WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,694 vulnerabilities, 1,872 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,251 High 9,213 Medium 17,889 Low 341

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 11, 2026.

Showing 1,001–1,050 of 1,414 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 21 of 29
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite plugin <= 1.5.9 - Cross Site Scripting (XSS) ≤ 1.5.9 Fixed in 1.5.10 CVE-2024-43151 Patchstack
5.9 Medium Depicter Slider Plugin depicter Cross-Site Scripting ≤ 3.1.2 Fixed in 3.2.0 CVE-2024-43161 Patchstack
5.3 Medium PDF Builder for WPForms Plugin pdf-builder-for-wpforms Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 1.2.116 CVE-2024-7414 Wordfence
4.3 Medium Brizy – Page Builder Plugin brizy Cross-Site Request Forgery Page Builder <= 2.5.1 - Cross-Site Request Forgery No login needed ≤ 2.5.1 CVE-2024-6254 Wordfence
8.8 High Blox Page Builder Plugin blox-page-builder Arbitrary File Upload Authenticated (Contributor+) Arbitrary File Upload ≤ 1.0.65 CVE-2024-6315 Wordfence
4.3 Medium TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder Plugin templatespare Broken Access Control TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update ≤ 2.4.2 CVE-2024-6872 Wordfence
7.2 High JetFormBuilder Plugin jetformbuilder Privilege Escalation Authenticated (Administrator+) Privilege Escalation ≤ 3.3.4.1 CVE-2024-7291 Wordfence
5.9 Medium Pretty Simple Popup Builder Plugin pretty-simple-popup-builder Cross-Site Scripting ≤ 1.0.9 Fixed in 1.0.10 CVE-2024-39626 Patchstack
5.8 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting No login needed ≤ 6.0.0.1 Fixed in 6.0.0.2 CVE-2024-39643 Patchstack
6.5 Medium Kubio AI Page Builder Plugin kubio Cross-Site Scripting Authenticated Cross Site Scripting (XSS) ≤ 2.2.4 Fixed in 2.2.5 CVE-2024-39661 Patchstack
8.8 High PowerPack for Beaver Builder Plugin Privilege Escalation Contributor+ Privilege Escalation ≤ 2.33.0 Fixed in 2.33.1 CVE-2024-39633 Patchstack
6.4 Medium Element Pack - Addon for Elementor Page Builder Plugin Cross-Site Scripting Addon for Elementor Page Builder WordPress Plugin <= 7.9.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Wrapper Link URL ≤ 7.9.0 CVE-2024-2455 Wordfence
7.2 High Lifetime free Drag & Drop Contact Form Builder for WordPress VForm Plugin v-form Cross-Site Scripting Unauthenticated Stored Cross-Site Scripting No login needed ≤ 2.1.5 CVE-2024-6770 Wordfence
6.4 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode ≤ 5.0.2 CVE-2024-7100 Wordfence
9.1 Critical User Profile Builder Plugin profile-builder Broken Access Control Unauthenticated Media Upload No login needed < 3.11.8 Fixed in 3.11.8 CVE-2024-6366 WPScan
4.9 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting via Welcome Screen Fields ≤ 5.1.19 CVE-2024-6703 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6518 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6520 Wordfence
4.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Administrator+) Stored Cross-Site Scripting ≤ 5.1.19 CVE-2024-6521 Wordfence
8.8 High Flipbox Builder Plugin flipbox-builder PHP Object Injection Authenticated (Contributor+) PHP Object Injection ≤ 1.5 CVE-2024-6152 Wordfence
4.3 Medium FunnelKit – Funnel Builder for WooCommerce Checkout Plugin funnel-builder Broken Access Control Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps & One Click Upsells <= 3.4.6 - Missing Authorization to Authenticated (Contributor+) Settings Update ≤ 3.4.6 CVE-2024-6836 Wordfence
6.5 Medium Elementor – Header, Footer & Blocks Template Plugin header-footer-elementor Cross-Site Scripting Contributor+ DOM-Based Cross Site Scripting (XSS) ≤ 1.6.35 Fixed in 1.6.36 CVE-2024-33933 Patchstack
6.5 Medium Page Builder Sandwich – Front-End Page Builder Plugin page-builder-sandwich Cross-Site Scripting ≤ 5.1.0 CVE-2024-37219 Patchstack
6.5 Medium Ninja Beaver Add-ons for Beaver Builder Plugin ninja-beaver-lite-addons-for-beaver-builder Cross-Site Scripting ≤ 2.4.5 CVE-2024-37244 Patchstack
6.5 Medium Enter Addons Plugin enteraddons Cross-Site Scripting Ultimate Template Builder for Elementor plugin <= 2.1.6 - Cross Site Scripting (XSS) ≤ 2.1.6 Fixed in 2.1.7 CVE-2024-37263 Patchstack
5.9 Medium Cards for Beaver Builder Plugin bb-bootstrap-cards Cross-Site Scripting ≤ 1.1.4 Fixed in 1.1.5 CVE-2024-37278 Patchstack
5.9 Medium PowerPack Lite for Beaver Builder Plugin powerpack-addon-for-beaver-builder Cross-Site Scripting ≤ 1.3.0.4 Fixed in 1.3.0.5 CVE-2024-37409 Patchstack
5.9 Medium Livemesh Addons for Beaver Builder Plugin addons-for-beaver-builder Cross-Site Scripting ≤ 3.6.1 Fixed in 3.7 CVE-2024-38784 Patchstack
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.8.2.2 Fixed in 2.8.3 CVE-2024-37500 Patchstack
6.5 Medium NEX-Forms – Ultimate Form Builder Plugin nex-forms-express-wp-form-builder Cross-Site Scripting Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) ≤ 8.5.10 Fixed in 8.6.1 CVE-2024-37512 Patchstack
6.4 Medium Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin post-and-page-builder Cross-Site Scripting Visual Drag and Drop Editor <= 1.26.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via File Upload ≤ 1.26.6 CVE-2024-6848 Wordfence
5.9 Medium Timeline Module for Beaver Builder Plugin timeline-for-beaver-builder Cross-Site Scripting ≤ 1.1.3 CVE-2024-37919 Patchstack
7.1 High ARForms Form Builder Plugin arforms-form-builder Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 1.6.7 Fixed in 1.6.8 CVE-2024-37920 Patchstack
6.5 Medium Tabs For WPBakery Page Builder Plugin tabs-for-visual-composer Cross-Site Scripting ≤ 1.2 CVE-2024-37936 Patchstack
4.9 Medium WappPress Plugin wapppress-builds-android-app-for-website Server-Side Request Forgery Blind Server Side Request Forgery (SSRF) ≤ 6.0.4 CVE-2024-38758 Patchstack
8.8 High Brizy – Page Builder Plugin brizy Arbitrary File Upload Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload ≤ 2.4.44 CVE-2024-3242 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5251 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5253 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5252 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5255 Wordfence
6.4 Medium Ultimate Addons for WPBakery Page Builder Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.19.20 CVE-2024-5254 Wordfence
4.3 Medium Web and WooCommerce Addons for WPBakery Builder Plugin vc-addons-by-bit14 Broken Access Control Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification ≤ 1.4.5 CVE-2024-6579 Wordfence
7.1 High Brizy – Page Builder Plugin brizy Broken Access Control Page Builder <= 2.4.44 - Missing Authorization to Authenticated (Contributor+) Post Modification ≤ 2.4.44 CVE-2024-1937 Wordfence
5.3 Medium AForms Plugin aforms-form-builder-for-price-calculator-cost-estimation Information Disclosure Unauthenticated Full Path Disclosure No login needed ≤ 2.2.6 CVE-2024-6565 Wordfence
5.3 Medium WP Popups – WordPress Popup builder Plugin wp-popups-lite Information Disclosure WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure No login needed ≤ 2.2.0.1 CVE-2024-6555 Wordfence
6.4 Medium UltraAddons for Elementor Plugin ultraaddons-elementor-lite Cross-Site Scripting Elementor Addons (Header Footer Builder, Custom Font, Custom CSS,Woo Widget, Menu Builder, Anywhere Elementor Shortcode) <= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.1.6 CVE-2024-4866 Wordfence
6.5 Medium ShopBuilder – Elementor WooCommerce Builder Addons Plugin shopbuilder Local File Inclusion Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion ≤ 2.1.12 Fixed in 2.1.13 CVE-2024-37520 Patchstack
4.9 Medium Beaver Builder Addons by WPZOOM Plugin wpzoom-addons-for-beaver-builder Local File Inclusion ≤ 1.3.5 Fixed in 1.3.6 CVE-2024-37464 Patchstack
6.4 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets ≤ 1.5 CVE-2024-4862 Wordfence
5.5 Medium Elementor Website Builder Plugin elementor Cross-Site Scripting Arbitrary SVG File Download ≤ 3.22.1 Fixed in 3.22.2 CVE-2024-37437 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only