9 CVE-2026-77792 WPScan

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only