WordPress vulnerability database

Every CVE published for WordPress core, plugins and themes since January 2024: 29,413 vulnerabilities, 1,639 of them in the last 30 days. The list is updated every day from the CVE List.

Critical 2,181 High 9,090 Medium 17,806 Low 336

Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 10, 2026.

Showing 1,301–1,350 of 1,407 vulnerabilities matching your filters

Known WordPress vulnerabilities, page 27 of 29
Severity Component Vulnerability Affected versions Published CVE Source
6.5 Medium Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin post-and-page-builder Cross-Site Scripting ≤ 1.26.2 Fixed in 1.26.3 CVE-2024-2888 Patchstack
6.4 Medium Page Builder Gutenberg Blocks – CoBlocks Plugin coblocks Cross-Site Scripting CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.1.6 CVE-2024-1049 Wordfence
6.4 Medium Page Builder by SiteOrigin Plugin siteorigin-panels Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget ≤ 2.29.6 CVE-2024-2202 Wordfence
4.3 Medium AJAX Thumbnail Rebuild Plugin ajax-thumbnail-rebuild Broken Access Control ≤ 1.13 Fixed in 1.14 CVE-2022-47604 Patchstack
4.3 Medium RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Broken Access Control ≤ 5.2.5.9 Fixed in 5.2.6.0 CVE-2024-25935 Patchstack
8.2 High Social Media Share Buttons Plugin social-media-builder PHP Object Injection ≤ 2.1.0 CVE-2024-2721 Patchstack
6.4 Medium WPBITS Addons For Elementor Page Builder Plugin wpbits-addons-for-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.4 CVE-2024-2129 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin essential-blocks Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.3 CVE-2024-2255 Wordfence
5.9 Medium Visual Composer Website Builder Plugin visualcomposer Cross-Site Scripting ≤ 45.6.0 Fixed in 45.7.0 CVE-2024-27997 Patchstack
4.3 Medium Builder for WooCommerce reviews shortcodes – ReviewShort Plugin woo-product-reviews-shortcode Cross-Site Request Forgery ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.01.3 Fixed in 1.01.4 CVE-2024-29093 Patchstack
5.9 Medium WP Popups Plugin wp-popups-lite Cross-Site Scripting WordPress Popup builder plugin <= 2.1.5.5 - Cross Site Scripting (XSS) ≤ 2.1.5.5 Fixed in 2.1.5.6 CVE-2024-29105 Patchstack
6.5 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting ≤ 1.12.10 Fixed in 1.12.11 CVE-2024-29107 Patchstack
7.1 High RegistrationMagic Plugin custom-registration-form-builder-with-submission-manager Cross-Site Scripting Reflected Cross Site Scripting (XSS) No login needed ≤ 5.2.5.9 Fixed in 5.2.6.0 CVE-2024-29113 Patchstack
8.8 High Social Media Share Buttons Plugin social-media-builder PHP Object Injection Authenticated (Subscriber+) PHP Object Injection ≤ 2.1.0 CVE-2024-1685 Wordfence
5.4 Medium WooCommerce PDF Invoice Builder Plugin woo-pdf-invoice-builder Cross-Site Request Forgery No login needed ≤ 1.2.101 Fixed in 1.2.102 CVE-2023-51486 Patchstack
5.4 Medium ARI Stream Quiz Plugin ari-stream-quiz Cross-Site Request Forgery WordPress Quizzes Builder plugin <= 1.2.32 - Cross Site Request Forgery (CSRF) No login needed ≤ 1.2.32 Fixed in 1.3.0 CVE-2023-51487 Patchstack
6.5 Medium NEX-Forms – Ultimate Form Builder Plugin nex-forms-express-wp-form-builder Cross-Site Scripting ≤ 8.5.5 Fixed in 8.5.6 CVE-2024-25593 Patchstack
6.4 Medium WPBakery Page Builder Addons by Livemesh Plugin Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.8.1 CVE-2024-2079 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.4.40 CVE-2024-1291 Wordfence
7.2 High AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber Plugin aweber-web-form-widget SQL Injection Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth By AWeber <= 7.3.14 - Authenticated (Admin+) SQL Injection ≤ 7.3.14 CVE-2024-1793 Wordfence
5.4 Medium Droit Elementor Addons – Widgets, Blocks, Templates Library For Elementor Builder Plugin droit-elementor-addons Cross-Site Scripting Widgets, Blocks, Templates Library For Elementor Builder <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.1.5 CVE-2024-2252 Wordfence
5.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Reflected (DOM-Based) Cross-Site Scripting No login needed ≤ 2.7.4.2 CVE-2024-1038 Wordfence
8.8 High Brizy – Page Builder Plugin brizy Arbitrary File Upload Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File Upload ≤ 2.4.40 CVE-2024-1311 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via heading tag ≤ 2.7.4.4 CVE-2024-1080 Wordfence
6.4 Medium Gutenberg Blocks by Kadence Blocks – Page Builder Features Plugin kadence-blocks Cross-Site Scripting Page Builder Features <= 3.2.23 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 3.2.23 CVE-2024-1541 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Content Switcher Widget ≤ 1.12.12 CVE-2024-1393 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Audio Widget ≤ 2.7.4.2 CVE-2024-1074 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget ≤ 1.12.12 CVE-2024-1391 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin beaver-builder-lite-version Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.7.4.2 CVE-2024-0896 Wordfence
6.4 Medium Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Plugin Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 4.5.1 CVE-2024-1854 Wordfence
6.4 Medium Elementor Header & Footer Builder Plugin header-footer-elementor Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 1.6.24 CVE-2024-1237 Wordfence
6.4 Medium Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table ≤ 5.9.9 CVE-2024-1537 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.4.40 CVE-2024-1293 Wordfence
5.3 Medium Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form Plugin bit-form Broken Access Control Unauthenticated Insecure Direct Object Reference to Form Submission Alteration No login needed ≤ 2.10.1 CVE-2024-1640 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet ≤ 1.12.12 CVE-2024-1422 Wordfence
6.4 Medium Brizy – Page Builder Plugin brizy Cross-Site Scripting Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.4.40 CVE-2024-1296 Wordfence
6.4 Medium Metform Elementor Contact Form Builder Plugin metform Cross-Site Scripting Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode ≤ 3.8.3 CVE-2024-1585 Wordfence
6.4 Medium Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget ≤ 1.12.12 CVE-2024-1392 Wordfence
5.4 Medium Beaver Builder Plugin beaver-builder-lite-version Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget ≤ 2.7.4.2 CVE-2024-0871 Wordfence
8.8 High Elementor Addon Elements Plugin addon-elements-for-elementor-page-builder Path Traversal Directory Traversal to Local File Inclusion ≤ 1.12.12 CVE-2024-1358 Wordfence
6.4 Medium Beaver Builder – WordPress Page Builder Plugin Cross-Site Scripting WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting ≤ 2.7.4.2 CVE-2024-0897 Wordfence
7.4 High Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Plugin essential-addons-for-elementor-lite Cross-Site Scripting Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Event Calendar ≤ 5.9.9 CVE-2024-1536 Wordfence
4.3 Medium Colibri Page Builder Plugin colibri-page-builder Broken Access Control Missing Authorization ≤ 1.0.260 CVE-2024-1870 Wordfence
6.4 Medium Page Builder: Pagelayer – Drag and Drop website builder Plugin pagelayer Cross-Site Scripting Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes ≤ 1.8.3 CVE-2024-2127 Wordfence
6.4 Medium The Plus Addons for Elementor Plugin the-plus-addons-for-elementor-page-builder Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget ≤ 5.4.0 CVE-2024-1419 Wordfence
6.5 Medium Page Builder Sandwich – Front End WordPress Page Builder Plugin page-builder-sandwich Information Disclosure Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposure ≤ 5.1.0 CVE-2024-1381 Wordfence
6.5 Medium Page Builder Sandwich Plugin page-builder-sandwich Broken Access Control Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing ≤ 5.1.0 CVE-2024-1285 Wordfence
5.3 Medium Build & Control Block Patterns – Boost up Gutenberg Editor Plugin control-block-patterns Broken Access Control Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization No login needed ≤ 1.3.5.4 CVE-2024-1095 Wordfence
8.8 High Avada | Website Builder For WordPress & WooCommerce Theme Arbitrary File Upload Authenticated (Contributor+) Arbitrary File Upload ≤ 7.11.4 CVE-2024-1468 Wordfence
4.3 Medium A no-code page builder for beautiful performance-based content Plugin setka-editor Cross-Site Request Forgery WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF) No login needed ≤ 2.1.20 CVE-2024-24701 Patchstack

About this data

Where it comes from
Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
What is included
CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
Severity
The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
Affected versions
The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
Updates
Every day, after the CVE List publishes its end-of-day changes.

CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.

This website uses cookies to enhance your browsing experience and ensure the site functions properly. By continuing to use this site, you acknowledge and accept our use of cookies.

Accept All Accept Required Only