WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 1,251–1,300 of 1,407 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 26 of 29
Severity Component Vulnerability Affected versions Published CVE Source
8.8 High Modal Popup Box – Popup Builder, Show Offers And News in Popup Plugin modal-popup-box PHP Object Injection Popup Builder, Show Offers And News in Popup <= 1.5.2 - Authenticated (Contributor+) PHP Object Injection in awl_modal_popup_box_shortcode ≤ 1.5.2 CVE-2024-2008 Wordfence
6.4 Medium ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Plugin woolentor-addons Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Universal Product Layout ≤ 2.8.3 CVE-2024-2868 Wordfence
9.9 Critical Oxygen Builder Plugin Remote Code Execution Authenticated Remote Code Execution (RCE) ≤ 4.9 CVE-2024-31380 Patchstack
4.9 Medium Builderall Builder Plugin builderall-cheetah-for-wp Server-Side Request Forgery ≤ 2.0.1 Fixed in 2.0.2 CVE-2024-30532 Patchstack
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.8.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button ≤ 2.8.0.5 CVE-2024-2925 Wordfence
6.4 Medium Colibri Page Builder Plugin colibri-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.0.263 CVE-2024-2839 Wordfence
6.4 Medium Metform Elementor Contact Form Builder Plugin metform Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Widgets ≤ 3.8.5 CVE-2024-2791 Wordfence
5.4 Medium Page Builder Gutenberg Blocks Plugin coblocks Cross-Site Scripting Contributor+ Stored XSS < 3.1.7 Fixed in 3.1.7 CVE-2024-2369 WPScan
8.5 High WP Cost Estimation & Payment Forms Builder Plugin SQL Injection ≤ 10.1.75 Fixed in 10.1.76 CVE-2024-30489 Patchstack
8.5 High Easy Form Builder Plugin easy-form-builder SQL Injection ≤ 3.7.4 Fixed in 3.7.5 CVE-2024-30535 Patchstack
7.6 High 10Web Map Builder for Google Maps Plugin wd-google-maps SQL Injection ≤ 1.0.74 CVE-2024-31116 Patchstack
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Icons Widget ≤ 1.5.7 CVE-2024-2140 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Table Widget ≤ 1.5.7 CVE-2024-2142 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget ≤ 1.5.7 CVE-2024-2141 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Separator Widget ≤ 1.5.7 CVE-2024-2144 Wordfence
6.4 Medium Ultimate Addons for Beaver Builder – Lite Plugin ultimate-addons-for-beaver-builder-lite Cross-Site Scripting Lite <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget ≤ 1.5.7 CVE-2024-2143 Wordfence
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 4.8.0 Fixed in 4.8.1 CVE-2024-30442 Patchstack
5.9 Medium WordPress Page Builder – Zion Builder Plugin zionbuilder Cross-Site Scripting Zion Builder plugin <= 3.6.9 - Cross Site Scripting (XSS) ≤ 3.6.9 Fixed in 3.6.10 CVE-2024-30444 Patchstack
6.5 Medium OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) Plugin stepbyteservice-openstreetmap Cross-Site Scripting ≤ 1.1.1 Fixed in 1.1.2 CVE-2024-30450 Patchstack
5.9 Medium Landing Page Builder Plugin page-builder-add Cross-Site Scripting ≤ 1.5.1.7 Fixed in 1.5.1.8 CVE-2024-30452 Patchstack
5.4 Medium Brave Popup Builder Plugin brave-popup-builder Server-Side Request Forgery No login needed ≤ 0.6.5 Fixed in 0.6.6 CVE-2024-30453 Patchstack
6.5 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting ≤ 2.7.4.4 Fixed in 2.7.4.5 CVE-2024-30425 Patchstack
6.5 Medium Carousel Anything For WPBakery Page Builder Plugin carousel-anything Cross-Site Scripting ≤ 2.1 CVE-2024-30520 Patchstack
4.6 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Scripting The Drag and Drop Form Builder for WordPress <= 3.8.0 - Authenticated (Author+) Stored Cross-Site Scripting ≤ 3.8.0 CVE-2024-2108 Wordfence
4.3 Medium Ninja Forms Contact Form – The Drag and Drop Form Builder Plugin ninja-forms Cross-Site Request Forgery The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export No login needed ≤ 3.8.0 CVE-2024-2113 Wordfence
6.4 Medium Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE Plugin otter-blocks Cross-Site Scripting Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 2.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.6.5 CVE-2024-2841 Wordfence
6.5 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting ≤ 1.13.1 Fixed in 1.13.2 CVE-2024-30422 Patchstack
8.5 High Fusion Builder Plugin SQL Injection Auth. SQL Injection ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39309 Patchstack
7.1 High Starter Templates — Elementor, WordPress & Beaver Builder Templates Plugin astra-sites Server-Side Request Forgery Server Side Request Forgery (SSRF) vulnerability in Starter Templates plugins ≤ 3.2.4 Fixed in 3.2.5 CVE-2023-34370 Patchstack
5.4 Medium Colibri Page Builder Plugin colibri-page-builder Broken Access Control ≤ 1.0.248 Fixed in 1.0.249 CVE-2024-28004 Patchstack
5.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.13.2 CVE-2024-2091 Wordfence
7.1 High Fusion Builder Plugin fusion-builder Cross-Site Request Forgery No login needed ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39311 Patchstack
5.9 Medium Funnel Builder by CartFlows Plugin cartflows Cross-Site Scripting ≤ 2.0.1 Fixed in 2.0.2 CVE-2024-29813 Patchstack
6.5 Medium Popup Builder Plugin popup-builder Cross-Site Scripting ≤ 4.2.6 Fixed in 4.2.7 CVE-2024-30184 Patchstack
6.5 Medium Livemesh Addons for WPBakery Page Builder Plugin addons-for-visual-composer Cross-Site Scripting ≤ 3.7 Fixed in 3.8 CVE-2024-30183 Patchstack
6.5 Medium Bold Page Builder Plugin bold-page-builder Cross-Site Scripting ≤ 4.7.6 Fixed in 4.7.7 CVE-2024-30179 Patchstack
6.5 Medium WC Builder Plugin wc-builder Cross-Site Scripting ≤ 1.0.18 Fixed in 1.0.19 CVE-2024-29926 Patchstack
6.5 Medium PDF Builder for WPForms Plugin pdf-builder-for-wpforms Cross-Site Scripting ≤ 1.2.88 Fixed in 1.2.89 CVE-2024-29820 Patchstack
5.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Post Navigation ≤ 3.20.1 CVE-2024-2120 Wordfence
6.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Form Widget SVGZ File Upload ≤ 3.20.1 CVE-2024-1521 Wordfence
6.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via video_html_tag ≤ 3.20.1 CVE-2024-2781 Wordfence
5.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.20.1 CVE-2024-2121 Wordfence
6.4 Medium Elementor Website Builder Pro Plugin Cross-Site Scripting Authententicated (Contributor+) Stored Cross-Site Scripting ≤ 3.20.1 CVE-2024-1364 Wordfence
7.1 High Fusion Builder Plugin Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 3.11.1 Fixed in 3.11.2 CVE-2023-39306 Patchstack
10.0 Critical WappPress Plugin wapppress-builds-android-app-for-website Arbitrary File Upload Unauthenticated Arbitrary File Upload No login needed ≤ 5.0.3 Fixed in 6.0.0 CVE-2023-49815 Patchstack
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Clients Widget ≤ 5.4.1 CVE-2024-2203 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Local File Inclusion Authenticated (Contributor+) Local File Inclusion via Team Member Listing ≤ 5.4.1 CVE-2024-2210 Wordfence
9.9 Critical Elementor Website Builder Plugin elementor Arbitrary File Upload 3.3.0 – 3.18.1 Fixed in 3.18.2 CVE-2023-48777 Patchstack
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Request Forgery No login needed ≤ 5.3.0.0 Fixed in 5.3.1.0 CVE-2024-2951 Patchstack
4.3 Medium Void Contact Form 7 Widget For Elementor Page Builder Plugin cf7-widget-elementor Broken Access Control ≤ 2.3 Fixed in 2.4 CVE-2023-52214 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only