WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 1,101–1,150 of 1,407 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 23 of 29
Severity Component Vulnerability Affected versions Published CVE Source
7.2 High Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Unauthenticated Stored Cross-Site Scripting via Form No login needed ≤ 2.4.43 CVE-2024-2087 Wordfence
7.1 High Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.41 - Authenticated(Contributor+) Stored Cross-Site Scripting ≤ 2.4.41 CVE-2024-1940 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes ≤ 2.4.43 CVE-2024-1161 Wordfence
4.3 Medium RT Easy Builder – Advanced addons for Elementor Plugin rt-easy-builder-advanced-addons-for-elementor Broken Access Control ≤ 2.0 Fixed in 2.1 CVE-2024-30484 Patchstack
6.5 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.8.0 Fixed in 45.9.0 CVE-2024-35653 Patchstack
5.9 Medium Brave Plugin brave-popup-builder Cross-Site Scripting Interactive Content plugin <= 0.6.9 - Cross Site Scripting (XSS) ≤ 0.6.9 Fixed in 0.7.0 CVE-2024-35655 Patchstack
10.0 Critical Bricks Builder Theme Remote Code Execution Unauthenticated Remote Code Execution (RCE) No login needed ≤ 1.9.6 Fixed in 1.9.6.1 CVE-2024-25600 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Other Form Submission Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51544 Patchstack
5.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Authentication Bypass IP Limit Bypass No login needed ≤ 5.2.5.0 Fixed in 5.2.5.1 CVE-2023-51543 Patchstack
5.4 Medium ARI Stream Quiz Plugin ari-stream-quiz Content Injection WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection ≤ 1.3.2 Fixed in 1.3.3 CVE-2023-47513 Patchstack
6.4 Medium Popup Builder Plugin popup-builder Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS ≤ 4.2.7 CVE-2024-2506 Wordfence
6.4 Medium Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder Plugin supreme-modules-for-divi Cross-Site Scripting Divi Theme, Extra Theme and Divi Builder <= 2.5.51 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.5.51 CVE-2024-5501 Wordfence
6.4 Medium Page Builder Gutenberg Blocks – CoBlocks Plugin coblocks Cross-Site Scripting CoBlocks <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles ≤ 3.1.9 CVE-2024-2933 Wordfence
6.4 Medium Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget ≤ 5.8.14 CVE-2024-5086 Wordfence
6.4 Medium Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation Plugin optinmonster Cross-Site Scripting WordPress Popups for Optins, Email Newsletters and Lead Generation <= 2.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.16.1 CVE-2024-4045 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.5.1 CVE-2024-4484 Wordfence
6.4 Medium The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.5.2 CVE-2024-4485 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Progress Bar, Header Meta Content, Scroll Navigation, Pricing Table, & Flip Box ≤ 5.5.4 CVE-2024-3718 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contibutor+) Stored Cross-Site Scripting via Hover Card ≤ 5.5.4 CVE-2024-2784 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.26 CVE-2024-2618 Wordfence
8.1 High Hash Form – Drag & Drop Form Builder Plugin hash-form PHP Object Injection Drag & Drop Form Builder <= 1.1.0 - Unauthenticated PHP Object Injection No login needed ≤ 1.1.0 CVE-2024-5085 Wordfence
9.8 Critical Hash Form – Drag & Drop Form Builder Plugin hash-form Arbitrary File Upload Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution No login needed ≤ 1.1.0 CVE-2024-5084 Wordfence
4.3 Medium Brizy – Page Builder Plugin brizy Broken Access Control Page Builder <= 2.4.43 - Missing Authorization ≤ 2.4.43 CVE-2024-3711 Wordfence
8.8 High Oxygen Builder Plugin Remote Code Execution Authenticated (Contributor+) Remote Code Execution ≤ 4.8.2 CVE-2024-4662 Wordfence
5.4 Medium Responsive Contact Form Builder & Lead Generation Plugin lead-form-builder Arbitrary Shortcode Execution Authenticated (Subscriber+) Arbitrary Shortcode Execution ≤ 1.9.1 CVE-2024-4261 Wordfence
4.3 Medium ApplyOnline – Application Form Builder and Manager Plugin apply-online Broken Access Control Application Form Builder and Manager <= 2.6.2 - Missing Authorization to Sensitive Information Exposure ≤ 2.6.2 CVE-2024-2036 Wordfence
7.5 High Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform PHP Object Injection PHP Object Injection via extractDynamicValues ≤ 5.1.15 CVE-2024-4157 Wordfence
6.4 Medium Ninja Beaver Add-ons for Beaver Builder Plugin ninja-beaver-lite-addons-for-beaver-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets ≤ 2.4.5 CVE-2024-2163 Wordfence
6.4 Medium Elementor Website Builder – More than Just a Page Builder Plugin elementor Cross-Site Scripting More than Just a Page Builder <= 3.21.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting ≤ 3.21.5 CVE-2024-4619 Wordfence
6.4 Medium Page Builder by SiteOrigin Plugin siteorigin-panels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via 'siteorigin_widget' Shortcode ≤ 2.29.15 CVE-2024-4361 Wordfence
6.4 Medium WP Table Builder – WordPress Table Plugin wp-table-builder Cross-Site Scripting WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4.14 CVE-2024-4700 Wordfence
6.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 5.1.16 CVE-2024-4709 Wordfence
6.4 Medium Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin Cross-Site Scripting Authenticated (Subscriber+) Stored Cross-Site Scripting ≤ 5.1.13 CVE-2024-2772 Wordfence
7.5 High Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Setting Manipulation No login needed ≤ 5.1.16 CVE-2024-2782 Wordfence
9.8 Critical Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder Plugin fluentform Broken Access Control Missing Authorization to Settings Update and Limited Privilege Escalation No login needed ≤ 5.1.16 CVE-2024-2771 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.12 CVE-2024-4891 Wordfence
8.5 High Elementor Website Builder Plugin elementor Arbitrary File Deletion Arbitrary File Deletion and Phar Deserialization ≤ 3.19.0 Fixed in 3.19.1 CVE-2024-24934 Patchstack
8.8 High Build App Online Plugin build-app-online Privilege Escalation Authenticated Privilege Escalation ≤ 1.0.19 CVE-2023-51479 Patchstack
6.3 Medium Ultimate Addons for Beaver Builder Plugin ultimate-addons-for-beaver-builder-lite Path Traversal Limited Arbitrary File Download ≤ 1.35.13 Fixed in 1.35.14 CVE-2023-51401 Patchstack
8.8 High Ultimate Addons for Beaver Builder Plugin ultimate-addons-for-beaver-builder-lite Privilege Escalation ≤ 1.35.14 Fixed in 1.35.15 CVE-2023-51398 Patchstack
8.8 High Thrive Theme Builder Theme Privilege Escalation Authenticated Privilege Escalation < 3.24.0 Fixed in 3.24.0 CVE-2023-47782 Patchstack
7.1 High Ultimate Addons for WPBakery Page Builder Plugin Local File Inclusion No login needed ≤ 3.19.14 Fixed in 3.19.15 CVE-2023-46205 Patchstack
6.4 Medium Cost Calculator Builder Pro Plugin Server-Side Request Forgery Authenticated (Subscriber+) Server-Side Request Forgery ≤ 3.1.72 CVE-2024-4789 Wordfence
5.3 Medium Profile Builder Plugin profile-builder Other Bypass Vulnerability No login needed ≤ 3.11.2 Fixed in 3.11.3 CVE-2024-31341 Patchstack
7.2 High JetFormBuilder Plugin jetformbuilder Privilege Escalation Authenticated Privilege Escalation ≤ 3.0.8 Fixed in 3.0.9 CVE-2023-37866 Patchstack
6.8 Medium Landing Page Builder – Free Landing Page Templates Plugin ultimate-landing-page Local File Inclusion Free Landing Page Templates plugin <= 3.1.9.9 - Local File Inclusion ≤ 3.1.9.9 Fixed in 3.2 CVE-2023-24379 Patchstack
6.5 Medium Popup Builder Plugin easy-notify-lite Cross-Site Scripting ≤ 1.1.29 Fixed in 1.1.30 CVE-2024-34567 Patchstack
7.1 High Landing Page Builder Plugin page-builder-add Cross-Site Scripting No login needed ≤ 1.5.1.8 Fixed in 1.5.1.9 CVE-2024-34752 Patchstack
5.0 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Content Injection Authenticated (Author+) HTML Injection ≤ 1.6.26 CVE-2024-2619 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.28 CVE-2024-4634 Wordfence

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only