WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 51–66 of 66 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 2 of 2
Severity Component Vulnerability Affected versions Published CVE Source
10.0 Critical Stacks Mobile App Builder Plugin stacks-mobile-app-builder Arbitrary File Upload No login needed ≤ 5.2.3 CVE-2024-50527 Patchstack
9.8 Critical Stacks Mobile App Builder Plugin stacks-mobile-app-builder Privilege Escalation Account Takeover No login needed ≤ 5.2.3 CVE-2024-50477 Patchstack
9.8 Critical SiteBuilder Dynamic Components Plugin sitebuilder-dynamic-components PHP Object Injection No login needed ≤ 1.0 CVE-2024-49625 Patchstack
9.3 Critical Cost Calculator Builder Plugin cost-calculator-builder SQL Injection No login needed ≤ 3.2.15 Fixed in 3.2.16 CVE-2024-43144 Patchstack
9.8 Critical Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor Plugin ultimate-store-kit PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 2.0.3 CVE-2024-8030 Wordfence
9.8 Critical Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor Plugin ultimate-store-kit PHP Object Injection Unauthenticated PHP Object Injection No login needed ≤ 1.6.4 CVE-2024-5335 Wordfence
9.0 Critical Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder Plugin bit-form Path Traversal Authenticated (Administrator+) Arbitrary File Read And Deletion 2.0 – 2.13.9 CVE-2024-7777 Wordfence
9.1 Critical User Profile Builder Plugin profile-builder Broken Access Control Unauthenticated Media Upload No login needed < 3.11.8 Fixed in 3.11.8 CVE-2024-6366 WPScan
9.0 Critical CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More Plugin PHP Object Injection Customize Checkout, Shop, Email, Products & More <= 4.4.1 - Unauthenticated PHP Object Injection No login needed ≤ 4.4.1 CVE-2024-4371 Wordfence
10.0 Critical Bricks Builder Theme Remote Code Execution Unauthenticated Remote Code Execution (RCE) No login needed ≤ 1.9.6 Fixed in 1.9.6.1 CVE-2024-25600 Patchstack
9.8 Critical Hash Form – Drag & Drop Form Builder Plugin hash-form Arbitrary File Upload Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution No login needed ≤ 1.1.0 CVE-2024-5084 Wordfence
9.8 Critical Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Settings Update and Limited Privilege Escalation No login needed ≤ 5.1.16 CVE-2024-2771 Wordfence
9.8 Critical Build App Online Plugin build-app-online Privilege Escalation Unauthenticated Account Takeover No login needed ≤ 1.0.19 CVE-2023-51478 Patchstack
9.9 Critical Oxygen Builder Plugin Remote Code Execution Authenticated Remote Code Execution (RCE) ≤ 4.9 CVE-2024-31380 Patchstack
10.0 Critical WappPress Plugin wapppress-builds-android-app-for-website Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 5.0.3 Fixed in 6.0.0 CVE-2023-49815 Patchstack
9.9 Critical Elementor Website Builder Plugin elementor Arbitrary File Upload 3.3.0 – 3.18.1 Fixed in 3.18.2 CVE-2023-48777 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only